xref: /openbmc/linux/net/mac80211/mlme.c (revision 3c6a73cc)
1 /*
2  * BSS client mode implementation
3  * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
4  * Copyright 2004, Instant802 Networks, Inc.
5  * Copyright 2005, Devicescape Software, Inc.
6  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
8  * Copyright 2013-2014  Intel Mobile Communications GmbH
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License version 2 as
12  * published by the Free Software Foundation.
13  */
14 
15 #include <linux/delay.h>
16 #include <linux/if_ether.h>
17 #include <linux/skbuff.h>
18 #include <linux/if_arp.h>
19 #include <linux/etherdevice.h>
20 #include <linux/moduleparam.h>
21 #include <linux/rtnetlink.h>
22 #include <linux/pm_qos.h>
23 #include <linux/crc32.h>
24 #include <linux/slab.h>
25 #include <linux/export.h>
26 #include <net/mac80211.h>
27 #include <asm/unaligned.h>
28 
29 #include "ieee80211_i.h"
30 #include "driver-ops.h"
31 #include "rate.h"
32 #include "led.h"
33 
34 #define IEEE80211_AUTH_TIMEOUT		(HZ / 5)
35 #define IEEE80211_AUTH_TIMEOUT_LONG	(HZ / 2)
36 #define IEEE80211_AUTH_TIMEOUT_SHORT	(HZ / 10)
37 #define IEEE80211_AUTH_MAX_TRIES	3
38 #define IEEE80211_AUTH_WAIT_ASSOC	(HZ * 5)
39 #define IEEE80211_ASSOC_TIMEOUT		(HZ / 5)
40 #define IEEE80211_ASSOC_TIMEOUT_LONG	(HZ / 2)
41 #define IEEE80211_ASSOC_TIMEOUT_SHORT	(HZ / 10)
42 #define IEEE80211_ASSOC_MAX_TRIES	3
43 
44 static int max_nullfunc_tries = 2;
45 module_param(max_nullfunc_tries, int, 0644);
46 MODULE_PARM_DESC(max_nullfunc_tries,
47 		 "Maximum nullfunc tx tries before disconnecting (reason 4).");
48 
49 static int max_probe_tries = 5;
50 module_param(max_probe_tries, int, 0644);
51 MODULE_PARM_DESC(max_probe_tries,
52 		 "Maximum probe tries before disconnecting (reason 4).");
53 
54 /*
55  * Beacon loss timeout is calculated as N frames times the
56  * advertised beacon interval.  This may need to be somewhat
57  * higher than what hardware might detect to account for
58  * delays in the host processing frames. But since we also
59  * probe on beacon miss before declaring the connection lost
60  * default to what we want.
61  */
62 static int beacon_loss_count = 7;
63 module_param(beacon_loss_count, int, 0644);
64 MODULE_PARM_DESC(beacon_loss_count,
65 		 "Number of beacon intervals before we decide beacon was lost.");
66 
67 /*
68  * Time the connection can be idle before we probe
69  * it to see if we can still talk to the AP.
70  */
71 #define IEEE80211_CONNECTION_IDLE_TIME	(30 * HZ)
72 /*
73  * Time we wait for a probe response after sending
74  * a probe request because of beacon loss or for
75  * checking the connection still works.
76  */
77 static int probe_wait_ms = 500;
78 module_param(probe_wait_ms, int, 0644);
79 MODULE_PARM_DESC(probe_wait_ms,
80 		 "Maximum time(ms) to wait for probe response"
81 		 " before disconnecting (reason 4).");
82 
83 /*
84  * Weight given to the latest Beacon frame when calculating average signal
85  * strength for Beacon frames received in the current BSS. This must be
86  * between 1 and 15.
87  */
88 #define IEEE80211_SIGNAL_AVE_WEIGHT	3
89 
90 /*
91  * How many Beacon frames need to have been used in average signal strength
92  * before starting to indicate signal change events.
93  */
94 #define IEEE80211_SIGNAL_AVE_MIN_COUNT	4
95 
96 /*
97  * We can have multiple work items (and connection probing)
98  * scheduling this timer, but we need to take care to only
99  * reschedule it when it should fire _earlier_ than it was
100  * asked for before, or if it's not pending right now. This
101  * function ensures that. Note that it then is required to
102  * run this function for all timeouts after the first one
103  * has happened -- the work that runs from this timer will
104  * do that.
105  */
106 static void run_again(struct ieee80211_sub_if_data *sdata,
107 		      unsigned long timeout)
108 {
109 	sdata_assert_lock(sdata);
110 
111 	if (!timer_pending(&sdata->u.mgd.timer) ||
112 	    time_before(timeout, sdata->u.mgd.timer.expires))
113 		mod_timer(&sdata->u.mgd.timer, timeout);
114 }
115 
116 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
117 {
118 	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
119 		return;
120 
121 	if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
122 		return;
123 
124 	mod_timer(&sdata->u.mgd.bcn_mon_timer,
125 		  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
126 }
127 
128 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
129 {
130 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
131 
132 	if (unlikely(!sdata->u.mgd.associated))
133 		return;
134 
135 	ifmgd->probe_send_count = 0;
136 
137 	if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
138 		return;
139 
140 	mod_timer(&sdata->u.mgd.conn_mon_timer,
141 		  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
142 }
143 
144 static int ecw2cw(int ecw)
145 {
146 	return (1 << ecw) - 1;
147 }
148 
149 static u32
150 ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
151 			     struct ieee80211_supported_band *sband,
152 			     struct ieee80211_channel *channel,
153 			     const struct ieee80211_ht_cap *ht_cap,
154 			     const struct ieee80211_ht_operation *ht_oper,
155 			     const struct ieee80211_vht_operation *vht_oper,
156 			     struct cfg80211_chan_def *chandef, bool tracking)
157 {
158 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
159 	struct cfg80211_chan_def vht_chandef;
160 	u32 ht_cfreq, ret;
161 
162 	chandef->chan = channel;
163 	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
164 	chandef->center_freq1 = channel->center_freq;
165 	chandef->center_freq2 = 0;
166 
167 	if (!ht_cap || !ht_oper || !sband->ht_cap.ht_supported) {
168 		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
169 		goto out;
170 	}
171 
172 	chandef->width = NL80211_CHAN_WIDTH_20;
173 
174 	if (!(ht_cap->cap_info &
175 	      cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40))) {
176 		ret = IEEE80211_STA_DISABLE_40MHZ;
177 		goto out;
178 	}
179 
180 	ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
181 						  channel->band);
182 	/* check that channel matches the right operating channel */
183 	if (!tracking && channel->center_freq != ht_cfreq) {
184 		/*
185 		 * It's possible that some APs are confused here;
186 		 * Netgear WNDR3700 sometimes reports 4 higher than
187 		 * the actual channel in association responses, but
188 		 * since we look at probe response/beacon data here
189 		 * it should be OK.
190 		 */
191 		sdata_info(sdata,
192 			   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
193 			   channel->center_freq, ht_cfreq,
194 			   ht_oper->primary_chan, channel->band);
195 		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
196 		goto out;
197 	}
198 
199 	/* check 40 MHz support, if we have it */
200 	if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
201 		switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
202 		case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
203 			chandef->width = NL80211_CHAN_WIDTH_40;
204 			chandef->center_freq1 += 10;
205 			break;
206 		case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
207 			chandef->width = NL80211_CHAN_WIDTH_40;
208 			chandef->center_freq1 -= 10;
209 			break;
210 		}
211 	} else {
212 		/* 40 MHz (and 80 MHz) must be supported for VHT */
213 		ret = IEEE80211_STA_DISABLE_VHT;
214 		/* also mark 40 MHz disabled */
215 		ret |= IEEE80211_STA_DISABLE_40MHZ;
216 		goto out;
217 	}
218 
219 	if (!vht_oper || !sband->vht_cap.vht_supported) {
220 		ret = IEEE80211_STA_DISABLE_VHT;
221 		goto out;
222 	}
223 
224 	vht_chandef.chan = channel;
225 	vht_chandef.center_freq1 =
226 		ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx,
227 					       channel->band);
228 	vht_chandef.center_freq2 = 0;
229 
230 	switch (vht_oper->chan_width) {
231 	case IEEE80211_VHT_CHANWIDTH_USE_HT:
232 		vht_chandef.width = chandef->width;
233 		vht_chandef.center_freq1 = chandef->center_freq1;
234 		break;
235 	case IEEE80211_VHT_CHANWIDTH_80MHZ:
236 		vht_chandef.width = NL80211_CHAN_WIDTH_80;
237 		break;
238 	case IEEE80211_VHT_CHANWIDTH_160MHZ:
239 		vht_chandef.width = NL80211_CHAN_WIDTH_160;
240 		break;
241 	case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
242 		vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
243 		vht_chandef.center_freq2 =
244 			ieee80211_channel_to_frequency(
245 				vht_oper->center_freq_seg2_idx,
246 				channel->band);
247 		break;
248 	default:
249 		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
250 			sdata_info(sdata,
251 				   "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
252 				   vht_oper->chan_width);
253 		ret = IEEE80211_STA_DISABLE_VHT;
254 		goto out;
255 	}
256 
257 	if (!cfg80211_chandef_valid(&vht_chandef)) {
258 		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
259 			sdata_info(sdata,
260 				   "AP VHT information is invalid, disable VHT\n");
261 		ret = IEEE80211_STA_DISABLE_VHT;
262 		goto out;
263 	}
264 
265 	if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
266 		ret = 0;
267 		goto out;
268 	}
269 
270 	if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
271 		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
272 			sdata_info(sdata,
273 				   "AP VHT information doesn't match HT, disable VHT\n");
274 		ret = IEEE80211_STA_DISABLE_VHT;
275 		goto out;
276 	}
277 
278 	*chandef = vht_chandef;
279 
280 	ret = 0;
281 
282 out:
283 	/*
284 	 * When tracking the current AP, don't do any further checks if the
285 	 * new chandef is identical to the one we're currently using for the
286 	 * connection. This keeps us from playing ping-pong with regulatory,
287 	 * without it the following can happen (for example):
288 	 *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
289 	 *  - AP advertises regdom US
290 	 *  - CRDA loads regdom US with 80 MHz prohibited (old database)
291 	 *  - the code below detects an unsupported channel, downgrades, and
292 	 *    we disconnect from the AP in the caller
293 	 *  - disconnect causes CRDA to reload world regdomain and the game
294 	 *    starts anew.
295 	 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
296 	 *
297 	 * It seems possible that there are still scenarios with CSA or real
298 	 * bandwidth changes where a this could happen, but those cases are
299 	 * less common and wouldn't completely prevent using the AP.
300 	 */
301 	if (tracking &&
302 	    cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
303 		return ret;
304 
305 	/* don't print the message below for VHT mismatch if VHT is disabled */
306 	if (ret & IEEE80211_STA_DISABLE_VHT)
307 		vht_chandef = *chandef;
308 
309 	/*
310 	 * Ignore the DISABLED flag when we're already connected and only
311 	 * tracking the APs beacon for bandwidth changes - otherwise we
312 	 * might get disconnected here if we connect to an AP, update our
313 	 * regulatory information based on the AP's country IE and the
314 	 * information we have is wrong/outdated and disables the channel
315 	 * that we're actually using for the connection to the AP.
316 	 */
317 	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
318 					tracking ? 0 :
319 						   IEEE80211_CHAN_DISABLED)) {
320 		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
321 			ret = IEEE80211_STA_DISABLE_HT |
322 			      IEEE80211_STA_DISABLE_VHT;
323 			break;
324 		}
325 
326 		ret |= ieee80211_chandef_downgrade(chandef);
327 	}
328 
329 	if (chandef->width != vht_chandef.width && !tracking)
330 		sdata_info(sdata,
331 			   "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
332 
333 	WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
334 	return ret;
335 }
336 
337 static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
338 			       struct sta_info *sta,
339 			       const struct ieee80211_ht_cap *ht_cap,
340 			       const struct ieee80211_ht_operation *ht_oper,
341 			       const struct ieee80211_vht_operation *vht_oper,
342 			       const u8 *bssid, u32 *changed)
343 {
344 	struct ieee80211_local *local = sdata->local;
345 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
346 	struct ieee80211_supported_band *sband;
347 	struct ieee80211_channel *chan;
348 	struct cfg80211_chan_def chandef;
349 	u16 ht_opmode;
350 	u32 flags;
351 	enum ieee80211_sta_rx_bandwidth new_sta_bw;
352 	int ret;
353 
354 	/* if HT was/is disabled, don't track any bandwidth changes */
355 	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
356 		return 0;
357 
358 	/* don't check VHT if we associated as non-VHT station */
359 	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
360 		vht_oper = NULL;
361 
362 	if (WARN_ON_ONCE(!sta))
363 		return -EINVAL;
364 
365 	/*
366 	 * if bss configuration changed store the new one -
367 	 * this may be applicable even if channel is identical
368 	 */
369 	ht_opmode = le16_to_cpu(ht_oper->operation_mode);
370 	if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
371 		*changed |= BSS_CHANGED_HT;
372 		sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
373 	}
374 
375 	chan = sdata->vif.bss_conf.chandef.chan;
376 	sband = local->hw.wiphy->bands[chan->band];
377 
378 	/* calculate new channel (type) based on HT/VHT operation IEs */
379 	flags = ieee80211_determine_chantype(sdata, sband, chan,
380 					     ht_cap, ht_oper, vht_oper,
381 					     &chandef, true);
382 
383 	/*
384 	 * Downgrade the new channel if we associated with restricted
385 	 * capabilities. For example, if we associated as a 20 MHz STA
386 	 * to a 40 MHz AP (due to regulatory, capabilities or config
387 	 * reasons) then switching to a 40 MHz channel now won't do us
388 	 * any good -- we couldn't use it with the AP.
389 	 */
390 	if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
391 	    chandef.width == NL80211_CHAN_WIDTH_80P80)
392 		flags |= ieee80211_chandef_downgrade(&chandef);
393 	if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
394 	    chandef.width == NL80211_CHAN_WIDTH_160)
395 		flags |= ieee80211_chandef_downgrade(&chandef);
396 	if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
397 	    chandef.width > NL80211_CHAN_WIDTH_20)
398 		flags |= ieee80211_chandef_downgrade(&chandef);
399 
400 	if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
401 		return 0;
402 
403 	sdata_info(sdata,
404 		   "AP %pM changed bandwidth, new config is %d MHz, width %d (%d/%d MHz)\n",
405 		   ifmgd->bssid, chandef.chan->center_freq, chandef.width,
406 		   chandef.center_freq1, chandef.center_freq2);
407 
408 	if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
409 				      IEEE80211_STA_DISABLE_VHT |
410 				      IEEE80211_STA_DISABLE_40MHZ |
411 				      IEEE80211_STA_DISABLE_80P80MHZ |
412 				      IEEE80211_STA_DISABLE_160MHZ)) ||
413 	    !cfg80211_chandef_valid(&chandef)) {
414 		sdata_info(sdata,
415 			   "AP %pM changed bandwidth in a way we can't support - disconnect\n",
416 			   ifmgd->bssid);
417 		return -EINVAL;
418 	}
419 
420 	switch (chandef.width) {
421 	case NL80211_CHAN_WIDTH_20_NOHT:
422 	case NL80211_CHAN_WIDTH_20:
423 		new_sta_bw = IEEE80211_STA_RX_BW_20;
424 		break;
425 	case NL80211_CHAN_WIDTH_40:
426 		new_sta_bw = IEEE80211_STA_RX_BW_40;
427 		break;
428 	case NL80211_CHAN_WIDTH_80:
429 		new_sta_bw = IEEE80211_STA_RX_BW_80;
430 		break;
431 	case NL80211_CHAN_WIDTH_80P80:
432 	case NL80211_CHAN_WIDTH_160:
433 		new_sta_bw = IEEE80211_STA_RX_BW_160;
434 		break;
435 	default:
436 		return -EINVAL;
437 	}
438 
439 	if (new_sta_bw > sta->cur_max_bandwidth)
440 		new_sta_bw = sta->cur_max_bandwidth;
441 
442 	if (new_sta_bw < sta->sta.bandwidth) {
443 		sta->sta.bandwidth = new_sta_bw;
444 		rate_control_rate_update(local, sband, sta,
445 					 IEEE80211_RC_BW_CHANGED);
446 	}
447 
448 	ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
449 	if (ret) {
450 		sdata_info(sdata,
451 			   "AP %pM changed bandwidth to incompatible one - disconnect\n",
452 			   ifmgd->bssid);
453 		return ret;
454 	}
455 
456 	if (new_sta_bw > sta->sta.bandwidth) {
457 		sta->sta.bandwidth = new_sta_bw;
458 		rate_control_rate_update(local, sband, sta,
459 					 IEEE80211_RC_BW_CHANGED);
460 	}
461 
462 	return 0;
463 }
464 
465 /* frame sending functions */
466 
467 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
468 				struct sk_buff *skb, u8 ap_ht_param,
469 				struct ieee80211_supported_band *sband,
470 				struct ieee80211_channel *channel,
471 				enum ieee80211_smps_mode smps)
472 {
473 	u8 *pos;
474 	u32 flags = channel->flags;
475 	u16 cap;
476 	struct ieee80211_sta_ht_cap ht_cap;
477 
478 	BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
479 
480 	memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
481 	ieee80211_apply_htcap_overrides(sdata, &ht_cap);
482 
483 	/* determine capability flags */
484 	cap = ht_cap.cap;
485 
486 	switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
487 	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
488 		if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
489 			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
490 			cap &= ~IEEE80211_HT_CAP_SGI_40;
491 		}
492 		break;
493 	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
494 		if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
495 			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
496 			cap &= ~IEEE80211_HT_CAP_SGI_40;
497 		}
498 		break;
499 	}
500 
501 	/*
502 	 * If 40 MHz was disabled associate as though we weren't
503 	 * capable of 40 MHz -- some broken APs will never fall
504 	 * back to trying to transmit in 20 MHz.
505 	 */
506 	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
507 		cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
508 		cap &= ~IEEE80211_HT_CAP_SGI_40;
509 	}
510 
511 	/* set SM PS mode properly */
512 	cap &= ~IEEE80211_HT_CAP_SM_PS;
513 	switch (smps) {
514 	case IEEE80211_SMPS_AUTOMATIC:
515 	case IEEE80211_SMPS_NUM_MODES:
516 		WARN_ON(1);
517 	case IEEE80211_SMPS_OFF:
518 		cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
519 			IEEE80211_HT_CAP_SM_PS_SHIFT;
520 		break;
521 	case IEEE80211_SMPS_STATIC:
522 		cap |= WLAN_HT_CAP_SM_PS_STATIC <<
523 			IEEE80211_HT_CAP_SM_PS_SHIFT;
524 		break;
525 	case IEEE80211_SMPS_DYNAMIC:
526 		cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
527 			IEEE80211_HT_CAP_SM_PS_SHIFT;
528 		break;
529 	}
530 
531 	/* reserve and fill IE */
532 	pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
533 	ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
534 }
535 
536 static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
537 				 struct sk_buff *skb,
538 				 struct ieee80211_supported_band *sband,
539 				 struct ieee80211_vht_cap *ap_vht_cap)
540 {
541 	u8 *pos;
542 	u32 cap;
543 	struct ieee80211_sta_vht_cap vht_cap;
544 	u32 mask, ap_bf_sts, our_bf_sts;
545 
546 	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
547 
548 	memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
549 	ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
550 
551 	/* determine capability flags */
552 	cap = vht_cap.cap;
553 
554 	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
555 		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
556 		cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
557 	}
558 
559 	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
560 		cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
561 		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
562 	}
563 
564 	/*
565 	 * Some APs apparently get confused if our capabilities are better
566 	 * than theirs, so restrict what we advertise in the assoc request.
567 	 */
568 	if (!(ap_vht_cap->vht_cap_info &
569 			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
570 		cap &= ~IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
571 
572 	mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
573 
574 	ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
575 	our_bf_sts = cap & mask;
576 
577 	if (ap_bf_sts < our_bf_sts) {
578 		cap &= ~mask;
579 		cap |= ap_bf_sts;
580 	}
581 
582 	/* reserve and fill IE */
583 	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
584 	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
585 }
586 
587 static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
588 {
589 	struct ieee80211_local *local = sdata->local;
590 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
591 	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
592 	struct sk_buff *skb;
593 	struct ieee80211_mgmt *mgmt;
594 	u8 *pos, qos_info;
595 	size_t offset = 0, noffset;
596 	int i, count, rates_len, supp_rates_len, shift;
597 	u16 capab;
598 	struct ieee80211_supported_band *sband;
599 	struct ieee80211_chanctx_conf *chanctx_conf;
600 	struct ieee80211_channel *chan;
601 	u32 rate_flags, rates = 0;
602 
603 	sdata_assert_lock(sdata);
604 
605 	rcu_read_lock();
606 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
607 	if (WARN_ON(!chanctx_conf)) {
608 		rcu_read_unlock();
609 		return;
610 	}
611 	chan = chanctx_conf->def.chan;
612 	rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
613 	rcu_read_unlock();
614 	sband = local->hw.wiphy->bands[chan->band];
615 	shift = ieee80211_vif_get_shift(&sdata->vif);
616 
617 	if (assoc_data->supp_rates_len) {
618 		/*
619 		 * Get all rates supported by the device and the AP as
620 		 * some APs don't like getting a superset of their rates
621 		 * in the association request (e.g. D-Link DAP 1353 in
622 		 * b-only mode)...
623 		 */
624 		rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
625 						     assoc_data->supp_rates,
626 						     assoc_data->supp_rates_len,
627 						     &rates);
628 	} else {
629 		/*
630 		 * In case AP not provide any supported rates information
631 		 * before association, we send information element(s) with
632 		 * all rates that we support.
633 		 */
634 		rates_len = 0;
635 		for (i = 0; i < sband->n_bitrates; i++) {
636 			if ((rate_flags & sband->bitrates[i].flags)
637 			    != rate_flags)
638 				continue;
639 			rates |= BIT(i);
640 			rates_len++;
641 		}
642 	}
643 
644 	skb = alloc_skb(local->hw.extra_tx_headroom +
645 			sizeof(*mgmt) + /* bit too much but doesn't matter */
646 			2 + assoc_data->ssid_len + /* SSID */
647 			4 + rates_len + /* (extended) rates */
648 			4 + /* power capability */
649 			2 + 2 * sband->n_channels + /* supported channels */
650 			2 + sizeof(struct ieee80211_ht_cap) + /* HT */
651 			2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
652 			assoc_data->ie_len + /* extra IEs */
653 			9, /* WMM */
654 			GFP_KERNEL);
655 	if (!skb)
656 		return;
657 
658 	skb_reserve(skb, local->hw.extra_tx_headroom);
659 
660 	capab = WLAN_CAPABILITY_ESS;
661 
662 	if (sband->band == IEEE80211_BAND_2GHZ) {
663 		if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
664 			capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
665 		if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
666 			capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
667 	}
668 
669 	if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
670 		capab |= WLAN_CAPABILITY_PRIVACY;
671 
672 	if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
673 	    (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
674 		capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
675 
676 	if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
677 		capab |= WLAN_CAPABILITY_RADIO_MEASURE;
678 
679 	mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
680 	memset(mgmt, 0, 24);
681 	memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
682 	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
683 	memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);
684 
685 	if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
686 		skb_put(skb, 10);
687 		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
688 						  IEEE80211_STYPE_REASSOC_REQ);
689 		mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
690 		mgmt->u.reassoc_req.listen_interval =
691 				cpu_to_le16(local->hw.conf.listen_interval);
692 		memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
693 		       ETH_ALEN);
694 	} else {
695 		skb_put(skb, 4);
696 		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
697 						  IEEE80211_STYPE_ASSOC_REQ);
698 		mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
699 		mgmt->u.assoc_req.listen_interval =
700 				cpu_to_le16(local->hw.conf.listen_interval);
701 	}
702 
703 	/* SSID */
704 	pos = skb_put(skb, 2 + assoc_data->ssid_len);
705 	*pos++ = WLAN_EID_SSID;
706 	*pos++ = assoc_data->ssid_len;
707 	memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);
708 
709 	/* add all rates which were marked to be used above */
710 	supp_rates_len = rates_len;
711 	if (supp_rates_len > 8)
712 		supp_rates_len = 8;
713 
714 	pos = skb_put(skb, supp_rates_len + 2);
715 	*pos++ = WLAN_EID_SUPP_RATES;
716 	*pos++ = supp_rates_len;
717 
718 	count = 0;
719 	for (i = 0; i < sband->n_bitrates; i++) {
720 		if (BIT(i) & rates) {
721 			int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
722 						5 * (1 << shift));
723 			*pos++ = (u8) rate;
724 			if (++count == 8)
725 				break;
726 		}
727 	}
728 
729 	if (rates_len > count) {
730 		pos = skb_put(skb, rates_len - count + 2);
731 		*pos++ = WLAN_EID_EXT_SUPP_RATES;
732 		*pos++ = rates_len - count;
733 
734 		for (i++; i < sband->n_bitrates; i++) {
735 			if (BIT(i) & rates) {
736 				int rate;
737 				rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
738 						    5 * (1 << shift));
739 				*pos++ = (u8) rate;
740 			}
741 		}
742 	}
743 
744 	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
745 	    capab & WLAN_CAPABILITY_RADIO_MEASURE) {
746 		pos = skb_put(skb, 4);
747 		*pos++ = WLAN_EID_PWR_CAPABILITY;
748 		*pos++ = 2;
749 		*pos++ = 0; /* min tx power */
750 		 /* max tx power */
751 		*pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
752 	}
753 
754 	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
755 		/* TODO: get this in reg domain format */
756 		pos = skb_put(skb, 2 * sband->n_channels + 2);
757 		*pos++ = WLAN_EID_SUPPORTED_CHANNELS;
758 		*pos++ = 2 * sband->n_channels;
759 		for (i = 0; i < sband->n_channels; i++) {
760 			*pos++ = ieee80211_frequency_to_channel(
761 					sband->channels[i].center_freq);
762 			*pos++ = 1; /* one channel in the subband*/
763 		}
764 	}
765 
766 	/* if present, add any custom IEs that go before HT */
767 	if (assoc_data->ie_len) {
768 		static const u8 before_ht[] = {
769 			WLAN_EID_SSID,
770 			WLAN_EID_SUPP_RATES,
771 			WLAN_EID_EXT_SUPP_RATES,
772 			WLAN_EID_PWR_CAPABILITY,
773 			WLAN_EID_SUPPORTED_CHANNELS,
774 			WLAN_EID_RSN,
775 			WLAN_EID_QOS_CAPA,
776 			WLAN_EID_RRM_ENABLED_CAPABILITIES,
777 			WLAN_EID_MOBILITY_DOMAIN,
778 			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
779 		};
780 		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
781 					     before_ht, ARRAY_SIZE(before_ht),
782 					     offset);
783 		pos = skb_put(skb, noffset - offset);
784 		memcpy(pos, assoc_data->ie + offset, noffset - offset);
785 		offset = noffset;
786 	}
787 
788 	if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
789 			 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
790 		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
791 
792 	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
793 		ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
794 				    sband, chan, sdata->smps_mode);
795 
796 	/* if present, add any custom IEs that go before VHT */
797 	if (assoc_data->ie_len) {
798 		static const u8 before_vht[] = {
799 			WLAN_EID_SSID,
800 			WLAN_EID_SUPP_RATES,
801 			WLAN_EID_EXT_SUPP_RATES,
802 			WLAN_EID_PWR_CAPABILITY,
803 			WLAN_EID_SUPPORTED_CHANNELS,
804 			WLAN_EID_RSN,
805 			WLAN_EID_QOS_CAPA,
806 			WLAN_EID_RRM_ENABLED_CAPABILITIES,
807 			WLAN_EID_MOBILITY_DOMAIN,
808 			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
809 			WLAN_EID_HT_CAPABILITY,
810 			WLAN_EID_BSS_COEX_2040,
811 			WLAN_EID_EXT_CAPABILITY,
812 			WLAN_EID_QOS_TRAFFIC_CAPA,
813 			WLAN_EID_TIM_BCAST_REQ,
814 			WLAN_EID_INTERWORKING,
815 		};
816 		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
817 					     before_vht, ARRAY_SIZE(before_vht),
818 					     offset);
819 		pos = skb_put(skb, noffset - offset);
820 		memcpy(pos, assoc_data->ie + offset, noffset - offset);
821 		offset = noffset;
822 	}
823 
824 	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
825 		ieee80211_add_vht_ie(sdata, skb, sband,
826 				     &assoc_data->ap_vht_cap);
827 
828 	/* if present, add any custom non-vendor IEs that go after HT */
829 	if (assoc_data->ie_len) {
830 		noffset = ieee80211_ie_split_vendor(assoc_data->ie,
831 						    assoc_data->ie_len,
832 						    offset);
833 		pos = skb_put(skb, noffset - offset);
834 		memcpy(pos, assoc_data->ie + offset, noffset - offset);
835 		offset = noffset;
836 	}
837 
838 	if (assoc_data->wmm) {
839 		if (assoc_data->uapsd) {
840 			qos_info = ifmgd->uapsd_queues;
841 			qos_info |= (ifmgd->uapsd_max_sp_len <<
842 				     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
843 		} else {
844 			qos_info = 0;
845 		}
846 
847 		pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
848 	}
849 
850 	/* add any remaining custom (i.e. vendor specific here) IEs */
851 	if (assoc_data->ie_len) {
852 		noffset = assoc_data->ie_len;
853 		pos = skb_put(skb, noffset - offset);
854 		memcpy(pos, assoc_data->ie + offset, noffset - offset);
855 	}
856 
857 	drv_mgd_prepare_tx(local, sdata);
858 
859 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
860 	if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
861 		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
862 						IEEE80211_TX_INTFL_MLME_CONN_TX;
863 	ieee80211_tx_skb(sdata, skb);
864 }
865 
866 void ieee80211_send_pspoll(struct ieee80211_local *local,
867 			   struct ieee80211_sub_if_data *sdata)
868 {
869 	struct ieee80211_pspoll *pspoll;
870 	struct sk_buff *skb;
871 
872 	skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
873 	if (!skb)
874 		return;
875 
876 	pspoll = (struct ieee80211_pspoll *) skb->data;
877 	pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
878 
879 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
880 	ieee80211_tx_skb(sdata, skb);
881 }
882 
883 void ieee80211_send_nullfunc(struct ieee80211_local *local,
884 			     struct ieee80211_sub_if_data *sdata,
885 			     int powersave)
886 {
887 	struct sk_buff *skb;
888 	struct ieee80211_hdr_3addr *nullfunc;
889 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
890 
891 	skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
892 	if (!skb)
893 		return;
894 
895 	nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
896 	if (powersave)
897 		nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
898 
899 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
900 					IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
901 
902 	if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
903 		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
904 
905 	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
906 		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
907 
908 	ieee80211_tx_skb(sdata, skb);
909 }
910 
911 static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
912 					  struct ieee80211_sub_if_data *sdata)
913 {
914 	struct sk_buff *skb;
915 	struct ieee80211_hdr *nullfunc;
916 	__le16 fc;
917 
918 	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
919 		return;
920 
921 	skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
922 	if (!skb)
923 		return;
924 
925 	skb_reserve(skb, local->hw.extra_tx_headroom);
926 
927 	nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30);
928 	memset(nullfunc, 0, 30);
929 	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
930 			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
931 	nullfunc->frame_control = fc;
932 	memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
933 	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
934 	memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
935 	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
936 
937 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
938 	ieee80211_tx_skb(sdata, skb);
939 }
940 
941 /* spectrum management related things */
942 static void ieee80211_chswitch_work(struct work_struct *work)
943 {
944 	struct ieee80211_sub_if_data *sdata =
945 		container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
946 	struct ieee80211_local *local = sdata->local;
947 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
948 	int ret;
949 
950 	if (!ieee80211_sdata_running(sdata))
951 		return;
952 
953 	sdata_lock(sdata);
954 	mutex_lock(&local->mtx);
955 	mutex_lock(&local->chanctx_mtx);
956 
957 	if (!ifmgd->associated)
958 		goto out;
959 
960 	if (!sdata->vif.csa_active)
961 		goto out;
962 
963 	/*
964 	 * using reservation isn't immediate as it may be deferred until later
965 	 * with multi-vif. once reservation is complete it will re-schedule the
966 	 * work with no reserved_chanctx so verify chandef to check if it
967 	 * completed successfully
968 	 */
969 
970 	if (sdata->reserved_chanctx) {
971 		/*
972 		 * with multi-vif csa driver may call ieee80211_csa_finish()
973 		 * many times while waiting for other interfaces to use their
974 		 * reservations
975 		 */
976 		if (sdata->reserved_ready)
977 			goto out;
978 
979 		ret = ieee80211_vif_use_reserved_context(sdata);
980 		if (ret) {
981 			sdata_info(sdata,
982 				   "failed to use reserved channel context, disconnecting (err=%d)\n",
983 				   ret);
984 			ieee80211_queue_work(&sdata->local->hw,
985 					     &ifmgd->csa_connection_drop_work);
986 			goto out;
987 		}
988 
989 		goto out;
990 	}
991 
992 	if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
993 					&sdata->csa_chandef)) {
994 		sdata_info(sdata,
995 			   "failed to finalize channel switch, disconnecting\n");
996 		ieee80211_queue_work(&sdata->local->hw,
997 				     &ifmgd->csa_connection_drop_work);
998 		goto out;
999 	}
1000 
1001 	/* XXX: shouldn't really modify cfg80211-owned data! */
1002 	ifmgd->associated->channel = sdata->csa_chandef.chan;
1003 
1004 	sdata->vif.csa_active = false;
1005 
1006 	/* XXX: wait for a beacon first? */
1007 	if (sdata->csa_block_tx) {
1008 		ieee80211_wake_vif_queues(local, sdata,
1009 					  IEEE80211_QUEUE_STOP_REASON_CSA);
1010 		sdata->csa_block_tx = false;
1011 	}
1012 
1013 	ieee80211_sta_reset_beacon_monitor(sdata);
1014 	ieee80211_sta_reset_conn_monitor(sdata);
1015 
1016 out:
1017 	mutex_unlock(&local->chanctx_mtx);
1018 	mutex_unlock(&local->mtx);
1019 	sdata_unlock(sdata);
1020 }
1021 
1022 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
1023 {
1024 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1025 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1026 
1027 	trace_api_chswitch_done(sdata, success);
1028 	if (!success) {
1029 		sdata_info(sdata,
1030 			   "driver channel switch failed, disconnecting\n");
1031 		ieee80211_queue_work(&sdata->local->hw,
1032 				     &ifmgd->csa_connection_drop_work);
1033 	} else {
1034 		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1035 	}
1036 }
1037 EXPORT_SYMBOL(ieee80211_chswitch_done);
1038 
1039 static void ieee80211_chswitch_timer(unsigned long data)
1040 {
1041 	struct ieee80211_sub_if_data *sdata =
1042 		(struct ieee80211_sub_if_data *) data;
1043 
1044 	ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
1045 }
1046 
1047 static void
1048 ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1049 				 u64 timestamp, struct ieee802_11_elems *elems,
1050 				 bool beacon)
1051 {
1052 	struct ieee80211_local *local = sdata->local;
1053 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1054 	struct cfg80211_bss *cbss = ifmgd->associated;
1055 	struct ieee80211_chanctx_conf *conf;
1056 	struct ieee80211_chanctx *chanctx;
1057 	enum ieee80211_band current_band;
1058 	struct ieee80211_csa_ie csa_ie;
1059 	int res;
1060 
1061 	sdata_assert_lock(sdata);
1062 
1063 	if (!cbss)
1064 		return;
1065 
1066 	if (local->scanning)
1067 		return;
1068 
1069 	/* disregard subsequent announcements if we are already processing */
1070 	if (sdata->vif.csa_active)
1071 		return;
1072 
1073 	current_band = cbss->channel->band;
1074 	memset(&csa_ie, 0, sizeof(csa_ie));
1075 	res = ieee80211_parse_ch_switch_ie(sdata, elems, beacon, current_band,
1076 					   ifmgd->flags,
1077 					   ifmgd->associated->bssid, &csa_ie);
1078 	if (res	< 0)
1079 		ieee80211_queue_work(&local->hw,
1080 				     &ifmgd->csa_connection_drop_work);
1081 	if (res)
1082 		return;
1083 
1084 	if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1085 				     IEEE80211_CHAN_DISABLED)) {
1086 		sdata_info(sdata,
1087 			   "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1088 			   ifmgd->associated->bssid,
1089 			   csa_ie.chandef.chan->center_freq,
1090 			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1091 			   csa_ie.chandef.center_freq2);
1092 		ieee80211_queue_work(&local->hw,
1093 				     &ifmgd->csa_connection_drop_work);
1094 		return;
1095 	}
1096 
1097 	mutex_lock(&local->mtx);
1098 	mutex_lock(&local->chanctx_mtx);
1099 	conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
1100 					 lockdep_is_held(&local->chanctx_mtx));
1101 	if (!conf) {
1102 		sdata_info(sdata,
1103 			   "no channel context assigned to vif?, disconnecting\n");
1104 		ieee80211_queue_work(&local->hw,
1105 				     &ifmgd->csa_connection_drop_work);
1106 		mutex_unlock(&local->chanctx_mtx);
1107 		mutex_unlock(&local->mtx);
1108 		return;
1109 	}
1110 
1111 	chanctx = container_of(conf, struct ieee80211_chanctx, conf);
1112 
1113 	if (local->use_chanctx) {
1114 		u32 num_chanctx = 0;
1115 		list_for_each_entry(chanctx, &local->chanctx_list, list)
1116 		       num_chanctx++;
1117 
1118 		if (num_chanctx > 1 ||
1119 		    !(local->hw.flags & IEEE80211_HW_CHANCTX_STA_CSA)) {
1120 			sdata_info(sdata,
1121 				   "not handling chan-switch with channel contexts\n");
1122 			ieee80211_queue_work(&local->hw,
1123 					     &ifmgd->csa_connection_drop_work);
1124 			mutex_unlock(&local->chanctx_mtx);
1125 			mutex_unlock(&local->mtx);
1126 			return;
1127 		}
1128 	}
1129 
1130 	res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
1131 					    chanctx->mode, false);
1132 	if (res) {
1133 		sdata_info(sdata,
1134 			   "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
1135 			   res);
1136 		ieee80211_queue_work(&local->hw,
1137 				     &ifmgd->csa_connection_drop_work);
1138 		mutex_unlock(&local->chanctx_mtx);
1139 		mutex_unlock(&local->mtx);
1140 		return;
1141 	}
1142 	mutex_unlock(&local->chanctx_mtx);
1143 
1144 	sdata->vif.csa_active = true;
1145 	sdata->csa_chandef = csa_ie.chandef;
1146 	sdata->csa_block_tx = csa_ie.mode;
1147 
1148 	if (sdata->csa_block_tx)
1149 		ieee80211_stop_vif_queues(local, sdata,
1150 					  IEEE80211_QUEUE_STOP_REASON_CSA);
1151 	mutex_unlock(&local->mtx);
1152 
1153 	if (local->ops->channel_switch) {
1154 		/* use driver's channel switch callback */
1155 		struct ieee80211_channel_switch ch_switch = {
1156 			.timestamp = timestamp,
1157 			.block_tx = csa_ie.mode,
1158 			.chandef = csa_ie.chandef,
1159 			.count = csa_ie.count,
1160 		};
1161 
1162 		drv_channel_switch(local, &ch_switch);
1163 		return;
1164 	}
1165 
1166 	/* channel switch handled in software */
1167 	if (csa_ie.count <= 1)
1168 		ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1169 	else
1170 		mod_timer(&ifmgd->chswitch_timer,
1171 			  TU_TO_EXP_TIME(csa_ie.count * cbss->beacon_interval));
1172 }
1173 
1174 static bool
1175 ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
1176 				 struct ieee80211_channel *channel,
1177 				 const u8 *country_ie, u8 country_ie_len,
1178 				 const u8 *pwr_constr_elem,
1179 				 int *chan_pwr, int *pwr_reduction)
1180 {
1181 	struct ieee80211_country_ie_triplet *triplet;
1182 	int chan = ieee80211_frequency_to_channel(channel->center_freq);
1183 	int i, chan_increment;
1184 	bool have_chan_pwr = false;
1185 
1186 	/* Invalid IE */
1187 	if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1188 		return false;
1189 
1190 	triplet = (void *)(country_ie + 3);
1191 	country_ie_len -= 3;
1192 
1193 	switch (channel->band) {
1194 	default:
1195 		WARN_ON_ONCE(1);
1196 		/* fall through */
1197 	case IEEE80211_BAND_2GHZ:
1198 	case IEEE80211_BAND_60GHZ:
1199 		chan_increment = 1;
1200 		break;
1201 	case IEEE80211_BAND_5GHZ:
1202 		chan_increment = 4;
1203 		break;
1204 	}
1205 
1206 	/* find channel */
1207 	while (country_ie_len >= 3) {
1208 		u8 first_channel = triplet->chans.first_channel;
1209 
1210 		if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
1211 			goto next;
1212 
1213 		for (i = 0; i < triplet->chans.num_channels; i++) {
1214 			if (first_channel + i * chan_increment == chan) {
1215 				have_chan_pwr = true;
1216 				*chan_pwr = triplet->chans.max_power;
1217 				break;
1218 			}
1219 		}
1220 		if (have_chan_pwr)
1221 			break;
1222 
1223  next:
1224 		triplet++;
1225 		country_ie_len -= 3;
1226 	}
1227 
1228 	if (have_chan_pwr)
1229 		*pwr_reduction = *pwr_constr_elem;
1230 	return have_chan_pwr;
1231 }
1232 
1233 static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
1234 				      struct ieee80211_channel *channel,
1235 				      const u8 *cisco_dtpc_ie,
1236 				      int *pwr_level)
1237 {
1238 	/* From practical testing, the first data byte of the DTPC element
1239 	 * seems to contain the requested dBm level, and the CLI on Cisco
1240 	 * APs clearly state the range is -127 to 127 dBm, which indicates
1241 	 * a signed byte, although it seemingly never actually goes negative.
1242 	 * The other byte seems to always be zero.
1243 	 */
1244 	*pwr_level = (__s8)cisco_dtpc_ie[4];
1245 }
1246 
1247 static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
1248 				       struct ieee80211_channel *channel,
1249 				       struct ieee80211_mgmt *mgmt,
1250 				       const u8 *country_ie, u8 country_ie_len,
1251 				       const u8 *pwr_constr_ie,
1252 				       const u8 *cisco_dtpc_ie)
1253 {
1254 	bool has_80211h_pwr = false, has_cisco_pwr = false;
1255 	int chan_pwr = 0, pwr_reduction_80211h = 0;
1256 	int pwr_level_cisco, pwr_level_80211h;
1257 	int new_ap_level;
1258 
1259 	if (country_ie && pwr_constr_ie &&
1260 	    mgmt->u.probe_resp.capab_info &
1261 		cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT)) {
1262 		has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
1263 			sdata, channel, country_ie, country_ie_len,
1264 			pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
1265 		pwr_level_80211h =
1266 			max_t(int, 0, chan_pwr - pwr_reduction_80211h);
1267 	}
1268 
1269 	if (cisco_dtpc_ie) {
1270 		ieee80211_find_cisco_dtpc(
1271 			sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
1272 		has_cisco_pwr = true;
1273 	}
1274 
1275 	if (!has_80211h_pwr && !has_cisco_pwr)
1276 		return 0;
1277 
1278 	/* If we have both 802.11h and Cisco DTPC, apply both limits
1279 	 * by picking the smallest of the two power levels advertised.
1280 	 */
1281 	if (has_80211h_pwr &&
1282 	    (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
1283 		sdata_info(sdata,
1284 			   "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
1285 			   pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
1286 			   sdata->u.mgd.bssid);
1287 		new_ap_level = pwr_level_80211h;
1288 	} else {  /* has_cisco_pwr is always true here. */
1289 		sdata_info(sdata,
1290 			   "Limiting TX power to %d dBm as advertised by %pM\n",
1291 			   pwr_level_cisco, sdata->u.mgd.bssid);
1292 		new_ap_level = pwr_level_cisco;
1293 	}
1294 
1295 	if (sdata->ap_power_level == new_ap_level)
1296 		return 0;
1297 
1298 	sdata->ap_power_level = new_ap_level;
1299 	if (__ieee80211_recalc_txpower(sdata))
1300 		return BSS_CHANGED_TXPOWER;
1301 	return 0;
1302 }
1303 
1304 /* powersave */
1305 static void ieee80211_enable_ps(struct ieee80211_local *local,
1306 				struct ieee80211_sub_if_data *sdata)
1307 {
1308 	struct ieee80211_conf *conf = &local->hw.conf;
1309 
1310 	/*
1311 	 * If we are scanning right now then the parameters will
1312 	 * take effect when scan finishes.
1313 	 */
1314 	if (local->scanning)
1315 		return;
1316 
1317 	if (conf->dynamic_ps_timeout > 0 &&
1318 	    !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
1319 		mod_timer(&local->dynamic_ps_timer, jiffies +
1320 			  msecs_to_jiffies(conf->dynamic_ps_timeout));
1321 	} else {
1322 		if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
1323 			ieee80211_send_nullfunc(local, sdata, 1);
1324 
1325 		if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
1326 		    (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS))
1327 			return;
1328 
1329 		conf->flags |= IEEE80211_CONF_PS;
1330 		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1331 	}
1332 }
1333 
1334 static void ieee80211_change_ps(struct ieee80211_local *local)
1335 {
1336 	struct ieee80211_conf *conf = &local->hw.conf;
1337 
1338 	if (local->ps_sdata) {
1339 		ieee80211_enable_ps(local, local->ps_sdata);
1340 	} else if (conf->flags & IEEE80211_CONF_PS) {
1341 		conf->flags &= ~IEEE80211_CONF_PS;
1342 		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1343 		del_timer_sync(&local->dynamic_ps_timer);
1344 		cancel_work_sync(&local->dynamic_ps_enable_work);
1345 	}
1346 }
1347 
1348 static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
1349 {
1350 	struct ieee80211_if_managed *mgd = &sdata->u.mgd;
1351 	struct sta_info *sta = NULL;
1352 	bool authorized = false;
1353 
1354 	if (!mgd->powersave)
1355 		return false;
1356 
1357 	if (mgd->broken_ap)
1358 		return false;
1359 
1360 	if (!mgd->associated)
1361 		return false;
1362 
1363 	if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
1364 		return false;
1365 
1366 	if (!mgd->have_beacon)
1367 		return false;
1368 
1369 	rcu_read_lock();
1370 	sta = sta_info_get(sdata, mgd->bssid);
1371 	if (sta)
1372 		authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1373 	rcu_read_unlock();
1374 
1375 	return authorized;
1376 }
1377 
1378 /* need to hold RTNL or interface lock */
1379 void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
1380 {
1381 	struct ieee80211_sub_if_data *sdata, *found = NULL;
1382 	int count = 0;
1383 	int timeout;
1384 
1385 	if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS)) {
1386 		local->ps_sdata = NULL;
1387 		return;
1388 	}
1389 
1390 	list_for_each_entry(sdata, &local->interfaces, list) {
1391 		if (!ieee80211_sdata_running(sdata))
1392 			continue;
1393 		if (sdata->vif.type == NL80211_IFTYPE_AP) {
1394 			/* If an AP vif is found, then disable PS
1395 			 * by setting the count to zero thereby setting
1396 			 * ps_sdata to NULL.
1397 			 */
1398 			count = 0;
1399 			break;
1400 		}
1401 		if (sdata->vif.type != NL80211_IFTYPE_STATION)
1402 			continue;
1403 		found = sdata;
1404 		count++;
1405 	}
1406 
1407 	if (count == 1 && ieee80211_powersave_allowed(found)) {
1408 		s32 beaconint_us;
1409 
1410 		if (latency < 0)
1411 			latency = pm_qos_request(PM_QOS_NETWORK_LATENCY);
1412 
1413 		beaconint_us = ieee80211_tu_to_usec(
1414 					found->vif.bss_conf.beacon_int);
1415 
1416 		timeout = local->dynamic_ps_forced_timeout;
1417 		if (timeout < 0) {
1418 			/*
1419 			 * Go to full PSM if the user configures a very low
1420 			 * latency requirement.
1421 			 * The 2000 second value is there for compatibility
1422 			 * until the PM_QOS_NETWORK_LATENCY is configured
1423 			 * with real values.
1424 			 */
1425 			if (latency > (1900 * USEC_PER_MSEC) &&
1426 			    latency != (2000 * USEC_PER_SEC))
1427 				timeout = 0;
1428 			else
1429 				timeout = 100;
1430 		}
1431 		local->hw.conf.dynamic_ps_timeout = timeout;
1432 
1433 		if (beaconint_us > latency) {
1434 			local->ps_sdata = NULL;
1435 		} else {
1436 			int maxslp = 1;
1437 			u8 dtimper = found->u.mgd.dtim_period;
1438 
1439 			/* If the TIM IE is invalid, pretend the value is 1 */
1440 			if (!dtimper)
1441 				dtimper = 1;
1442 			else if (dtimper > 1)
1443 				maxslp = min_t(int, dtimper,
1444 						    latency / beaconint_us);
1445 
1446 			local->hw.conf.max_sleep_period = maxslp;
1447 			local->hw.conf.ps_dtim_period = dtimper;
1448 			local->ps_sdata = found;
1449 		}
1450 	} else {
1451 		local->ps_sdata = NULL;
1452 	}
1453 
1454 	ieee80211_change_ps(local);
1455 }
1456 
1457 void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
1458 {
1459 	bool ps_allowed = ieee80211_powersave_allowed(sdata);
1460 
1461 	if (sdata->vif.bss_conf.ps != ps_allowed) {
1462 		sdata->vif.bss_conf.ps = ps_allowed;
1463 		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
1464 	}
1465 }
1466 
1467 void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
1468 {
1469 	struct ieee80211_local *local =
1470 		container_of(work, struct ieee80211_local,
1471 			     dynamic_ps_disable_work);
1472 
1473 	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1474 		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1475 		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1476 	}
1477 
1478 	ieee80211_wake_queues_by_reason(&local->hw,
1479 					IEEE80211_MAX_QUEUE_MAP,
1480 					IEEE80211_QUEUE_STOP_REASON_PS,
1481 					false);
1482 }
1483 
1484 void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
1485 {
1486 	struct ieee80211_local *local =
1487 		container_of(work, struct ieee80211_local,
1488 			     dynamic_ps_enable_work);
1489 	struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1490 	struct ieee80211_if_managed *ifmgd;
1491 	unsigned long flags;
1492 	int q;
1493 
1494 	/* can only happen when PS was just disabled anyway */
1495 	if (!sdata)
1496 		return;
1497 
1498 	ifmgd = &sdata->u.mgd;
1499 
1500 	if (local->hw.conf.flags & IEEE80211_CONF_PS)
1501 		return;
1502 
1503 	if (local->hw.conf.dynamic_ps_timeout > 0) {
1504 		/* don't enter PS if TX frames are pending */
1505 		if (drv_tx_frames_pending(local)) {
1506 			mod_timer(&local->dynamic_ps_timer, jiffies +
1507 				  msecs_to_jiffies(
1508 				  local->hw.conf.dynamic_ps_timeout));
1509 			return;
1510 		}
1511 
1512 		/*
1513 		 * transmission can be stopped by others which leads to
1514 		 * dynamic_ps_timer expiry. Postpone the ps timer if it
1515 		 * is not the actual idle state.
1516 		 */
1517 		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
1518 		for (q = 0; q < local->hw.queues; q++) {
1519 			if (local->queue_stop_reasons[q]) {
1520 				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1521 						       flags);
1522 				mod_timer(&local->dynamic_ps_timer, jiffies +
1523 					  msecs_to_jiffies(
1524 					  local->hw.conf.dynamic_ps_timeout));
1525 				return;
1526 			}
1527 		}
1528 		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1529 	}
1530 
1531 	if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
1532 	    !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1533 		if (drv_tx_frames_pending(local)) {
1534 			mod_timer(&local->dynamic_ps_timer, jiffies +
1535 				  msecs_to_jiffies(
1536 				  local->hw.conf.dynamic_ps_timeout));
1537 		} else {
1538 			ieee80211_send_nullfunc(local, sdata, 1);
1539 			/* Flush to get the tx status of nullfunc frame */
1540 			ieee80211_flush_queues(local, sdata);
1541 		}
1542 	}
1543 
1544 	if (!((local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
1545 	      (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)) ||
1546 	    (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1547 		ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
1548 		local->hw.conf.flags |= IEEE80211_CONF_PS;
1549 		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1550 	}
1551 }
1552 
1553 void ieee80211_dynamic_ps_timer(unsigned long data)
1554 {
1555 	struct ieee80211_local *local = (void *) data;
1556 
1557 	if (local->quiescing || local->suspended)
1558 		return;
1559 
1560 	ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1561 }
1562 
1563 void ieee80211_dfs_cac_timer_work(struct work_struct *work)
1564 {
1565 	struct delayed_work *delayed_work =
1566 		container_of(work, struct delayed_work, work);
1567 	struct ieee80211_sub_if_data *sdata =
1568 		container_of(delayed_work, struct ieee80211_sub_if_data,
1569 			     dfs_cac_timer_work);
1570 	struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
1571 
1572 	mutex_lock(&sdata->local->mtx);
1573 	if (sdata->wdev.cac_started) {
1574 		ieee80211_vif_release_channel(sdata);
1575 		cfg80211_cac_event(sdata->dev, &chandef,
1576 				   NL80211_RADAR_CAC_FINISHED,
1577 				   GFP_KERNEL);
1578 	}
1579 	mutex_unlock(&sdata->local->mtx);
1580 }
1581 
1582 /* MLME */
1583 static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
1584 				     struct ieee80211_sub_if_data *sdata,
1585 				     const u8 *wmm_param, size_t wmm_param_len)
1586 {
1587 	struct ieee80211_tx_queue_params params;
1588 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1589 	size_t left;
1590 	int count;
1591 	const u8 *pos;
1592 	u8 uapsd_queues = 0;
1593 
1594 	if (!local->ops->conf_tx)
1595 		return false;
1596 
1597 	if (local->hw.queues < IEEE80211_NUM_ACS)
1598 		return false;
1599 
1600 	if (!wmm_param)
1601 		return false;
1602 
1603 	if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1604 		return false;
1605 
1606 	if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1607 		uapsd_queues = ifmgd->uapsd_queues;
1608 
1609 	count = wmm_param[6] & 0x0f;
1610 	if (count == ifmgd->wmm_last_param_set)
1611 		return false;
1612 	ifmgd->wmm_last_param_set = count;
1613 
1614 	pos = wmm_param + 8;
1615 	left = wmm_param_len - 8;
1616 
1617 	memset(&params, 0, sizeof(params));
1618 
1619 	sdata->wmm_acm = 0;
1620 	for (; left >= 4; left -= 4, pos += 4) {
1621 		int aci = (pos[0] >> 5) & 0x03;
1622 		int acm = (pos[0] >> 4) & 0x01;
1623 		bool uapsd = false;
1624 		int queue;
1625 
1626 		switch (aci) {
1627 		case 1: /* AC_BK */
1628 			queue = 3;
1629 			if (acm)
1630 				sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
1631 			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
1632 				uapsd = true;
1633 			break;
1634 		case 2: /* AC_VI */
1635 			queue = 1;
1636 			if (acm)
1637 				sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
1638 			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
1639 				uapsd = true;
1640 			break;
1641 		case 3: /* AC_VO */
1642 			queue = 0;
1643 			if (acm)
1644 				sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
1645 			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
1646 				uapsd = true;
1647 			break;
1648 		case 0: /* AC_BE */
1649 		default:
1650 			queue = 2;
1651 			if (acm)
1652 				sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
1653 			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
1654 				uapsd = true;
1655 			break;
1656 		}
1657 
1658 		params.aifs = pos[0] & 0x0f;
1659 		params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
1660 		params.cw_min = ecw2cw(pos[1] & 0x0f);
1661 		params.txop = get_unaligned_le16(pos + 2);
1662 		params.acm = acm;
1663 		params.uapsd = uapsd;
1664 
1665 		mlme_dbg(sdata,
1666 			 "WMM queue=%d aci=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d\n",
1667 			 queue, aci, acm,
1668 			 params.aifs, params.cw_min, params.cw_max,
1669 			 params.txop, params.uapsd);
1670 		sdata->tx_conf[queue] = params;
1671 		if (drv_conf_tx(local, sdata, queue, &params))
1672 			sdata_err(sdata,
1673 				  "failed to set TX queue parameters for queue %d\n",
1674 				  queue);
1675 	}
1676 
1677 	/* enable WMM or activate new settings */
1678 	sdata->vif.bss_conf.qos = true;
1679 	return true;
1680 }
1681 
1682 static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
1683 {
1684 	lockdep_assert_held(&sdata->local->mtx);
1685 
1686 	sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
1687 	ieee80211_run_deferred_scan(sdata->local);
1688 }
1689 
1690 static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
1691 {
1692 	mutex_lock(&sdata->local->mtx);
1693 	__ieee80211_stop_poll(sdata);
1694 	mutex_unlock(&sdata->local->mtx);
1695 }
1696 
1697 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
1698 					   u16 capab, bool erp_valid, u8 erp)
1699 {
1700 	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1701 	u32 changed = 0;
1702 	bool use_protection;
1703 	bool use_short_preamble;
1704 	bool use_short_slot;
1705 
1706 	if (erp_valid) {
1707 		use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
1708 		use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
1709 	} else {
1710 		use_protection = false;
1711 		use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
1712 	}
1713 
1714 	use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
1715 	if (ieee80211_get_sdata_band(sdata) == IEEE80211_BAND_5GHZ)
1716 		use_short_slot = true;
1717 
1718 	if (use_protection != bss_conf->use_cts_prot) {
1719 		bss_conf->use_cts_prot = use_protection;
1720 		changed |= BSS_CHANGED_ERP_CTS_PROT;
1721 	}
1722 
1723 	if (use_short_preamble != bss_conf->use_short_preamble) {
1724 		bss_conf->use_short_preamble = use_short_preamble;
1725 		changed |= BSS_CHANGED_ERP_PREAMBLE;
1726 	}
1727 
1728 	if (use_short_slot != bss_conf->use_short_slot) {
1729 		bss_conf->use_short_slot = use_short_slot;
1730 		changed |= BSS_CHANGED_ERP_SLOT;
1731 	}
1732 
1733 	return changed;
1734 }
1735 
1736 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
1737 				     struct cfg80211_bss *cbss,
1738 				     u32 bss_info_changed)
1739 {
1740 	struct ieee80211_bss *bss = (void *)cbss->priv;
1741 	struct ieee80211_local *local = sdata->local;
1742 	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1743 
1744 	bss_info_changed |= BSS_CHANGED_ASSOC;
1745 	bss_info_changed |= ieee80211_handle_bss_capability(sdata,
1746 		bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
1747 
1748 	sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
1749 		beacon_loss_count * bss_conf->beacon_int));
1750 
1751 	sdata->u.mgd.associated = cbss;
1752 	memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
1753 
1754 	sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;
1755 
1756 	if (sdata->vif.p2p) {
1757 		const struct cfg80211_bss_ies *ies;
1758 
1759 		rcu_read_lock();
1760 		ies = rcu_dereference(cbss->ies);
1761 		if (ies) {
1762 			int ret;
1763 
1764 			ret = cfg80211_get_p2p_attr(
1765 					ies->data, ies->len,
1766 					IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
1767 					(u8 *) &bss_conf->p2p_noa_attr,
1768 					sizeof(bss_conf->p2p_noa_attr));
1769 			if (ret >= 2) {
1770 				sdata->u.mgd.p2p_noa_index =
1771 					bss_conf->p2p_noa_attr.index;
1772 				bss_info_changed |= BSS_CHANGED_P2P_PS;
1773 			}
1774 		}
1775 		rcu_read_unlock();
1776 	}
1777 
1778 	/* just to be sure */
1779 	ieee80211_stop_poll(sdata);
1780 
1781 	ieee80211_led_assoc(local, 1);
1782 
1783 	if (sdata->u.mgd.have_beacon) {
1784 		/*
1785 		 * If the AP is buggy we may get here with no DTIM period
1786 		 * known, so assume it's 1 which is the only safe assumption
1787 		 * in that case, although if the TIM IE is broken powersave
1788 		 * probably just won't work at all.
1789 		 */
1790 		bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
1791 		bss_conf->beacon_rate = bss->beacon_rate;
1792 		bss_info_changed |= BSS_CHANGED_BEACON_INFO;
1793 	} else {
1794 		bss_conf->beacon_rate = NULL;
1795 		bss_conf->dtim_period = 0;
1796 	}
1797 
1798 	bss_conf->assoc = 1;
1799 
1800 	/* Tell the driver to monitor connection quality (if supported) */
1801 	if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
1802 	    bss_conf->cqm_rssi_thold)
1803 		bss_info_changed |= BSS_CHANGED_CQM;
1804 
1805 	/* Enable ARP filtering */
1806 	if (bss_conf->arp_addr_cnt)
1807 		bss_info_changed |= BSS_CHANGED_ARP_FILTER;
1808 
1809 	ieee80211_bss_info_change_notify(sdata, bss_info_changed);
1810 
1811 	mutex_lock(&local->iflist_mtx);
1812 	ieee80211_recalc_ps(local, -1);
1813 	mutex_unlock(&local->iflist_mtx);
1814 
1815 	ieee80211_recalc_smps(sdata);
1816 	ieee80211_recalc_ps_vif(sdata);
1817 
1818 	netif_carrier_on(sdata->dev);
1819 }
1820 
1821 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
1822 				   u16 stype, u16 reason, bool tx,
1823 				   u8 *frame_buf)
1824 {
1825 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1826 	struct ieee80211_local *local = sdata->local;
1827 	u32 changed = 0;
1828 
1829 	sdata_assert_lock(sdata);
1830 
1831 	if (WARN_ON_ONCE(tx && !frame_buf))
1832 		return;
1833 
1834 	if (WARN_ON(!ifmgd->associated))
1835 		return;
1836 
1837 	ieee80211_stop_poll(sdata);
1838 
1839 	ifmgd->associated = NULL;
1840 	netif_carrier_off(sdata->dev);
1841 
1842 	/*
1843 	 * if we want to get out of ps before disassoc (why?) we have
1844 	 * to do it before sending disassoc, as otherwise the null-packet
1845 	 * won't be valid.
1846 	 */
1847 	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1848 		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1849 		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1850 	}
1851 	local->ps_sdata = NULL;
1852 
1853 	/* disable per-vif ps */
1854 	ieee80211_recalc_ps_vif(sdata);
1855 
1856 	/* flush out any pending frame (e.g. DELBA) before deauth/disassoc */
1857 	if (tx)
1858 		ieee80211_flush_queues(local, sdata);
1859 
1860 	/* deauthenticate/disassociate now */
1861 	if (tx || frame_buf)
1862 		ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
1863 					       reason, tx, frame_buf);
1864 
1865 	/* flush out frame */
1866 	if (tx)
1867 		ieee80211_flush_queues(local, sdata);
1868 
1869 	/* clear bssid only after building the needed mgmt frames */
1870 	memset(ifmgd->bssid, 0, ETH_ALEN);
1871 
1872 	/* remove AP and TDLS peers */
1873 	sta_info_flush(sdata);
1874 
1875 	/* finally reset all BSS / config parameters */
1876 	changed |= ieee80211_reset_erp_info(sdata);
1877 
1878 	ieee80211_led_assoc(local, 0);
1879 	changed |= BSS_CHANGED_ASSOC;
1880 	sdata->vif.bss_conf.assoc = false;
1881 
1882 	ifmgd->p2p_noa_index = -1;
1883 	memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
1884 	       sizeof(sdata->vif.bss_conf.p2p_noa_attr));
1885 
1886 	/* on the next assoc, re-program HT/VHT parameters */
1887 	memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
1888 	memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
1889 	memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
1890 	memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
1891 
1892 	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
1893 
1894 	del_timer_sync(&local->dynamic_ps_timer);
1895 	cancel_work_sync(&local->dynamic_ps_enable_work);
1896 
1897 	/* Disable ARP filtering */
1898 	if (sdata->vif.bss_conf.arp_addr_cnt)
1899 		changed |= BSS_CHANGED_ARP_FILTER;
1900 
1901 	sdata->vif.bss_conf.qos = false;
1902 	changed |= BSS_CHANGED_QOS;
1903 
1904 	/* The BSSID (not really interesting) and HT changed */
1905 	changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
1906 	ieee80211_bss_info_change_notify(sdata, changed);
1907 
1908 	/* disassociated - set to defaults now */
1909 	ieee80211_set_wmm_default(sdata, false);
1910 
1911 	del_timer_sync(&sdata->u.mgd.conn_mon_timer);
1912 	del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
1913 	del_timer_sync(&sdata->u.mgd.timer);
1914 	del_timer_sync(&sdata->u.mgd.chswitch_timer);
1915 
1916 	sdata->vif.bss_conf.dtim_period = 0;
1917 	sdata->vif.bss_conf.beacon_rate = NULL;
1918 
1919 	ifmgd->have_beacon = false;
1920 
1921 	ifmgd->flags = 0;
1922 	mutex_lock(&local->mtx);
1923 	ieee80211_vif_release_channel(sdata);
1924 
1925 	sdata->vif.csa_active = false;
1926 	if (sdata->csa_block_tx) {
1927 		ieee80211_wake_vif_queues(local, sdata,
1928 					  IEEE80211_QUEUE_STOP_REASON_CSA);
1929 		sdata->csa_block_tx = false;
1930 	}
1931 	mutex_unlock(&local->mtx);
1932 
1933 	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
1934 }
1935 
1936 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
1937 			     struct ieee80211_hdr *hdr)
1938 {
1939 	/*
1940 	 * We can postpone the mgd.timer whenever receiving unicast frames
1941 	 * from AP because we know that the connection is working both ways
1942 	 * at that time. But multicast frames (and hence also beacons) must
1943 	 * be ignored here, because we need to trigger the timer during
1944 	 * data idle periods for sending the periodic probe request to the
1945 	 * AP we're connected to.
1946 	 */
1947 	if (is_multicast_ether_addr(hdr->addr1))
1948 		return;
1949 
1950 	ieee80211_sta_reset_conn_monitor(sdata);
1951 }
1952 
1953 static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
1954 {
1955 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1956 	struct ieee80211_local *local = sdata->local;
1957 
1958 	mutex_lock(&local->mtx);
1959 	if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
1960 		goto out;
1961 
1962 	__ieee80211_stop_poll(sdata);
1963 
1964 	mutex_lock(&local->iflist_mtx);
1965 	ieee80211_recalc_ps(local, -1);
1966 	mutex_unlock(&local->iflist_mtx);
1967 
1968 	if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
1969 		goto out;
1970 
1971 	/*
1972 	 * We've received a probe response, but are not sure whether
1973 	 * we have or will be receiving any beacons or data, so let's
1974 	 * schedule the timers again, just in case.
1975 	 */
1976 	ieee80211_sta_reset_beacon_monitor(sdata);
1977 
1978 	mod_timer(&ifmgd->conn_mon_timer,
1979 		  round_jiffies_up(jiffies +
1980 				   IEEE80211_CONNECTION_IDLE_TIME));
1981 out:
1982 	mutex_unlock(&local->mtx);
1983 }
1984 
1985 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
1986 			     struct ieee80211_hdr *hdr, bool ack)
1987 {
1988 	if (!ieee80211_is_data(hdr->frame_control))
1989 	    return;
1990 
1991 	if (ieee80211_is_nullfunc(hdr->frame_control) &&
1992 	    sdata->u.mgd.probe_send_count > 0) {
1993 		if (ack)
1994 			ieee80211_sta_reset_conn_monitor(sdata);
1995 		else
1996 			sdata->u.mgd.nullfunc_failed = true;
1997 		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
1998 		return;
1999 	}
2000 
2001 	if (ack)
2002 		ieee80211_sta_reset_conn_monitor(sdata);
2003 }
2004 
2005 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
2006 {
2007 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2008 	const u8 *ssid;
2009 	u8 *dst = ifmgd->associated->bssid;
2010 	u8 unicast_limit = max(1, max_probe_tries - 3);
2011 
2012 	/*
2013 	 * Try sending broadcast probe requests for the last three
2014 	 * probe requests after the first ones failed since some
2015 	 * buggy APs only support broadcast probe requests.
2016 	 */
2017 	if (ifmgd->probe_send_count >= unicast_limit)
2018 		dst = NULL;
2019 
2020 	/*
2021 	 * When the hardware reports an accurate Tx ACK status, it's
2022 	 * better to send a nullfunc frame instead of a probe request,
2023 	 * as it will kick us off the AP quickly if we aren't associated
2024 	 * anymore. The timeout will be reset if the frame is ACKed by
2025 	 * the AP.
2026 	 */
2027 	ifmgd->probe_send_count++;
2028 
2029 	if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
2030 		ifmgd->nullfunc_failed = false;
2031 		ieee80211_send_nullfunc(sdata->local, sdata, 0);
2032 	} else {
2033 		int ssid_len;
2034 
2035 		rcu_read_lock();
2036 		ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
2037 		if (WARN_ON_ONCE(ssid == NULL))
2038 			ssid_len = 0;
2039 		else
2040 			ssid_len = ssid[1];
2041 
2042 		ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid_len, NULL,
2043 					 0, (u32) -1, true, 0,
2044 					 ifmgd->associated->channel, false);
2045 		rcu_read_unlock();
2046 	}
2047 
2048 	ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
2049 	run_again(sdata, ifmgd->probe_timeout);
2050 	if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
2051 		ieee80211_flush_queues(sdata->local, sdata);
2052 }
2053 
2054 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
2055 				   bool beacon)
2056 {
2057 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2058 	bool already = false;
2059 
2060 	if (!ieee80211_sdata_running(sdata))
2061 		return;
2062 
2063 	sdata_lock(sdata);
2064 
2065 	if (!ifmgd->associated)
2066 		goto out;
2067 
2068 	mutex_lock(&sdata->local->mtx);
2069 
2070 	if (sdata->local->tmp_channel || sdata->local->scanning) {
2071 		mutex_unlock(&sdata->local->mtx);
2072 		goto out;
2073 	}
2074 
2075 	if (beacon) {
2076 		mlme_dbg_ratelimited(sdata,
2077 				     "detected beacon loss from AP (missed %d beacons) - probing\n",
2078 				     beacon_loss_count);
2079 
2080 		ieee80211_cqm_rssi_notify(&sdata->vif,
2081 					  NL80211_CQM_RSSI_BEACON_LOSS_EVENT,
2082 					  GFP_KERNEL);
2083 	}
2084 
2085 	/*
2086 	 * The driver/our work has already reported this event or the
2087 	 * connection monitoring has kicked in and we have already sent
2088 	 * a probe request. Or maybe the AP died and the driver keeps
2089 	 * reporting until we disassociate...
2090 	 *
2091 	 * In either case we have to ignore the current call to this
2092 	 * function (except for setting the correct probe reason bit)
2093 	 * because otherwise we would reset the timer every time and
2094 	 * never check whether we received a probe response!
2095 	 */
2096 	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
2097 		already = true;
2098 
2099 	ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
2100 
2101 	mutex_unlock(&sdata->local->mtx);
2102 
2103 	if (already)
2104 		goto out;
2105 
2106 	mutex_lock(&sdata->local->iflist_mtx);
2107 	ieee80211_recalc_ps(sdata->local, -1);
2108 	mutex_unlock(&sdata->local->iflist_mtx);
2109 
2110 	ifmgd->probe_send_count = 0;
2111 	ieee80211_mgd_probe_ap_send(sdata);
2112  out:
2113 	sdata_unlock(sdata);
2114 }
2115 
2116 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
2117 					  struct ieee80211_vif *vif)
2118 {
2119 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2120 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2121 	struct cfg80211_bss *cbss;
2122 	struct sk_buff *skb;
2123 	const u8 *ssid;
2124 	int ssid_len;
2125 
2126 	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
2127 		return NULL;
2128 
2129 	sdata_assert_lock(sdata);
2130 
2131 	if (ifmgd->associated)
2132 		cbss = ifmgd->associated;
2133 	else if (ifmgd->auth_data)
2134 		cbss = ifmgd->auth_data->bss;
2135 	else if (ifmgd->assoc_data)
2136 		cbss = ifmgd->assoc_data->bss;
2137 	else
2138 		return NULL;
2139 
2140 	rcu_read_lock();
2141 	ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2142 	if (WARN_ON_ONCE(ssid == NULL))
2143 		ssid_len = 0;
2144 	else
2145 		ssid_len = ssid[1];
2146 
2147 	skb = ieee80211_build_probe_req(sdata, cbss->bssid,
2148 					(u32) -1, cbss->channel,
2149 					ssid + 2, ssid_len,
2150 					NULL, 0, true);
2151 	rcu_read_unlock();
2152 
2153 	return skb;
2154 }
2155 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
2156 
2157 static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2158 {
2159 	struct ieee80211_local *local = sdata->local;
2160 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2161 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2162 
2163 	sdata_lock(sdata);
2164 	if (!ifmgd->associated) {
2165 		sdata_unlock(sdata);
2166 		return;
2167 	}
2168 
2169 	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
2170 			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2171 			       true, frame_buf);
2172 	mutex_lock(&local->mtx);
2173 	sdata->vif.csa_active = false;
2174 	if (sdata->csa_block_tx) {
2175 		ieee80211_wake_vif_queues(local, sdata,
2176 					  IEEE80211_QUEUE_STOP_REASON_CSA);
2177 		sdata->csa_block_tx = false;
2178 	}
2179 	mutex_unlock(&local->mtx);
2180 
2181 	cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
2182 			      IEEE80211_DEAUTH_FRAME_LEN);
2183 	sdata_unlock(sdata);
2184 }
2185 
2186 static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
2187 {
2188 	struct ieee80211_sub_if_data *sdata =
2189 		container_of(work, struct ieee80211_sub_if_data,
2190 			     u.mgd.beacon_connection_loss_work);
2191 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2192 	struct sta_info *sta;
2193 
2194 	if (ifmgd->associated) {
2195 		rcu_read_lock();
2196 		sta = sta_info_get(sdata, ifmgd->bssid);
2197 		if (sta)
2198 			sta->beacon_loss_count++;
2199 		rcu_read_unlock();
2200 	}
2201 
2202 	if (ifmgd->connection_loss) {
2203 		sdata_info(sdata, "Connection to AP %pM lost\n",
2204 			   ifmgd->bssid);
2205 		__ieee80211_disconnect(sdata);
2206 	} else {
2207 		ieee80211_mgd_probe_ap(sdata, true);
2208 	}
2209 }
2210 
2211 static void ieee80211_csa_connection_drop_work(struct work_struct *work)
2212 {
2213 	struct ieee80211_sub_if_data *sdata =
2214 		container_of(work, struct ieee80211_sub_if_data,
2215 			     u.mgd.csa_connection_drop_work);
2216 
2217 	__ieee80211_disconnect(sdata);
2218 }
2219 
2220 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
2221 {
2222 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2223 	struct ieee80211_hw *hw = &sdata->local->hw;
2224 
2225 	trace_api_beacon_loss(sdata);
2226 
2227 	sdata->u.mgd.connection_loss = false;
2228 	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2229 }
2230 EXPORT_SYMBOL(ieee80211_beacon_loss);
2231 
2232 void ieee80211_connection_loss(struct ieee80211_vif *vif)
2233 {
2234 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2235 	struct ieee80211_hw *hw = &sdata->local->hw;
2236 
2237 	trace_api_connection_loss(sdata);
2238 
2239 	sdata->u.mgd.connection_loss = true;
2240 	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2241 }
2242 EXPORT_SYMBOL(ieee80211_connection_loss);
2243 
2244 
2245 static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
2246 					bool assoc)
2247 {
2248 	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
2249 
2250 	sdata_assert_lock(sdata);
2251 
2252 	if (!assoc) {
2253 		sta_info_destroy_addr(sdata, auth_data->bss->bssid);
2254 
2255 		memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
2256 		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2257 		sdata->u.mgd.flags = 0;
2258 		mutex_lock(&sdata->local->mtx);
2259 		ieee80211_vif_release_channel(sdata);
2260 		mutex_unlock(&sdata->local->mtx);
2261 	}
2262 
2263 	cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
2264 	kfree(auth_data);
2265 	sdata->u.mgd.auth_data = NULL;
2266 }
2267 
2268 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
2269 				     struct ieee80211_mgmt *mgmt, size_t len)
2270 {
2271 	struct ieee80211_local *local = sdata->local;
2272 	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
2273 	u8 *pos;
2274 	struct ieee802_11_elems elems;
2275 	u32 tx_flags = 0;
2276 
2277 	pos = mgmt->u.auth.variable;
2278 	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
2279 	if (!elems.challenge)
2280 		return;
2281 	auth_data->expected_transaction = 4;
2282 	drv_mgd_prepare_tx(sdata->local, sdata);
2283 	if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
2284 		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
2285 			   IEEE80211_TX_INTFL_MLME_CONN_TX;
2286 	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
2287 			    elems.challenge - 2, elems.challenge_len + 2,
2288 			    auth_data->bss->bssid, auth_data->bss->bssid,
2289 			    auth_data->key, auth_data->key_len,
2290 			    auth_data->key_idx, tx_flags);
2291 }
2292 
2293 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
2294 				   struct ieee80211_mgmt *mgmt, size_t len)
2295 {
2296 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2297 	u8 bssid[ETH_ALEN];
2298 	u16 auth_alg, auth_transaction, status_code;
2299 	struct sta_info *sta;
2300 
2301 	sdata_assert_lock(sdata);
2302 
2303 	if (len < 24 + 6)
2304 		return;
2305 
2306 	if (!ifmgd->auth_data || ifmgd->auth_data->done)
2307 		return;
2308 
2309 	memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
2310 
2311 	if (!ether_addr_equal(bssid, mgmt->bssid))
2312 		return;
2313 
2314 	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
2315 	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
2316 	status_code = le16_to_cpu(mgmt->u.auth.status_code);
2317 
2318 	if (auth_alg != ifmgd->auth_data->algorithm ||
2319 	    auth_transaction != ifmgd->auth_data->expected_transaction) {
2320 		sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
2321 			   mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
2322 			   auth_transaction,
2323 			   ifmgd->auth_data->expected_transaction);
2324 		return;
2325 	}
2326 
2327 	if (status_code != WLAN_STATUS_SUCCESS) {
2328 		sdata_info(sdata, "%pM denied authentication (status %d)\n",
2329 			   mgmt->sa, status_code);
2330 		ieee80211_destroy_auth_data(sdata, false);
2331 		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2332 		return;
2333 	}
2334 
2335 	switch (ifmgd->auth_data->algorithm) {
2336 	case WLAN_AUTH_OPEN:
2337 	case WLAN_AUTH_LEAP:
2338 	case WLAN_AUTH_FT:
2339 	case WLAN_AUTH_SAE:
2340 		break;
2341 	case WLAN_AUTH_SHARED_KEY:
2342 		if (ifmgd->auth_data->expected_transaction != 4) {
2343 			ieee80211_auth_challenge(sdata, mgmt, len);
2344 			/* need another frame */
2345 			return;
2346 		}
2347 		break;
2348 	default:
2349 		WARN_ONCE(1, "invalid auth alg %d",
2350 			  ifmgd->auth_data->algorithm);
2351 		return;
2352 	}
2353 
2354 	sdata_info(sdata, "authenticated\n");
2355 	ifmgd->auth_data->done = true;
2356 	ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
2357 	ifmgd->auth_data->timeout_started = true;
2358 	run_again(sdata, ifmgd->auth_data->timeout);
2359 
2360 	if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
2361 	    ifmgd->auth_data->expected_transaction != 2) {
2362 		/*
2363 		 * Report auth frame to user space for processing since another
2364 		 * round of Authentication frames is still needed.
2365 		 */
2366 		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2367 		return;
2368 	}
2369 
2370 	/* move station state to auth */
2371 	mutex_lock(&sdata->local->sta_mtx);
2372 	sta = sta_info_get(sdata, bssid);
2373 	if (!sta) {
2374 		WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
2375 		goto out_err;
2376 	}
2377 	if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
2378 		sdata_info(sdata, "failed moving %pM to auth\n", bssid);
2379 		goto out_err;
2380 	}
2381 	mutex_unlock(&sdata->local->sta_mtx);
2382 
2383 	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2384 	return;
2385  out_err:
2386 	mutex_unlock(&sdata->local->sta_mtx);
2387 	/* ignore frame -- wait for timeout */
2388 }
2389 
2390 #define case_WLAN(type) \
2391 	case WLAN_REASON_##type: return #type
2392 
2393 static const char *ieee80211_get_reason_code_string(u16 reason_code)
2394 {
2395 	switch (reason_code) {
2396 	case_WLAN(UNSPECIFIED);
2397 	case_WLAN(PREV_AUTH_NOT_VALID);
2398 	case_WLAN(DEAUTH_LEAVING);
2399 	case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
2400 	case_WLAN(DISASSOC_AP_BUSY);
2401 	case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
2402 	case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
2403 	case_WLAN(DISASSOC_STA_HAS_LEFT);
2404 	case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
2405 	case_WLAN(DISASSOC_BAD_POWER);
2406 	case_WLAN(DISASSOC_BAD_SUPP_CHAN);
2407 	case_WLAN(INVALID_IE);
2408 	case_WLAN(MIC_FAILURE);
2409 	case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
2410 	case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
2411 	case_WLAN(IE_DIFFERENT);
2412 	case_WLAN(INVALID_GROUP_CIPHER);
2413 	case_WLAN(INVALID_PAIRWISE_CIPHER);
2414 	case_WLAN(INVALID_AKMP);
2415 	case_WLAN(UNSUPP_RSN_VERSION);
2416 	case_WLAN(INVALID_RSN_IE_CAP);
2417 	case_WLAN(IEEE8021X_FAILED);
2418 	case_WLAN(CIPHER_SUITE_REJECTED);
2419 	case_WLAN(DISASSOC_UNSPECIFIED_QOS);
2420 	case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
2421 	case_WLAN(DISASSOC_LOW_ACK);
2422 	case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
2423 	case_WLAN(QSTA_LEAVE_QBSS);
2424 	case_WLAN(QSTA_NOT_USE);
2425 	case_WLAN(QSTA_REQUIRE_SETUP);
2426 	case_WLAN(QSTA_TIMEOUT);
2427 	case_WLAN(QSTA_CIPHER_NOT_SUPP);
2428 	case_WLAN(MESH_PEER_CANCELED);
2429 	case_WLAN(MESH_MAX_PEERS);
2430 	case_WLAN(MESH_CONFIG);
2431 	case_WLAN(MESH_CLOSE);
2432 	case_WLAN(MESH_MAX_RETRIES);
2433 	case_WLAN(MESH_CONFIRM_TIMEOUT);
2434 	case_WLAN(MESH_INVALID_GTK);
2435 	case_WLAN(MESH_INCONSISTENT_PARAM);
2436 	case_WLAN(MESH_INVALID_SECURITY);
2437 	case_WLAN(MESH_PATH_ERROR);
2438 	case_WLAN(MESH_PATH_NOFORWARD);
2439 	case_WLAN(MESH_PATH_DEST_UNREACHABLE);
2440 	case_WLAN(MAC_EXISTS_IN_MBSS);
2441 	case_WLAN(MESH_CHAN_REGULATORY);
2442 	case_WLAN(MESH_CHAN);
2443 	default: return "<unknown>";
2444 	}
2445 }
2446 
2447 static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
2448 				     struct ieee80211_mgmt *mgmt, size_t len)
2449 {
2450 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2451 	const u8 *bssid = NULL;
2452 	u16 reason_code;
2453 
2454 	sdata_assert_lock(sdata);
2455 
2456 	if (len < 24 + 2)
2457 		return;
2458 
2459 	if (!ifmgd->associated ||
2460 	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2461 		return;
2462 
2463 	bssid = ifmgd->associated->bssid;
2464 
2465 	reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
2466 
2467 	sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
2468 		   bssid, reason_code, ieee80211_get_reason_code_string(reason_code));
2469 
2470 	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2471 
2472 	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2473 }
2474 
2475 
2476 static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
2477 				       struct ieee80211_mgmt *mgmt, size_t len)
2478 {
2479 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2480 	u16 reason_code;
2481 
2482 	sdata_assert_lock(sdata);
2483 
2484 	if (len < 24 + 2)
2485 		return;
2486 
2487 	if (!ifmgd->associated ||
2488 	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2489 		return;
2490 
2491 	reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
2492 
2493 	sdata_info(sdata, "disassociated from %pM (Reason: %u)\n",
2494 		   mgmt->sa, reason_code);
2495 
2496 	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2497 
2498 	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2499 }
2500 
2501 static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
2502 				u8 *supp_rates, unsigned int supp_rates_len,
2503 				u32 *rates, u32 *basic_rates,
2504 				bool *have_higher_than_11mbit,
2505 				int *min_rate, int *min_rate_index,
2506 				int shift, u32 rate_flags)
2507 {
2508 	int i, j;
2509 
2510 	for (i = 0; i < supp_rates_len; i++) {
2511 		int rate = supp_rates[i] & 0x7f;
2512 		bool is_basic = !!(supp_rates[i] & 0x80);
2513 
2514 		if ((rate * 5 * (1 << shift)) > 110)
2515 			*have_higher_than_11mbit = true;
2516 
2517 		/*
2518 		 * BSS_MEMBERSHIP_SELECTOR_HT_PHY is defined in 802.11n-2009
2519 		 * 7.3.2.2 as a magic value instead of a rate. Hence, skip it.
2520 		 *
2521 		 * Note: Even through the membership selector and the basic
2522 		 *	 rate flag share the same bit, they are not exactly
2523 		 *	 the same.
2524 		 */
2525 		if (!!(supp_rates[i] & 0x80) &&
2526 		    (supp_rates[i] & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
2527 			continue;
2528 
2529 		for (j = 0; j < sband->n_bitrates; j++) {
2530 			struct ieee80211_rate *br;
2531 			int brate;
2532 
2533 			br = &sband->bitrates[j];
2534 			if ((rate_flags & br->flags) != rate_flags)
2535 				continue;
2536 
2537 			brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
2538 			if (brate == rate) {
2539 				*rates |= BIT(j);
2540 				if (is_basic)
2541 					*basic_rates |= BIT(j);
2542 				if ((rate * 5) < *min_rate) {
2543 					*min_rate = rate * 5;
2544 					*min_rate_index = j;
2545 				}
2546 				break;
2547 			}
2548 		}
2549 	}
2550 }
2551 
2552 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
2553 					 bool assoc)
2554 {
2555 	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
2556 
2557 	sdata_assert_lock(sdata);
2558 
2559 	if (!assoc) {
2560 		sta_info_destroy_addr(sdata, assoc_data->bss->bssid);
2561 
2562 		memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
2563 		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2564 		sdata->u.mgd.flags = 0;
2565 		mutex_lock(&sdata->local->mtx);
2566 		ieee80211_vif_release_channel(sdata);
2567 		mutex_unlock(&sdata->local->mtx);
2568 	}
2569 
2570 	kfree(assoc_data);
2571 	sdata->u.mgd.assoc_data = NULL;
2572 }
2573 
2574 static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
2575 				    struct cfg80211_bss *cbss,
2576 				    struct ieee80211_mgmt *mgmt, size_t len)
2577 {
2578 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2579 	struct ieee80211_local *local = sdata->local;
2580 	struct ieee80211_supported_band *sband;
2581 	struct sta_info *sta;
2582 	u8 *pos;
2583 	u16 capab_info, aid;
2584 	struct ieee802_11_elems elems;
2585 	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2586 	const struct cfg80211_bss_ies *bss_ies = NULL;
2587 	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
2588 	u32 changed = 0;
2589 	int err;
2590 	bool ret;
2591 
2592 	/* AssocResp and ReassocResp have identical structure */
2593 
2594 	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
2595 	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2596 
2597 	if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
2598 		sdata_info(sdata, "invalid AID value 0x%x; bits 15:14 not set\n",
2599 			   aid);
2600 	aid &= ~(BIT(15) | BIT(14));
2601 
2602 	ifmgd->broken_ap = false;
2603 
2604 	if (aid == 0 || aid > IEEE80211_MAX_AID) {
2605 		sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
2606 			   aid);
2607 		aid = 0;
2608 		ifmgd->broken_ap = true;
2609 	}
2610 
2611 	pos = mgmt->u.assoc_resp.variable;
2612 	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
2613 
2614 	if (!elems.supp_rates) {
2615 		sdata_info(sdata, "no SuppRates element in AssocResp\n");
2616 		return false;
2617 	}
2618 
2619 	ifmgd->aid = aid;
2620 
2621 	/*
2622 	 * Some APs are erroneously not including some information in their
2623 	 * (re)association response frames. Try to recover by using the data
2624 	 * from the beacon or probe response. This seems to afflict mobile
2625 	 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
2626 	 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
2627 	 */
2628 	if ((assoc_data->wmm && !elems.wmm_param) ||
2629 	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
2630 	     (!elems.ht_cap_elem || !elems.ht_operation)) ||
2631 	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
2632 	     (!elems.vht_cap_elem || !elems.vht_operation))) {
2633 		const struct cfg80211_bss_ies *ies;
2634 		struct ieee802_11_elems bss_elems;
2635 
2636 		rcu_read_lock();
2637 		ies = rcu_dereference(cbss->ies);
2638 		if (ies)
2639 			bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
2640 					  GFP_ATOMIC);
2641 		rcu_read_unlock();
2642 		if (!bss_ies)
2643 			return false;
2644 
2645 		ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
2646 				       false, &bss_elems);
2647 		if (assoc_data->wmm &&
2648 		    !elems.wmm_param && bss_elems.wmm_param) {
2649 			elems.wmm_param = bss_elems.wmm_param;
2650 			sdata_info(sdata,
2651 				   "AP bug: WMM param missing from AssocResp\n");
2652 		}
2653 
2654 		/*
2655 		 * Also check if we requested HT/VHT, otherwise the AP doesn't
2656 		 * have to include the IEs in the (re)association response.
2657 		 */
2658 		if (!elems.ht_cap_elem && bss_elems.ht_cap_elem &&
2659 		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
2660 			elems.ht_cap_elem = bss_elems.ht_cap_elem;
2661 			sdata_info(sdata,
2662 				   "AP bug: HT capability missing from AssocResp\n");
2663 		}
2664 		if (!elems.ht_operation && bss_elems.ht_operation &&
2665 		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
2666 			elems.ht_operation = bss_elems.ht_operation;
2667 			sdata_info(sdata,
2668 				   "AP bug: HT operation missing from AssocResp\n");
2669 		}
2670 		if (!elems.vht_cap_elem && bss_elems.vht_cap_elem &&
2671 		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
2672 			elems.vht_cap_elem = bss_elems.vht_cap_elem;
2673 			sdata_info(sdata,
2674 				   "AP bug: VHT capa missing from AssocResp\n");
2675 		}
2676 		if (!elems.vht_operation && bss_elems.vht_operation &&
2677 		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
2678 			elems.vht_operation = bss_elems.vht_operation;
2679 			sdata_info(sdata,
2680 				   "AP bug: VHT operation missing from AssocResp\n");
2681 		}
2682 	}
2683 
2684 	/*
2685 	 * We previously checked these in the beacon/probe response, so
2686 	 * they should be present here. This is just a safety net.
2687 	 */
2688 	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
2689 	    (!elems.wmm_param || !elems.ht_cap_elem || !elems.ht_operation)) {
2690 		sdata_info(sdata,
2691 			   "HT AP is missing WMM params or HT capability/operation\n");
2692 		ret = false;
2693 		goto out;
2694 	}
2695 
2696 	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
2697 	    (!elems.vht_cap_elem || !elems.vht_operation)) {
2698 		sdata_info(sdata,
2699 			   "VHT AP is missing VHT capability/operation\n");
2700 		ret = false;
2701 		goto out;
2702 	}
2703 
2704 	mutex_lock(&sdata->local->sta_mtx);
2705 	/*
2706 	 * station info was already allocated and inserted before
2707 	 * the association and should be available to us
2708 	 */
2709 	sta = sta_info_get(sdata, cbss->bssid);
2710 	if (WARN_ON(!sta)) {
2711 		mutex_unlock(&sdata->local->sta_mtx);
2712 		ret = false;
2713 		goto out;
2714 	}
2715 
2716 	sband = local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
2717 
2718 	/* Set up internal HT/VHT capabilities */
2719 	if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
2720 		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
2721 						  elems.ht_cap_elem, sta);
2722 
2723 	if (elems.vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
2724 		ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
2725 						    elems.vht_cap_elem, sta);
2726 
2727 	/*
2728 	 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
2729 	 * in their association response, so ignore that data for our own
2730 	 * configuration. If it changed since the last beacon, we'll get the
2731 	 * next beacon and update then.
2732 	 */
2733 
2734 	/*
2735 	 * If an operating mode notification IE is present, override the
2736 	 * NSS calculation (that would be done in rate_control_rate_init())
2737 	 * and use the # of streams from that element.
2738 	 */
2739 	if (elems.opmode_notif &&
2740 	    !(*elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
2741 		u8 nss;
2742 
2743 		nss = *elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
2744 		nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
2745 		nss += 1;
2746 		sta->sta.rx_nss = nss;
2747 	}
2748 
2749 	rate_control_rate_init(sta);
2750 
2751 	if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED)
2752 		set_sta_flag(sta, WLAN_STA_MFP);
2753 
2754 	sta->sta.wme = elems.wmm_param;
2755 
2756 	err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
2757 	if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
2758 		err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
2759 	if (err) {
2760 		sdata_info(sdata,
2761 			   "failed to move station %pM to desired state\n",
2762 			   sta->sta.addr);
2763 		WARN_ON(__sta_info_destroy(sta));
2764 		mutex_unlock(&sdata->local->sta_mtx);
2765 		ret = false;
2766 		goto out;
2767 	}
2768 
2769 	mutex_unlock(&sdata->local->sta_mtx);
2770 
2771 	/*
2772 	 * Always handle WMM once after association regardless
2773 	 * of the first value the AP uses. Setting -1 here has
2774 	 * that effect because the AP values is an unsigned
2775 	 * 4-bit value.
2776 	 */
2777 	ifmgd->wmm_last_param_set = -1;
2778 
2779 	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) && elems.wmm_param)
2780 		ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
2781 					 elems.wmm_param_len);
2782 	else
2783 		ieee80211_set_wmm_default(sdata, false);
2784 	changed |= BSS_CHANGED_QOS;
2785 
2786 	/* set AID and assoc capability,
2787 	 * ieee80211_set_associated() will tell the driver */
2788 	bss_conf->aid = aid;
2789 	bss_conf->assoc_capability = capab_info;
2790 	ieee80211_set_associated(sdata, cbss, changed);
2791 
2792 	/*
2793 	 * If we're using 4-addr mode, let the AP know that we're
2794 	 * doing so, so that it can create the STA VLAN on its side
2795 	 */
2796 	if (ifmgd->use_4addr)
2797 		ieee80211_send_4addr_nullfunc(local, sdata);
2798 
2799 	/*
2800 	 * Start timer to probe the connection to the AP now.
2801 	 * Also start the timer that will detect beacon loss.
2802 	 */
2803 	ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
2804 	ieee80211_sta_reset_beacon_monitor(sdata);
2805 
2806 	ret = true;
2807  out:
2808 	kfree(bss_ies);
2809 	return ret;
2810 }
2811 
2812 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
2813 					 struct ieee80211_mgmt *mgmt,
2814 					 size_t len)
2815 {
2816 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2817 	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
2818 	u16 capab_info, status_code, aid;
2819 	struct ieee802_11_elems elems;
2820 	int ac, uapsd_queues = -1;
2821 	u8 *pos;
2822 	bool reassoc;
2823 	struct cfg80211_bss *bss;
2824 
2825 	sdata_assert_lock(sdata);
2826 
2827 	if (!assoc_data)
2828 		return;
2829 	if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
2830 		return;
2831 
2832 	/*
2833 	 * AssocResp and ReassocResp have identical structure, so process both
2834 	 * of them in this function.
2835 	 */
2836 
2837 	if (len < 24 + 6)
2838 		return;
2839 
2840 	reassoc = ieee80211_is_reassoc_req(mgmt->frame_control);
2841 	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2842 	status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
2843 	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
2844 
2845 	sdata_info(sdata,
2846 		   "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
2847 		   reassoc ? "Rea" : "A", mgmt->sa,
2848 		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
2849 
2850 	pos = mgmt->u.assoc_resp.variable;
2851 	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
2852 
2853 	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
2854 	    elems.timeout_int &&
2855 	    elems.timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
2856 		u32 tu, ms;
2857 		tu = le32_to_cpu(elems.timeout_int->value);
2858 		ms = tu * 1024 / 1000;
2859 		sdata_info(sdata,
2860 			   "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
2861 			   mgmt->sa, tu, ms);
2862 		assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
2863 		assoc_data->timeout_started = true;
2864 		if (ms > IEEE80211_ASSOC_TIMEOUT)
2865 			run_again(sdata, assoc_data->timeout);
2866 		return;
2867 	}
2868 
2869 	bss = assoc_data->bss;
2870 
2871 	if (status_code != WLAN_STATUS_SUCCESS) {
2872 		sdata_info(sdata, "%pM denied association (code=%d)\n",
2873 			   mgmt->sa, status_code);
2874 		ieee80211_destroy_assoc_data(sdata, false);
2875 	} else {
2876 		if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
2877 			/* oops -- internal error -- send timeout for now */
2878 			ieee80211_destroy_assoc_data(sdata, false);
2879 			cfg80211_assoc_timeout(sdata->dev, bss);
2880 			return;
2881 		}
2882 		sdata_info(sdata, "associated\n");
2883 
2884 		/*
2885 		 * destroy assoc_data afterwards, as otherwise an idle
2886 		 * recalc after assoc_data is NULL but before associated
2887 		 * is set can cause the interface to go idle
2888 		 */
2889 		ieee80211_destroy_assoc_data(sdata, true);
2890 
2891 		/* get uapsd queues configuration */
2892 		uapsd_queues = 0;
2893 		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
2894 			if (sdata->tx_conf[ac].uapsd)
2895 				uapsd_queues |= BIT(ac);
2896 	}
2897 
2898 	cfg80211_rx_assoc_resp(sdata->dev, bss, (u8 *)mgmt, len, uapsd_queues);
2899 }
2900 
2901 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
2902 				  struct ieee80211_mgmt *mgmt, size_t len,
2903 				  struct ieee80211_rx_status *rx_status,
2904 				  struct ieee802_11_elems *elems)
2905 {
2906 	struct ieee80211_local *local = sdata->local;
2907 	struct ieee80211_bss *bss;
2908 	struct ieee80211_channel *channel;
2909 
2910 	sdata_assert_lock(sdata);
2911 
2912 	channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
2913 	if (!channel)
2914 		return;
2915 
2916 	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
2917 					channel);
2918 	if (bss) {
2919 		sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
2920 		ieee80211_rx_bss_put(local, bss);
2921 	}
2922 }
2923 
2924 
2925 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
2926 					 struct sk_buff *skb)
2927 {
2928 	struct ieee80211_mgmt *mgmt = (void *)skb->data;
2929 	struct ieee80211_if_managed *ifmgd;
2930 	struct ieee80211_rx_status *rx_status = (void *) skb->cb;
2931 	size_t baselen, len = skb->len;
2932 	struct ieee802_11_elems elems;
2933 
2934 	ifmgd = &sdata->u.mgd;
2935 
2936 	sdata_assert_lock(sdata);
2937 
2938 	if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
2939 		return; /* ignore ProbeResp to foreign address */
2940 
2941 	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
2942 	if (baselen > len)
2943 		return;
2944 
2945 	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
2946 			       false, &elems);
2947 
2948 	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
2949 
2950 	if (ifmgd->associated &&
2951 	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2952 		ieee80211_reset_ap_probe(sdata);
2953 
2954 	if (ifmgd->auth_data && !ifmgd->auth_data->bss->proberesp_ies &&
2955 	    ether_addr_equal(mgmt->bssid, ifmgd->auth_data->bss->bssid)) {
2956 		/* got probe response, continue with auth */
2957 		sdata_info(sdata, "direct probe responded\n");
2958 		ifmgd->auth_data->tries = 0;
2959 		ifmgd->auth_data->timeout = jiffies;
2960 		ifmgd->auth_data->timeout_started = true;
2961 		run_again(sdata, ifmgd->auth_data->timeout);
2962 	}
2963 }
2964 
2965 /*
2966  * This is the canonical list of information elements we care about,
2967  * the filter code also gives us all changes to the Microsoft OUI
2968  * (00:50:F2) vendor IE which is used for WMM which we need to track,
2969  * as well as the DTPC IE (part of the Cisco OUI) used for signaling
2970  * changes to requested client power.
2971  *
2972  * We implement beacon filtering in software since that means we can
2973  * avoid processing the frame here and in cfg80211, and userspace
2974  * will not be able to tell whether the hardware supports it or not.
2975  *
2976  * XXX: This list needs to be dynamic -- userspace needs to be able to
2977  *	add items it requires. It also needs to be able to tell us to
2978  *	look out for other vendor IEs.
2979  */
2980 static const u64 care_about_ies =
2981 	(1ULL << WLAN_EID_COUNTRY) |
2982 	(1ULL << WLAN_EID_ERP_INFO) |
2983 	(1ULL << WLAN_EID_CHANNEL_SWITCH) |
2984 	(1ULL << WLAN_EID_PWR_CONSTRAINT) |
2985 	(1ULL << WLAN_EID_HT_CAPABILITY) |
2986 	(1ULL << WLAN_EID_HT_OPERATION);
2987 
2988 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
2989 				     struct ieee80211_mgmt *mgmt, size_t len,
2990 				     struct ieee80211_rx_status *rx_status)
2991 {
2992 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2993 	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2994 	size_t baselen;
2995 	struct ieee802_11_elems elems;
2996 	struct ieee80211_local *local = sdata->local;
2997 	struct ieee80211_chanctx_conf *chanctx_conf;
2998 	struct ieee80211_channel *chan;
2999 	struct sta_info *sta;
3000 	u32 changed = 0;
3001 	bool erp_valid;
3002 	u8 erp_value = 0;
3003 	u32 ncrc;
3004 	u8 *bssid;
3005 	u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
3006 
3007 	sdata_assert_lock(sdata);
3008 
3009 	/* Process beacon from the current BSS */
3010 	baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
3011 	if (baselen > len)
3012 		return;
3013 
3014 	rcu_read_lock();
3015 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
3016 	if (!chanctx_conf) {
3017 		rcu_read_unlock();
3018 		return;
3019 	}
3020 
3021 	if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
3022 		rcu_read_unlock();
3023 		return;
3024 	}
3025 	chan = chanctx_conf->def.chan;
3026 	rcu_read_unlock();
3027 
3028 	if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
3029 	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
3030 		ieee802_11_parse_elems(mgmt->u.beacon.variable,
3031 				       len - baselen, false, &elems);
3032 
3033 		ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3034 		if (elems.tim && !elems.parse_error) {
3035 			const struct ieee80211_tim_ie *tim_ie = elems.tim;
3036 			ifmgd->dtim_period = tim_ie->dtim_period;
3037 		}
3038 		ifmgd->have_beacon = true;
3039 		ifmgd->assoc_data->need_beacon = false;
3040 		if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
3041 			sdata->vif.bss_conf.sync_tsf =
3042 				le64_to_cpu(mgmt->u.beacon.timestamp);
3043 			sdata->vif.bss_conf.sync_device_ts =
3044 				rx_status->device_timestamp;
3045 			if (elems.tim)
3046 				sdata->vif.bss_conf.sync_dtim_count =
3047 					elems.tim->dtim_count;
3048 			else
3049 				sdata->vif.bss_conf.sync_dtim_count = 0;
3050 		}
3051 		/* continue assoc process */
3052 		ifmgd->assoc_data->timeout = jiffies;
3053 		ifmgd->assoc_data->timeout_started = true;
3054 		run_again(sdata, ifmgd->assoc_data->timeout);
3055 		return;
3056 	}
3057 
3058 	if (!ifmgd->associated ||
3059 	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3060 		return;
3061 	bssid = ifmgd->associated->bssid;
3062 
3063 	/* Track average RSSI from the Beacon frames of the current AP */
3064 	ifmgd->last_beacon_signal = rx_status->signal;
3065 	if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
3066 		ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
3067 		ifmgd->ave_beacon_signal = rx_status->signal * 16;
3068 		ifmgd->last_cqm_event_signal = 0;
3069 		ifmgd->count_beacon_signal = 1;
3070 		ifmgd->last_ave_beacon_signal = 0;
3071 	} else {
3072 		ifmgd->ave_beacon_signal =
3073 			(IEEE80211_SIGNAL_AVE_WEIGHT * rx_status->signal * 16 +
3074 			 (16 - IEEE80211_SIGNAL_AVE_WEIGHT) *
3075 			 ifmgd->ave_beacon_signal) / 16;
3076 		ifmgd->count_beacon_signal++;
3077 	}
3078 
3079 	if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
3080 	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
3081 		int sig = ifmgd->ave_beacon_signal;
3082 		int last_sig = ifmgd->last_ave_beacon_signal;
3083 
3084 		/*
3085 		 * if signal crosses either of the boundaries, invoke callback
3086 		 * with appropriate parameters
3087 		 */
3088 		if (sig > ifmgd->rssi_max_thold &&
3089 		    (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
3090 			ifmgd->last_ave_beacon_signal = sig;
3091 			drv_rssi_callback(local, sdata, RSSI_EVENT_HIGH);
3092 		} else if (sig < ifmgd->rssi_min_thold &&
3093 			   (last_sig >= ifmgd->rssi_max_thold ||
3094 			   last_sig == 0)) {
3095 			ifmgd->last_ave_beacon_signal = sig;
3096 			drv_rssi_callback(local, sdata, RSSI_EVENT_LOW);
3097 		}
3098 	}
3099 
3100 	if (bss_conf->cqm_rssi_thold &&
3101 	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
3102 	    !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
3103 		int sig = ifmgd->ave_beacon_signal / 16;
3104 		int last_event = ifmgd->last_cqm_event_signal;
3105 		int thold = bss_conf->cqm_rssi_thold;
3106 		int hyst = bss_conf->cqm_rssi_hyst;
3107 		if (sig < thold &&
3108 		    (last_event == 0 || sig < last_event - hyst)) {
3109 			ifmgd->last_cqm_event_signal = sig;
3110 			ieee80211_cqm_rssi_notify(
3111 				&sdata->vif,
3112 				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
3113 				GFP_KERNEL);
3114 		} else if (sig > thold &&
3115 			   (last_event == 0 || sig > last_event + hyst)) {
3116 			ifmgd->last_cqm_event_signal = sig;
3117 			ieee80211_cqm_rssi_notify(
3118 				&sdata->vif,
3119 				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
3120 				GFP_KERNEL);
3121 		}
3122 	}
3123 
3124 	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
3125 		mlme_dbg_ratelimited(sdata,
3126 				     "cancelling AP probe due to a received beacon\n");
3127 		ieee80211_reset_ap_probe(sdata);
3128 	}
3129 
3130 	/*
3131 	 * Push the beacon loss detection into the future since
3132 	 * we are processing a beacon from the AP just now.
3133 	 */
3134 	ieee80211_sta_reset_beacon_monitor(sdata);
3135 
3136 	ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
3137 	ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
3138 					  len - baselen, false, &elems,
3139 					  care_about_ies, ncrc);
3140 
3141 	if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
3142 		bool directed_tim = ieee80211_check_tim(elems.tim,
3143 							elems.tim_len,
3144 							ifmgd->aid);
3145 		if (directed_tim) {
3146 			if (local->hw.conf.dynamic_ps_timeout > 0) {
3147 				if (local->hw.conf.flags & IEEE80211_CONF_PS) {
3148 					local->hw.conf.flags &= ~IEEE80211_CONF_PS;
3149 					ieee80211_hw_config(local,
3150 							    IEEE80211_CONF_CHANGE_PS);
3151 				}
3152 				ieee80211_send_nullfunc(local, sdata, 0);
3153 			} else if (!local->pspolling && sdata->u.mgd.powersave) {
3154 				local->pspolling = true;
3155 
3156 				/*
3157 				 * Here is assumed that the driver will be
3158 				 * able to send ps-poll frame and receive a
3159 				 * response even though power save mode is
3160 				 * enabled, but some drivers might require
3161 				 * to disable power save here. This needs
3162 				 * to be investigated.
3163 				 */
3164 				ieee80211_send_pspoll(local, sdata);
3165 			}
3166 		}
3167 	}
3168 
3169 	if (sdata->vif.p2p) {
3170 		struct ieee80211_p2p_noa_attr noa = {};
3171 		int ret;
3172 
3173 		ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
3174 					    len - baselen,
3175 					    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
3176 					    (u8 *) &noa, sizeof(noa));
3177 		if (ret >= 2) {
3178 			if (sdata->u.mgd.p2p_noa_index != noa.index) {
3179 				/* valid noa_attr and index changed */
3180 				sdata->u.mgd.p2p_noa_index = noa.index;
3181 				memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
3182 				changed |= BSS_CHANGED_P2P_PS;
3183 				/*
3184 				 * make sure we update all information, the CRC
3185 				 * mechanism doesn't look at P2P attributes.
3186 				 */
3187 				ifmgd->beacon_crc_valid = false;
3188 			}
3189 		} else if (sdata->u.mgd.p2p_noa_index != -1) {
3190 			/* noa_attr not found and we had valid noa_attr before */
3191 			sdata->u.mgd.p2p_noa_index = -1;
3192 			memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
3193 			changed |= BSS_CHANGED_P2P_PS;
3194 			ifmgd->beacon_crc_valid = false;
3195 		}
3196 	}
3197 
3198 	if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
3199 		return;
3200 	ifmgd->beacon_crc = ncrc;
3201 	ifmgd->beacon_crc_valid = true;
3202 
3203 	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3204 
3205 	ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
3206 					 &elems, true);
3207 
3208 	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
3209 	    ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
3210 				     elems.wmm_param_len))
3211 		changed |= BSS_CHANGED_QOS;
3212 
3213 	/*
3214 	 * If we haven't had a beacon before, tell the driver about the
3215 	 * DTIM period (and beacon timing if desired) now.
3216 	 */
3217 	if (!ifmgd->have_beacon) {
3218 		/* a few bogus AP send dtim_period = 0 or no TIM IE */
3219 		if (elems.tim)
3220 			bss_conf->dtim_period = elems.tim->dtim_period ?: 1;
3221 		else
3222 			bss_conf->dtim_period = 1;
3223 
3224 		if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
3225 			sdata->vif.bss_conf.sync_tsf =
3226 				le64_to_cpu(mgmt->u.beacon.timestamp);
3227 			sdata->vif.bss_conf.sync_device_ts =
3228 				rx_status->device_timestamp;
3229 			if (elems.tim)
3230 				sdata->vif.bss_conf.sync_dtim_count =
3231 					elems.tim->dtim_count;
3232 			else
3233 				sdata->vif.bss_conf.sync_dtim_count = 0;
3234 		}
3235 
3236 		changed |= BSS_CHANGED_BEACON_INFO;
3237 		ifmgd->have_beacon = true;
3238 
3239 		mutex_lock(&local->iflist_mtx);
3240 		ieee80211_recalc_ps(local, -1);
3241 		mutex_unlock(&local->iflist_mtx);
3242 
3243 		ieee80211_recalc_ps_vif(sdata);
3244 	}
3245 
3246 	if (elems.erp_info) {
3247 		erp_valid = true;
3248 		erp_value = elems.erp_info[0];
3249 	} else {
3250 		erp_valid = false;
3251 	}
3252 	changed |= ieee80211_handle_bss_capability(sdata,
3253 			le16_to_cpu(mgmt->u.beacon.capab_info),
3254 			erp_valid, erp_value);
3255 
3256 	mutex_lock(&local->sta_mtx);
3257 	sta = sta_info_get(sdata, bssid);
3258 
3259 	if (ieee80211_config_bw(sdata, sta,
3260 				elems.ht_cap_elem, elems.ht_operation,
3261 				elems.vht_operation, bssid, &changed)) {
3262 		mutex_unlock(&local->sta_mtx);
3263 		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
3264 				       WLAN_REASON_DEAUTH_LEAVING,
3265 				       true, deauth_buf);
3266 		cfg80211_tx_mlme_mgmt(sdata->dev, deauth_buf,
3267 				      sizeof(deauth_buf));
3268 		return;
3269 	}
3270 
3271 	if (sta && elems.opmode_notif)
3272 		ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
3273 					    rx_status->band, true);
3274 	mutex_unlock(&local->sta_mtx);
3275 
3276 	changed |= ieee80211_handle_pwr_constr(sdata, chan, mgmt,
3277 					       elems.country_elem,
3278 					       elems.country_elem_len,
3279 					       elems.pwr_constr_elem,
3280 					       elems.cisco_dtpc_elem);
3281 
3282 	ieee80211_bss_info_change_notify(sdata, changed);
3283 }
3284 
3285 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
3286 				  struct sk_buff *skb)
3287 {
3288 	struct ieee80211_rx_status *rx_status;
3289 	struct ieee80211_mgmt *mgmt;
3290 	u16 fc;
3291 	struct ieee802_11_elems elems;
3292 	int ies_len;
3293 
3294 	rx_status = (struct ieee80211_rx_status *) skb->cb;
3295 	mgmt = (struct ieee80211_mgmt *) skb->data;
3296 	fc = le16_to_cpu(mgmt->frame_control);
3297 
3298 	sdata_lock(sdata);
3299 
3300 	switch (fc & IEEE80211_FCTL_STYPE) {
3301 	case IEEE80211_STYPE_BEACON:
3302 		ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
3303 		break;
3304 	case IEEE80211_STYPE_PROBE_RESP:
3305 		ieee80211_rx_mgmt_probe_resp(sdata, skb);
3306 		break;
3307 	case IEEE80211_STYPE_AUTH:
3308 		ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
3309 		break;
3310 	case IEEE80211_STYPE_DEAUTH:
3311 		ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
3312 		break;
3313 	case IEEE80211_STYPE_DISASSOC:
3314 		ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
3315 		break;
3316 	case IEEE80211_STYPE_ASSOC_RESP:
3317 	case IEEE80211_STYPE_REASSOC_RESP:
3318 		ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
3319 		break;
3320 	case IEEE80211_STYPE_ACTION:
3321 		if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
3322 			ies_len = skb->len -
3323 				  offsetof(struct ieee80211_mgmt,
3324 					   u.action.u.chan_switch.variable);
3325 
3326 			if (ies_len < 0)
3327 				break;
3328 
3329 			ieee802_11_parse_elems(
3330 				mgmt->u.action.u.chan_switch.variable,
3331 				ies_len, true, &elems);
3332 
3333 			if (elems.parse_error)
3334 				break;
3335 
3336 			ieee80211_sta_process_chanswitch(sdata,
3337 							 rx_status->mactime,
3338 							 &elems, false);
3339 		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
3340 			ies_len = skb->len -
3341 				  offsetof(struct ieee80211_mgmt,
3342 					   u.action.u.ext_chan_switch.variable);
3343 
3344 			if (ies_len < 0)
3345 				break;
3346 
3347 			ieee802_11_parse_elems(
3348 				mgmt->u.action.u.ext_chan_switch.variable,
3349 				ies_len, true, &elems);
3350 
3351 			if (elems.parse_error)
3352 				break;
3353 
3354 			/* for the handling code pretend this was also an IE */
3355 			elems.ext_chansw_ie =
3356 				&mgmt->u.action.u.ext_chan_switch.data;
3357 
3358 			ieee80211_sta_process_chanswitch(sdata,
3359 							 rx_status->mactime,
3360 							 &elems, false);
3361 		}
3362 		break;
3363 	}
3364 	sdata_unlock(sdata);
3365 }
3366 
3367 static void ieee80211_sta_timer(unsigned long data)
3368 {
3369 	struct ieee80211_sub_if_data *sdata =
3370 		(struct ieee80211_sub_if_data *) data;
3371 
3372 	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3373 }
3374 
3375 static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
3376 					  u8 *bssid, u8 reason, bool tx)
3377 {
3378 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3379 
3380 	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
3381 			       tx, frame_buf);
3382 
3383 	cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
3384 			      IEEE80211_DEAUTH_FRAME_LEN);
3385 }
3386 
3387 static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
3388 {
3389 	struct ieee80211_local *local = sdata->local;
3390 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3391 	struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
3392 	u32 tx_flags = 0;
3393 
3394 	sdata_assert_lock(sdata);
3395 
3396 	if (WARN_ON_ONCE(!auth_data))
3397 		return -EINVAL;
3398 
3399 	auth_data->tries++;
3400 
3401 	if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
3402 		sdata_info(sdata, "authentication with %pM timed out\n",
3403 			   auth_data->bss->bssid);
3404 
3405 		/*
3406 		 * Most likely AP is not in the range so remove the
3407 		 * bss struct for that AP.
3408 		 */
3409 		cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);
3410 
3411 		return -ETIMEDOUT;
3412 	}
3413 
3414 	drv_mgd_prepare_tx(local, sdata);
3415 
3416 	if (auth_data->bss->proberesp_ies) {
3417 		u16 trans = 1;
3418 		u16 status = 0;
3419 
3420 		sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
3421 			   auth_data->bss->bssid, auth_data->tries,
3422 			   IEEE80211_AUTH_MAX_TRIES);
3423 
3424 		auth_data->expected_transaction = 2;
3425 
3426 		if (auth_data->algorithm == WLAN_AUTH_SAE) {
3427 			trans = auth_data->sae_trans;
3428 			status = auth_data->sae_status;
3429 			auth_data->expected_transaction = trans;
3430 		}
3431 
3432 		if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
3433 			tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
3434 				   IEEE80211_TX_INTFL_MLME_CONN_TX;
3435 
3436 		ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
3437 				    auth_data->data, auth_data->data_len,
3438 				    auth_data->bss->bssid,
3439 				    auth_data->bss->bssid, NULL, 0, 0,
3440 				    tx_flags);
3441 	} else {
3442 		const u8 *ssidie;
3443 
3444 		sdata_info(sdata, "direct probe to %pM (try %d/%i)\n",
3445 			   auth_data->bss->bssid, auth_data->tries,
3446 			   IEEE80211_AUTH_MAX_TRIES);
3447 
3448 		rcu_read_lock();
3449 		ssidie = ieee80211_bss_get_ie(auth_data->bss, WLAN_EID_SSID);
3450 		if (!ssidie) {
3451 			rcu_read_unlock();
3452 			return -EINVAL;
3453 		}
3454 		/*
3455 		 * Direct probe is sent to broadcast address as some APs
3456 		 * will not answer to direct packet in unassociated state.
3457 		 */
3458 		ieee80211_send_probe_req(sdata, NULL, ssidie + 2, ssidie[1],
3459 					 NULL, 0, (u32) -1, true, 0,
3460 					 auth_data->bss->channel, false);
3461 		rcu_read_unlock();
3462 	}
3463 
3464 	if (tx_flags == 0) {
3465 		auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
3466 		auth_data->timeout_started = true;
3467 		run_again(sdata, auth_data->timeout);
3468 	} else {
3469 		auth_data->timeout =
3470 			round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
3471 		auth_data->timeout_started = true;
3472 		run_again(sdata, auth_data->timeout);
3473 	}
3474 
3475 	return 0;
3476 }
3477 
3478 static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
3479 {
3480 	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
3481 	struct ieee80211_local *local = sdata->local;
3482 
3483 	sdata_assert_lock(sdata);
3484 
3485 	assoc_data->tries++;
3486 	if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
3487 		sdata_info(sdata, "association with %pM timed out\n",
3488 			   assoc_data->bss->bssid);
3489 
3490 		/*
3491 		 * Most likely AP is not in the range so remove the
3492 		 * bss struct for that AP.
3493 		 */
3494 		cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);
3495 
3496 		return -ETIMEDOUT;
3497 	}
3498 
3499 	sdata_info(sdata, "associate with %pM (try %d/%d)\n",
3500 		   assoc_data->bss->bssid, assoc_data->tries,
3501 		   IEEE80211_ASSOC_MAX_TRIES);
3502 	ieee80211_send_assoc(sdata);
3503 
3504 	if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
3505 		assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
3506 		assoc_data->timeout_started = true;
3507 		run_again(sdata, assoc_data->timeout);
3508 	} else {
3509 		assoc_data->timeout =
3510 			round_jiffies_up(jiffies +
3511 					 IEEE80211_ASSOC_TIMEOUT_LONG);
3512 		assoc_data->timeout_started = true;
3513 		run_again(sdata, assoc_data->timeout);
3514 	}
3515 
3516 	return 0;
3517 }
3518 
3519 void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
3520 				  __le16 fc, bool acked)
3521 {
3522 	struct ieee80211_local *local = sdata->local;
3523 
3524 	sdata->u.mgd.status_fc = fc;
3525 	sdata->u.mgd.status_acked = acked;
3526 	sdata->u.mgd.status_received = true;
3527 
3528 	ieee80211_queue_work(&local->hw, &sdata->work);
3529 }
3530 
3531 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
3532 {
3533 	struct ieee80211_local *local = sdata->local;
3534 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3535 
3536 	sdata_lock(sdata);
3537 
3538 	if (ifmgd->status_received) {
3539 		__le16 fc = ifmgd->status_fc;
3540 		bool status_acked = ifmgd->status_acked;
3541 
3542 		ifmgd->status_received = false;
3543 		if (ifmgd->auth_data &&
3544 		    (ieee80211_is_probe_req(fc) || ieee80211_is_auth(fc))) {
3545 			if (status_acked) {
3546 				ifmgd->auth_data->timeout =
3547 					jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
3548 				run_again(sdata, ifmgd->auth_data->timeout);
3549 			} else {
3550 				ifmgd->auth_data->timeout = jiffies - 1;
3551 			}
3552 			ifmgd->auth_data->timeout_started = true;
3553 		} else if (ifmgd->assoc_data &&
3554 			   (ieee80211_is_assoc_req(fc) ||
3555 			    ieee80211_is_reassoc_req(fc))) {
3556 			if (status_acked) {
3557 				ifmgd->assoc_data->timeout =
3558 					jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
3559 				run_again(sdata, ifmgd->assoc_data->timeout);
3560 			} else {
3561 				ifmgd->assoc_data->timeout = jiffies - 1;
3562 			}
3563 			ifmgd->assoc_data->timeout_started = true;
3564 		}
3565 	}
3566 
3567 	if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
3568 	    time_after(jiffies, ifmgd->auth_data->timeout)) {
3569 		if (ifmgd->auth_data->done) {
3570 			/*
3571 			 * ok ... we waited for assoc but userspace didn't,
3572 			 * so let's just kill the auth data
3573 			 */
3574 			ieee80211_destroy_auth_data(sdata, false);
3575 		} else if (ieee80211_probe_auth(sdata)) {
3576 			u8 bssid[ETH_ALEN];
3577 
3578 			memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
3579 
3580 			ieee80211_destroy_auth_data(sdata, false);
3581 
3582 			cfg80211_auth_timeout(sdata->dev, bssid);
3583 		}
3584 	} else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
3585 		run_again(sdata, ifmgd->auth_data->timeout);
3586 
3587 	if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
3588 	    time_after(jiffies, ifmgd->assoc_data->timeout)) {
3589 		if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
3590 		    ieee80211_do_assoc(sdata)) {
3591 			struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
3592 
3593 			ieee80211_destroy_assoc_data(sdata, false);
3594 			cfg80211_assoc_timeout(sdata->dev, bss);
3595 		}
3596 	} else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
3597 		run_again(sdata, ifmgd->assoc_data->timeout);
3598 
3599 	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
3600 	    ifmgd->associated) {
3601 		u8 bssid[ETH_ALEN];
3602 		int max_tries;
3603 
3604 		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
3605 
3606 		if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
3607 			max_tries = max_nullfunc_tries;
3608 		else
3609 			max_tries = max_probe_tries;
3610 
3611 		/* ACK received for nullfunc probing frame */
3612 		if (!ifmgd->probe_send_count)
3613 			ieee80211_reset_ap_probe(sdata);
3614 		else if (ifmgd->nullfunc_failed) {
3615 			if (ifmgd->probe_send_count < max_tries) {
3616 				mlme_dbg(sdata,
3617 					 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
3618 					 bssid, ifmgd->probe_send_count,
3619 					 max_tries);
3620 				ieee80211_mgd_probe_ap_send(sdata);
3621 			} else {
3622 				mlme_dbg(sdata,
3623 					 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
3624 					 bssid);
3625 				ieee80211_sta_connection_lost(sdata, bssid,
3626 					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
3627 					false);
3628 			}
3629 		} else if (time_is_after_jiffies(ifmgd->probe_timeout))
3630 			run_again(sdata, ifmgd->probe_timeout);
3631 		else if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
3632 			mlme_dbg(sdata,
3633 				 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
3634 				 bssid, probe_wait_ms);
3635 			ieee80211_sta_connection_lost(sdata, bssid,
3636 				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
3637 		} else if (ifmgd->probe_send_count < max_tries) {
3638 			mlme_dbg(sdata,
3639 				 "No probe response from AP %pM after %dms, try %d/%i\n",
3640 				 bssid, probe_wait_ms,
3641 				 ifmgd->probe_send_count, max_tries);
3642 			ieee80211_mgd_probe_ap_send(sdata);
3643 		} else {
3644 			/*
3645 			 * We actually lost the connection ... or did we?
3646 			 * Let's make sure!
3647 			 */
3648 			wiphy_debug(local->hw.wiphy,
3649 				    "%s: No probe response from AP %pM"
3650 				    " after %dms, disconnecting.\n",
3651 				    sdata->name,
3652 				    bssid, probe_wait_ms);
3653 
3654 			ieee80211_sta_connection_lost(sdata, bssid,
3655 				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
3656 		}
3657 	}
3658 
3659 	sdata_unlock(sdata);
3660 }
3661 
3662 static void ieee80211_sta_bcn_mon_timer(unsigned long data)
3663 {
3664 	struct ieee80211_sub_if_data *sdata =
3665 		(struct ieee80211_sub_if_data *) data;
3666 	struct ieee80211_local *local = sdata->local;
3667 
3668 	if (local->quiescing)
3669 		return;
3670 
3671 	if (sdata->vif.csa_active)
3672 		return;
3673 
3674 	sdata->u.mgd.connection_loss = false;
3675 	ieee80211_queue_work(&sdata->local->hw,
3676 			     &sdata->u.mgd.beacon_connection_loss_work);
3677 }
3678 
3679 static void ieee80211_sta_conn_mon_timer(unsigned long data)
3680 {
3681 	struct ieee80211_sub_if_data *sdata =
3682 		(struct ieee80211_sub_if_data *) data;
3683 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3684 	struct ieee80211_local *local = sdata->local;
3685 
3686 	if (local->quiescing)
3687 		return;
3688 
3689 	if (sdata->vif.csa_active)
3690 		return;
3691 
3692 	ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
3693 }
3694 
3695 static void ieee80211_sta_monitor_work(struct work_struct *work)
3696 {
3697 	struct ieee80211_sub_if_data *sdata =
3698 		container_of(work, struct ieee80211_sub_if_data,
3699 			     u.mgd.monitor_work);
3700 
3701 	ieee80211_mgd_probe_ap(sdata, false);
3702 }
3703 
3704 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
3705 {
3706 	u32 flags;
3707 
3708 	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
3709 		__ieee80211_stop_poll(sdata);
3710 
3711 		/* let's probe the connection once */
3712 		flags = sdata->local->hw.flags;
3713 		if (!(flags & IEEE80211_HW_CONNECTION_MONITOR))
3714 			ieee80211_queue_work(&sdata->local->hw,
3715 					     &sdata->u.mgd.monitor_work);
3716 		/* and do all the other regular work too */
3717 		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3718 	}
3719 }
3720 
3721 #ifdef CONFIG_PM
3722 void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
3723 {
3724 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3725 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3726 
3727 	sdata_lock(sdata);
3728 
3729 	if (ifmgd->auth_data || ifmgd->assoc_data) {
3730 		const u8 *bssid = ifmgd->auth_data ?
3731 				ifmgd->auth_data->bss->bssid :
3732 				ifmgd->assoc_data->bss->bssid;
3733 
3734 		/*
3735 		 * If we are trying to authenticate / associate while suspending,
3736 		 * cfg80211 won't know and won't actually abort those attempts,
3737 		 * thus we need to do that ourselves.
3738 		 */
3739 		ieee80211_send_deauth_disassoc(sdata, bssid,
3740 					       IEEE80211_STYPE_DEAUTH,
3741 					       WLAN_REASON_DEAUTH_LEAVING,
3742 					       false, frame_buf);
3743 		if (ifmgd->assoc_data)
3744 			ieee80211_destroy_assoc_data(sdata, false);
3745 		if (ifmgd->auth_data)
3746 			ieee80211_destroy_auth_data(sdata, false);
3747 		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
3748 				      IEEE80211_DEAUTH_FRAME_LEN);
3749 	}
3750 
3751 	sdata_unlock(sdata);
3752 }
3753 
3754 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
3755 {
3756 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3757 
3758 	sdata_lock(sdata);
3759 	if (!ifmgd->associated) {
3760 		sdata_unlock(sdata);
3761 		return;
3762 	}
3763 
3764 	if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
3765 		sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
3766 		mlme_dbg(sdata, "driver requested disconnect after resume\n");
3767 		ieee80211_sta_connection_lost(sdata,
3768 					      ifmgd->associated->bssid,
3769 					      WLAN_REASON_UNSPECIFIED,
3770 					      true);
3771 		sdata_unlock(sdata);
3772 		return;
3773 	}
3774 	sdata_unlock(sdata);
3775 }
3776 #endif
3777 
3778 /* interface setup */
3779 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
3780 {
3781 	struct ieee80211_if_managed *ifmgd;
3782 
3783 	ifmgd = &sdata->u.mgd;
3784 	INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
3785 	INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
3786 	INIT_WORK(&ifmgd->beacon_connection_loss_work,
3787 		  ieee80211_beacon_connection_loss_work);
3788 	INIT_WORK(&ifmgd->csa_connection_drop_work,
3789 		  ieee80211_csa_connection_drop_work);
3790 	INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_mgd_work);
3791 	INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
3792 			  ieee80211_tdls_peer_del_work);
3793 	setup_timer(&ifmgd->timer, ieee80211_sta_timer,
3794 		    (unsigned long) sdata);
3795 	setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
3796 		    (unsigned long) sdata);
3797 	setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer,
3798 		    (unsigned long) sdata);
3799 	setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
3800 		    (unsigned long) sdata);
3801 
3802 	ifmgd->flags = 0;
3803 	ifmgd->powersave = sdata->wdev.ps;
3804 	ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
3805 	ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
3806 	ifmgd->p2p_noa_index = -1;
3807 
3808 	if (sdata->local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
3809 		ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
3810 	else
3811 		ifmgd->req_smps = IEEE80211_SMPS_OFF;
3812 }
3813 
3814 /* scan finished notification */
3815 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
3816 {
3817 	struct ieee80211_sub_if_data *sdata;
3818 
3819 	/* Restart STA timers */
3820 	rcu_read_lock();
3821 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3822 		if (ieee80211_sdata_running(sdata))
3823 			ieee80211_restart_sta_timer(sdata);
3824 	}
3825 	rcu_read_unlock();
3826 }
3827 
3828 int ieee80211_max_network_latency(struct notifier_block *nb,
3829 				  unsigned long data, void *dummy)
3830 {
3831 	s32 latency_usec = (s32) data;
3832 	struct ieee80211_local *local =
3833 		container_of(nb, struct ieee80211_local,
3834 			     network_latency_notifier);
3835 
3836 	mutex_lock(&local->iflist_mtx);
3837 	ieee80211_recalc_ps(local, latency_usec);
3838 	mutex_unlock(&local->iflist_mtx);
3839 
3840 	return NOTIFY_OK;
3841 }
3842 
3843 static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
3844 				     struct cfg80211_bss *cbss)
3845 {
3846 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3847 	const u8 *ht_cap_ie, *vht_cap_ie;
3848 	const struct ieee80211_ht_cap *ht_cap;
3849 	const struct ieee80211_vht_cap *vht_cap;
3850 	u8 chains = 1;
3851 
3852 	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
3853 		return chains;
3854 
3855 	ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
3856 	if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
3857 		ht_cap = (void *)(ht_cap_ie + 2);
3858 		chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
3859 		/*
3860 		 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
3861 		 *	 "Tx Unequal Modulation Supported" fields.
3862 		 */
3863 	}
3864 
3865 	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
3866 		return chains;
3867 
3868 	vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
3869 	if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
3870 		u8 nss;
3871 		u16 tx_mcs_map;
3872 
3873 		vht_cap = (void *)(vht_cap_ie + 2);
3874 		tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
3875 		for (nss = 8; nss > 0; nss--) {
3876 			if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
3877 					IEEE80211_VHT_MCS_NOT_SUPPORTED)
3878 				break;
3879 		}
3880 		/* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
3881 		chains = max(chains, nss);
3882 	}
3883 
3884 	return chains;
3885 }
3886 
3887 static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
3888 				  struct cfg80211_bss *cbss)
3889 {
3890 	struct ieee80211_local *local = sdata->local;
3891 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3892 	const struct ieee80211_ht_cap *ht_cap = NULL;
3893 	const struct ieee80211_ht_operation *ht_oper = NULL;
3894 	const struct ieee80211_vht_operation *vht_oper = NULL;
3895 	struct ieee80211_supported_band *sband;
3896 	struct cfg80211_chan_def chandef;
3897 	int ret;
3898 
3899 	sband = local->hw.wiphy->bands[cbss->channel->band];
3900 
3901 	ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
3902 			  IEEE80211_STA_DISABLE_80P80MHZ |
3903 			  IEEE80211_STA_DISABLE_160MHZ);
3904 
3905 	rcu_read_lock();
3906 
3907 	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3908 	    sband->ht_cap.ht_supported) {
3909 		const u8 *ht_oper_ie, *ht_cap_ie;
3910 
3911 		ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
3912 		if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
3913 			ht_oper = (void *)(ht_oper_ie + 2);
3914 
3915 		ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
3916 		if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap))
3917 			ht_cap = (void *)(ht_cap_ie + 2);
3918 
3919 		if (!ht_cap) {
3920 			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
3921 			ht_oper = NULL;
3922 		}
3923 	}
3924 
3925 	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3926 	    sband->vht_cap.vht_supported) {
3927 		const u8 *vht_oper_ie, *vht_cap;
3928 
3929 		vht_oper_ie = ieee80211_bss_get_ie(cbss,
3930 						   WLAN_EID_VHT_OPERATION);
3931 		if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
3932 			vht_oper = (void *)(vht_oper_ie + 2);
3933 		if (vht_oper && !ht_oper) {
3934 			vht_oper = NULL;
3935 			sdata_info(sdata,
3936 				   "AP advertised VHT without HT, disabling both\n");
3937 			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
3938 			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
3939 		}
3940 
3941 		vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
3942 		if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
3943 			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
3944 			vht_oper = NULL;
3945 		}
3946 	}
3947 
3948 	ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
3949 						     cbss->channel,
3950 						     ht_cap, ht_oper, vht_oper,
3951 						     &chandef, false);
3952 
3953 	sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
3954 				      local->rx_chains);
3955 
3956 	rcu_read_unlock();
3957 
3958 	/* will change later if needed */
3959 	sdata->smps_mode = IEEE80211_SMPS_OFF;
3960 
3961 	mutex_lock(&local->mtx);
3962 	/*
3963 	 * If this fails (possibly due to channel context sharing
3964 	 * on incompatible channels, e.g. 80+80 and 160 sharing the
3965 	 * same control channel) try to use a smaller bandwidth.
3966 	 */
3967 	ret = ieee80211_vif_use_channel(sdata, &chandef,
3968 					IEEE80211_CHANCTX_SHARED);
3969 
3970 	/* don't downgrade for 5 and 10 MHz channels, though. */
3971 	if (chandef.width == NL80211_CHAN_WIDTH_5 ||
3972 	    chandef.width == NL80211_CHAN_WIDTH_10)
3973 		goto out;
3974 
3975 	while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
3976 		ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
3977 		ret = ieee80211_vif_use_channel(sdata, &chandef,
3978 						IEEE80211_CHANCTX_SHARED);
3979 	}
3980  out:
3981 	mutex_unlock(&local->mtx);
3982 	return ret;
3983 }
3984 
3985 static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
3986 				     struct cfg80211_bss *cbss, bool assoc)
3987 {
3988 	struct ieee80211_local *local = sdata->local;
3989 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3990 	struct ieee80211_bss *bss = (void *)cbss->priv;
3991 	struct sta_info *new_sta = NULL;
3992 	bool have_sta = false;
3993 	int err;
3994 
3995 	if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
3996 		return -EINVAL;
3997 
3998 	if (assoc) {
3999 		rcu_read_lock();
4000 		have_sta = sta_info_get(sdata, cbss->bssid);
4001 		rcu_read_unlock();
4002 	}
4003 
4004 	if (!have_sta) {
4005 		new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
4006 		if (!new_sta)
4007 			return -ENOMEM;
4008 	}
4009 	if (new_sta) {
4010 		u32 rates = 0, basic_rates = 0;
4011 		bool have_higher_than_11mbit;
4012 		int min_rate = INT_MAX, min_rate_index = -1;
4013 		struct ieee80211_chanctx_conf *chanctx_conf;
4014 		struct ieee80211_supported_band *sband;
4015 		const struct cfg80211_bss_ies *ies;
4016 		int shift;
4017 		u32 rate_flags;
4018 
4019 		sband = local->hw.wiphy->bands[cbss->channel->band];
4020 
4021 		err = ieee80211_prep_channel(sdata, cbss);
4022 		if (err) {
4023 			sta_info_free(local, new_sta);
4024 			return -EINVAL;
4025 		}
4026 		shift = ieee80211_vif_get_shift(&sdata->vif);
4027 
4028 		rcu_read_lock();
4029 		chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4030 		if (WARN_ON(!chanctx_conf)) {
4031 			rcu_read_unlock();
4032 			sta_info_free(local, new_sta);
4033 			return -EINVAL;
4034 		}
4035 		rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
4036 		rcu_read_unlock();
4037 
4038 		ieee80211_get_rates(sband, bss->supp_rates,
4039 				    bss->supp_rates_len,
4040 				    &rates, &basic_rates,
4041 				    &have_higher_than_11mbit,
4042 				    &min_rate, &min_rate_index,
4043 				    shift, rate_flags);
4044 
4045 		/*
4046 		 * This used to be a workaround for basic rates missing
4047 		 * in the association response frame. Now that we no
4048 		 * longer use the basic rates from there, it probably
4049 		 * doesn't happen any more, but keep the workaround so
4050 		 * in case some *other* APs are buggy in different ways
4051 		 * we can connect -- with a warning.
4052 		 */
4053 		if (!basic_rates && min_rate_index >= 0) {
4054 			sdata_info(sdata,
4055 				   "No basic rates, using min rate instead\n");
4056 			basic_rates = BIT(min_rate_index);
4057 		}
4058 
4059 		new_sta->sta.supp_rates[cbss->channel->band] = rates;
4060 		sdata->vif.bss_conf.basic_rates = basic_rates;
4061 
4062 		/* cf. IEEE 802.11 9.2.12 */
4063 		if (cbss->channel->band == IEEE80211_BAND_2GHZ &&
4064 		    have_higher_than_11mbit)
4065 			sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
4066 		else
4067 			sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
4068 
4069 		memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);
4070 
4071 		/* set timing information */
4072 		sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
4073 		rcu_read_lock();
4074 		ies = rcu_dereference(cbss->beacon_ies);
4075 		if (ies) {
4076 			const u8 *tim_ie;
4077 
4078 			sdata->vif.bss_conf.sync_tsf = ies->tsf;
4079 			sdata->vif.bss_conf.sync_device_ts =
4080 				bss->device_ts_beacon;
4081 			tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
4082 						  ies->data, ies->len);
4083 			if (tim_ie && tim_ie[1] >= 2)
4084 				sdata->vif.bss_conf.sync_dtim_count = tim_ie[2];
4085 			else
4086 				sdata->vif.bss_conf.sync_dtim_count = 0;
4087 		} else if (!(local->hw.flags &
4088 					IEEE80211_HW_TIMING_BEACON_ONLY)) {
4089 			ies = rcu_dereference(cbss->proberesp_ies);
4090 			/* must be non-NULL since beacon IEs were NULL */
4091 			sdata->vif.bss_conf.sync_tsf = ies->tsf;
4092 			sdata->vif.bss_conf.sync_device_ts =
4093 				bss->device_ts_presp;
4094 			sdata->vif.bss_conf.sync_dtim_count = 0;
4095 		} else {
4096 			sdata->vif.bss_conf.sync_tsf = 0;
4097 			sdata->vif.bss_conf.sync_device_ts = 0;
4098 			sdata->vif.bss_conf.sync_dtim_count = 0;
4099 		}
4100 		rcu_read_unlock();
4101 
4102 		/* tell driver about BSSID, basic rates and timing */
4103 		ieee80211_bss_info_change_notify(sdata,
4104 			BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
4105 			BSS_CHANGED_BEACON_INT);
4106 
4107 		if (assoc)
4108 			sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
4109 
4110 		err = sta_info_insert(new_sta);
4111 		new_sta = NULL;
4112 		if (err) {
4113 			sdata_info(sdata,
4114 				   "failed to insert STA entry for the AP (error %d)\n",
4115 				   err);
4116 			return err;
4117 		}
4118 	} else
4119 		WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
4120 
4121 	return 0;
4122 }
4123 
4124 /* config hooks */
4125 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
4126 		       struct cfg80211_auth_request *req)
4127 {
4128 	struct ieee80211_local *local = sdata->local;
4129 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4130 	struct ieee80211_mgd_auth_data *auth_data;
4131 	u16 auth_alg;
4132 	int err;
4133 
4134 	/* prepare auth data structure */
4135 
4136 	switch (req->auth_type) {
4137 	case NL80211_AUTHTYPE_OPEN_SYSTEM:
4138 		auth_alg = WLAN_AUTH_OPEN;
4139 		break;
4140 	case NL80211_AUTHTYPE_SHARED_KEY:
4141 		if (IS_ERR(local->wep_tx_tfm))
4142 			return -EOPNOTSUPP;
4143 		auth_alg = WLAN_AUTH_SHARED_KEY;
4144 		break;
4145 	case NL80211_AUTHTYPE_FT:
4146 		auth_alg = WLAN_AUTH_FT;
4147 		break;
4148 	case NL80211_AUTHTYPE_NETWORK_EAP:
4149 		auth_alg = WLAN_AUTH_LEAP;
4150 		break;
4151 	case NL80211_AUTHTYPE_SAE:
4152 		auth_alg = WLAN_AUTH_SAE;
4153 		break;
4154 	default:
4155 		return -EOPNOTSUPP;
4156 	}
4157 
4158 	auth_data = kzalloc(sizeof(*auth_data) + req->sae_data_len +
4159 			    req->ie_len, GFP_KERNEL);
4160 	if (!auth_data)
4161 		return -ENOMEM;
4162 
4163 	auth_data->bss = req->bss;
4164 
4165 	if (req->sae_data_len >= 4) {
4166 		__le16 *pos = (__le16 *) req->sae_data;
4167 		auth_data->sae_trans = le16_to_cpu(pos[0]);
4168 		auth_data->sae_status = le16_to_cpu(pos[1]);
4169 		memcpy(auth_data->data, req->sae_data + 4,
4170 		       req->sae_data_len - 4);
4171 		auth_data->data_len += req->sae_data_len - 4;
4172 	}
4173 
4174 	if (req->ie && req->ie_len) {
4175 		memcpy(&auth_data->data[auth_data->data_len],
4176 		       req->ie, req->ie_len);
4177 		auth_data->data_len += req->ie_len;
4178 	}
4179 
4180 	if (req->key && req->key_len) {
4181 		auth_data->key_len = req->key_len;
4182 		auth_data->key_idx = req->key_idx;
4183 		memcpy(auth_data->key, req->key, req->key_len);
4184 	}
4185 
4186 	auth_data->algorithm = auth_alg;
4187 
4188 	/* try to authenticate/probe */
4189 
4190 	if ((ifmgd->auth_data && !ifmgd->auth_data->done) ||
4191 	    ifmgd->assoc_data) {
4192 		err = -EBUSY;
4193 		goto err_free;
4194 	}
4195 
4196 	if (ifmgd->auth_data)
4197 		ieee80211_destroy_auth_data(sdata, false);
4198 
4199 	/* prep auth_data so we don't go into idle on disassoc */
4200 	ifmgd->auth_data = auth_data;
4201 
4202 	if (ifmgd->associated) {
4203 		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4204 
4205 		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4206 				       WLAN_REASON_UNSPECIFIED,
4207 				       false, frame_buf);
4208 
4209 		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4210 				      sizeof(frame_buf));
4211 	}
4212 
4213 	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
4214 
4215 	err = ieee80211_prep_connection(sdata, req->bss, false);
4216 	if (err)
4217 		goto err_clear;
4218 
4219 	err = ieee80211_probe_auth(sdata);
4220 	if (err) {
4221 		sta_info_destroy_addr(sdata, req->bss->bssid);
4222 		goto err_clear;
4223 	}
4224 
4225 	/* hold our own reference */
4226 	cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
4227 	return 0;
4228 
4229  err_clear:
4230 	memset(ifmgd->bssid, 0, ETH_ALEN);
4231 	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
4232 	ifmgd->auth_data = NULL;
4233  err_free:
4234 	kfree(auth_data);
4235 	return err;
4236 }
4237 
4238 static bool ieee80211_usable_wmm_params(struct ieee80211_sub_if_data *sdata,
4239 					const u8 *wmm_param, int len)
4240 {
4241 	const u8 *pos;
4242 	size_t left;
4243 
4244 	if (len < 8)
4245 		return false;
4246 
4247 	if (wmm_param[5] != 1 /* version */)
4248 		return false;
4249 
4250 	pos = wmm_param + 8;
4251 	left = len - 8;
4252 
4253 	for (; left >= 4; left -= 4, pos += 4) {
4254 		u8 aifsn = pos[0] & 0x0f;
4255 		u8 ecwmin = pos[1] & 0x0f;
4256 		u8 ecwmax = (pos[1] & 0xf0) >> 4;
4257 		int aci = (pos[0] >> 5) & 0x03;
4258 
4259 		if (aifsn < 2) {
4260 			sdata_info(sdata,
4261 				   "AP has invalid WMM params (AIFSN=%d for ACI %d), disabling WMM\n",
4262 				   aifsn, aci);
4263 			return false;
4264 		}
4265 		if (ecwmin > ecwmax) {
4266 			sdata_info(sdata,
4267 				   "AP has invalid WMM params (ECWmin/max=%d/%d for ACI %d), disabling WMM\n",
4268 				   ecwmin, ecwmax, aci);
4269 			return false;
4270 		}
4271 	}
4272 
4273 	return true;
4274 }
4275 
4276 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
4277 			struct cfg80211_assoc_request *req)
4278 {
4279 	struct ieee80211_local *local = sdata->local;
4280 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4281 	struct ieee80211_bss *bss = (void *)req->bss->priv;
4282 	struct ieee80211_mgd_assoc_data *assoc_data;
4283 	const struct cfg80211_bss_ies *beacon_ies;
4284 	struct ieee80211_supported_band *sband;
4285 	const u8 *ssidie, *ht_ie, *vht_ie;
4286 	int i, err;
4287 
4288 	assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
4289 	if (!assoc_data)
4290 		return -ENOMEM;
4291 
4292 	rcu_read_lock();
4293 	ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
4294 	if (!ssidie) {
4295 		rcu_read_unlock();
4296 		kfree(assoc_data);
4297 		return -EINVAL;
4298 	}
4299 	memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
4300 	assoc_data->ssid_len = ssidie[1];
4301 	rcu_read_unlock();
4302 
4303 	if (ifmgd->associated) {
4304 		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4305 
4306 		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4307 				       WLAN_REASON_UNSPECIFIED,
4308 				       false, frame_buf);
4309 
4310 		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4311 				      sizeof(frame_buf));
4312 	}
4313 
4314 	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
4315 		err = -EBUSY;
4316 		goto err_free;
4317 	}
4318 
4319 	if (ifmgd->assoc_data) {
4320 		err = -EBUSY;
4321 		goto err_free;
4322 	}
4323 
4324 	if (ifmgd->auth_data) {
4325 		bool match;
4326 
4327 		/* keep sta info, bssid if matching */
4328 		match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
4329 		ieee80211_destroy_auth_data(sdata, match);
4330 	}
4331 
4332 	/* prepare assoc data */
4333 
4334 	ifmgd->beacon_crc_valid = false;
4335 
4336 	assoc_data->wmm = bss->wmm_used &&
4337 			  (local->hw.queues >= IEEE80211_NUM_ACS);
4338 	if (assoc_data->wmm) {
4339 		/* try to check validity of WMM params IE */
4340 		const struct cfg80211_bss_ies *ies;
4341 		const u8 *wp, *start, *end;
4342 
4343 		rcu_read_lock();
4344 		ies = rcu_dereference(req->bss->ies);
4345 		start = ies->data;
4346 		end = start + ies->len;
4347 
4348 		while (true) {
4349 			wp = cfg80211_find_vendor_ie(
4350 				WLAN_OUI_MICROSOFT,
4351 				WLAN_OUI_TYPE_MICROSOFT_WMM,
4352 				start, end - start);
4353 			if (!wp)
4354 				break;
4355 			start = wp + wp[1] + 2;
4356 			/* if this IE is too short, try the next */
4357 			if (wp[1] <= 4)
4358 				continue;
4359 			/* if this IE is WMM params, we found what we wanted */
4360 			if (wp[6] == 1)
4361 				break;
4362 		}
4363 
4364 		if (!wp || !ieee80211_usable_wmm_params(sdata, wp + 2,
4365 							wp[1] - 2)) {
4366 			assoc_data->wmm = false;
4367 			ifmgd->flags |= IEEE80211_STA_DISABLE_WMM;
4368 		}
4369 		rcu_read_unlock();
4370 	}
4371 
4372 	/*
4373 	 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
4374 	 * We still associate in non-HT mode (11a/b/g) if any one of these
4375 	 * ciphers is configured as pairwise.
4376 	 * We can set this to true for non-11n hardware, that'll be checked
4377 	 * separately along with the peer capabilities.
4378 	 */
4379 	for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
4380 		if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
4381 		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
4382 		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
4383 			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4384 			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4385 			netdev_info(sdata->dev,
4386 				    "disabling HT/VHT due to WEP/TKIP use\n");
4387 		}
4388 	}
4389 
4390 	if (req->flags & ASSOC_REQ_DISABLE_HT) {
4391 		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4392 		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4393 	}
4394 
4395 	if (req->flags & ASSOC_REQ_DISABLE_VHT)
4396 		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4397 
4398 	/* Also disable HT if we don't support it or the AP doesn't use WMM */
4399 	sband = local->hw.wiphy->bands[req->bss->channel->band];
4400 	if (!sband->ht_cap.ht_supported ||
4401 	    local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
4402 	    ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4403 		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4404 		if (!bss->wmm_used &&
4405 		    !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4406 			netdev_info(sdata->dev,
4407 				    "disabling HT as WMM/QoS is not supported by the AP\n");
4408 	}
4409 
4410 	/* disable VHT if we don't support it or the AP doesn't use WMM */
4411 	if (!sband->vht_cap.vht_supported ||
4412 	    local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
4413 	    ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4414 		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4415 		if (!bss->wmm_used &&
4416 		    !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4417 			netdev_info(sdata->dev,
4418 				    "disabling VHT as WMM/QoS is not supported by the AP\n");
4419 	}
4420 
4421 	memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
4422 	memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
4423 	       sizeof(ifmgd->ht_capa_mask));
4424 
4425 	memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
4426 	memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
4427 	       sizeof(ifmgd->vht_capa_mask));
4428 
4429 	if (req->ie && req->ie_len) {
4430 		memcpy(assoc_data->ie, req->ie, req->ie_len);
4431 		assoc_data->ie_len = req->ie_len;
4432 	}
4433 
4434 	assoc_data->bss = req->bss;
4435 
4436 	if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
4437 		if (ifmgd->powersave)
4438 			sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
4439 		else
4440 			sdata->smps_mode = IEEE80211_SMPS_OFF;
4441 	} else
4442 		sdata->smps_mode = ifmgd->req_smps;
4443 
4444 	assoc_data->capability = req->bss->capability;
4445 	assoc_data->supp_rates = bss->supp_rates;
4446 	assoc_data->supp_rates_len = bss->supp_rates_len;
4447 
4448 	rcu_read_lock();
4449 	ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
4450 	if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
4451 		assoc_data->ap_ht_param =
4452 			((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
4453 	else
4454 		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4455 	vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
4456 	if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
4457 		memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
4458 		       sizeof(struct ieee80211_vht_cap));
4459 	else
4460 		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4461 	rcu_read_unlock();
4462 
4463 	if (bss->wmm_used && bss->uapsd_supported &&
4464 	    (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
4465 		assoc_data->uapsd = true;
4466 		ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
4467 	} else {
4468 		assoc_data->uapsd = false;
4469 		ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
4470 	}
4471 
4472 	if (req->prev_bssid)
4473 		memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
4474 
4475 	if (req->use_mfp) {
4476 		ifmgd->mfp = IEEE80211_MFP_REQUIRED;
4477 		ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
4478 	} else {
4479 		ifmgd->mfp = IEEE80211_MFP_DISABLED;
4480 		ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
4481 	}
4482 
4483 	if (req->flags & ASSOC_REQ_USE_RRM)
4484 		ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
4485 	else
4486 		ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;
4487 
4488 	if (req->crypto.control_port)
4489 		ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
4490 	else
4491 		ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
4492 
4493 	sdata->control_port_protocol = req->crypto.control_port_ethertype;
4494 	sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
4495 	sdata->encrypt_headroom = ieee80211_cs_headroom(local, &req->crypto,
4496 							sdata->vif.type);
4497 
4498 	/* kick off associate process */
4499 
4500 	ifmgd->assoc_data = assoc_data;
4501 	ifmgd->dtim_period = 0;
4502 	ifmgd->have_beacon = false;
4503 
4504 	err = ieee80211_prep_connection(sdata, req->bss, true);
4505 	if (err)
4506 		goto err_clear;
4507 
4508 	rcu_read_lock();
4509 	beacon_ies = rcu_dereference(req->bss->beacon_ies);
4510 
4511 	if (sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC &&
4512 	    !beacon_ies) {
4513 		/*
4514 		 * Wait up to one beacon interval ...
4515 		 * should this be more if we miss one?
4516 		 */
4517 		sdata_info(sdata, "waiting for beacon from %pM\n",
4518 			   ifmgd->bssid);
4519 		assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
4520 		assoc_data->timeout_started = true;
4521 		assoc_data->need_beacon = true;
4522 	} else if (beacon_ies) {
4523 		const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
4524 						    beacon_ies->data,
4525 						    beacon_ies->len);
4526 		u8 dtim_count = 0;
4527 
4528 		if (tim_ie && tim_ie[1] >= sizeof(struct ieee80211_tim_ie)) {
4529 			const struct ieee80211_tim_ie *tim;
4530 			tim = (void *)(tim_ie + 2);
4531 			ifmgd->dtim_period = tim->dtim_period;
4532 			dtim_count = tim->dtim_count;
4533 		}
4534 		ifmgd->have_beacon = true;
4535 		assoc_data->timeout = jiffies;
4536 		assoc_data->timeout_started = true;
4537 
4538 		if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
4539 			sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
4540 			sdata->vif.bss_conf.sync_device_ts =
4541 				bss->device_ts_beacon;
4542 			sdata->vif.bss_conf.sync_dtim_count = dtim_count;
4543 		}
4544 	} else {
4545 		assoc_data->timeout = jiffies;
4546 		assoc_data->timeout_started = true;
4547 	}
4548 	rcu_read_unlock();
4549 
4550 	run_again(sdata, assoc_data->timeout);
4551 
4552 	if (bss->corrupt_data) {
4553 		char *corrupt_type = "data";
4554 		if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
4555 			if (bss->corrupt_data &
4556 					IEEE80211_BSS_CORRUPT_PROBE_RESP)
4557 				corrupt_type = "beacon and probe response";
4558 			else
4559 				corrupt_type = "beacon";
4560 		} else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
4561 			corrupt_type = "probe response";
4562 		sdata_info(sdata, "associating with AP with corrupt %s\n",
4563 			   corrupt_type);
4564 	}
4565 
4566 	return 0;
4567  err_clear:
4568 	memset(ifmgd->bssid, 0, ETH_ALEN);
4569 	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
4570 	ifmgd->assoc_data = NULL;
4571  err_free:
4572 	kfree(assoc_data);
4573 	return err;
4574 }
4575 
4576 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
4577 			 struct cfg80211_deauth_request *req)
4578 {
4579 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4580 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4581 	bool tx = !req->local_state_change;
4582 
4583 	if (ifmgd->auth_data &&
4584 	    ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
4585 		sdata_info(sdata,
4586 			   "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
4587 			   req->bssid, req->reason_code,
4588 			   ieee80211_get_reason_code_string(req->reason_code));
4589 
4590 		drv_mgd_prepare_tx(sdata->local, sdata);
4591 		ieee80211_send_deauth_disassoc(sdata, req->bssid,
4592 					       IEEE80211_STYPE_DEAUTH,
4593 					       req->reason_code, tx,
4594 					       frame_buf);
4595 		ieee80211_destroy_auth_data(sdata, false);
4596 		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4597 				      IEEE80211_DEAUTH_FRAME_LEN);
4598 
4599 		return 0;
4600 	}
4601 
4602 	if (ifmgd->associated &&
4603 	    ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
4604 		sdata_info(sdata,
4605 			   "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
4606 			   req->bssid, req->reason_code,
4607 			   ieee80211_get_reason_code_string(req->reason_code));
4608 
4609 		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4610 				       req->reason_code, tx, frame_buf);
4611 		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4612 				      IEEE80211_DEAUTH_FRAME_LEN);
4613 		return 0;
4614 	}
4615 
4616 	return -ENOTCONN;
4617 }
4618 
4619 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
4620 			   struct cfg80211_disassoc_request *req)
4621 {
4622 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4623 	u8 bssid[ETH_ALEN];
4624 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4625 
4626 	/*
4627 	 * cfg80211 should catch this ... but it's racy since
4628 	 * we can receive a disassoc frame, process it, hand it
4629 	 * to cfg80211 while that's in a locked section already
4630 	 * trying to tell us that the user wants to disconnect.
4631 	 */
4632 	if (ifmgd->associated != req->bss)
4633 		return -ENOLINK;
4634 
4635 	sdata_info(sdata,
4636 		   "disassociating from %pM by local choice (Reason: %u=%s)\n",
4637 		   req->bss->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
4638 
4639 	memcpy(bssid, req->bss->bssid, ETH_ALEN);
4640 	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
4641 			       req->reason_code, !req->local_state_change,
4642 			       frame_buf);
4643 
4644 	cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
4645 			      IEEE80211_DEAUTH_FRAME_LEN);
4646 
4647 	return 0;
4648 }
4649 
4650 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
4651 {
4652 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4653 
4654 	/*
4655 	 * Make sure some work items will not run after this,
4656 	 * they will not do anything but might not have been
4657 	 * cancelled when disconnecting.
4658 	 */
4659 	cancel_work_sync(&ifmgd->monitor_work);
4660 	cancel_work_sync(&ifmgd->beacon_connection_loss_work);
4661 	cancel_work_sync(&ifmgd->request_smps_work);
4662 	cancel_work_sync(&ifmgd->csa_connection_drop_work);
4663 	cancel_work_sync(&ifmgd->chswitch_work);
4664 	cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
4665 
4666 	sdata_lock(sdata);
4667 	if (ifmgd->assoc_data) {
4668 		struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
4669 		ieee80211_destroy_assoc_data(sdata, false);
4670 		cfg80211_assoc_timeout(sdata->dev, bss);
4671 	}
4672 	if (ifmgd->auth_data)
4673 		ieee80211_destroy_auth_data(sdata, false);
4674 	del_timer_sync(&ifmgd->timer);
4675 	sdata_unlock(sdata);
4676 }
4677 
4678 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
4679 			       enum nl80211_cqm_rssi_threshold_event rssi_event,
4680 			       gfp_t gfp)
4681 {
4682 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
4683 
4684 	trace_api_cqm_rssi_notify(sdata, rssi_event);
4685 
4686 	cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, gfp);
4687 }
4688 EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
4689