1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * BSS client mode implementation
4  * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
5  * Copyright 2004, Instant802 Networks, Inc.
6  * Copyright 2005, Devicescape Software, Inc.
7  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
8  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
9  * Copyright 2013-2014  Intel Mobile Communications GmbH
10  * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
11  * Copyright (C) 2018 - 2023 Intel Corporation
12  */
13 
14 #include <linux/delay.h>
15 #include <linux/fips.h>
16 #include <linux/if_ether.h>
17 #include <linux/skbuff.h>
18 #include <linux/if_arp.h>
19 #include <linux/etherdevice.h>
20 #include <linux/moduleparam.h>
21 #include <linux/rtnetlink.h>
22 #include <linux/crc32.h>
23 #include <linux/slab.h>
24 #include <linux/export.h>
25 #include <net/mac80211.h>
26 #include <asm/unaligned.h>
27 
28 #include "ieee80211_i.h"
29 #include "driver-ops.h"
30 #include "rate.h"
31 #include "led.h"
32 #include "fils_aead.h"
33 
34 #define IEEE80211_AUTH_TIMEOUT		(HZ / 5)
35 #define IEEE80211_AUTH_TIMEOUT_LONG	(HZ / 2)
36 #define IEEE80211_AUTH_TIMEOUT_SHORT	(HZ / 10)
37 #define IEEE80211_AUTH_TIMEOUT_SAE	(HZ * 2)
38 #define IEEE80211_AUTH_MAX_TRIES	3
39 #define IEEE80211_AUTH_WAIT_ASSOC	(HZ * 5)
40 #define IEEE80211_AUTH_WAIT_SAE_RETRY	(HZ * 2)
41 #define IEEE80211_ASSOC_TIMEOUT		(HZ / 5)
42 #define IEEE80211_ASSOC_TIMEOUT_LONG	(HZ / 2)
43 #define IEEE80211_ASSOC_TIMEOUT_SHORT	(HZ / 10)
44 #define IEEE80211_ASSOC_MAX_TRIES	3
45 
46 static int max_nullfunc_tries = 2;
47 module_param(max_nullfunc_tries, int, 0644);
48 MODULE_PARM_DESC(max_nullfunc_tries,
49 		 "Maximum nullfunc tx tries before disconnecting (reason 4).");
50 
51 static int max_probe_tries = 5;
52 module_param(max_probe_tries, int, 0644);
53 MODULE_PARM_DESC(max_probe_tries,
54 		 "Maximum probe tries before disconnecting (reason 4).");
55 
56 /*
57  * Beacon loss timeout is calculated as N frames times the
58  * advertised beacon interval.  This may need to be somewhat
59  * higher than what hardware might detect to account for
60  * delays in the host processing frames. But since we also
61  * probe on beacon miss before declaring the connection lost
62  * default to what we want.
63  */
64 static int beacon_loss_count = 7;
65 module_param(beacon_loss_count, int, 0644);
66 MODULE_PARM_DESC(beacon_loss_count,
67 		 "Number of beacon intervals before we decide beacon was lost.");
68 
69 /*
70  * Time the connection can be idle before we probe
71  * it to see if we can still talk to the AP.
72  */
73 #define IEEE80211_CONNECTION_IDLE_TIME	(30 * HZ)
74 /*
75  * Time we wait for a probe response after sending
76  * a probe request because of beacon loss or for
77  * checking the connection still works.
78  */
79 static int probe_wait_ms = 500;
80 module_param(probe_wait_ms, int, 0644);
81 MODULE_PARM_DESC(probe_wait_ms,
82 		 "Maximum time(ms) to wait for probe response"
83 		 " before disconnecting (reason 4).");
84 
85 /*
86  * How many Beacon frames need to have been used in average signal strength
87  * before starting to indicate signal change events.
88  */
89 #define IEEE80211_SIGNAL_AVE_MIN_COUNT	4
90 
91 /*
92  * Extract from the given disabled subchannel bitmap (raw format
93  * from the EHT Operation Element) the bits for the subchannel
94  * we're using right now.
95  */
96 static u16
ieee80211_extract_dis_subch_bmap(const struct ieee80211_eht_operation * eht_oper,struct cfg80211_chan_def * chandef,u16 bitmap)97 ieee80211_extract_dis_subch_bmap(const struct ieee80211_eht_operation *eht_oper,
98 				 struct cfg80211_chan_def *chandef, u16 bitmap)
99 {
100 	struct ieee80211_eht_operation_info *info = (void *)eht_oper->optional;
101 	struct cfg80211_chan_def ap_chandef = *chandef;
102 	u32 ap_center_freq, local_center_freq;
103 	u32 ap_bw, local_bw;
104 	int ap_start_freq, local_start_freq;
105 	u16 shift, mask;
106 
107 	if (!(eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) ||
108 	    !(eht_oper->params &
109 	      IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT))
110 		return 0;
111 
112 	/* set 160/320 supported to get the full AP definition */
113 	ieee80211_chandef_eht_oper(eht_oper, true, true, &ap_chandef);
114 	ap_center_freq = ap_chandef.center_freq1;
115 	ap_bw = 20 * BIT(u8_get_bits(info->control,
116 				     IEEE80211_EHT_OPER_CHAN_WIDTH));
117 	ap_start_freq = ap_center_freq - ap_bw / 2;
118 	local_center_freq = chandef->center_freq1;
119 	local_bw = 20 * BIT(ieee80211_chan_width_to_rx_bw(chandef->width));
120 	local_start_freq = local_center_freq - local_bw / 2;
121 	shift = (local_start_freq - ap_start_freq) / 20;
122 	mask = BIT(local_bw / 20) - 1;
123 
124 	return (bitmap >> shift) & mask;
125 }
126 
127 /*
128  * Handle the puncturing bitmap, possibly downgrading bandwidth to get a
129  * valid bitmap.
130  */
131 static void
ieee80211_handle_puncturing_bitmap(struct ieee80211_link_data * link,const struct ieee80211_eht_operation * eht_oper,u16 bitmap,u64 * changed)132 ieee80211_handle_puncturing_bitmap(struct ieee80211_link_data *link,
133 				   const struct ieee80211_eht_operation *eht_oper,
134 				   u16 bitmap, u64 *changed)
135 {
136 	struct cfg80211_chan_def *chandef = &link->conf->chandef;
137 	u16 extracted;
138 	u64 _changed = 0;
139 
140 	if (!changed)
141 		changed = &_changed;
142 
143 	while (chandef->width > NL80211_CHAN_WIDTH_40) {
144 		extracted =
145 			ieee80211_extract_dis_subch_bmap(eht_oper, chandef,
146 							 bitmap);
147 
148 		if (cfg80211_valid_disable_subchannel_bitmap(&bitmap,
149 							     chandef))
150 			break;
151 		link->u.mgd.conn_flags |=
152 			ieee80211_chandef_downgrade(chandef);
153 		*changed |= BSS_CHANGED_BANDWIDTH;
154 	}
155 
156 	if (chandef->width <= NL80211_CHAN_WIDTH_40)
157 		extracted = 0;
158 
159 	if (link->conf->eht_puncturing != extracted) {
160 		link->conf->eht_puncturing = extracted;
161 		*changed |= BSS_CHANGED_EHT_PUNCTURING;
162 	}
163 }
164 
165 /*
166  * We can have multiple work items (and connection probing)
167  * scheduling this timer, but we need to take care to only
168  * reschedule it when it should fire _earlier_ than it was
169  * asked for before, or if it's not pending right now. This
170  * function ensures that. Note that it then is required to
171  * run this function for all timeouts after the first one
172  * has happened -- the work that runs from this timer will
173  * do that.
174  */
run_again(struct ieee80211_sub_if_data * sdata,unsigned long timeout)175 static void run_again(struct ieee80211_sub_if_data *sdata,
176 		      unsigned long timeout)
177 {
178 	sdata_assert_lock(sdata);
179 
180 	if (!timer_pending(&sdata->u.mgd.timer) ||
181 	    time_before(timeout, sdata->u.mgd.timer.expires))
182 		mod_timer(&sdata->u.mgd.timer, timeout);
183 }
184 
ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data * sdata)185 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
186 {
187 	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
188 		return;
189 
190 	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
191 		return;
192 
193 	mod_timer(&sdata->u.mgd.bcn_mon_timer,
194 		  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
195 }
196 
ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data * sdata)197 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
198 {
199 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
200 
201 	if (unlikely(!ifmgd->associated))
202 		return;
203 
204 	if (ifmgd->probe_send_count)
205 		ifmgd->probe_send_count = 0;
206 
207 	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
208 		return;
209 
210 	mod_timer(&ifmgd->conn_mon_timer,
211 		  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
212 }
213 
ecw2cw(int ecw)214 static int ecw2cw(int ecw)
215 {
216 	return (1 << ecw) - 1;
217 }
218 
219 static ieee80211_conn_flags_t
ieee80211_determine_chantype(struct ieee80211_sub_if_data * sdata,struct ieee80211_link_data * link,ieee80211_conn_flags_t conn_flags,struct ieee80211_supported_band * sband,struct ieee80211_channel * channel,u32 vht_cap_info,const struct ieee80211_ht_operation * ht_oper,const struct ieee80211_vht_operation * vht_oper,const struct ieee80211_he_operation * he_oper,const struct ieee80211_eht_operation * eht_oper,const struct ieee80211_s1g_oper_ie * s1g_oper,struct cfg80211_chan_def * chandef,bool tracking)220 ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
221 			     struct ieee80211_link_data *link,
222 			     ieee80211_conn_flags_t conn_flags,
223 			     struct ieee80211_supported_band *sband,
224 			     struct ieee80211_channel *channel,
225 			     u32 vht_cap_info,
226 			     const struct ieee80211_ht_operation *ht_oper,
227 			     const struct ieee80211_vht_operation *vht_oper,
228 			     const struct ieee80211_he_operation *he_oper,
229 			     const struct ieee80211_eht_operation *eht_oper,
230 			     const struct ieee80211_s1g_oper_ie *s1g_oper,
231 			     struct cfg80211_chan_def *chandef, bool tracking)
232 {
233 	struct cfg80211_chan_def vht_chandef;
234 	struct ieee80211_sta_ht_cap sta_ht_cap;
235 	ieee80211_conn_flags_t ret;
236 	u32 ht_cfreq;
237 
238 	memset(chandef, 0, sizeof(struct cfg80211_chan_def));
239 	chandef->chan = channel;
240 	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
241 	chandef->center_freq1 = channel->center_freq;
242 	chandef->freq1_offset = channel->freq_offset;
243 
244 	if (channel->band == NL80211_BAND_6GHZ) {
245 		if (!ieee80211_chandef_he_6ghz_oper(sdata, he_oper, eht_oper,
246 						    chandef)) {
247 			mlme_dbg(sdata,
248 				 "bad 6 GHz operation, disabling HT/VHT/HE/EHT\n");
249 			ret = IEEE80211_CONN_DISABLE_HT |
250 			      IEEE80211_CONN_DISABLE_VHT |
251 			      IEEE80211_CONN_DISABLE_HE |
252 			      IEEE80211_CONN_DISABLE_EHT;
253 		} else {
254 			ret = 0;
255 		}
256 		vht_chandef = *chandef;
257 		goto out;
258 	} else if (sband->band == NL80211_BAND_S1GHZ) {
259 		if (!ieee80211_chandef_s1g_oper(s1g_oper, chandef)) {
260 			sdata_info(sdata,
261 				   "Missing S1G Operation Element? Trying operating == primary\n");
262 			chandef->width = ieee80211_s1g_channel_width(channel);
263 		}
264 
265 		ret = IEEE80211_CONN_DISABLE_HT | IEEE80211_CONN_DISABLE_40MHZ |
266 		      IEEE80211_CONN_DISABLE_VHT |
267 		      IEEE80211_CONN_DISABLE_80P80MHZ |
268 		      IEEE80211_CONN_DISABLE_160MHZ;
269 		goto out;
270 	}
271 
272 	memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
273 	ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
274 
275 	if (!ht_oper || !sta_ht_cap.ht_supported) {
276 		mlme_dbg(sdata, "HT operation missing / HT not supported\n");
277 		ret = IEEE80211_CONN_DISABLE_HT |
278 		      IEEE80211_CONN_DISABLE_VHT |
279 		      IEEE80211_CONN_DISABLE_HE |
280 		      IEEE80211_CONN_DISABLE_EHT;
281 		goto out;
282 	}
283 
284 	chandef->width = NL80211_CHAN_WIDTH_20;
285 
286 	ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
287 						  channel->band);
288 	/* check that channel matches the right operating channel */
289 	if (!tracking && channel->center_freq != ht_cfreq) {
290 		/*
291 		 * It's possible that some APs are confused here;
292 		 * Netgear WNDR3700 sometimes reports 4 higher than
293 		 * the actual channel in association responses, but
294 		 * since we look at probe response/beacon data here
295 		 * it should be OK.
296 		 */
297 		sdata_info(sdata,
298 			   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
299 			   channel->center_freq, ht_cfreq,
300 			   ht_oper->primary_chan, channel->band);
301 		ret = IEEE80211_CONN_DISABLE_HT |
302 		      IEEE80211_CONN_DISABLE_VHT |
303 		      IEEE80211_CONN_DISABLE_HE |
304 		      IEEE80211_CONN_DISABLE_EHT;
305 		goto out;
306 	}
307 
308 	/* check 40 MHz support, if we have it */
309 	if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
310 		ieee80211_chandef_ht_oper(ht_oper, chandef);
311 	} else {
312 		mlme_dbg(sdata, "40 MHz not supported\n");
313 		/* 40 MHz (and 80 MHz) must be supported for VHT */
314 		ret = IEEE80211_CONN_DISABLE_VHT;
315 		/* also mark 40 MHz disabled */
316 		ret |= IEEE80211_CONN_DISABLE_40MHZ;
317 		goto out;
318 	}
319 
320 	if (!vht_oper || !sband->vht_cap.vht_supported) {
321 		mlme_dbg(sdata, "VHT operation missing / VHT not supported\n");
322 		ret = IEEE80211_CONN_DISABLE_VHT;
323 		goto out;
324 	}
325 
326 	vht_chandef = *chandef;
327 	if (!(conn_flags & IEEE80211_CONN_DISABLE_HE) &&
328 	    he_oper &&
329 	    (le32_to_cpu(he_oper->he_oper_params) &
330 	     IEEE80211_HE_OPERATION_VHT_OPER_INFO)) {
331 		struct ieee80211_vht_operation he_oper_vht_cap;
332 
333 		/*
334 		 * Set only first 3 bytes (other 2 aren't used in
335 		 * ieee80211_chandef_vht_oper() anyway)
336 		 */
337 		memcpy(&he_oper_vht_cap, he_oper->optional, 3);
338 		he_oper_vht_cap.basic_mcs_set = cpu_to_le16(0);
339 
340 		if (!ieee80211_chandef_vht_oper(&sdata->local->hw, vht_cap_info,
341 						&he_oper_vht_cap, ht_oper,
342 						&vht_chandef)) {
343 			if (!(conn_flags & IEEE80211_CONN_DISABLE_HE))
344 				sdata_info(sdata,
345 					   "HE AP VHT information is invalid, disabling HE\n");
346 			ret = IEEE80211_CONN_DISABLE_HE | IEEE80211_CONN_DISABLE_EHT;
347 			goto out;
348 		}
349 	} else if (!ieee80211_chandef_vht_oper(&sdata->local->hw,
350 					       vht_cap_info,
351 					       vht_oper, ht_oper,
352 					       &vht_chandef)) {
353 		if (!(conn_flags & IEEE80211_CONN_DISABLE_VHT))
354 			sdata_info(sdata,
355 				   "AP VHT information is invalid, disabling VHT\n");
356 		ret = IEEE80211_CONN_DISABLE_VHT;
357 		goto out;
358 	}
359 
360 	if (!cfg80211_chandef_valid(&vht_chandef)) {
361 		if (!(conn_flags & IEEE80211_CONN_DISABLE_VHT))
362 			sdata_info(sdata,
363 				   "AP VHT information is invalid, disabling VHT\n");
364 		ret = IEEE80211_CONN_DISABLE_VHT;
365 		goto out;
366 	}
367 
368 	if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
369 		ret = 0;
370 		goto out;
371 	}
372 
373 	if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
374 		if (!(conn_flags & IEEE80211_CONN_DISABLE_VHT))
375 			sdata_info(sdata,
376 				   "AP VHT information doesn't match HT, disabling VHT\n");
377 		ret = IEEE80211_CONN_DISABLE_VHT;
378 		goto out;
379 	}
380 
381 	*chandef = vht_chandef;
382 
383 	/*
384 	 * handle the case that the EHT operation indicates that it holds EHT
385 	 * operation information (in case that the channel width differs from
386 	 * the channel width reported in HT/VHT/HE).
387 	 */
388 	if (eht_oper && (eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT)) {
389 		struct cfg80211_chan_def eht_chandef = *chandef;
390 
391 		ieee80211_chandef_eht_oper(eht_oper,
392 					   eht_chandef.width ==
393 					   NL80211_CHAN_WIDTH_160,
394 					   false, &eht_chandef);
395 
396 		if (!cfg80211_chandef_valid(&eht_chandef)) {
397 			if (!(conn_flags & IEEE80211_CONN_DISABLE_EHT))
398 				sdata_info(sdata,
399 					   "AP EHT information is invalid, disabling EHT\n");
400 			ret = IEEE80211_CONN_DISABLE_EHT;
401 			goto out;
402 		}
403 
404 		if (!cfg80211_chandef_compatible(chandef, &eht_chandef)) {
405 			if (!(conn_flags & IEEE80211_CONN_DISABLE_EHT))
406 				sdata_info(sdata,
407 					   "AP EHT information is incompatible, disabling EHT\n");
408 			ret = IEEE80211_CONN_DISABLE_EHT;
409 			goto out;
410 		}
411 
412 		*chandef = eht_chandef;
413 	}
414 
415 	ret = 0;
416 
417 out:
418 	/*
419 	 * When tracking the current AP, don't do any further checks if the
420 	 * new chandef is identical to the one we're currently using for the
421 	 * connection. This keeps us from playing ping-pong with regulatory,
422 	 * without it the following can happen (for example):
423 	 *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
424 	 *  - AP advertises regdom US
425 	 *  - CRDA loads regdom US with 80 MHz prohibited (old database)
426 	 *  - the code below detects an unsupported channel, downgrades, and
427 	 *    we disconnect from the AP in the caller
428 	 *  - disconnect causes CRDA to reload world regdomain and the game
429 	 *    starts anew.
430 	 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
431 	 *
432 	 * It seems possible that there are still scenarios with CSA or real
433 	 * bandwidth changes where a this could happen, but those cases are
434 	 * less common and wouldn't completely prevent using the AP.
435 	 */
436 	if (tracking &&
437 	    cfg80211_chandef_identical(chandef, &link->conf->chandef))
438 		return ret;
439 
440 	/* don't print the message below for VHT mismatch if VHT is disabled */
441 	if (ret & IEEE80211_CONN_DISABLE_VHT)
442 		vht_chandef = *chandef;
443 
444 	/*
445 	 * Ignore the DISABLED flag when we're already connected and only
446 	 * tracking the APs beacon for bandwidth changes - otherwise we
447 	 * might get disconnected here if we connect to an AP, update our
448 	 * regulatory information based on the AP's country IE and the
449 	 * information we have is wrong/outdated and disables the channel
450 	 * that we're actually using for the connection to the AP.
451 	 */
452 	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
453 					tracking ? 0 :
454 						   IEEE80211_CHAN_DISABLED)) {
455 		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
456 			ret = IEEE80211_CONN_DISABLE_HT |
457 			      IEEE80211_CONN_DISABLE_VHT |
458 			      IEEE80211_CONN_DISABLE_HE |
459 			      IEEE80211_CONN_DISABLE_EHT;
460 			break;
461 		}
462 
463 		ret |= ieee80211_chandef_downgrade(chandef);
464 	}
465 
466 	if (!he_oper || !cfg80211_chandef_usable(sdata->wdev.wiphy, chandef,
467 						 IEEE80211_CHAN_NO_HE))
468 		ret |= IEEE80211_CONN_DISABLE_HE | IEEE80211_CONN_DISABLE_EHT;
469 
470 	if (!eht_oper || !cfg80211_chandef_usable(sdata->wdev.wiphy, chandef,
471 						  IEEE80211_CHAN_NO_EHT))
472 		ret |= IEEE80211_CONN_DISABLE_EHT;
473 
474 	if (chandef->width != vht_chandef.width && !tracking)
475 		sdata_info(sdata,
476 			   "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
477 
478 	WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
479 	return ret;
480 }
481 
ieee80211_config_bw(struct ieee80211_link_data * link,const struct ieee80211_ht_cap * ht_cap,const struct ieee80211_vht_cap * vht_cap,const struct ieee80211_ht_operation * ht_oper,const struct ieee80211_vht_operation * vht_oper,const struct ieee80211_he_operation * he_oper,const struct ieee80211_eht_operation * eht_oper,const struct ieee80211_s1g_oper_ie * s1g_oper,const u8 * bssid,u64 * changed)482 static int ieee80211_config_bw(struct ieee80211_link_data *link,
483 			       const struct ieee80211_ht_cap *ht_cap,
484 			       const struct ieee80211_vht_cap *vht_cap,
485 			       const struct ieee80211_ht_operation *ht_oper,
486 			       const struct ieee80211_vht_operation *vht_oper,
487 			       const struct ieee80211_he_operation *he_oper,
488 			       const struct ieee80211_eht_operation *eht_oper,
489 			       const struct ieee80211_s1g_oper_ie *s1g_oper,
490 			       const u8 *bssid, u64 *changed)
491 {
492 	struct ieee80211_sub_if_data *sdata = link->sdata;
493 	struct ieee80211_local *local = sdata->local;
494 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
495 	struct ieee80211_channel *chan = link->conf->chandef.chan;
496 	struct ieee80211_supported_band *sband =
497 		local->hw.wiphy->bands[chan->band];
498 	struct cfg80211_chan_def chandef;
499 	u16 ht_opmode;
500 	ieee80211_conn_flags_t flags;
501 	u32 vht_cap_info = 0;
502 	int ret;
503 
504 	/* if HT was/is disabled, don't track any bandwidth changes */
505 	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT || !ht_oper)
506 		return 0;
507 
508 	/* don't check VHT if we associated as non-VHT station */
509 	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)
510 		vht_oper = NULL;
511 
512 	/* don't check HE if we associated as non-HE station */
513 	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE ||
514 	    !ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif)) {
515 		he_oper = NULL;
516 		eht_oper = NULL;
517 	}
518 
519 	/* don't check EHT if we associated as non-EHT station */
520 	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_EHT ||
521 	    !ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif))
522 		eht_oper = NULL;
523 
524 	/*
525 	 * if bss configuration changed store the new one -
526 	 * this may be applicable even if channel is identical
527 	 */
528 	ht_opmode = le16_to_cpu(ht_oper->operation_mode);
529 	if (link->conf->ht_operation_mode != ht_opmode) {
530 		*changed |= BSS_CHANGED_HT;
531 		link->conf->ht_operation_mode = ht_opmode;
532 	}
533 
534 	if (vht_cap)
535 		vht_cap_info = le32_to_cpu(vht_cap->vht_cap_info);
536 
537 	/* calculate new channel (type) based on HT/VHT/HE operation IEs */
538 	flags = ieee80211_determine_chantype(sdata, link,
539 					     link->u.mgd.conn_flags,
540 					     sband, chan, vht_cap_info,
541 					     ht_oper, vht_oper,
542 					     he_oper, eht_oper,
543 					     s1g_oper, &chandef, true);
544 
545 	/*
546 	 * Downgrade the new channel if we associated with restricted
547 	 * capabilities. For example, if we associated as a 20 MHz STA
548 	 * to a 40 MHz AP (due to regulatory, capabilities or config
549 	 * reasons) then switching to a 40 MHz channel now won't do us
550 	 * any good -- we couldn't use it with the AP.
551 	 */
552 	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_80P80MHZ &&
553 	    chandef.width == NL80211_CHAN_WIDTH_80P80)
554 		flags |= ieee80211_chandef_downgrade(&chandef);
555 	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_160MHZ &&
556 	    chandef.width == NL80211_CHAN_WIDTH_160)
557 		flags |= ieee80211_chandef_downgrade(&chandef);
558 	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_40MHZ &&
559 	    chandef.width > NL80211_CHAN_WIDTH_20)
560 		flags |= ieee80211_chandef_downgrade(&chandef);
561 
562 	if (cfg80211_chandef_identical(&chandef, &link->conf->chandef))
563 		return 0;
564 
565 	link_info(link,
566 		  "AP %pM changed bandwidth, new config is %d.%03d MHz, width %d (%d.%03d/%d MHz)\n",
567 		  link->u.mgd.bssid, chandef.chan->center_freq,
568 		  chandef.chan->freq_offset, chandef.width,
569 		  chandef.center_freq1, chandef.freq1_offset,
570 		  chandef.center_freq2);
571 
572 	if (flags != (link->u.mgd.conn_flags &
573 				(IEEE80211_CONN_DISABLE_HT |
574 				 IEEE80211_CONN_DISABLE_VHT |
575 				 IEEE80211_CONN_DISABLE_HE |
576 				 IEEE80211_CONN_DISABLE_EHT |
577 				 IEEE80211_CONN_DISABLE_40MHZ |
578 				 IEEE80211_CONN_DISABLE_80P80MHZ |
579 				 IEEE80211_CONN_DISABLE_160MHZ |
580 				 IEEE80211_CONN_DISABLE_320MHZ)) ||
581 	    !cfg80211_chandef_valid(&chandef)) {
582 		sdata_info(sdata,
583 			   "AP %pM changed caps/bw in a way we can't support (0x%x/0x%x) - disconnect\n",
584 			   link->u.mgd.bssid, flags, ifmgd->flags);
585 		return -EINVAL;
586 	}
587 
588 	ret = ieee80211_link_change_bandwidth(link, &chandef, changed);
589 
590 	if (ret) {
591 		sdata_info(sdata,
592 			   "AP %pM changed bandwidth to incompatible one - disconnect\n",
593 			   link->u.mgd.bssid);
594 		return ret;
595 	}
596 
597 	return 0;
598 }
599 
600 /* frame sending functions */
601 
ieee80211_add_ht_ie(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,u8 ap_ht_param,struct ieee80211_supported_band * sband,struct ieee80211_channel * channel,enum ieee80211_smps_mode smps,ieee80211_conn_flags_t conn_flags)602 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
603 				struct sk_buff *skb, u8 ap_ht_param,
604 				struct ieee80211_supported_band *sband,
605 				struct ieee80211_channel *channel,
606 				enum ieee80211_smps_mode smps,
607 				ieee80211_conn_flags_t conn_flags)
608 {
609 	u8 *pos;
610 	u32 flags = channel->flags;
611 	u16 cap;
612 	struct ieee80211_sta_ht_cap ht_cap;
613 
614 	BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
615 
616 	memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
617 	ieee80211_apply_htcap_overrides(sdata, &ht_cap);
618 
619 	/* determine capability flags */
620 	cap = ht_cap.cap;
621 
622 	switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
623 	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
624 		if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
625 			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
626 			cap &= ~IEEE80211_HT_CAP_SGI_40;
627 		}
628 		break;
629 	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
630 		if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
631 			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
632 			cap &= ~IEEE80211_HT_CAP_SGI_40;
633 		}
634 		break;
635 	}
636 
637 	/*
638 	 * If 40 MHz was disabled associate as though we weren't
639 	 * capable of 40 MHz -- some broken APs will never fall
640 	 * back to trying to transmit in 20 MHz.
641 	 */
642 	if (conn_flags & IEEE80211_CONN_DISABLE_40MHZ) {
643 		cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
644 		cap &= ~IEEE80211_HT_CAP_SGI_40;
645 	}
646 
647 	/* set SM PS mode properly */
648 	cap &= ~IEEE80211_HT_CAP_SM_PS;
649 	switch (smps) {
650 	case IEEE80211_SMPS_AUTOMATIC:
651 	case IEEE80211_SMPS_NUM_MODES:
652 		WARN_ON(1);
653 		fallthrough;
654 	case IEEE80211_SMPS_OFF:
655 		cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
656 			IEEE80211_HT_CAP_SM_PS_SHIFT;
657 		break;
658 	case IEEE80211_SMPS_STATIC:
659 		cap |= WLAN_HT_CAP_SM_PS_STATIC <<
660 			IEEE80211_HT_CAP_SM_PS_SHIFT;
661 		break;
662 	case IEEE80211_SMPS_DYNAMIC:
663 		cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
664 			IEEE80211_HT_CAP_SM_PS_SHIFT;
665 		break;
666 	}
667 
668 	/* reserve and fill IE */
669 	pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
670 	ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
671 }
672 
673 /* This function determines vht capability flags for the association
674  * and builds the IE.
675  * Note - the function returns true to own the MU-MIMO capability
676  */
ieee80211_add_vht_ie(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,struct ieee80211_supported_band * sband,struct ieee80211_vht_cap * ap_vht_cap,ieee80211_conn_flags_t conn_flags)677 static bool ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
678 				 struct sk_buff *skb,
679 				 struct ieee80211_supported_band *sband,
680 				 struct ieee80211_vht_cap *ap_vht_cap,
681 				 ieee80211_conn_flags_t conn_flags)
682 {
683 	struct ieee80211_local *local = sdata->local;
684 	u8 *pos;
685 	u32 cap;
686 	struct ieee80211_sta_vht_cap vht_cap;
687 	u32 mask, ap_bf_sts, our_bf_sts;
688 	bool mu_mimo_owner = false;
689 
690 	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
691 
692 	memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
693 	ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
694 
695 	/* determine capability flags */
696 	cap = vht_cap.cap;
697 
698 	if (conn_flags & IEEE80211_CONN_DISABLE_80P80MHZ) {
699 		u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
700 
701 		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
702 		if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
703 		    bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
704 			cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
705 	}
706 
707 	if (conn_flags & IEEE80211_CONN_DISABLE_160MHZ) {
708 		cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
709 		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
710 	}
711 
712 	/*
713 	 * Some APs apparently get confused if our capabilities are better
714 	 * than theirs, so restrict what we advertise in the assoc request.
715 	 */
716 	if (!(ap_vht_cap->vht_cap_info &
717 			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
718 		cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
719 			 IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
720 	else if (!(ap_vht_cap->vht_cap_info &
721 			cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
722 		cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
723 
724 	/*
725 	 * If some other vif is using the MU-MIMO capability we cannot associate
726 	 * using MU-MIMO - this will lead to contradictions in the group-id
727 	 * mechanism.
728 	 * Ownership is defined since association request, in order to avoid
729 	 * simultaneous associations with MU-MIMO.
730 	 */
731 	if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
732 		bool disable_mu_mimo = false;
733 		struct ieee80211_sub_if_data *other;
734 
735 		list_for_each_entry_rcu(other, &local->interfaces, list) {
736 			if (other->vif.bss_conf.mu_mimo_owner) {
737 				disable_mu_mimo = true;
738 				break;
739 			}
740 		}
741 		if (disable_mu_mimo)
742 			cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
743 		else
744 			mu_mimo_owner = true;
745 	}
746 
747 	mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
748 
749 	ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
750 	our_bf_sts = cap & mask;
751 
752 	if (ap_bf_sts < our_bf_sts) {
753 		cap &= ~mask;
754 		cap |= ap_bf_sts;
755 	}
756 
757 	/* reserve and fill IE */
758 	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
759 	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
760 
761 	return mu_mimo_owner;
762 }
763 
764 /* This function determines HE capability flags for the association
765  * and builds the IE.
766  */
ieee80211_add_he_ie(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,struct ieee80211_supported_band * sband,enum ieee80211_smps_mode smps_mode,ieee80211_conn_flags_t conn_flags)767 static void ieee80211_add_he_ie(struct ieee80211_sub_if_data *sdata,
768 				struct sk_buff *skb,
769 				struct ieee80211_supported_band *sband,
770 				enum ieee80211_smps_mode smps_mode,
771 				ieee80211_conn_flags_t conn_flags)
772 {
773 	u8 *pos, *pre_he_pos;
774 	const struct ieee80211_sta_he_cap *he_cap;
775 	u8 he_cap_size;
776 
777 	he_cap = ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
778 	if (WARN_ON(!he_cap))
779 		return;
780 
781 	/* get a max size estimate */
782 	he_cap_size =
783 		2 + 1 + sizeof(he_cap->he_cap_elem) +
784 		ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem) +
785 		ieee80211_he_ppe_size(he_cap->ppe_thres[0],
786 				      he_cap->he_cap_elem.phy_cap_info);
787 	pos = skb_put(skb, he_cap_size);
788 	pre_he_pos = pos;
789 	pos = ieee80211_ie_build_he_cap(conn_flags,
790 					pos, he_cap, pos + he_cap_size);
791 	/* trim excess if any */
792 	skb_trim(skb, skb->len - (pre_he_pos + he_cap_size - pos));
793 
794 	ieee80211_ie_build_he_6ghz_cap(sdata, smps_mode, skb);
795 }
796 
ieee80211_add_eht_ie(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,struct ieee80211_supported_band * sband)797 static void ieee80211_add_eht_ie(struct ieee80211_sub_if_data *sdata,
798 				 struct sk_buff *skb,
799 				 struct ieee80211_supported_band *sband)
800 {
801 	u8 *pos;
802 	const struct ieee80211_sta_he_cap *he_cap;
803 	const struct ieee80211_sta_eht_cap *eht_cap;
804 	u8 eht_cap_size;
805 
806 	he_cap = ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
807 	eht_cap = ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif);
808 
809 	/*
810 	 * EHT capabilities element is only added if the HE capabilities element
811 	 * was added so assume that 'he_cap' is valid and don't check it.
812 	 */
813 	if (WARN_ON(!he_cap || !eht_cap))
814 		return;
815 
816 	eht_cap_size =
817 		2 + 1 + sizeof(eht_cap->eht_cap_elem) +
818 		ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
819 					   &eht_cap->eht_cap_elem,
820 					   false) +
821 		ieee80211_eht_ppe_size(eht_cap->eht_ppe_thres[0],
822 				       eht_cap->eht_cap_elem.phy_cap_info);
823 	pos = skb_put(skb, eht_cap_size);
824 	ieee80211_ie_build_eht_cap(pos, he_cap, eht_cap, pos + eht_cap_size,
825 				   false);
826 }
827 
ieee80211_assoc_add_rates(struct sk_buff * skb,enum nl80211_chan_width width,struct ieee80211_supported_band * sband,struct ieee80211_mgd_assoc_data * assoc_data)828 static void ieee80211_assoc_add_rates(struct sk_buff *skb,
829 				      enum nl80211_chan_width width,
830 				      struct ieee80211_supported_band *sband,
831 				      struct ieee80211_mgd_assoc_data *assoc_data)
832 {
833 	unsigned int shift = ieee80211_chanwidth_get_shift(width);
834 	unsigned int rates_len, supp_rates_len;
835 	u32 rates = 0;
836 	int i, count;
837 	u8 *pos;
838 
839 	if (assoc_data->supp_rates_len) {
840 		/*
841 		 * Get all rates supported by the device and the AP as
842 		 * some APs don't like getting a superset of their rates
843 		 * in the association request (e.g. D-Link DAP 1353 in
844 		 * b-only mode)...
845 		 */
846 		rates_len = ieee80211_parse_bitrates(width, sband,
847 						     assoc_data->supp_rates,
848 						     assoc_data->supp_rates_len,
849 						     &rates);
850 	} else {
851 		/*
852 		 * In case AP not provide any supported rates information
853 		 * before association, we send information element(s) with
854 		 * all rates that we support.
855 		 */
856 		rates_len = sband->n_bitrates;
857 		for (i = 0; i < sband->n_bitrates; i++)
858 			rates |= BIT(i);
859 	}
860 
861 	supp_rates_len = rates_len;
862 	if (supp_rates_len > 8)
863 		supp_rates_len = 8;
864 
865 	pos = skb_put(skb, supp_rates_len + 2);
866 	*pos++ = WLAN_EID_SUPP_RATES;
867 	*pos++ = supp_rates_len;
868 
869 	count = 0;
870 	for (i = 0; i < sband->n_bitrates; i++) {
871 		if (BIT(i) & rates) {
872 			int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
873 						5 * (1 << shift));
874 			*pos++ = (u8)rate;
875 			if (++count == 8)
876 				break;
877 		}
878 	}
879 
880 	if (rates_len > count) {
881 		pos = skb_put(skb, rates_len - count + 2);
882 		*pos++ = WLAN_EID_EXT_SUPP_RATES;
883 		*pos++ = rates_len - count;
884 
885 		for (i++; i < sband->n_bitrates; i++) {
886 			if (BIT(i) & rates) {
887 				int rate;
888 
889 				rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
890 						    5 * (1 << shift));
891 				*pos++ = (u8)rate;
892 			}
893 		}
894 	}
895 }
896 
ieee80211_add_before_ht_elems(struct sk_buff * skb,const u8 * elems,size_t elems_len,size_t offset)897 static size_t ieee80211_add_before_ht_elems(struct sk_buff *skb,
898 					    const u8 *elems,
899 					    size_t elems_len,
900 					    size_t offset)
901 {
902 	size_t noffset;
903 
904 	static const u8 before_ht[] = {
905 		WLAN_EID_SSID,
906 		WLAN_EID_SUPP_RATES,
907 		WLAN_EID_EXT_SUPP_RATES,
908 		WLAN_EID_PWR_CAPABILITY,
909 		WLAN_EID_SUPPORTED_CHANNELS,
910 		WLAN_EID_RSN,
911 		WLAN_EID_QOS_CAPA,
912 		WLAN_EID_RRM_ENABLED_CAPABILITIES,
913 		WLAN_EID_MOBILITY_DOMAIN,
914 		WLAN_EID_FAST_BSS_TRANSITION,	/* reassoc only */
915 		WLAN_EID_RIC_DATA,		/* reassoc only */
916 		WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
917 	};
918 	static const u8 after_ric[] = {
919 		WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
920 		WLAN_EID_HT_CAPABILITY,
921 		WLAN_EID_BSS_COEX_2040,
922 		/* luckily this is almost always there */
923 		WLAN_EID_EXT_CAPABILITY,
924 		WLAN_EID_QOS_TRAFFIC_CAPA,
925 		WLAN_EID_TIM_BCAST_REQ,
926 		WLAN_EID_INTERWORKING,
927 		/* 60 GHz (Multi-band, DMG, MMS) can't happen */
928 		WLAN_EID_VHT_CAPABILITY,
929 		WLAN_EID_OPMODE_NOTIF,
930 	};
931 
932 	if (!elems_len)
933 		return offset;
934 
935 	noffset = ieee80211_ie_split_ric(elems, elems_len,
936 					 before_ht,
937 					 ARRAY_SIZE(before_ht),
938 					 after_ric,
939 					 ARRAY_SIZE(after_ric),
940 					 offset);
941 	skb_put_data(skb, elems + offset, noffset - offset);
942 
943 	return noffset;
944 }
945 
ieee80211_add_before_vht_elems(struct sk_buff * skb,const u8 * elems,size_t elems_len,size_t offset)946 static size_t ieee80211_add_before_vht_elems(struct sk_buff *skb,
947 					     const u8 *elems,
948 					     size_t elems_len,
949 					     size_t offset)
950 {
951 	static const u8 before_vht[] = {
952 		/*
953 		 * no need to list the ones split off before HT
954 		 * or generated here
955 		 */
956 		WLAN_EID_BSS_COEX_2040,
957 		WLAN_EID_EXT_CAPABILITY,
958 		WLAN_EID_QOS_TRAFFIC_CAPA,
959 		WLAN_EID_TIM_BCAST_REQ,
960 		WLAN_EID_INTERWORKING,
961 		/* 60 GHz (Multi-band, DMG, MMS) can't happen */
962 	};
963 	size_t noffset;
964 
965 	if (!elems_len)
966 		return offset;
967 
968 	/* RIC already taken care of in ieee80211_add_before_ht_elems() */
969 	noffset = ieee80211_ie_split(elems, elems_len,
970 				     before_vht, ARRAY_SIZE(before_vht),
971 				     offset);
972 	skb_put_data(skb, elems + offset, noffset - offset);
973 
974 	return noffset;
975 }
976 
ieee80211_add_before_he_elems(struct sk_buff * skb,const u8 * elems,size_t elems_len,size_t offset)977 static size_t ieee80211_add_before_he_elems(struct sk_buff *skb,
978 					    const u8 *elems,
979 					    size_t elems_len,
980 					    size_t offset)
981 {
982 	static const u8 before_he[] = {
983 		/*
984 		 * no need to list the ones split off before VHT
985 		 * or generated here
986 		 */
987 		WLAN_EID_OPMODE_NOTIF,
988 		WLAN_EID_EXTENSION, WLAN_EID_EXT_FUTURE_CHAN_GUIDANCE,
989 		/* 11ai elements */
990 		WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_SESSION,
991 		WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_PUBLIC_KEY,
992 		WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_KEY_CONFIRM,
993 		WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_HLP_CONTAINER,
994 		WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_IP_ADDR_ASSIGN,
995 		/* TODO: add 11ah/11aj/11ak elements */
996 	};
997 	size_t noffset;
998 
999 	if (!elems_len)
1000 		return offset;
1001 
1002 	/* RIC already taken care of in ieee80211_add_before_ht_elems() */
1003 	noffset = ieee80211_ie_split(elems, elems_len,
1004 				     before_he, ARRAY_SIZE(before_he),
1005 				     offset);
1006 	skb_put_data(skb, elems + offset, noffset - offset);
1007 
1008 	return noffset;
1009 }
1010 
1011 #define PRESENT_ELEMS_MAX	8
1012 #define PRESENT_ELEM_EXT_OFFS	0x100
1013 
1014 static void ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata,
1015 					struct sk_buff *skb, u16 capab,
1016 					const struct element *ext_capa,
1017 					const u16 *present_elems);
1018 
ieee80211_assoc_link_elems(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,u16 * capab,const struct element * ext_capa,const u8 * extra_elems,size_t extra_elems_len,unsigned int link_id,struct ieee80211_link_data * link,u16 * present_elems)1019 static size_t ieee80211_assoc_link_elems(struct ieee80211_sub_if_data *sdata,
1020 					 struct sk_buff *skb, u16 *capab,
1021 					 const struct element *ext_capa,
1022 					 const u8 *extra_elems,
1023 					 size_t extra_elems_len,
1024 					 unsigned int link_id,
1025 					 struct ieee80211_link_data *link,
1026 					 u16 *present_elems)
1027 {
1028 	enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
1029 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1030 	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
1031 	struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
1032 	struct ieee80211_channel *chan = cbss->channel;
1033 	const struct ieee80211_sband_iftype_data *iftd;
1034 	struct ieee80211_local *local = sdata->local;
1035 	struct ieee80211_supported_band *sband;
1036 	enum nl80211_chan_width width = NL80211_CHAN_WIDTH_20;
1037 	struct ieee80211_chanctx_conf *chanctx_conf;
1038 	enum ieee80211_smps_mode smps_mode;
1039 	u16 orig_capab = *capab;
1040 	size_t offset = 0;
1041 	int present_elems_len = 0;
1042 	u8 *pos;
1043 	int i;
1044 
1045 #define ADD_PRESENT_ELEM(id) do {					\
1046 	/* need a last for termination - we use 0 == SSID */		\
1047 	if (!WARN_ON(present_elems_len >= PRESENT_ELEMS_MAX - 1))	\
1048 		present_elems[present_elems_len++] = (id);		\
1049 } while (0)
1050 #define ADD_PRESENT_EXT_ELEM(id) ADD_PRESENT_ELEM(PRESENT_ELEM_EXT_OFFS | (id))
1051 
1052 	if (link)
1053 		smps_mode = link->smps_mode;
1054 	else if (sdata->u.mgd.powersave)
1055 		smps_mode = IEEE80211_SMPS_DYNAMIC;
1056 	else
1057 		smps_mode = IEEE80211_SMPS_OFF;
1058 
1059 	if (link) {
1060 		/*
1061 		 * 5/10 MHz scenarios are only viable without MLO, in which
1062 		 * case this pointer should be used ... All of this is a bit
1063 		 * unclear though, not sure this even works at all.
1064 		 */
1065 		rcu_read_lock();
1066 		chanctx_conf = rcu_dereference(link->conf->chanctx_conf);
1067 		if (chanctx_conf)
1068 			width = chanctx_conf->def.width;
1069 		rcu_read_unlock();
1070 	}
1071 
1072 	sband = local->hw.wiphy->bands[chan->band];
1073 	iftd = ieee80211_get_sband_iftype_data(sband, iftype);
1074 
1075 	if (sband->band == NL80211_BAND_2GHZ) {
1076 		*capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
1077 		*capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
1078 	}
1079 
1080 	if ((cbss->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
1081 	    ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
1082 		*capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
1083 
1084 	if (sband->band != NL80211_BAND_S1GHZ)
1085 		ieee80211_assoc_add_rates(skb, width, sband, assoc_data);
1086 
1087 	if (*capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
1088 	    *capab & WLAN_CAPABILITY_RADIO_MEASURE) {
1089 		struct cfg80211_chan_def chandef = {
1090 			.width = width,
1091 			.chan = chan,
1092 		};
1093 
1094 		pos = skb_put(skb, 4);
1095 		*pos++ = WLAN_EID_PWR_CAPABILITY;
1096 		*pos++ = 2;
1097 		*pos++ = 0; /* min tx power */
1098 		 /* max tx power */
1099 		*pos++ = ieee80211_chandef_max_power(&chandef);
1100 		ADD_PRESENT_ELEM(WLAN_EID_PWR_CAPABILITY);
1101 	}
1102 
1103 	/*
1104 	 * Per spec, we shouldn't include the list of channels if we advertise
1105 	 * support for extended channel switching, but we've always done that;
1106 	 * (for now?) apply this restriction only on the (new) 6 GHz band.
1107 	 */
1108 	if (*capab & WLAN_CAPABILITY_SPECTRUM_MGMT &&
1109 	    (sband->band != NL80211_BAND_6GHZ ||
1110 	     !ext_capa || ext_capa->datalen < 1 ||
1111 	     !(ext_capa->data[0] & WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING))) {
1112 		/* TODO: get this in reg domain format */
1113 		pos = skb_put(skb, 2 * sband->n_channels + 2);
1114 		*pos++ = WLAN_EID_SUPPORTED_CHANNELS;
1115 		*pos++ = 2 * sband->n_channels;
1116 		for (i = 0; i < sband->n_channels; i++) {
1117 			int cf = sband->channels[i].center_freq;
1118 
1119 			*pos++ = ieee80211_frequency_to_channel(cf);
1120 			*pos++ = 1; /* one channel in the subband*/
1121 		}
1122 		ADD_PRESENT_ELEM(WLAN_EID_SUPPORTED_CHANNELS);
1123 	}
1124 
1125 	/* if present, add any custom IEs that go before HT */
1126 	offset = ieee80211_add_before_ht_elems(skb, extra_elems,
1127 					       extra_elems_len,
1128 					       offset);
1129 
1130 	if (sband->band != NL80211_BAND_6GHZ &&
1131 	    !(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_HT)) {
1132 		ieee80211_add_ht_ie(sdata, skb,
1133 				    assoc_data->link[link_id].ap_ht_param,
1134 				    sband, chan, smps_mode,
1135 				    assoc_data->link[link_id].conn_flags);
1136 		ADD_PRESENT_ELEM(WLAN_EID_HT_CAPABILITY);
1137 	}
1138 
1139 	/* if present, add any custom IEs that go before VHT */
1140 	offset = ieee80211_add_before_vht_elems(skb, extra_elems,
1141 						extra_elems_len,
1142 						offset);
1143 
1144 	if (sband->band != NL80211_BAND_6GHZ &&
1145 	    !(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_VHT)) {
1146 		bool mu_mimo_owner =
1147 			ieee80211_add_vht_ie(sdata, skb, sband,
1148 					     &assoc_data->link[link_id].ap_vht_cap,
1149 					     assoc_data->link[link_id].conn_flags);
1150 
1151 		if (link)
1152 			link->conf->mu_mimo_owner = mu_mimo_owner;
1153 		ADD_PRESENT_ELEM(WLAN_EID_VHT_CAPABILITY);
1154 	}
1155 
1156 	/*
1157 	 * If AP doesn't support HT, mark HE and EHT as disabled.
1158 	 * If on the 5GHz band, make sure it supports VHT.
1159 	 */
1160 	if (assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_HT ||
1161 	    (sband->band == NL80211_BAND_5GHZ &&
1162 	     assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_VHT))
1163 		assoc_data->link[link_id].conn_flags |=
1164 			IEEE80211_CONN_DISABLE_HE |
1165 			IEEE80211_CONN_DISABLE_EHT;
1166 
1167 	/* if present, add any custom IEs that go before HE */
1168 	offset = ieee80211_add_before_he_elems(skb, extra_elems,
1169 					       extra_elems_len,
1170 					       offset);
1171 
1172 	if (!(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_HE)) {
1173 		ieee80211_add_he_ie(sdata, skb, sband, smps_mode,
1174 				    assoc_data->link[link_id].conn_flags);
1175 		ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_HE_CAPABILITY);
1176 	}
1177 
1178 	/*
1179 	 * careful - need to know about all the present elems before
1180 	 * calling ieee80211_assoc_add_ml_elem(), so add this one if
1181 	 * we're going to put it after the ML element
1182 	 */
1183 	if (!(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_EHT))
1184 		ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_EHT_CAPABILITY);
1185 
1186 	if (link_id == assoc_data->assoc_link_id)
1187 		ieee80211_assoc_add_ml_elem(sdata, skb, orig_capab, ext_capa,
1188 					    present_elems);
1189 
1190 	/* crash if somebody gets it wrong */
1191 	present_elems = NULL;
1192 
1193 	if (!(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_EHT))
1194 		ieee80211_add_eht_ie(sdata, skb, sband);
1195 
1196 	if (sband->band == NL80211_BAND_S1GHZ) {
1197 		ieee80211_add_aid_request_ie(sdata, skb);
1198 		ieee80211_add_s1g_capab_ie(sdata, &sband->s1g_cap, skb);
1199 	}
1200 
1201 	if (iftd && iftd->vendor_elems.data && iftd->vendor_elems.len)
1202 		skb_put_data(skb, iftd->vendor_elems.data, iftd->vendor_elems.len);
1203 
1204 	if (link)
1205 		link->u.mgd.conn_flags = assoc_data->link[link_id].conn_flags;
1206 
1207 	return offset;
1208 }
1209 
ieee80211_add_non_inheritance_elem(struct sk_buff * skb,const u16 * outer,const u16 * inner)1210 static void ieee80211_add_non_inheritance_elem(struct sk_buff *skb,
1211 					       const u16 *outer,
1212 					       const u16 *inner)
1213 {
1214 	unsigned int skb_len = skb->len;
1215 	bool at_extension = false;
1216 	bool added = false;
1217 	int i, j;
1218 	u8 *len, *list_len = NULL;
1219 
1220 	skb_put_u8(skb, WLAN_EID_EXTENSION);
1221 	len = skb_put(skb, 1);
1222 	skb_put_u8(skb, WLAN_EID_EXT_NON_INHERITANCE);
1223 
1224 	for (i = 0; i < PRESENT_ELEMS_MAX && outer[i]; i++) {
1225 		u16 elem = outer[i];
1226 		bool have_inner = false;
1227 
1228 		/* should at least be sorted in the sense of normal -> ext */
1229 		WARN_ON(at_extension && elem < PRESENT_ELEM_EXT_OFFS);
1230 
1231 		/* switch to extension list */
1232 		if (!at_extension && elem >= PRESENT_ELEM_EXT_OFFS) {
1233 			at_extension = true;
1234 			if (!list_len)
1235 				skb_put_u8(skb, 0);
1236 			list_len = NULL;
1237 		}
1238 
1239 		for (j = 0; j < PRESENT_ELEMS_MAX && inner[j]; j++) {
1240 			if (elem == inner[j]) {
1241 				have_inner = true;
1242 				break;
1243 			}
1244 		}
1245 
1246 		if (have_inner)
1247 			continue;
1248 
1249 		if (!list_len) {
1250 			list_len = skb_put(skb, 1);
1251 			*list_len = 0;
1252 		}
1253 		*list_len += 1;
1254 		skb_put_u8(skb, (u8)elem);
1255 		added = true;
1256 	}
1257 
1258 	/* if we added a list but no extension list, make a zero-len one */
1259 	if (added && (!at_extension || !list_len))
1260 		skb_put_u8(skb, 0);
1261 
1262 	/* if nothing added remove extension element completely */
1263 	if (!added)
1264 		skb_trim(skb, skb_len);
1265 	else
1266 		*len = skb->len - skb_len - 2;
1267 }
1268 
ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,u16 capab,const struct element * ext_capa,const u16 * outer_present_elems)1269 static void ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata,
1270 					struct sk_buff *skb, u16 capab,
1271 					const struct element *ext_capa,
1272 					const u16 *outer_present_elems)
1273 {
1274 	struct ieee80211_local *local = sdata->local;
1275 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1276 	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
1277 	struct ieee80211_multi_link_elem *ml_elem;
1278 	struct ieee80211_mle_basic_common_info *common;
1279 	const struct wiphy_iftype_ext_capab *ift_ext_capa;
1280 	__le16 eml_capa = 0, mld_capa_ops = 0;
1281 	unsigned int link_id;
1282 	u8 *ml_elem_len;
1283 	void *capab_pos;
1284 
1285 	if (!ieee80211_vif_is_mld(&sdata->vif))
1286 		return;
1287 
1288 	ift_ext_capa = cfg80211_get_iftype_ext_capa(local->hw.wiphy,
1289 						    ieee80211_vif_type_p2p(&sdata->vif));
1290 	if (ift_ext_capa) {
1291 		eml_capa = cpu_to_le16(ift_ext_capa->eml_capabilities);
1292 		mld_capa_ops = cpu_to_le16(ift_ext_capa->mld_capa_and_ops);
1293 	}
1294 
1295 	skb_put_u8(skb, WLAN_EID_EXTENSION);
1296 	ml_elem_len = skb_put(skb, 1);
1297 	skb_put_u8(skb, WLAN_EID_EXT_EHT_MULTI_LINK);
1298 	ml_elem = skb_put(skb, sizeof(*ml_elem));
1299 	ml_elem->control =
1300 		cpu_to_le16(IEEE80211_ML_CONTROL_TYPE_BASIC |
1301 			    IEEE80211_MLC_BASIC_PRES_MLD_CAPA_OP);
1302 	common = skb_put(skb, sizeof(*common));
1303 	common->len = sizeof(*common) +
1304 		      2;  /* MLD capa/ops */
1305 	memcpy(common->mld_mac_addr, sdata->vif.addr, ETH_ALEN);
1306 
1307 	/* add EML_CAPA only if needed, see Draft P802.11be_D2.1, 35.3.17 */
1308 	if (eml_capa &
1309 	    cpu_to_le16((IEEE80211_EML_CAP_EMLSR_SUPP |
1310 			 IEEE80211_EML_CAP_EMLMR_SUPPORT))) {
1311 		common->len += 2; /* EML capabilities */
1312 		ml_elem->control |=
1313 			cpu_to_le16(IEEE80211_MLC_BASIC_PRES_EML_CAPA);
1314 		skb_put_data(skb, &eml_capa, sizeof(eml_capa));
1315 	}
1316 	/* need indication from userspace to support this */
1317 	mld_capa_ops &= ~cpu_to_le16(IEEE80211_MLD_CAP_OP_TID_TO_LINK_MAP_NEG_SUPP);
1318 	skb_put_data(skb, &mld_capa_ops, sizeof(mld_capa_ops));
1319 
1320 	for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
1321 		u16 link_present_elems[PRESENT_ELEMS_MAX] = {};
1322 		const u8 *extra_elems;
1323 		size_t extra_elems_len;
1324 		size_t extra_used;
1325 		u8 *subelem_len = NULL;
1326 		__le16 ctrl;
1327 
1328 		if (!assoc_data->link[link_id].bss ||
1329 		    link_id == assoc_data->assoc_link_id)
1330 			continue;
1331 
1332 		extra_elems = assoc_data->link[link_id].elems;
1333 		extra_elems_len = assoc_data->link[link_id].elems_len;
1334 
1335 		skb_put_u8(skb, IEEE80211_MLE_SUBELEM_PER_STA_PROFILE);
1336 		subelem_len = skb_put(skb, 1);
1337 
1338 		ctrl = cpu_to_le16(link_id |
1339 				   IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE |
1340 				   IEEE80211_MLE_STA_CONTROL_STA_MAC_ADDR_PRESENT);
1341 		skb_put_data(skb, &ctrl, sizeof(ctrl));
1342 		skb_put_u8(skb, 1 + ETH_ALEN); /* STA Info Length */
1343 		skb_put_data(skb, assoc_data->link[link_id].addr,
1344 			     ETH_ALEN);
1345 		/*
1346 		 * Now add the contents of the (re)association request,
1347 		 * but the "listen interval" and "current AP address"
1348 		 * (if applicable) are skipped. So we only have
1349 		 * the capability field (remember the position and fill
1350 		 * later), followed by the elements added below by
1351 		 * calling ieee80211_assoc_link_elems().
1352 		 */
1353 		capab_pos = skb_put(skb, 2);
1354 
1355 		extra_used = ieee80211_assoc_link_elems(sdata, skb, &capab,
1356 							ext_capa,
1357 							extra_elems,
1358 							extra_elems_len,
1359 							link_id, NULL,
1360 							link_present_elems);
1361 		if (extra_elems)
1362 			skb_put_data(skb, extra_elems + extra_used,
1363 				     extra_elems_len - extra_used);
1364 
1365 		put_unaligned_le16(capab, capab_pos);
1366 
1367 		ieee80211_add_non_inheritance_elem(skb, outer_present_elems,
1368 						   link_present_elems);
1369 
1370 		ieee80211_fragment_element(skb, subelem_len,
1371 					   IEEE80211_MLE_SUBELEM_FRAGMENT);
1372 	}
1373 
1374 	ieee80211_fragment_element(skb, ml_elem_len, WLAN_EID_FRAGMENT);
1375 }
1376 
ieee80211_send_assoc(struct ieee80211_sub_if_data * sdata)1377 static int ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
1378 {
1379 	struct ieee80211_local *local = sdata->local;
1380 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1381 	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
1382 	struct ieee80211_link_data *link;
1383 	struct sk_buff *skb;
1384 	struct ieee80211_mgmt *mgmt;
1385 	u8 *pos, qos_info, *ie_start;
1386 	size_t offset, noffset;
1387 	u16 capab = WLAN_CAPABILITY_ESS, link_capab;
1388 	__le16 listen_int;
1389 	struct element *ext_capa = NULL;
1390 	enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
1391 	struct ieee80211_prep_tx_info info = {};
1392 	unsigned int link_id, n_links = 0;
1393 	u16 present_elems[PRESENT_ELEMS_MAX] = {};
1394 	void *capab_pos;
1395 	size_t size;
1396 	int ret;
1397 
1398 	/* we know it's writable, cast away the const */
1399 	if (assoc_data->ie_len)
1400 		ext_capa = (void *)cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
1401 						      assoc_data->ie,
1402 						      assoc_data->ie_len);
1403 
1404 	sdata_assert_lock(sdata);
1405 
1406 	size = local->hw.extra_tx_headroom +
1407 	       sizeof(*mgmt) + /* bit too much but doesn't matter */
1408 	       2 + assoc_data->ssid_len + /* SSID */
1409 	       assoc_data->ie_len + /* extra IEs */
1410 	       (assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) +
1411 	       9; /* WMM */
1412 
1413 	for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
1414 		struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
1415 		const struct ieee80211_sband_iftype_data *iftd;
1416 		struct ieee80211_supported_band *sband;
1417 
1418 		if (!cbss)
1419 			continue;
1420 
1421 		sband = local->hw.wiphy->bands[cbss->channel->band];
1422 
1423 		n_links++;
1424 		/* add STA profile elements length */
1425 		size += assoc_data->link[link_id].elems_len;
1426 		/* and supported rates length */
1427 		size += 4 + sband->n_bitrates;
1428 		/* supported channels */
1429 		size += 2 + 2 * sband->n_channels;
1430 
1431 		iftd = ieee80211_get_sband_iftype_data(sband, iftype);
1432 		if (iftd)
1433 			size += iftd->vendor_elems.len;
1434 
1435 		/* power capability */
1436 		size += 4;
1437 
1438 		/* HT, VHT, HE, EHT */
1439 		size += 2 + sizeof(struct ieee80211_ht_cap);
1440 		size += 2 + sizeof(struct ieee80211_vht_cap);
1441 		size += 2 + 1 + sizeof(struct ieee80211_he_cap_elem) +
1442 			sizeof(struct ieee80211_he_mcs_nss_supp) +
1443 			IEEE80211_HE_PPE_THRES_MAX_LEN;
1444 
1445 		if (sband->band == NL80211_BAND_6GHZ)
1446 			size += 2 + 1 + sizeof(struct ieee80211_he_6ghz_capa);
1447 
1448 		size += 2 + 1 + sizeof(struct ieee80211_eht_cap_elem) +
1449 			sizeof(struct ieee80211_eht_mcs_nss_supp) +
1450 			IEEE80211_EHT_PPE_THRES_MAX_LEN;
1451 
1452 		/* non-inheritance element */
1453 		size += 2 + 2 + PRESENT_ELEMS_MAX;
1454 
1455 		/* should be the same across all BSSes */
1456 		if (cbss->capability & WLAN_CAPABILITY_PRIVACY)
1457 			capab |= WLAN_CAPABILITY_PRIVACY;
1458 	}
1459 
1460 	if (ieee80211_vif_is_mld(&sdata->vif)) {
1461 		/* consider the multi-link element with STA profile */
1462 		size += sizeof(struct ieee80211_multi_link_elem);
1463 		/* max common info field in basic multi-link element */
1464 		size += sizeof(struct ieee80211_mle_basic_common_info) +
1465 			2 + /* capa & op */
1466 			2; /* EML capa */
1467 
1468 		/*
1469 		 * The capability elements were already considered above;
1470 		 * note this over-estimates a bit because there's no
1471 		 * STA profile for the assoc link.
1472 		 */
1473 		size += (n_links - 1) *
1474 			(1 + 1 + /* subelement ID/length */
1475 			 2 + /* STA control */
1476 			 1 + ETH_ALEN + 2 /* STA Info field */);
1477 	}
1478 
1479 	link = sdata_dereference(sdata->link[assoc_data->assoc_link_id], sdata);
1480 	if (WARN_ON(!link))
1481 		return -EINVAL;
1482 
1483 	if (WARN_ON(!assoc_data->link[assoc_data->assoc_link_id].bss))
1484 		return -EINVAL;
1485 
1486 	skb = alloc_skb(size, GFP_KERNEL);
1487 	if (!skb)
1488 		return -ENOMEM;
1489 
1490 	skb_reserve(skb, local->hw.extra_tx_headroom);
1491 
1492 	if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
1493 		capab |= WLAN_CAPABILITY_RADIO_MEASURE;
1494 
1495 	/* Set MBSSID support for HE AP if needed */
1496 	if (ieee80211_hw_check(&local->hw, SUPPORTS_ONLY_HE_MULTI_BSSID) &&
1497 	    !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
1498 	    ext_capa && ext_capa->datalen >= 3)
1499 		ext_capa->data[2] |= WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT;
1500 
1501 	mgmt = skb_put_zero(skb, 24);
1502 	memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN);
1503 	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
1504 	memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
1505 
1506 	listen_int = cpu_to_le16(assoc_data->s1g ?
1507 			ieee80211_encode_usf(local->hw.conf.listen_interval) :
1508 			local->hw.conf.listen_interval);
1509 	if (!is_zero_ether_addr(assoc_data->prev_ap_addr)) {
1510 		skb_put(skb, 10);
1511 		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1512 						  IEEE80211_STYPE_REASSOC_REQ);
1513 		capab_pos = &mgmt->u.reassoc_req.capab_info;
1514 		mgmt->u.reassoc_req.listen_interval = listen_int;
1515 		memcpy(mgmt->u.reassoc_req.current_ap,
1516 		       assoc_data->prev_ap_addr, ETH_ALEN);
1517 		info.subtype = IEEE80211_STYPE_REASSOC_REQ;
1518 	} else {
1519 		skb_put(skb, 4);
1520 		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1521 						  IEEE80211_STYPE_ASSOC_REQ);
1522 		capab_pos = &mgmt->u.assoc_req.capab_info;
1523 		mgmt->u.assoc_req.listen_interval = listen_int;
1524 		info.subtype = IEEE80211_STYPE_ASSOC_REQ;
1525 	}
1526 
1527 	/* SSID */
1528 	pos = skb_put(skb, 2 + assoc_data->ssid_len);
1529 	ie_start = pos;
1530 	*pos++ = WLAN_EID_SSID;
1531 	*pos++ = assoc_data->ssid_len;
1532 	memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);
1533 
1534 	/* add the elements for the assoc (main) link */
1535 	link_capab = capab;
1536 	offset = ieee80211_assoc_link_elems(sdata, skb, &link_capab,
1537 					    ext_capa,
1538 					    assoc_data->ie,
1539 					    assoc_data->ie_len,
1540 					    assoc_data->assoc_link_id, link,
1541 					    present_elems);
1542 	put_unaligned_le16(link_capab, capab_pos);
1543 
1544 	/* if present, add any custom non-vendor IEs */
1545 	if (assoc_data->ie_len) {
1546 		noffset = ieee80211_ie_split_vendor(assoc_data->ie,
1547 						    assoc_data->ie_len,
1548 						    offset);
1549 		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
1550 		offset = noffset;
1551 	}
1552 
1553 	if (assoc_data->wmm) {
1554 		if (assoc_data->uapsd) {
1555 			qos_info = ifmgd->uapsd_queues;
1556 			qos_info |= (ifmgd->uapsd_max_sp_len <<
1557 				     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
1558 		} else {
1559 			qos_info = 0;
1560 		}
1561 
1562 		pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
1563 	}
1564 
1565 	/* add any remaining custom (i.e. vendor specific here) IEs */
1566 	if (assoc_data->ie_len) {
1567 		noffset = assoc_data->ie_len;
1568 		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
1569 	}
1570 
1571 	if (assoc_data->fils_kek_len) {
1572 		ret = fils_encrypt_assoc_req(skb, assoc_data);
1573 		if (ret < 0) {
1574 			dev_kfree_skb(skb);
1575 			return ret;
1576 		}
1577 	}
1578 
1579 	pos = skb_tail_pointer(skb);
1580 	kfree(ifmgd->assoc_req_ies);
1581 	ifmgd->assoc_req_ies = kmemdup(ie_start, pos - ie_start, GFP_ATOMIC);
1582 	if (!ifmgd->assoc_req_ies) {
1583 		dev_kfree_skb(skb);
1584 		return -ENOMEM;
1585 	}
1586 
1587 	ifmgd->assoc_req_ies_len = pos - ie_start;
1588 
1589 	drv_mgd_prepare_tx(local, sdata, &info);
1590 
1591 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1592 	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1593 		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
1594 						IEEE80211_TX_INTFL_MLME_CONN_TX;
1595 	ieee80211_tx_skb(sdata, skb);
1596 
1597 	return 0;
1598 }
1599 
ieee80211_send_pspoll(struct ieee80211_local * local,struct ieee80211_sub_if_data * sdata)1600 void ieee80211_send_pspoll(struct ieee80211_local *local,
1601 			   struct ieee80211_sub_if_data *sdata)
1602 {
1603 	struct ieee80211_pspoll *pspoll;
1604 	struct sk_buff *skb;
1605 
1606 	skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
1607 	if (!skb)
1608 		return;
1609 
1610 	pspoll = (struct ieee80211_pspoll *) skb->data;
1611 	pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1612 
1613 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1614 	ieee80211_tx_skb(sdata, skb);
1615 }
1616 
ieee80211_send_nullfunc(struct ieee80211_local * local,struct ieee80211_sub_if_data * sdata,bool powersave)1617 void ieee80211_send_nullfunc(struct ieee80211_local *local,
1618 			     struct ieee80211_sub_if_data *sdata,
1619 			     bool powersave)
1620 {
1621 	struct sk_buff *skb;
1622 	struct ieee80211_hdr_3addr *nullfunc;
1623 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1624 
1625 	skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif, -1,
1626 				     !ieee80211_hw_check(&local->hw,
1627 							 DOESNT_SUPPORT_QOS_NDP));
1628 	if (!skb)
1629 		return;
1630 
1631 	nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
1632 	if (powersave)
1633 		nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1634 
1635 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
1636 					IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
1637 
1638 	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1639 		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
1640 
1641 	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
1642 		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
1643 
1644 	ieee80211_tx_skb(sdata, skb);
1645 }
1646 
ieee80211_send_4addr_nullfunc(struct ieee80211_local * local,struct ieee80211_sub_if_data * sdata)1647 void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
1648 				   struct ieee80211_sub_if_data *sdata)
1649 {
1650 	struct sk_buff *skb;
1651 	struct ieee80211_hdr *nullfunc;
1652 	__le16 fc;
1653 
1654 	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
1655 		return;
1656 
1657 	skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
1658 	if (!skb)
1659 		return;
1660 
1661 	skb_reserve(skb, local->hw.extra_tx_headroom);
1662 
1663 	nullfunc = skb_put_zero(skb, 30);
1664 	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
1665 			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
1666 	nullfunc->frame_control = fc;
1667 	memcpy(nullfunc->addr1, sdata->deflink.u.mgd.bssid, ETH_ALEN);
1668 	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
1669 	memcpy(nullfunc->addr3, sdata->deflink.u.mgd.bssid, ETH_ALEN);
1670 	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
1671 
1672 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1673 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
1674 	ieee80211_tx_skb(sdata, skb);
1675 }
1676 
1677 /* spectrum management related things */
ieee80211_chswitch_work(struct wiphy * wiphy,struct wiphy_work * work)1678 static void ieee80211_chswitch_work(struct wiphy *wiphy,
1679 				    struct wiphy_work *work)
1680 {
1681 	struct ieee80211_link_data *link =
1682 		container_of(work, struct ieee80211_link_data,
1683 			     u.mgd.chswitch_work.work);
1684 	struct ieee80211_sub_if_data *sdata = link->sdata;
1685 	struct ieee80211_local *local = sdata->local;
1686 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1687 	int ret;
1688 
1689 	if (!ieee80211_sdata_running(sdata))
1690 		return;
1691 
1692 	sdata_lock(sdata);
1693 	mutex_lock(&local->mtx);
1694 	mutex_lock(&local->chanctx_mtx);
1695 
1696 	if (!ifmgd->associated)
1697 		goto out;
1698 
1699 	if (!link->conf->csa_active)
1700 		goto out;
1701 
1702 	/*
1703 	 * using reservation isn't immediate as it may be deferred until later
1704 	 * with multi-vif. once reservation is complete it will re-schedule the
1705 	 * work with no reserved_chanctx so verify chandef to check if it
1706 	 * completed successfully
1707 	 */
1708 
1709 	if (link->reserved_chanctx) {
1710 		/*
1711 		 * with multi-vif csa driver may call ieee80211_csa_finish()
1712 		 * many times while waiting for other interfaces to use their
1713 		 * reservations
1714 		 */
1715 		if (link->reserved_ready)
1716 			goto out;
1717 
1718 		ret = ieee80211_link_use_reserved_context(link);
1719 		if (ret) {
1720 			sdata_info(sdata,
1721 				   "failed to use reserved channel context, disconnecting (err=%d)\n",
1722 				   ret);
1723 			wiphy_work_queue(sdata->local->hw.wiphy,
1724 					 &ifmgd->csa_connection_drop_work);
1725 			goto out;
1726 		}
1727 
1728 		goto out;
1729 	}
1730 
1731 	if (!cfg80211_chandef_identical(&link->conf->chandef,
1732 					&link->csa_chandef)) {
1733 		sdata_info(sdata,
1734 			   "failed to finalize channel switch, disconnecting\n");
1735 		wiphy_work_queue(sdata->local->hw.wiphy,
1736 				 &ifmgd->csa_connection_drop_work);
1737 		goto out;
1738 	}
1739 
1740 	link->u.mgd.csa_waiting_bcn = true;
1741 
1742 	ieee80211_sta_reset_beacon_monitor(sdata);
1743 	ieee80211_sta_reset_conn_monitor(sdata);
1744 
1745 out:
1746 	mutex_unlock(&local->chanctx_mtx);
1747 	mutex_unlock(&local->mtx);
1748 	sdata_unlock(sdata);
1749 }
1750 
ieee80211_chswitch_post_beacon(struct ieee80211_link_data * link)1751 static void ieee80211_chswitch_post_beacon(struct ieee80211_link_data *link)
1752 {
1753 	struct ieee80211_sub_if_data *sdata = link->sdata;
1754 	struct ieee80211_local *local = sdata->local;
1755 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1756 	int ret;
1757 
1758 	sdata_assert_lock(sdata);
1759 
1760 	WARN_ON(!link->conf->csa_active);
1761 
1762 	if (link->csa_block_tx) {
1763 		ieee80211_wake_vif_queues(local, sdata,
1764 					  IEEE80211_QUEUE_STOP_REASON_CSA);
1765 		link->csa_block_tx = false;
1766 	}
1767 
1768 	link->conf->csa_active = false;
1769 	link->u.mgd.csa_waiting_bcn = false;
1770 	/*
1771 	 * If the CSA IE is still present on the beacon after the switch,
1772 	 * we need to consider it as a new CSA (possibly to self).
1773 	 */
1774 	link->u.mgd.beacon_crc_valid = false;
1775 
1776 	ret = drv_post_channel_switch(sdata);
1777 	if (ret) {
1778 		sdata_info(sdata,
1779 			   "driver post channel switch failed, disconnecting\n");
1780 		wiphy_work_queue(sdata->local->hw.wiphy,
1781 				 &ifmgd->csa_connection_drop_work);
1782 		return;
1783 	}
1784 
1785 	cfg80211_ch_switch_notify(sdata->dev, &link->reserved_chandef, 0, 0);
1786 }
1787 
ieee80211_chswitch_done(struct ieee80211_vif * vif,bool success)1788 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
1789 {
1790 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1791 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1792 
1793 	if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
1794 		success = false;
1795 
1796 	trace_api_chswitch_done(sdata, success);
1797 	if (!success) {
1798 		sdata_info(sdata,
1799 			   "driver channel switch failed, disconnecting\n");
1800 		wiphy_work_queue(sdata->local->hw.wiphy,
1801 				 &ifmgd->csa_connection_drop_work);
1802 	} else {
1803 		wiphy_delayed_work_queue(sdata->local->hw.wiphy,
1804 					 &sdata->deflink.u.mgd.chswitch_work,
1805 					 0);
1806 	}
1807 }
1808 EXPORT_SYMBOL(ieee80211_chswitch_done);
1809 
1810 static void
ieee80211_sta_abort_chanswitch(struct ieee80211_link_data * link)1811 ieee80211_sta_abort_chanswitch(struct ieee80211_link_data *link)
1812 {
1813 	struct ieee80211_sub_if_data *sdata = link->sdata;
1814 	struct ieee80211_local *local = sdata->local;
1815 
1816 	if (!local->ops->abort_channel_switch)
1817 		return;
1818 
1819 	mutex_lock(&local->mtx);
1820 
1821 	mutex_lock(&local->chanctx_mtx);
1822 	ieee80211_link_unreserve_chanctx(link);
1823 	mutex_unlock(&local->chanctx_mtx);
1824 
1825 	if (link->csa_block_tx)
1826 		ieee80211_wake_vif_queues(local, sdata,
1827 					  IEEE80211_QUEUE_STOP_REASON_CSA);
1828 
1829 	link->csa_block_tx = false;
1830 	link->conf->csa_active = false;
1831 
1832 	mutex_unlock(&local->mtx);
1833 
1834 	drv_abort_channel_switch(sdata);
1835 }
1836 
1837 static void
ieee80211_sta_process_chanswitch(struct ieee80211_link_data * link,u64 timestamp,u32 device_timestamp,struct ieee802_11_elems * elems,bool beacon)1838 ieee80211_sta_process_chanswitch(struct ieee80211_link_data *link,
1839 				 u64 timestamp, u32 device_timestamp,
1840 				 struct ieee802_11_elems *elems,
1841 				 bool beacon)
1842 {
1843 	struct ieee80211_sub_if_data *sdata = link->sdata;
1844 	struct ieee80211_local *local = sdata->local;
1845 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1846 	struct cfg80211_bss *cbss = link->u.mgd.bss;
1847 	struct ieee80211_chanctx_conf *conf;
1848 	struct ieee80211_chanctx *chanctx;
1849 	enum nl80211_band current_band;
1850 	struct ieee80211_csa_ie csa_ie;
1851 	struct ieee80211_channel_switch ch_switch;
1852 	struct ieee80211_bss *bss;
1853 	unsigned long timeout;
1854 	int res;
1855 
1856 	sdata_assert_lock(sdata);
1857 
1858 	if (!cbss)
1859 		return;
1860 
1861 	current_band = cbss->channel->band;
1862 	bss = (void *)cbss->priv;
1863 	res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1864 					   bss->vht_cap_info,
1865 					   link->u.mgd.conn_flags,
1866 					   link->u.mgd.bssid, &csa_ie);
1867 
1868 	if (!res) {
1869 		ch_switch.timestamp = timestamp;
1870 		ch_switch.device_timestamp = device_timestamp;
1871 		ch_switch.block_tx = csa_ie.mode;
1872 		ch_switch.chandef = csa_ie.chandef;
1873 		ch_switch.count = csa_ie.count;
1874 		ch_switch.delay = csa_ie.max_switch_time;
1875 	}
1876 
1877 	if (res < 0)
1878 		goto lock_and_drop_connection;
1879 
1880 	if (beacon && link->conf->csa_active &&
1881 	    !link->u.mgd.csa_waiting_bcn) {
1882 		if (res)
1883 			ieee80211_sta_abort_chanswitch(link);
1884 		else
1885 			drv_channel_switch_rx_beacon(sdata, &ch_switch);
1886 		return;
1887 	} else if (link->conf->csa_active || res) {
1888 		/* disregard subsequent announcements if already processing */
1889 		return;
1890 	}
1891 
1892 	if (link->conf->chandef.chan->band !=
1893 	    csa_ie.chandef.chan->band) {
1894 		sdata_info(sdata,
1895 			   "AP %pM switches to different band (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1896 			   link->u.mgd.bssid,
1897 			   csa_ie.chandef.chan->center_freq,
1898 			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1899 			   csa_ie.chandef.center_freq2);
1900 		goto lock_and_drop_connection;
1901 	}
1902 
1903 	if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1904 				     IEEE80211_CHAN_DISABLED)) {
1905 		sdata_info(sdata,
1906 			   "AP %pM switches to unsupported channel "
1907 			   "(%d.%03d MHz, width:%d, CF1/2: %d.%03d/%d MHz), "
1908 			   "disconnecting\n",
1909 			   link->u.mgd.bssid,
1910 			   csa_ie.chandef.chan->center_freq,
1911 			   csa_ie.chandef.chan->freq_offset,
1912 			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1913 			   csa_ie.chandef.freq1_offset,
1914 			   csa_ie.chandef.center_freq2);
1915 		goto lock_and_drop_connection;
1916 	}
1917 
1918 	if (cfg80211_chandef_identical(&csa_ie.chandef,
1919 				       &link->conf->chandef) &&
1920 	    (!csa_ie.mode || !beacon)) {
1921 		if (link->u.mgd.csa_ignored_same_chan)
1922 			return;
1923 		sdata_info(sdata,
1924 			   "AP %pM tries to chanswitch to same channel, ignore\n",
1925 			   link->u.mgd.bssid);
1926 		link->u.mgd.csa_ignored_same_chan = true;
1927 		return;
1928 	}
1929 
1930 	/*
1931 	 * Drop all TDLS peers - either we disconnect or move to a different
1932 	 * channel from this point on. There's no telling what our peer will do.
1933 	 * The TDLS WIDER_BW scenario is also problematic, as peers might now
1934 	 * have an incompatible wider chandef.
1935 	 */
1936 	ieee80211_teardown_tdls_peers(sdata);
1937 
1938 	mutex_lock(&local->mtx);
1939 	mutex_lock(&local->chanctx_mtx);
1940 	conf = rcu_dereference_protected(link->conf->chanctx_conf,
1941 					 lockdep_is_held(&local->chanctx_mtx));
1942 	if (!conf) {
1943 		sdata_info(sdata,
1944 			   "no channel context assigned to vif?, disconnecting\n");
1945 		goto drop_connection;
1946 	}
1947 
1948 	chanctx = container_of(conf, struct ieee80211_chanctx, conf);
1949 
1950 	if (local->use_chanctx &&
1951 	    !ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
1952 		sdata_info(sdata,
1953 			   "driver doesn't support chan-switch with channel contexts\n");
1954 		goto drop_connection;
1955 	}
1956 
1957 	if (drv_pre_channel_switch(sdata, &ch_switch)) {
1958 		sdata_info(sdata,
1959 			   "preparing for channel switch failed, disconnecting\n");
1960 		goto drop_connection;
1961 	}
1962 
1963 	res = ieee80211_link_reserve_chanctx(link, &csa_ie.chandef,
1964 					     chanctx->mode, false);
1965 	if (res) {
1966 		sdata_info(sdata,
1967 			   "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
1968 			   res);
1969 		goto drop_connection;
1970 	}
1971 	mutex_unlock(&local->chanctx_mtx);
1972 
1973 	link->conf->csa_active = true;
1974 	link->csa_chandef = csa_ie.chandef;
1975 	link->csa_block_tx = csa_ie.mode;
1976 	link->u.mgd.csa_ignored_same_chan = false;
1977 	link->u.mgd.beacon_crc_valid = false;
1978 
1979 	if (link->csa_block_tx)
1980 		ieee80211_stop_vif_queues(local, sdata,
1981 					  IEEE80211_QUEUE_STOP_REASON_CSA);
1982 	mutex_unlock(&local->mtx);
1983 
1984 	cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
1985 					  link->link_id, csa_ie.count,
1986 					  csa_ie.mode, 0);
1987 
1988 	if (local->ops->channel_switch) {
1989 		/* use driver's channel switch callback */
1990 		drv_channel_switch(local, sdata, &ch_switch);
1991 		return;
1992 	}
1993 
1994 	/* channel switch handled in software */
1995 	timeout = TU_TO_JIFFIES((max_t(int, csa_ie.count, 1) - 1) *
1996 				cbss->beacon_interval);
1997 	wiphy_delayed_work_queue(local->hw.wiphy,
1998 				 &link->u.mgd.chswitch_work,
1999 				 timeout);
2000 	return;
2001  lock_and_drop_connection:
2002 	mutex_lock(&local->mtx);
2003 	mutex_lock(&local->chanctx_mtx);
2004  drop_connection:
2005 	/*
2006 	 * This is just so that the disconnect flow will know that
2007 	 * we were trying to switch channel and failed. In case the
2008 	 * mode is 1 (we are not allowed to Tx), we will know not to
2009 	 * send a deauthentication frame. Those two fields will be
2010 	 * reset when the disconnection worker runs.
2011 	 */
2012 	link->conf->csa_active = true;
2013 	link->csa_block_tx = csa_ie.mode;
2014 
2015 	wiphy_work_queue(sdata->local->hw.wiphy,
2016 			 &ifmgd->csa_connection_drop_work);
2017 	mutex_unlock(&local->chanctx_mtx);
2018 	mutex_unlock(&local->mtx);
2019 }
2020 
2021 static bool
ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data * sdata,struct ieee80211_channel * channel,const u8 * country_ie,u8 country_ie_len,const u8 * pwr_constr_elem,int * chan_pwr,int * pwr_reduction)2022 ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
2023 				 struct ieee80211_channel *channel,
2024 				 const u8 *country_ie, u8 country_ie_len,
2025 				 const u8 *pwr_constr_elem,
2026 				 int *chan_pwr, int *pwr_reduction)
2027 {
2028 	struct ieee80211_country_ie_triplet *triplet;
2029 	int chan = ieee80211_frequency_to_channel(channel->center_freq);
2030 	int i, chan_increment;
2031 	bool have_chan_pwr = false;
2032 
2033 	/* Invalid IE */
2034 	if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
2035 		return false;
2036 
2037 	triplet = (void *)(country_ie + 3);
2038 	country_ie_len -= 3;
2039 
2040 	switch (channel->band) {
2041 	default:
2042 		WARN_ON_ONCE(1);
2043 		fallthrough;
2044 	case NL80211_BAND_2GHZ:
2045 	case NL80211_BAND_60GHZ:
2046 	case NL80211_BAND_LC:
2047 		chan_increment = 1;
2048 		break;
2049 	case NL80211_BAND_5GHZ:
2050 		chan_increment = 4;
2051 		break;
2052 	case NL80211_BAND_6GHZ:
2053 		/*
2054 		 * In the 6 GHz band, the "maximum transmit power level"
2055 		 * field in the triplets is reserved, and thus will be
2056 		 * zero and we shouldn't use it to control TX power.
2057 		 * The actual TX power will be given in the transmit
2058 		 * power envelope element instead.
2059 		 */
2060 		return false;
2061 	}
2062 
2063 	/* find channel */
2064 	while (country_ie_len >= 3) {
2065 		u8 first_channel = triplet->chans.first_channel;
2066 
2067 		if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
2068 			goto next;
2069 
2070 		for (i = 0; i < triplet->chans.num_channels; i++) {
2071 			if (first_channel + i * chan_increment == chan) {
2072 				have_chan_pwr = true;
2073 				*chan_pwr = triplet->chans.max_power;
2074 				break;
2075 			}
2076 		}
2077 		if (have_chan_pwr)
2078 			break;
2079 
2080  next:
2081 		triplet++;
2082 		country_ie_len -= 3;
2083 	}
2084 
2085 	if (have_chan_pwr && pwr_constr_elem)
2086 		*pwr_reduction = *pwr_constr_elem;
2087 	else
2088 		*pwr_reduction = 0;
2089 
2090 	return have_chan_pwr;
2091 }
2092 
ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data * sdata,struct ieee80211_channel * channel,const u8 * cisco_dtpc_ie,int * pwr_level)2093 static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
2094 				      struct ieee80211_channel *channel,
2095 				      const u8 *cisco_dtpc_ie,
2096 				      int *pwr_level)
2097 {
2098 	/* From practical testing, the first data byte of the DTPC element
2099 	 * seems to contain the requested dBm level, and the CLI on Cisco
2100 	 * APs clearly state the range is -127 to 127 dBm, which indicates
2101 	 * a signed byte, although it seemingly never actually goes negative.
2102 	 * The other byte seems to always be zero.
2103 	 */
2104 	*pwr_level = (__s8)cisco_dtpc_ie[4];
2105 }
2106 
ieee80211_handle_pwr_constr(struct ieee80211_link_data * link,struct ieee80211_channel * channel,struct ieee80211_mgmt * mgmt,const u8 * country_ie,u8 country_ie_len,const u8 * pwr_constr_ie,const u8 * cisco_dtpc_ie)2107 static u64 ieee80211_handle_pwr_constr(struct ieee80211_link_data *link,
2108 				       struct ieee80211_channel *channel,
2109 				       struct ieee80211_mgmt *mgmt,
2110 				       const u8 *country_ie, u8 country_ie_len,
2111 				       const u8 *pwr_constr_ie,
2112 				       const u8 *cisco_dtpc_ie)
2113 {
2114 	struct ieee80211_sub_if_data *sdata = link->sdata;
2115 	bool has_80211h_pwr = false, has_cisco_pwr = false;
2116 	int chan_pwr = 0, pwr_reduction_80211h = 0;
2117 	int pwr_level_cisco, pwr_level_80211h;
2118 	int new_ap_level;
2119 	__le16 capab = mgmt->u.probe_resp.capab_info;
2120 
2121 	if (ieee80211_is_s1g_beacon(mgmt->frame_control))
2122 		return 0;	/* TODO */
2123 
2124 	if (country_ie &&
2125 	    (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
2126 	     capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
2127 		has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
2128 			sdata, channel, country_ie, country_ie_len,
2129 			pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
2130 		pwr_level_80211h =
2131 			max_t(int, 0, chan_pwr - pwr_reduction_80211h);
2132 	}
2133 
2134 	if (cisco_dtpc_ie) {
2135 		ieee80211_find_cisco_dtpc(
2136 			sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
2137 		has_cisco_pwr = true;
2138 	}
2139 
2140 	if (!has_80211h_pwr && !has_cisco_pwr)
2141 		return 0;
2142 
2143 	/* If we have both 802.11h and Cisco DTPC, apply both limits
2144 	 * by picking the smallest of the two power levels advertised.
2145 	 */
2146 	if (has_80211h_pwr &&
2147 	    (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
2148 		new_ap_level = pwr_level_80211h;
2149 
2150 		if (link->ap_power_level == new_ap_level)
2151 			return 0;
2152 
2153 		sdata_dbg(sdata,
2154 			  "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
2155 			  pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
2156 			  link->u.mgd.bssid);
2157 	} else {  /* has_cisco_pwr is always true here. */
2158 		new_ap_level = pwr_level_cisco;
2159 
2160 		if (link->ap_power_level == new_ap_level)
2161 			return 0;
2162 
2163 		sdata_dbg(sdata,
2164 			  "Limiting TX power to %d dBm as advertised by %pM\n",
2165 			  pwr_level_cisco, link->u.mgd.bssid);
2166 	}
2167 
2168 	link->ap_power_level = new_ap_level;
2169 	if (__ieee80211_recalc_txpower(sdata))
2170 		return BSS_CHANGED_TXPOWER;
2171 	return 0;
2172 }
2173 
2174 /* powersave */
ieee80211_enable_ps(struct ieee80211_local * local,struct ieee80211_sub_if_data * sdata)2175 static void ieee80211_enable_ps(struct ieee80211_local *local,
2176 				struct ieee80211_sub_if_data *sdata)
2177 {
2178 	struct ieee80211_conf *conf = &local->hw.conf;
2179 
2180 	/*
2181 	 * If we are scanning right now then the parameters will
2182 	 * take effect when scan finishes.
2183 	 */
2184 	if (local->scanning)
2185 		return;
2186 
2187 	if (conf->dynamic_ps_timeout > 0 &&
2188 	    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
2189 		mod_timer(&local->dynamic_ps_timer, jiffies +
2190 			  msecs_to_jiffies(conf->dynamic_ps_timeout));
2191 	} else {
2192 		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
2193 			ieee80211_send_nullfunc(local, sdata, true);
2194 
2195 		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
2196 		    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2197 			return;
2198 
2199 		conf->flags |= IEEE80211_CONF_PS;
2200 		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2201 	}
2202 }
2203 
ieee80211_change_ps(struct ieee80211_local * local)2204 static void ieee80211_change_ps(struct ieee80211_local *local)
2205 {
2206 	struct ieee80211_conf *conf = &local->hw.conf;
2207 
2208 	if (local->ps_sdata) {
2209 		ieee80211_enable_ps(local, local->ps_sdata);
2210 	} else if (conf->flags & IEEE80211_CONF_PS) {
2211 		conf->flags &= ~IEEE80211_CONF_PS;
2212 		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2213 		del_timer_sync(&local->dynamic_ps_timer);
2214 		cancel_work_sync(&local->dynamic_ps_enable_work);
2215 	}
2216 }
2217 
ieee80211_powersave_allowed(struct ieee80211_sub_if_data * sdata)2218 static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
2219 {
2220 	struct ieee80211_local *local = sdata->local;
2221 	struct ieee80211_if_managed *mgd = &sdata->u.mgd;
2222 	struct sta_info *sta = NULL;
2223 	bool authorized = false;
2224 
2225 	if (!mgd->powersave)
2226 		return false;
2227 
2228 	if (mgd->broken_ap)
2229 		return false;
2230 
2231 	if (!mgd->associated)
2232 		return false;
2233 
2234 	if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
2235 		return false;
2236 
2237 	if (!(local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO) &&
2238 	    !sdata->deflink.u.mgd.have_beacon)
2239 		return false;
2240 
2241 	rcu_read_lock();
2242 	sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
2243 	if (sta)
2244 		authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
2245 	rcu_read_unlock();
2246 
2247 	return authorized;
2248 }
2249 
2250 /* need to hold RTNL or interface lock */
ieee80211_recalc_ps(struct ieee80211_local * local)2251 void ieee80211_recalc_ps(struct ieee80211_local *local)
2252 {
2253 	struct ieee80211_sub_if_data *sdata, *found = NULL;
2254 	int count = 0;
2255 	int timeout;
2256 
2257 	if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS) ||
2258 	    ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
2259 		local->ps_sdata = NULL;
2260 		return;
2261 	}
2262 
2263 	list_for_each_entry(sdata, &local->interfaces, list) {
2264 		if (!ieee80211_sdata_running(sdata))
2265 			continue;
2266 		if (sdata->vif.type == NL80211_IFTYPE_AP) {
2267 			/* If an AP vif is found, then disable PS
2268 			 * by setting the count to zero thereby setting
2269 			 * ps_sdata to NULL.
2270 			 */
2271 			count = 0;
2272 			break;
2273 		}
2274 		if (sdata->vif.type != NL80211_IFTYPE_STATION)
2275 			continue;
2276 		found = sdata;
2277 		count++;
2278 	}
2279 
2280 	if (count == 1 && ieee80211_powersave_allowed(found)) {
2281 		u8 dtimper = found->deflink.u.mgd.dtim_period;
2282 
2283 		timeout = local->dynamic_ps_forced_timeout;
2284 		if (timeout < 0)
2285 			timeout = 100;
2286 		local->hw.conf.dynamic_ps_timeout = timeout;
2287 
2288 		/* If the TIM IE is invalid, pretend the value is 1 */
2289 		if (!dtimper)
2290 			dtimper = 1;
2291 
2292 		local->hw.conf.ps_dtim_period = dtimper;
2293 		local->ps_sdata = found;
2294 	} else {
2295 		local->ps_sdata = NULL;
2296 	}
2297 
2298 	ieee80211_change_ps(local);
2299 }
2300 
ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data * sdata)2301 void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
2302 {
2303 	bool ps_allowed = ieee80211_powersave_allowed(sdata);
2304 
2305 	if (sdata->vif.cfg.ps != ps_allowed) {
2306 		sdata->vif.cfg.ps = ps_allowed;
2307 		ieee80211_vif_cfg_change_notify(sdata, BSS_CHANGED_PS);
2308 	}
2309 }
2310 
ieee80211_dynamic_ps_disable_work(struct work_struct * work)2311 void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
2312 {
2313 	struct ieee80211_local *local =
2314 		container_of(work, struct ieee80211_local,
2315 			     dynamic_ps_disable_work);
2316 
2317 	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
2318 		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
2319 		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2320 	}
2321 
2322 	ieee80211_wake_queues_by_reason(&local->hw,
2323 					IEEE80211_MAX_QUEUE_MAP,
2324 					IEEE80211_QUEUE_STOP_REASON_PS,
2325 					false);
2326 }
2327 
ieee80211_dynamic_ps_enable_work(struct work_struct * work)2328 void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
2329 {
2330 	struct ieee80211_local *local =
2331 		container_of(work, struct ieee80211_local,
2332 			     dynamic_ps_enable_work);
2333 	struct ieee80211_sub_if_data *sdata = local->ps_sdata;
2334 	struct ieee80211_if_managed *ifmgd;
2335 	unsigned long flags;
2336 	int q;
2337 
2338 	/* can only happen when PS was just disabled anyway */
2339 	if (!sdata)
2340 		return;
2341 
2342 	ifmgd = &sdata->u.mgd;
2343 
2344 	if (local->hw.conf.flags & IEEE80211_CONF_PS)
2345 		return;
2346 
2347 	if (local->hw.conf.dynamic_ps_timeout > 0) {
2348 		/* don't enter PS if TX frames are pending */
2349 		if (drv_tx_frames_pending(local)) {
2350 			mod_timer(&local->dynamic_ps_timer, jiffies +
2351 				  msecs_to_jiffies(
2352 				  local->hw.conf.dynamic_ps_timeout));
2353 			return;
2354 		}
2355 
2356 		/*
2357 		 * transmission can be stopped by others which leads to
2358 		 * dynamic_ps_timer expiry. Postpone the ps timer if it
2359 		 * is not the actual idle state.
2360 		 */
2361 		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
2362 		for (q = 0; q < local->hw.queues; q++) {
2363 			if (local->queue_stop_reasons[q]) {
2364 				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
2365 						       flags);
2366 				mod_timer(&local->dynamic_ps_timer, jiffies +
2367 					  msecs_to_jiffies(
2368 					  local->hw.conf.dynamic_ps_timeout));
2369 				return;
2370 			}
2371 		}
2372 		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
2373 	}
2374 
2375 	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
2376 	    !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
2377 		if (drv_tx_frames_pending(local)) {
2378 			mod_timer(&local->dynamic_ps_timer, jiffies +
2379 				  msecs_to_jiffies(
2380 				  local->hw.conf.dynamic_ps_timeout));
2381 		} else {
2382 			ieee80211_send_nullfunc(local, sdata, true);
2383 			/* Flush to get the tx status of nullfunc frame */
2384 			ieee80211_flush_queues(local, sdata, false);
2385 		}
2386 	}
2387 
2388 	if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
2389 	      ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
2390 	    (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
2391 		ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
2392 		local->hw.conf.flags |= IEEE80211_CONF_PS;
2393 		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2394 	}
2395 }
2396 
ieee80211_dynamic_ps_timer(struct timer_list * t)2397 void ieee80211_dynamic_ps_timer(struct timer_list *t)
2398 {
2399 	struct ieee80211_local *local = from_timer(local, t, dynamic_ps_timer);
2400 
2401 	ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
2402 }
2403 
ieee80211_dfs_cac_timer_work(struct work_struct * work)2404 void ieee80211_dfs_cac_timer_work(struct work_struct *work)
2405 {
2406 	struct delayed_work *delayed_work = to_delayed_work(work);
2407 	struct ieee80211_link_data *link =
2408 		container_of(delayed_work, struct ieee80211_link_data,
2409 			     dfs_cac_timer_work);
2410 	struct cfg80211_chan_def chandef = link->conf->chandef;
2411 	struct ieee80211_sub_if_data *sdata = link->sdata;
2412 
2413 	mutex_lock(&sdata->local->mtx);
2414 	if (sdata->wdev.cac_started) {
2415 		ieee80211_link_release_channel(link);
2416 		cfg80211_cac_event(sdata->dev, &chandef,
2417 				   NL80211_RADAR_CAC_FINISHED,
2418 				   GFP_KERNEL);
2419 	}
2420 	mutex_unlock(&sdata->local->mtx);
2421 }
2422 
2423 static bool
__ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data * sdata)2424 __ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
2425 {
2426 	struct ieee80211_local *local = sdata->local;
2427 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2428 	bool ret = false;
2429 	int ac;
2430 
2431 	if (local->hw.queues < IEEE80211_NUM_ACS)
2432 		return false;
2433 
2434 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2435 		struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
2436 		int non_acm_ac;
2437 		unsigned long now = jiffies;
2438 
2439 		if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
2440 		    tx_tspec->admitted_time &&
2441 		    time_after(now, tx_tspec->time_slice_start + HZ)) {
2442 			tx_tspec->consumed_tx_time = 0;
2443 			tx_tspec->time_slice_start = now;
2444 
2445 			if (tx_tspec->downgraded)
2446 				tx_tspec->action =
2447 					TX_TSPEC_ACTION_STOP_DOWNGRADE;
2448 		}
2449 
2450 		switch (tx_tspec->action) {
2451 		case TX_TSPEC_ACTION_STOP_DOWNGRADE:
2452 			/* take the original parameters */
2453 			if (drv_conf_tx(local, &sdata->deflink, ac,
2454 					&sdata->deflink.tx_conf[ac]))
2455 				link_err(&sdata->deflink,
2456 					 "failed to set TX queue parameters for queue %d\n",
2457 					 ac);
2458 			tx_tspec->action = TX_TSPEC_ACTION_NONE;
2459 			tx_tspec->downgraded = false;
2460 			ret = true;
2461 			break;
2462 		case TX_TSPEC_ACTION_DOWNGRADE:
2463 			if (time_after(now, tx_tspec->time_slice_start + HZ)) {
2464 				tx_tspec->action = TX_TSPEC_ACTION_NONE;
2465 				ret = true;
2466 				break;
2467 			}
2468 			/* downgrade next lower non-ACM AC */
2469 			for (non_acm_ac = ac + 1;
2470 			     non_acm_ac < IEEE80211_NUM_ACS;
2471 			     non_acm_ac++)
2472 				if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
2473 					break;
2474 			/* Usually the loop will result in using BK even if it
2475 			 * requires admission control, but such a configuration
2476 			 * makes no sense and we have to transmit somehow - the
2477 			 * AC selection does the same thing.
2478 			 * If we started out trying to downgrade from BK, then
2479 			 * the extra condition here might be needed.
2480 			 */
2481 			if (non_acm_ac >= IEEE80211_NUM_ACS)
2482 				non_acm_ac = IEEE80211_AC_BK;
2483 			if (drv_conf_tx(local, &sdata->deflink, ac,
2484 					&sdata->deflink.tx_conf[non_acm_ac]))
2485 				link_err(&sdata->deflink,
2486 					 "failed to set TX queue parameters for queue %d\n",
2487 					 ac);
2488 			tx_tspec->action = TX_TSPEC_ACTION_NONE;
2489 			ret = true;
2490 			schedule_delayed_work(&ifmgd->tx_tspec_wk,
2491 				tx_tspec->time_slice_start + HZ - now + 1);
2492 			break;
2493 		case TX_TSPEC_ACTION_NONE:
2494 			/* nothing now */
2495 			break;
2496 		}
2497 	}
2498 
2499 	return ret;
2500 }
2501 
ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data * sdata)2502 void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
2503 {
2504 	if (__ieee80211_sta_handle_tspec_ac_params(sdata))
2505 		ieee80211_link_info_change_notify(sdata, &sdata->deflink,
2506 						  BSS_CHANGED_QOS);
2507 }
2508 
ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct * work)2509 static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
2510 {
2511 	struct ieee80211_sub_if_data *sdata;
2512 
2513 	sdata = container_of(work, struct ieee80211_sub_if_data,
2514 			     u.mgd.tx_tspec_wk.work);
2515 	ieee80211_sta_handle_tspec_ac_params(sdata);
2516 }
2517 
ieee80211_mgd_set_link_qos_params(struct ieee80211_link_data * link)2518 void ieee80211_mgd_set_link_qos_params(struct ieee80211_link_data *link)
2519 {
2520 	struct ieee80211_sub_if_data *sdata = link->sdata;
2521 	struct ieee80211_local *local = sdata->local;
2522 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2523 	struct ieee80211_tx_queue_params *params = link->tx_conf;
2524 	u8 ac;
2525 
2526 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2527 		mlme_dbg(sdata,
2528 			 "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
2529 			 ac, params[ac].acm,
2530 			 params[ac].aifs, params[ac].cw_min, params[ac].cw_max,
2531 			 params[ac].txop, params[ac].uapsd,
2532 			 ifmgd->tx_tspec[ac].downgraded);
2533 		if (!ifmgd->tx_tspec[ac].downgraded &&
2534 		    drv_conf_tx(local, link, ac, &params[ac]))
2535 			link_err(link,
2536 				 "failed to set TX queue parameters for AC %d\n",
2537 				 ac);
2538 	}
2539 }
2540 
2541 /* MLME */
2542 static bool
ieee80211_sta_wmm_params(struct ieee80211_local * local,struct ieee80211_link_data * link,const u8 * wmm_param,size_t wmm_param_len,const struct ieee80211_mu_edca_param_set * mu_edca)2543 ieee80211_sta_wmm_params(struct ieee80211_local *local,
2544 			 struct ieee80211_link_data *link,
2545 			 const u8 *wmm_param, size_t wmm_param_len,
2546 			 const struct ieee80211_mu_edca_param_set *mu_edca)
2547 {
2548 	struct ieee80211_sub_if_data *sdata = link->sdata;
2549 	struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS];
2550 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2551 	size_t left;
2552 	int count, mu_edca_count, ac;
2553 	const u8 *pos;
2554 	u8 uapsd_queues = 0;
2555 
2556 	if (!local->ops->conf_tx)
2557 		return false;
2558 
2559 	if (local->hw.queues < IEEE80211_NUM_ACS)
2560 		return false;
2561 
2562 	if (!wmm_param)
2563 		return false;
2564 
2565 	if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
2566 		return false;
2567 
2568 	if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
2569 		uapsd_queues = ifmgd->uapsd_queues;
2570 
2571 	count = wmm_param[6] & 0x0f;
2572 	/* -1 is the initial value of ifmgd->mu_edca_last_param_set.
2573 	 * if mu_edca was preset before and now it disappeared tell
2574 	 * the driver about it.
2575 	 */
2576 	mu_edca_count = mu_edca ? mu_edca->mu_qos_info & 0x0f : -1;
2577 	if (count == link->u.mgd.wmm_last_param_set &&
2578 	    mu_edca_count == link->u.mgd.mu_edca_last_param_set)
2579 		return false;
2580 	link->u.mgd.wmm_last_param_set = count;
2581 	link->u.mgd.mu_edca_last_param_set = mu_edca_count;
2582 
2583 	pos = wmm_param + 8;
2584 	left = wmm_param_len - 8;
2585 
2586 	memset(&params, 0, sizeof(params));
2587 
2588 	sdata->wmm_acm = 0;
2589 	for (; left >= 4; left -= 4, pos += 4) {
2590 		int aci = (pos[0] >> 5) & 0x03;
2591 		int acm = (pos[0] >> 4) & 0x01;
2592 		bool uapsd = false;
2593 
2594 		switch (aci) {
2595 		case 1: /* AC_BK */
2596 			ac = IEEE80211_AC_BK;
2597 			if (acm)
2598 				sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
2599 			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
2600 				uapsd = true;
2601 			params[ac].mu_edca = !!mu_edca;
2602 			if (mu_edca)
2603 				params[ac].mu_edca_param_rec = mu_edca->ac_bk;
2604 			break;
2605 		case 2: /* AC_VI */
2606 			ac = IEEE80211_AC_VI;
2607 			if (acm)
2608 				sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
2609 			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
2610 				uapsd = true;
2611 			params[ac].mu_edca = !!mu_edca;
2612 			if (mu_edca)
2613 				params[ac].mu_edca_param_rec = mu_edca->ac_vi;
2614 			break;
2615 		case 3: /* AC_VO */
2616 			ac = IEEE80211_AC_VO;
2617 			if (acm)
2618 				sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
2619 			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
2620 				uapsd = true;
2621 			params[ac].mu_edca = !!mu_edca;
2622 			if (mu_edca)
2623 				params[ac].mu_edca_param_rec = mu_edca->ac_vo;
2624 			break;
2625 		case 0: /* AC_BE */
2626 		default:
2627 			ac = IEEE80211_AC_BE;
2628 			if (acm)
2629 				sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
2630 			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
2631 				uapsd = true;
2632 			params[ac].mu_edca = !!mu_edca;
2633 			if (mu_edca)
2634 				params[ac].mu_edca_param_rec = mu_edca->ac_be;
2635 			break;
2636 		}
2637 
2638 		params[ac].aifs = pos[0] & 0x0f;
2639 
2640 		if (params[ac].aifs < 2) {
2641 			link_info(link,
2642 				  "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n",
2643 				  params[ac].aifs, aci);
2644 			params[ac].aifs = 2;
2645 		}
2646 		params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
2647 		params[ac].cw_min = ecw2cw(pos[1] & 0x0f);
2648 		params[ac].txop = get_unaligned_le16(pos + 2);
2649 		params[ac].acm = acm;
2650 		params[ac].uapsd = uapsd;
2651 
2652 		if (params[ac].cw_min == 0 ||
2653 		    params[ac].cw_min > params[ac].cw_max) {
2654 			link_info(link,
2655 				  "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
2656 				  params[ac].cw_min, params[ac].cw_max, aci);
2657 			return false;
2658 		}
2659 		ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
2660 	}
2661 
2662 	/* WMM specification requires all 4 ACIs. */
2663 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
2664 		if (params[ac].cw_min == 0) {
2665 			link_info(link,
2666 				  "AP has invalid WMM params (missing AC %d), using defaults\n",
2667 				  ac);
2668 			return false;
2669 		}
2670 	}
2671 
2672 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
2673 		link->tx_conf[ac] = params[ac];
2674 
2675 	ieee80211_mgd_set_link_qos_params(link);
2676 
2677 	/* enable WMM or activate new settings */
2678 	link->conf->qos = true;
2679 	return true;
2680 }
2681 
__ieee80211_stop_poll(struct ieee80211_sub_if_data * sdata)2682 static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
2683 {
2684 	lockdep_assert_held(&sdata->local->mtx);
2685 
2686 	sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
2687 	ieee80211_run_deferred_scan(sdata->local);
2688 }
2689 
ieee80211_stop_poll(struct ieee80211_sub_if_data * sdata)2690 static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
2691 {
2692 	mutex_lock(&sdata->local->mtx);
2693 	__ieee80211_stop_poll(sdata);
2694 	mutex_unlock(&sdata->local->mtx);
2695 }
2696 
ieee80211_handle_bss_capability(struct ieee80211_link_data * link,u16 capab,bool erp_valid,u8 erp)2697 static u64 ieee80211_handle_bss_capability(struct ieee80211_link_data *link,
2698 					   u16 capab, bool erp_valid, u8 erp)
2699 {
2700 	struct ieee80211_bss_conf *bss_conf = link->conf;
2701 	struct ieee80211_supported_band *sband;
2702 	u64 changed = 0;
2703 	bool use_protection;
2704 	bool use_short_preamble;
2705 	bool use_short_slot;
2706 
2707 	sband = ieee80211_get_link_sband(link);
2708 	if (!sband)
2709 		return changed;
2710 
2711 	if (erp_valid) {
2712 		use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
2713 		use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
2714 	} else {
2715 		use_protection = false;
2716 		use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
2717 	}
2718 
2719 	use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
2720 	if (sband->band == NL80211_BAND_5GHZ ||
2721 	    sband->band == NL80211_BAND_6GHZ)
2722 		use_short_slot = true;
2723 
2724 	if (use_protection != bss_conf->use_cts_prot) {
2725 		bss_conf->use_cts_prot = use_protection;
2726 		changed |= BSS_CHANGED_ERP_CTS_PROT;
2727 	}
2728 
2729 	if (use_short_preamble != bss_conf->use_short_preamble) {
2730 		bss_conf->use_short_preamble = use_short_preamble;
2731 		changed |= BSS_CHANGED_ERP_PREAMBLE;
2732 	}
2733 
2734 	if (use_short_slot != bss_conf->use_short_slot) {
2735 		bss_conf->use_short_slot = use_short_slot;
2736 		changed |= BSS_CHANGED_ERP_SLOT;
2737 	}
2738 
2739 	return changed;
2740 }
2741 
ieee80211_link_set_associated(struct ieee80211_link_data * link,struct cfg80211_bss * cbss)2742 static u64 ieee80211_link_set_associated(struct ieee80211_link_data *link,
2743 					 struct cfg80211_bss *cbss)
2744 {
2745 	struct ieee80211_sub_if_data *sdata = link->sdata;
2746 	struct ieee80211_bss_conf *bss_conf = link->conf;
2747 	struct ieee80211_bss *bss = (void *)cbss->priv;
2748 	u64 changed = BSS_CHANGED_QOS;
2749 
2750 	/* not really used in MLO */
2751 	sdata->u.mgd.beacon_timeout =
2752 		usecs_to_jiffies(ieee80211_tu_to_usec(beacon_loss_count *
2753 						      bss_conf->beacon_int));
2754 
2755 	changed |= ieee80211_handle_bss_capability(link,
2756 						   bss_conf->assoc_capability,
2757 						   bss->has_erp_value,
2758 						   bss->erp_value);
2759 
2760 	ieee80211_check_rate_mask(link);
2761 
2762 	link->u.mgd.bss = cbss;
2763 	memcpy(link->u.mgd.bssid, cbss->bssid, ETH_ALEN);
2764 
2765 	if (sdata->vif.p2p ||
2766 	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
2767 		const struct cfg80211_bss_ies *ies;
2768 
2769 		rcu_read_lock();
2770 		ies = rcu_dereference(cbss->ies);
2771 		if (ies) {
2772 			int ret;
2773 
2774 			ret = cfg80211_get_p2p_attr(
2775 					ies->data, ies->len,
2776 					IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
2777 					(u8 *) &bss_conf->p2p_noa_attr,
2778 					sizeof(bss_conf->p2p_noa_attr));
2779 			if (ret >= 2) {
2780 				link->u.mgd.p2p_noa_index =
2781 					bss_conf->p2p_noa_attr.index;
2782 				changed |= BSS_CHANGED_P2P_PS;
2783 			}
2784 		}
2785 		rcu_read_unlock();
2786 	}
2787 
2788 	if (link->u.mgd.have_beacon) {
2789 		bss_conf->beacon_rate = bss->beacon_rate;
2790 		changed |= BSS_CHANGED_BEACON_INFO;
2791 	} else {
2792 		bss_conf->beacon_rate = NULL;
2793 	}
2794 
2795 	/* Tell the driver to monitor connection quality (if supported) */
2796 	if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
2797 	    bss_conf->cqm_rssi_thold)
2798 		changed |= BSS_CHANGED_CQM;
2799 
2800 	return changed;
2801 }
2802 
ieee80211_set_associated(struct ieee80211_sub_if_data * sdata,struct ieee80211_mgd_assoc_data * assoc_data,u64 changed[IEEE80211_MLD_MAX_NUM_LINKS])2803 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
2804 				     struct ieee80211_mgd_assoc_data *assoc_data,
2805 				     u64 changed[IEEE80211_MLD_MAX_NUM_LINKS])
2806 {
2807 	struct ieee80211_local *local = sdata->local;
2808 	struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
2809 	u64 vif_changed = BSS_CHANGED_ASSOC;
2810 	unsigned int link_id;
2811 
2812 	sdata->u.mgd.associated = true;
2813 
2814 	for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
2815 		struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
2816 		struct ieee80211_link_data *link;
2817 
2818 		if (!cbss ||
2819 		    assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS)
2820 			continue;
2821 
2822 		if (ieee80211_vif_is_mld(&sdata->vif) &&
2823 		    !(ieee80211_vif_usable_links(&sdata->vif) & BIT(link_id)))
2824 			continue;
2825 
2826 		link = sdata_dereference(sdata->link[link_id], sdata);
2827 		if (WARN_ON(!link))
2828 			return;
2829 
2830 		changed[link_id] |= ieee80211_link_set_associated(link, cbss);
2831 	}
2832 
2833 	/* just to be sure */
2834 	ieee80211_stop_poll(sdata);
2835 
2836 	ieee80211_led_assoc(local, 1);
2837 
2838 	vif_cfg->assoc = 1;
2839 
2840 	/* Enable ARP filtering */
2841 	if (vif_cfg->arp_addr_cnt)
2842 		vif_changed |= BSS_CHANGED_ARP_FILTER;
2843 
2844 	if (ieee80211_vif_is_mld(&sdata->vif)) {
2845 		for (link_id = 0;
2846 		     link_id < IEEE80211_MLD_MAX_NUM_LINKS;
2847 		     link_id++) {
2848 			struct ieee80211_link_data *link;
2849 			struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
2850 
2851 			if (!cbss ||
2852 			    !(BIT(link_id) &
2853 			      ieee80211_vif_usable_links(&sdata->vif)) ||
2854 			    assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS)
2855 				continue;
2856 
2857 			link = sdata_dereference(sdata->link[link_id], sdata);
2858 			if (WARN_ON(!link))
2859 				return;
2860 
2861 			ieee80211_link_info_change_notify(sdata, link,
2862 							  changed[link_id]);
2863 
2864 			ieee80211_recalc_smps(sdata, link);
2865 		}
2866 
2867 		ieee80211_vif_cfg_change_notify(sdata, vif_changed);
2868 	} else {
2869 		ieee80211_bss_info_change_notify(sdata,
2870 						 vif_changed | changed[0]);
2871 	}
2872 
2873 	mutex_lock(&local->iflist_mtx);
2874 	ieee80211_recalc_ps(local);
2875 	mutex_unlock(&local->iflist_mtx);
2876 
2877 	/* leave this here to not change ordering in non-MLO cases */
2878 	if (!ieee80211_vif_is_mld(&sdata->vif))
2879 		ieee80211_recalc_smps(sdata, &sdata->deflink);
2880 	ieee80211_recalc_ps_vif(sdata);
2881 
2882 	netif_carrier_on(sdata->dev);
2883 }
2884 
ieee80211_set_disassoc(struct ieee80211_sub_if_data * sdata,u16 stype,u16 reason,bool tx,u8 * frame_buf)2885 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
2886 				   u16 stype, u16 reason, bool tx,
2887 				   u8 *frame_buf)
2888 {
2889 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2890 	struct ieee80211_local *local = sdata->local;
2891 	unsigned int link_id;
2892 	u64 changed = 0;
2893 	struct ieee80211_prep_tx_info info = {
2894 		.subtype = stype,
2895 	};
2896 
2897 	sdata_assert_lock(sdata);
2898 
2899 	if (WARN_ON_ONCE(tx && !frame_buf))
2900 		return;
2901 
2902 	if (WARN_ON(!ifmgd->associated))
2903 		return;
2904 
2905 	ieee80211_stop_poll(sdata);
2906 
2907 	ifmgd->associated = false;
2908 
2909 	/* other links will be destroyed */
2910 	sdata->deflink.u.mgd.bss = NULL;
2911 
2912 	netif_carrier_off(sdata->dev);
2913 
2914 	/*
2915 	 * if we want to get out of ps before disassoc (why?) we have
2916 	 * to do it before sending disassoc, as otherwise the null-packet
2917 	 * won't be valid.
2918 	 */
2919 	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
2920 		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
2921 		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2922 	}
2923 	local->ps_sdata = NULL;
2924 
2925 	/* disable per-vif ps */
2926 	ieee80211_recalc_ps_vif(sdata);
2927 
2928 	/* make sure ongoing transmission finishes */
2929 	synchronize_net();
2930 
2931 	/*
2932 	 * drop any frame before deauth/disassoc, this can be data or
2933 	 * management frame. Since we are disconnecting, we should not
2934 	 * insist sending these frames which can take time and delay
2935 	 * the disconnection and possible the roaming.
2936 	 */
2937 	if (tx)
2938 		ieee80211_flush_queues(local, sdata, true);
2939 
2940 	/* deauthenticate/disassociate now */
2941 	if (tx || frame_buf) {
2942 		/*
2943 		 * In multi channel scenarios guarantee that the virtual
2944 		 * interface is granted immediate airtime to transmit the
2945 		 * deauthentication frame by calling mgd_prepare_tx, if the
2946 		 * driver requested so.
2947 		 */
2948 		if (ieee80211_hw_check(&local->hw, DEAUTH_NEED_MGD_TX_PREP) &&
2949 		    !sdata->deflink.u.mgd.have_beacon) {
2950 			drv_mgd_prepare_tx(sdata->local, sdata, &info);
2951 		}
2952 
2953 		ieee80211_send_deauth_disassoc(sdata, sdata->vif.cfg.ap_addr,
2954 					       sdata->vif.cfg.ap_addr, stype,
2955 					       reason, tx, frame_buf);
2956 	}
2957 
2958 	/* flush out frame - make sure the deauth was actually sent */
2959 	if (tx)
2960 		ieee80211_flush_queues(local, sdata, false);
2961 
2962 	drv_mgd_complete_tx(sdata->local, sdata, &info);
2963 
2964 	/* clear AP addr only after building the needed mgmt frames */
2965 	eth_zero_addr(sdata->deflink.u.mgd.bssid);
2966 	eth_zero_addr(sdata->vif.cfg.ap_addr);
2967 
2968 	sdata->vif.cfg.ssid_len = 0;
2969 
2970 	/* remove AP and TDLS peers */
2971 	sta_info_flush(sdata);
2972 
2973 	/* finally reset all BSS / config parameters */
2974 	if (!ieee80211_vif_is_mld(&sdata->vif))
2975 		changed |= ieee80211_reset_erp_info(sdata);
2976 
2977 	ieee80211_led_assoc(local, 0);
2978 	changed |= BSS_CHANGED_ASSOC;
2979 	sdata->vif.cfg.assoc = false;
2980 
2981 	sdata->deflink.u.mgd.p2p_noa_index = -1;
2982 	memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
2983 	       sizeof(sdata->vif.bss_conf.p2p_noa_attr));
2984 
2985 	/* on the next assoc, re-program HT/VHT parameters */
2986 	memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
2987 	memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
2988 	memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
2989 	memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
2990 
2991 	/*
2992 	 * reset MU-MIMO ownership and group data in default link,
2993 	 * if used, other links are destroyed
2994 	 */
2995 	memset(sdata->vif.bss_conf.mu_group.membership, 0,
2996 	       sizeof(sdata->vif.bss_conf.mu_group.membership));
2997 	memset(sdata->vif.bss_conf.mu_group.position, 0,
2998 	       sizeof(sdata->vif.bss_conf.mu_group.position));
2999 	if (!ieee80211_vif_is_mld(&sdata->vif))
3000 		changed |= BSS_CHANGED_MU_GROUPS;
3001 	sdata->vif.bss_conf.mu_mimo_owner = false;
3002 
3003 	sdata->deflink.ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
3004 
3005 	del_timer_sync(&local->dynamic_ps_timer);
3006 	cancel_work_sync(&local->dynamic_ps_enable_work);
3007 
3008 	/* Disable ARP filtering */
3009 	if (sdata->vif.cfg.arp_addr_cnt)
3010 		changed |= BSS_CHANGED_ARP_FILTER;
3011 
3012 	sdata->vif.bss_conf.qos = false;
3013 	if (!ieee80211_vif_is_mld(&sdata->vif)) {
3014 		changed |= BSS_CHANGED_QOS;
3015 		/* The BSSID (not really interesting) and HT changed */
3016 		changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
3017 		ieee80211_bss_info_change_notify(sdata, changed);
3018 	} else {
3019 		ieee80211_vif_cfg_change_notify(sdata, changed);
3020 	}
3021 
3022 	/* disassociated - set to defaults now */
3023 	ieee80211_set_wmm_default(&sdata->deflink, false, false);
3024 
3025 	del_timer_sync(&sdata->u.mgd.conn_mon_timer);
3026 	del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
3027 	del_timer_sync(&sdata->u.mgd.timer);
3028 
3029 	sdata->vif.bss_conf.dtim_period = 0;
3030 	sdata->vif.bss_conf.beacon_rate = NULL;
3031 
3032 	sdata->deflink.u.mgd.have_beacon = false;
3033 	sdata->deflink.u.mgd.tracking_signal_avg = false;
3034 	sdata->deflink.u.mgd.disable_wmm_tracking = false;
3035 
3036 	ifmgd->flags = 0;
3037 	sdata->deflink.u.mgd.conn_flags = 0;
3038 	mutex_lock(&local->mtx);
3039 
3040 	for (link_id = 0; link_id < ARRAY_SIZE(sdata->link); link_id++) {
3041 		struct ieee80211_link_data *link;
3042 
3043 		link = sdata_dereference(sdata->link[link_id], sdata);
3044 		if (!link)
3045 			continue;
3046 		ieee80211_link_release_channel(link);
3047 	}
3048 
3049 	sdata->vif.bss_conf.csa_active = false;
3050 	sdata->deflink.u.mgd.csa_waiting_bcn = false;
3051 	sdata->deflink.u.mgd.csa_ignored_same_chan = false;
3052 	if (sdata->deflink.csa_block_tx) {
3053 		ieee80211_wake_vif_queues(local, sdata,
3054 					  IEEE80211_QUEUE_STOP_REASON_CSA);
3055 		sdata->deflink.csa_block_tx = false;
3056 	}
3057 	mutex_unlock(&local->mtx);
3058 
3059 	/* existing TX TSPEC sessions no longer exist */
3060 	memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
3061 	cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);
3062 
3063 	sdata->vif.bss_conf.pwr_reduction = 0;
3064 	sdata->vif.bss_conf.tx_pwr_env_num = 0;
3065 	memset(sdata->vif.bss_conf.tx_pwr_env, 0,
3066 	       sizeof(sdata->vif.bss_conf.tx_pwr_env));
3067 
3068 	ieee80211_vif_set_links(sdata, 0, 0);
3069 }
3070 
ieee80211_reset_ap_probe(struct ieee80211_sub_if_data * sdata)3071 static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
3072 {
3073 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3074 	struct ieee80211_local *local = sdata->local;
3075 
3076 	mutex_lock(&local->mtx);
3077 	if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
3078 		goto out;
3079 
3080 	__ieee80211_stop_poll(sdata);
3081 
3082 	mutex_lock(&local->iflist_mtx);
3083 	ieee80211_recalc_ps(local);
3084 	mutex_unlock(&local->iflist_mtx);
3085 
3086 	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
3087 		goto out;
3088 
3089 	/*
3090 	 * We've received a probe response, but are not sure whether
3091 	 * we have or will be receiving any beacons or data, so let's
3092 	 * schedule the timers again, just in case.
3093 	 */
3094 	ieee80211_sta_reset_beacon_monitor(sdata);
3095 
3096 	mod_timer(&ifmgd->conn_mon_timer,
3097 		  round_jiffies_up(jiffies +
3098 				   IEEE80211_CONNECTION_IDLE_TIME));
3099 out:
3100 	mutex_unlock(&local->mtx);
3101 }
3102 
ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data * sdata,struct ieee80211_hdr * hdr,u16 tx_time)3103 static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
3104 					   struct ieee80211_hdr *hdr,
3105 					   u16 tx_time)
3106 {
3107 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3108 	u16 tid;
3109 	int ac;
3110 	struct ieee80211_sta_tx_tspec *tx_tspec;
3111 	unsigned long now = jiffies;
3112 
3113 	if (!ieee80211_is_data_qos(hdr->frame_control))
3114 		return;
3115 
3116 	tid = ieee80211_get_tid(hdr);
3117 	ac = ieee80211_ac_from_tid(tid);
3118 	tx_tspec = &ifmgd->tx_tspec[ac];
3119 
3120 	if (likely(!tx_tspec->admitted_time))
3121 		return;
3122 
3123 	if (time_after(now, tx_tspec->time_slice_start + HZ)) {
3124 		tx_tspec->consumed_tx_time = 0;
3125 		tx_tspec->time_slice_start = now;
3126 
3127 		if (tx_tspec->downgraded) {
3128 			tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
3129 			schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
3130 		}
3131 	}
3132 
3133 	if (tx_tspec->downgraded)
3134 		return;
3135 
3136 	tx_tspec->consumed_tx_time += tx_time;
3137 
3138 	if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
3139 		tx_tspec->downgraded = true;
3140 		tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
3141 		schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
3142 	}
3143 }
3144 
ieee80211_sta_tx_notify(struct ieee80211_sub_if_data * sdata,struct ieee80211_hdr * hdr,bool ack,u16 tx_time)3145 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
3146 			     struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
3147 {
3148 	ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);
3149 
3150 	if (!ieee80211_is_any_nullfunc(hdr->frame_control) ||
3151 	    !sdata->u.mgd.probe_send_count)
3152 		return;
3153 
3154 	if (ack)
3155 		sdata->u.mgd.probe_send_count = 0;
3156 	else
3157 		sdata->u.mgd.nullfunc_failed = true;
3158 	wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
3159 }
3160 
ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data * sdata,const u8 * src,const u8 * dst,const u8 * ssid,size_t ssid_len,struct ieee80211_channel * channel)3161 static void ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data *sdata,
3162 					  const u8 *src, const u8 *dst,
3163 					  const u8 *ssid, size_t ssid_len,
3164 					  struct ieee80211_channel *channel)
3165 {
3166 	struct sk_buff *skb;
3167 
3168 	skb = ieee80211_build_probe_req(sdata, src, dst, (u32)-1, channel,
3169 					ssid, ssid_len, NULL, 0,
3170 					IEEE80211_PROBE_FLAG_DIRECTED);
3171 	if (skb)
3172 		ieee80211_tx_skb(sdata, skb);
3173 }
3174 
ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data * sdata)3175 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
3176 {
3177 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3178 	u8 *dst = sdata->vif.cfg.ap_addr;
3179 	u8 unicast_limit = max(1, max_probe_tries - 3);
3180 	struct sta_info *sta;
3181 
3182 	if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
3183 		return;
3184 
3185 	/*
3186 	 * Try sending broadcast probe requests for the last three
3187 	 * probe requests after the first ones failed since some
3188 	 * buggy APs only support broadcast probe requests.
3189 	 */
3190 	if (ifmgd->probe_send_count >= unicast_limit)
3191 		dst = NULL;
3192 
3193 	/*
3194 	 * When the hardware reports an accurate Tx ACK status, it's
3195 	 * better to send a nullfunc frame instead of a probe request,
3196 	 * as it will kick us off the AP quickly if we aren't associated
3197 	 * anymore. The timeout will be reset if the frame is ACKed by
3198 	 * the AP.
3199 	 */
3200 	ifmgd->probe_send_count++;
3201 
3202 	if (dst) {
3203 		mutex_lock(&sdata->local->sta_mtx);
3204 		sta = sta_info_get(sdata, dst);
3205 		if (!WARN_ON(!sta))
3206 			ieee80211_check_fast_rx(sta);
3207 		mutex_unlock(&sdata->local->sta_mtx);
3208 	}
3209 
3210 	if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
3211 		ifmgd->nullfunc_failed = false;
3212 		ieee80211_send_nullfunc(sdata->local, sdata, false);
3213 	} else {
3214 		ieee80211_mlme_send_probe_req(sdata, sdata->vif.addr, dst,
3215 					      sdata->vif.cfg.ssid,
3216 					      sdata->vif.cfg.ssid_len,
3217 					      sdata->deflink.u.mgd.bss->channel);
3218 	}
3219 
3220 	ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
3221 	run_again(sdata, ifmgd->probe_timeout);
3222 }
3223 
ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data * sdata,bool beacon)3224 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
3225 				   bool beacon)
3226 {
3227 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3228 	bool already = false;
3229 
3230 	if (WARN_ON_ONCE(ieee80211_vif_is_mld(&sdata->vif)))
3231 		return;
3232 
3233 	if (!ieee80211_sdata_running(sdata))
3234 		return;
3235 
3236 	sdata_lock(sdata);
3237 
3238 	if (!ifmgd->associated)
3239 		goto out;
3240 
3241 	mutex_lock(&sdata->local->mtx);
3242 
3243 	if (sdata->local->tmp_channel || sdata->local->scanning) {
3244 		mutex_unlock(&sdata->local->mtx);
3245 		goto out;
3246 	}
3247 
3248 	if (sdata->local->suspending) {
3249 		/* reschedule after resume */
3250 		mutex_unlock(&sdata->local->mtx);
3251 		ieee80211_reset_ap_probe(sdata);
3252 		goto out;
3253 	}
3254 
3255 	if (beacon) {
3256 		mlme_dbg_ratelimited(sdata,
3257 				     "detected beacon loss from AP (missed %d beacons) - probing\n",
3258 				     beacon_loss_count);
3259 
3260 		ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
3261 	}
3262 
3263 	/*
3264 	 * The driver/our work has already reported this event or the
3265 	 * connection monitoring has kicked in and we have already sent
3266 	 * a probe request. Or maybe the AP died and the driver keeps
3267 	 * reporting until we disassociate...
3268 	 *
3269 	 * In either case we have to ignore the current call to this
3270 	 * function (except for setting the correct probe reason bit)
3271 	 * because otherwise we would reset the timer every time and
3272 	 * never check whether we received a probe response!
3273 	 */
3274 	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
3275 		already = true;
3276 
3277 	ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
3278 
3279 	mutex_unlock(&sdata->local->mtx);
3280 
3281 	if (already)
3282 		goto out;
3283 
3284 	mutex_lock(&sdata->local->iflist_mtx);
3285 	ieee80211_recalc_ps(sdata->local);
3286 	mutex_unlock(&sdata->local->iflist_mtx);
3287 
3288 	ifmgd->probe_send_count = 0;
3289 	ieee80211_mgd_probe_ap_send(sdata);
3290  out:
3291 	sdata_unlock(sdata);
3292 }
3293 
ieee80211_ap_probereq_get(struct ieee80211_hw * hw,struct ieee80211_vif * vif)3294 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
3295 					  struct ieee80211_vif *vif)
3296 {
3297 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3298 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3299 	struct cfg80211_bss *cbss;
3300 	struct sk_buff *skb;
3301 	const struct element *ssid;
3302 	int ssid_len;
3303 
3304 	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
3305 		    ieee80211_vif_is_mld(&sdata->vif)))
3306 		return NULL;
3307 
3308 	sdata_assert_lock(sdata);
3309 
3310 	if (ifmgd->associated)
3311 		cbss = sdata->deflink.u.mgd.bss;
3312 	else if (ifmgd->auth_data)
3313 		cbss = ifmgd->auth_data->bss;
3314 	else if (ifmgd->assoc_data && ifmgd->assoc_data->link[0].bss)
3315 		cbss = ifmgd->assoc_data->link[0].bss;
3316 	else
3317 		return NULL;
3318 
3319 	rcu_read_lock();
3320 	ssid = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID);
3321 	if (WARN_ONCE(!ssid || ssid->datalen > IEEE80211_MAX_SSID_LEN,
3322 		      "invalid SSID element (len=%d)",
3323 		      ssid ? ssid->datalen : -1))
3324 		ssid_len = 0;
3325 	else
3326 		ssid_len = ssid->datalen;
3327 
3328 	skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
3329 					(u32) -1, cbss->channel,
3330 					ssid->data, ssid_len,
3331 					NULL, 0, IEEE80211_PROBE_FLAG_DIRECTED);
3332 	rcu_read_unlock();
3333 
3334 	return skb;
3335 }
3336 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
3337 
ieee80211_report_disconnect(struct ieee80211_sub_if_data * sdata,const u8 * buf,size_t len,bool tx,u16 reason,bool reconnect)3338 static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
3339 					const u8 *buf, size_t len, bool tx,
3340 					u16 reason, bool reconnect)
3341 {
3342 	struct ieee80211_event event = {
3343 		.type = MLME_EVENT,
3344 		.u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
3345 		.u.mlme.reason = reason,
3346 	};
3347 
3348 	if (tx)
3349 		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len, reconnect);
3350 	else
3351 		cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);
3352 
3353 	drv_event_callback(sdata->local, sdata, &event);
3354 }
3355 
___ieee80211_disconnect(struct ieee80211_sub_if_data * sdata)3356 static void ___ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
3357 {
3358 	struct ieee80211_local *local = sdata->local;
3359 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3360 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3361 	bool tx;
3362 
3363 	if (!ifmgd->associated)
3364 		return;
3365 
3366 	/* in MLO assume we have a link where we can TX the frame */
3367 	tx = ieee80211_vif_is_mld(&sdata->vif) ||
3368 		!sdata->deflink.csa_block_tx;
3369 
3370 	if (!ifmgd->driver_disconnect) {
3371 		unsigned int link_id;
3372 
3373 		/*
3374 		 * AP is probably out of range (or not reachable for another
3375 		 * reason) so remove the bss structs for that AP. In the case
3376 		 * of multi-link, it's not clear that all of them really are
3377 		 * out of range, but if they weren't the driver likely would
3378 		 * have switched to just have a single link active?
3379 		 */
3380 		for (link_id = 0;
3381 		     link_id < ARRAY_SIZE(sdata->link);
3382 		     link_id++) {
3383 			struct ieee80211_link_data *link;
3384 
3385 			link = sdata_dereference(sdata->link[link_id], sdata);
3386 			if (!link)
3387 				continue;
3388 			cfg80211_unlink_bss(local->hw.wiphy, link->u.mgd.bss);
3389 			link->u.mgd.bss = NULL;
3390 		}
3391 	}
3392 
3393 	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
3394 			       ifmgd->driver_disconnect ?
3395 					WLAN_REASON_DEAUTH_LEAVING :
3396 					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
3397 			       tx, frame_buf);
3398 	mutex_lock(&local->mtx);
3399 	/* the other links will be destroyed */
3400 	sdata->vif.bss_conf.csa_active = false;
3401 	sdata->deflink.u.mgd.csa_waiting_bcn = false;
3402 	if (sdata->deflink.csa_block_tx) {
3403 		ieee80211_wake_vif_queues(local, sdata,
3404 					  IEEE80211_QUEUE_STOP_REASON_CSA);
3405 		sdata->deflink.csa_block_tx = false;
3406 	}
3407 	mutex_unlock(&local->mtx);
3408 
3409 	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
3410 				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
3411 				    ifmgd->reconnect);
3412 	ifmgd->reconnect = false;
3413 }
3414 
__ieee80211_disconnect(struct ieee80211_sub_if_data * sdata)3415 static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
3416 {
3417 	sdata_lock(sdata);
3418 	___ieee80211_disconnect(sdata);
3419 	sdata_unlock(sdata);
3420 }
3421 
ieee80211_beacon_connection_loss_work(struct wiphy * wiphy,struct wiphy_work * work)3422 static void ieee80211_beacon_connection_loss_work(struct wiphy *wiphy,
3423 						  struct wiphy_work *work)
3424 {
3425 	struct ieee80211_sub_if_data *sdata =
3426 		container_of(work, struct ieee80211_sub_if_data,
3427 			     u.mgd.beacon_connection_loss_work);
3428 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3429 
3430 	if (ifmgd->connection_loss) {
3431 		sdata_info(sdata, "Connection to AP %pM lost\n",
3432 			   sdata->vif.cfg.ap_addr);
3433 		__ieee80211_disconnect(sdata);
3434 		ifmgd->connection_loss = false;
3435 	} else if (ifmgd->driver_disconnect) {
3436 		sdata_info(sdata,
3437 			   "Driver requested disconnection from AP %pM\n",
3438 			   sdata->vif.cfg.ap_addr);
3439 		__ieee80211_disconnect(sdata);
3440 		ifmgd->driver_disconnect = false;
3441 	} else {
3442 		if (ifmgd->associated)
3443 			sdata->deflink.u.mgd.beacon_loss_count++;
3444 		ieee80211_mgd_probe_ap(sdata, true);
3445 	}
3446 }
3447 
ieee80211_csa_connection_drop_work(struct wiphy * wiphy,struct wiphy_work * work)3448 static void ieee80211_csa_connection_drop_work(struct wiphy *wiphy,
3449 					       struct wiphy_work *work)
3450 {
3451 	struct ieee80211_sub_if_data *sdata =
3452 		container_of(work, struct ieee80211_sub_if_data,
3453 			     u.mgd.csa_connection_drop_work);
3454 
3455 	__ieee80211_disconnect(sdata);
3456 }
3457 
ieee80211_beacon_loss(struct ieee80211_vif * vif)3458 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
3459 {
3460 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3461 	struct ieee80211_hw *hw = &sdata->local->hw;
3462 
3463 	trace_api_beacon_loss(sdata);
3464 
3465 	sdata->u.mgd.connection_loss = false;
3466 	wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work);
3467 }
3468 EXPORT_SYMBOL(ieee80211_beacon_loss);
3469 
ieee80211_connection_loss(struct ieee80211_vif * vif)3470 void ieee80211_connection_loss(struct ieee80211_vif *vif)
3471 {
3472 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3473 	struct ieee80211_hw *hw = &sdata->local->hw;
3474 
3475 	trace_api_connection_loss(sdata);
3476 
3477 	sdata->u.mgd.connection_loss = true;
3478 	wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work);
3479 }
3480 EXPORT_SYMBOL(ieee80211_connection_loss);
3481 
ieee80211_disconnect(struct ieee80211_vif * vif,bool reconnect)3482 void ieee80211_disconnect(struct ieee80211_vif *vif, bool reconnect)
3483 {
3484 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3485 	struct ieee80211_hw *hw = &sdata->local->hw;
3486 
3487 	trace_api_disconnect(sdata, reconnect);
3488 
3489 	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
3490 		return;
3491 
3492 	sdata->u.mgd.driver_disconnect = true;
3493 	sdata->u.mgd.reconnect = reconnect;
3494 	wiphy_work_queue(hw->wiphy, &sdata->u.mgd.beacon_connection_loss_work);
3495 }
3496 EXPORT_SYMBOL(ieee80211_disconnect);
3497 
ieee80211_destroy_auth_data(struct ieee80211_sub_if_data * sdata,bool assoc)3498 static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
3499 					bool assoc)
3500 {
3501 	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
3502 
3503 	sdata_assert_lock(sdata);
3504 
3505 	if (!assoc) {
3506 		/*
3507 		 * we are not authenticated yet, the only timer that could be
3508 		 * running is the timeout for the authentication response which
3509 		 * which is not relevant anymore.
3510 		 */
3511 		del_timer_sync(&sdata->u.mgd.timer);
3512 		sta_info_destroy_addr(sdata, auth_data->ap_addr);
3513 
3514 		/* other links are destroyed */
3515 		sdata->deflink.u.mgd.conn_flags = 0;
3516 		eth_zero_addr(sdata->deflink.u.mgd.bssid);
3517 		ieee80211_link_info_change_notify(sdata, &sdata->deflink,
3518 						  BSS_CHANGED_BSSID);
3519 		sdata->u.mgd.flags = 0;
3520 
3521 		mutex_lock(&sdata->local->mtx);
3522 		ieee80211_link_release_channel(&sdata->deflink);
3523 		ieee80211_vif_set_links(sdata, 0, 0);
3524 		mutex_unlock(&sdata->local->mtx);
3525 	}
3526 
3527 	cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
3528 	kfree(auth_data);
3529 	sdata->u.mgd.auth_data = NULL;
3530 }
3531 
3532 enum assoc_status {
3533 	ASSOC_SUCCESS,
3534 	ASSOC_REJECTED,
3535 	ASSOC_TIMEOUT,
3536 	ASSOC_ABANDON,
3537 };
3538 
ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data * sdata,enum assoc_status status)3539 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
3540 					 enum assoc_status status)
3541 {
3542 	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
3543 
3544 	sdata_assert_lock(sdata);
3545 
3546 	if (status != ASSOC_SUCCESS) {
3547 		/*
3548 		 * we are not associated yet, the only timer that could be
3549 		 * running is the timeout for the association response which
3550 		 * which is not relevant anymore.
3551 		 */
3552 		del_timer_sync(&sdata->u.mgd.timer);
3553 		sta_info_destroy_addr(sdata, assoc_data->ap_addr);
3554 
3555 		sdata->deflink.u.mgd.conn_flags = 0;
3556 		eth_zero_addr(sdata->deflink.u.mgd.bssid);
3557 		ieee80211_link_info_change_notify(sdata, &sdata->deflink,
3558 						  BSS_CHANGED_BSSID);
3559 		sdata->u.mgd.flags = 0;
3560 		sdata->vif.bss_conf.mu_mimo_owner = false;
3561 
3562 		if (status != ASSOC_REJECTED) {
3563 			struct cfg80211_assoc_failure data = {
3564 				.timeout = status == ASSOC_TIMEOUT,
3565 			};
3566 			int i;
3567 
3568 			BUILD_BUG_ON(ARRAY_SIZE(data.bss) !=
3569 				     ARRAY_SIZE(assoc_data->link));
3570 
3571 			for (i = 0; i < ARRAY_SIZE(data.bss); i++)
3572 				data.bss[i] = assoc_data->link[i].bss;
3573 
3574 			if (ieee80211_vif_is_mld(&sdata->vif))
3575 				data.ap_mld_addr = assoc_data->ap_addr;
3576 
3577 			cfg80211_assoc_failure(sdata->dev, &data);
3578 		}
3579 
3580 		mutex_lock(&sdata->local->mtx);
3581 		ieee80211_link_release_channel(&sdata->deflink);
3582 		ieee80211_vif_set_links(sdata, 0, 0);
3583 		mutex_unlock(&sdata->local->mtx);
3584 	}
3585 
3586 	kfree(assoc_data);
3587 	sdata->u.mgd.assoc_data = NULL;
3588 }
3589 
ieee80211_auth_challenge(struct ieee80211_sub_if_data * sdata,struct ieee80211_mgmt * mgmt,size_t len)3590 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
3591 				     struct ieee80211_mgmt *mgmt, size_t len)
3592 {
3593 	struct ieee80211_local *local = sdata->local;
3594 	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
3595 	const struct element *challenge;
3596 	u8 *pos;
3597 	u32 tx_flags = 0;
3598 	struct ieee80211_prep_tx_info info = {
3599 		.subtype = IEEE80211_STYPE_AUTH,
3600 	};
3601 
3602 	pos = mgmt->u.auth.variable;
3603 	challenge = cfg80211_find_elem(WLAN_EID_CHALLENGE, pos,
3604 				       len - (pos - (u8 *)mgmt));
3605 	if (!challenge)
3606 		return;
3607 	auth_data->expected_transaction = 4;
3608 	drv_mgd_prepare_tx(sdata->local, sdata, &info);
3609 	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
3610 		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
3611 			   IEEE80211_TX_INTFL_MLME_CONN_TX;
3612 	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
3613 			    (void *)challenge,
3614 			    challenge->datalen + sizeof(*challenge),
3615 			    auth_data->ap_addr, auth_data->ap_addr,
3616 			    auth_data->key, auth_data->key_len,
3617 			    auth_data->key_idx, tx_flags);
3618 }
3619 
ieee80211_mark_sta_auth(struct ieee80211_sub_if_data * sdata)3620 static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata)
3621 {
3622 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3623 	const u8 *ap_addr = ifmgd->auth_data->ap_addr;
3624 	struct sta_info *sta;
3625 	bool result = true;
3626 
3627 	sdata_info(sdata, "authenticated\n");
3628 	ifmgd->auth_data->done = true;
3629 	ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
3630 	ifmgd->auth_data->timeout_started = true;
3631 	run_again(sdata, ifmgd->auth_data->timeout);
3632 
3633 	/* move station state to auth */
3634 	mutex_lock(&sdata->local->sta_mtx);
3635 	sta = sta_info_get(sdata, ap_addr);
3636 	if (!sta) {
3637 		WARN_ONCE(1, "%s: STA %pM not found", sdata->name, ap_addr);
3638 		result = false;
3639 		goto out;
3640 	}
3641 	if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
3642 		sdata_info(sdata, "failed moving %pM to auth\n", ap_addr);
3643 		result = false;
3644 		goto out;
3645 	}
3646 
3647 out:
3648 	mutex_unlock(&sdata->local->sta_mtx);
3649 	return result;
3650 }
3651 
ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data * sdata,struct ieee80211_mgmt * mgmt,size_t len)3652 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
3653 				   struct ieee80211_mgmt *mgmt, size_t len)
3654 {
3655 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3656 	u16 auth_alg, auth_transaction, status_code;
3657 	struct ieee80211_event event = {
3658 		.type = MLME_EVENT,
3659 		.u.mlme.data = AUTH_EVENT,
3660 	};
3661 	struct ieee80211_prep_tx_info info = {
3662 		.subtype = IEEE80211_STYPE_AUTH,
3663 	};
3664 
3665 	sdata_assert_lock(sdata);
3666 
3667 	if (len < 24 + 6)
3668 		return;
3669 
3670 	if (!ifmgd->auth_data || ifmgd->auth_data->done)
3671 		return;
3672 
3673 	if (!ether_addr_equal(ifmgd->auth_data->ap_addr, mgmt->bssid))
3674 		return;
3675 
3676 	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
3677 	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
3678 	status_code = le16_to_cpu(mgmt->u.auth.status_code);
3679 
3680 	if (auth_alg != ifmgd->auth_data->algorithm ||
3681 	    (auth_alg != WLAN_AUTH_SAE &&
3682 	     auth_transaction != ifmgd->auth_data->expected_transaction) ||
3683 	    (auth_alg == WLAN_AUTH_SAE &&
3684 	     (auth_transaction < ifmgd->auth_data->expected_transaction ||
3685 	      auth_transaction > 2))) {
3686 		sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
3687 			   mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
3688 			   auth_transaction,
3689 			   ifmgd->auth_data->expected_transaction);
3690 		goto notify_driver;
3691 	}
3692 
3693 	if (status_code != WLAN_STATUS_SUCCESS) {
3694 		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
3695 
3696 		if (auth_alg == WLAN_AUTH_SAE &&
3697 		    (status_code == WLAN_STATUS_ANTI_CLOG_REQUIRED ||
3698 		     (auth_transaction == 1 &&
3699 		      (status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
3700 		       status_code == WLAN_STATUS_SAE_PK)))) {
3701 			/* waiting for userspace now */
3702 			ifmgd->auth_data->waiting = true;
3703 			ifmgd->auth_data->timeout =
3704 				jiffies + IEEE80211_AUTH_WAIT_SAE_RETRY;
3705 			ifmgd->auth_data->timeout_started = true;
3706 			run_again(sdata, ifmgd->auth_data->timeout);
3707 			goto notify_driver;
3708 		}
3709 
3710 		sdata_info(sdata, "%pM denied authentication (status %d)\n",
3711 			   mgmt->sa, status_code);
3712 		ieee80211_destroy_auth_data(sdata, false);
3713 		event.u.mlme.status = MLME_DENIED;
3714 		event.u.mlme.reason = status_code;
3715 		drv_event_callback(sdata->local, sdata, &event);
3716 		goto notify_driver;
3717 	}
3718 
3719 	switch (ifmgd->auth_data->algorithm) {
3720 	case WLAN_AUTH_OPEN:
3721 	case WLAN_AUTH_LEAP:
3722 	case WLAN_AUTH_FT:
3723 	case WLAN_AUTH_SAE:
3724 	case WLAN_AUTH_FILS_SK:
3725 	case WLAN_AUTH_FILS_SK_PFS:
3726 	case WLAN_AUTH_FILS_PK:
3727 		break;
3728 	case WLAN_AUTH_SHARED_KEY:
3729 		if (ifmgd->auth_data->expected_transaction != 4) {
3730 			ieee80211_auth_challenge(sdata, mgmt, len);
3731 			/* need another frame */
3732 			return;
3733 		}
3734 		break;
3735 	default:
3736 		WARN_ONCE(1, "invalid auth alg %d",
3737 			  ifmgd->auth_data->algorithm);
3738 		goto notify_driver;
3739 	}
3740 
3741 	event.u.mlme.status = MLME_SUCCESS;
3742 	info.success = 1;
3743 	drv_event_callback(sdata->local, sdata, &event);
3744 	if (ifmgd->auth_data->algorithm != WLAN_AUTH_SAE ||
3745 	    (auth_transaction == 2 &&
3746 	     ifmgd->auth_data->expected_transaction == 2)) {
3747 		if (!ieee80211_mark_sta_auth(sdata))
3748 			return; /* ignore frame -- wait for timeout */
3749 	} else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
3750 		   auth_transaction == 2) {
3751 		sdata_info(sdata, "SAE peer confirmed\n");
3752 		ifmgd->auth_data->peer_confirmed = true;
3753 	}
3754 
3755 	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
3756 notify_driver:
3757 	drv_mgd_complete_tx(sdata->local, sdata, &info);
3758 }
3759 
3760 #define case_WLAN(type) \
3761 	case WLAN_REASON_##type: return #type
3762 
ieee80211_get_reason_code_string(u16 reason_code)3763 const char *ieee80211_get_reason_code_string(u16 reason_code)
3764 {
3765 	switch (reason_code) {
3766 	case_WLAN(UNSPECIFIED);
3767 	case_WLAN(PREV_AUTH_NOT_VALID);
3768 	case_WLAN(DEAUTH_LEAVING);
3769 	case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
3770 	case_WLAN(DISASSOC_AP_BUSY);
3771 	case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
3772 	case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
3773 	case_WLAN(DISASSOC_STA_HAS_LEFT);
3774 	case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
3775 	case_WLAN(DISASSOC_BAD_POWER);
3776 	case_WLAN(DISASSOC_BAD_SUPP_CHAN);
3777 	case_WLAN(INVALID_IE);
3778 	case_WLAN(MIC_FAILURE);
3779 	case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
3780 	case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
3781 	case_WLAN(IE_DIFFERENT);
3782 	case_WLAN(INVALID_GROUP_CIPHER);
3783 	case_WLAN(INVALID_PAIRWISE_CIPHER);
3784 	case_WLAN(INVALID_AKMP);
3785 	case_WLAN(UNSUPP_RSN_VERSION);
3786 	case_WLAN(INVALID_RSN_IE_CAP);
3787 	case_WLAN(IEEE8021X_FAILED);
3788 	case_WLAN(CIPHER_SUITE_REJECTED);
3789 	case_WLAN(DISASSOC_UNSPECIFIED_QOS);
3790 	case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
3791 	case_WLAN(DISASSOC_LOW_ACK);
3792 	case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
3793 	case_WLAN(QSTA_LEAVE_QBSS);
3794 	case_WLAN(QSTA_NOT_USE);
3795 	case_WLAN(QSTA_REQUIRE_SETUP);
3796 	case_WLAN(QSTA_TIMEOUT);
3797 	case_WLAN(QSTA_CIPHER_NOT_SUPP);
3798 	case_WLAN(MESH_PEER_CANCELED);
3799 	case_WLAN(MESH_MAX_PEERS);
3800 	case_WLAN(MESH_CONFIG);
3801 	case_WLAN(MESH_CLOSE);
3802 	case_WLAN(MESH_MAX_RETRIES);
3803 	case_WLAN(MESH_CONFIRM_TIMEOUT);
3804 	case_WLAN(MESH_INVALID_GTK);
3805 	case_WLAN(MESH_INCONSISTENT_PARAM);
3806 	case_WLAN(MESH_INVALID_SECURITY);
3807 	case_WLAN(MESH_PATH_ERROR);
3808 	case_WLAN(MESH_PATH_NOFORWARD);
3809 	case_WLAN(MESH_PATH_DEST_UNREACHABLE);
3810 	case_WLAN(MAC_EXISTS_IN_MBSS);
3811 	case_WLAN(MESH_CHAN_REGULATORY);
3812 	case_WLAN(MESH_CHAN);
3813 	default: return "<unknown>";
3814 	}
3815 }
3816 
ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data * sdata,struct ieee80211_mgmt * mgmt,size_t len)3817 static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
3818 				     struct ieee80211_mgmt *mgmt, size_t len)
3819 {
3820 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3821 	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
3822 
3823 	sdata_assert_lock(sdata);
3824 
3825 	if (len < 24 + 2)
3826 		return;
3827 
3828 	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
3829 		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
3830 		return;
3831 	}
3832 
3833 	if (ifmgd->associated &&
3834 	    ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)) {
3835 		sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
3836 			   sdata->vif.cfg.ap_addr, reason_code,
3837 			   ieee80211_get_reason_code_string(reason_code));
3838 
3839 		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3840 
3841 		ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
3842 					    reason_code, false);
3843 		return;
3844 	}
3845 
3846 	if (ifmgd->assoc_data &&
3847 	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->ap_addr)) {
3848 		sdata_info(sdata,
3849 			   "deauthenticated from %pM while associating (Reason: %u=%s)\n",
3850 			   ifmgd->assoc_data->ap_addr, reason_code,
3851 			   ieee80211_get_reason_code_string(reason_code));
3852 
3853 		ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
3854 
3855 		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
3856 		return;
3857 	}
3858 }
3859 
3860 
ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data * sdata,struct ieee80211_mgmt * mgmt,size_t len)3861 static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
3862 				       struct ieee80211_mgmt *mgmt, size_t len)
3863 {
3864 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3865 	u16 reason_code;
3866 
3867 	sdata_assert_lock(sdata);
3868 
3869 	if (len < 24 + 2)
3870 		return;
3871 
3872 	if (!ifmgd->associated ||
3873 	    !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr))
3874 		return;
3875 
3876 	reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
3877 
3878 	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
3879 		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
3880 		return;
3881 	}
3882 
3883 	sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
3884 		   sdata->vif.cfg.ap_addr, reason_code,
3885 		   ieee80211_get_reason_code_string(reason_code));
3886 
3887 	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3888 
3889 	ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code,
3890 				    false);
3891 }
3892 
ieee80211_get_rates(struct ieee80211_supported_band * sband,u8 * supp_rates,unsigned int supp_rates_len,u32 * rates,u32 * basic_rates,bool * have_higher_than_11mbit,int * min_rate,int * min_rate_index,int shift)3893 static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
3894 				u8 *supp_rates, unsigned int supp_rates_len,
3895 				u32 *rates, u32 *basic_rates,
3896 				bool *have_higher_than_11mbit,
3897 				int *min_rate, int *min_rate_index,
3898 				int shift)
3899 {
3900 	int i, j;
3901 
3902 	for (i = 0; i < supp_rates_len; i++) {
3903 		int rate = supp_rates[i] & 0x7f;
3904 		bool is_basic = !!(supp_rates[i] & 0x80);
3905 
3906 		if ((rate * 5 * (1 << shift)) > 110)
3907 			*have_higher_than_11mbit = true;
3908 
3909 		/*
3910 		 * Skip HT, VHT, HE, EHT and SAE H2E only BSS membership
3911 		 * selectors since they're not rates.
3912 		 *
3913 		 * Note: Even though the membership selector and the basic
3914 		 *	 rate flag share the same bit, they are not exactly
3915 		 *	 the same.
3916 		 */
3917 		if (supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY) ||
3918 		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY) ||
3919 		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HE_PHY) ||
3920 		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_EHT_PHY) ||
3921 		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_SAE_H2E))
3922 			continue;
3923 
3924 		for (j = 0; j < sband->n_bitrates; j++) {
3925 			struct ieee80211_rate *br;
3926 			int brate;
3927 
3928 			br = &sband->bitrates[j];
3929 
3930 			brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
3931 			if (brate == rate) {
3932 				*rates |= BIT(j);
3933 				if (is_basic)
3934 					*basic_rates |= BIT(j);
3935 				if ((rate * 5) < *min_rate) {
3936 					*min_rate = rate * 5;
3937 					*min_rate_index = j;
3938 				}
3939 				break;
3940 			}
3941 		}
3942 	}
3943 }
3944 
ieee80211_twt_req_supported(struct ieee80211_sub_if_data * sdata,struct ieee80211_supported_band * sband,const struct link_sta_info * link_sta,const struct ieee802_11_elems * elems)3945 static bool ieee80211_twt_req_supported(struct ieee80211_sub_if_data *sdata,
3946 					struct ieee80211_supported_band *sband,
3947 					const struct link_sta_info *link_sta,
3948 					const struct ieee802_11_elems *elems)
3949 {
3950 	const struct ieee80211_sta_he_cap *own_he_cap =
3951 		ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
3952 
3953 	if (elems->ext_capab_len < 10)
3954 		return false;
3955 
3956 	if (!(elems->ext_capab[9] & WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT))
3957 		return false;
3958 
3959 	return link_sta->pub->he_cap.he_cap_elem.mac_cap_info[0] &
3960 		IEEE80211_HE_MAC_CAP0_TWT_RES &&
3961 		own_he_cap &&
3962 		(own_he_cap->he_cap_elem.mac_cap_info[0] &
3963 			IEEE80211_HE_MAC_CAP0_TWT_REQ);
3964 }
3965 
ieee80211_recalc_twt_req(struct ieee80211_sub_if_data * sdata,struct ieee80211_supported_band * sband,struct ieee80211_link_data * link,struct link_sta_info * link_sta,struct ieee802_11_elems * elems)3966 static u64 ieee80211_recalc_twt_req(struct ieee80211_sub_if_data *sdata,
3967 				    struct ieee80211_supported_band *sband,
3968 				    struct ieee80211_link_data *link,
3969 				    struct link_sta_info *link_sta,
3970 				    struct ieee802_11_elems *elems)
3971 {
3972 	bool twt = ieee80211_twt_req_supported(sdata, sband, link_sta, elems);
3973 
3974 	if (link->conf->twt_requester != twt) {
3975 		link->conf->twt_requester = twt;
3976 		return BSS_CHANGED_TWT;
3977 	}
3978 	return 0;
3979 }
3980 
ieee80211_twt_bcast_support(struct ieee80211_sub_if_data * sdata,struct ieee80211_bss_conf * bss_conf,struct ieee80211_supported_band * sband,struct link_sta_info * link_sta)3981 static bool ieee80211_twt_bcast_support(struct ieee80211_sub_if_data *sdata,
3982 					struct ieee80211_bss_conf *bss_conf,
3983 					struct ieee80211_supported_band *sband,
3984 					struct link_sta_info *link_sta)
3985 {
3986 	const struct ieee80211_sta_he_cap *own_he_cap =
3987 		ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
3988 
3989 	return bss_conf->he_support &&
3990 		(link_sta->pub->he_cap.he_cap_elem.mac_cap_info[2] &
3991 			IEEE80211_HE_MAC_CAP2_BCAST_TWT) &&
3992 		own_he_cap &&
3993 		(own_he_cap->he_cap_elem.mac_cap_info[2] &
3994 			IEEE80211_HE_MAC_CAP2_BCAST_TWT);
3995 }
3996 
ieee80211_assoc_config_link(struct ieee80211_link_data * link,struct link_sta_info * link_sta,struct cfg80211_bss * cbss,struct ieee80211_mgmt * mgmt,const u8 * elem_start,unsigned int elem_len,u64 * changed)3997 static bool ieee80211_assoc_config_link(struct ieee80211_link_data *link,
3998 					struct link_sta_info *link_sta,
3999 					struct cfg80211_bss *cbss,
4000 					struct ieee80211_mgmt *mgmt,
4001 					const u8 *elem_start,
4002 					unsigned int elem_len,
4003 					u64 *changed)
4004 {
4005 	struct ieee80211_sub_if_data *sdata = link->sdata;
4006 	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
4007 	struct ieee80211_bss_conf *bss_conf = link->conf;
4008 	struct ieee80211_local *local = sdata->local;
4009 	unsigned int link_id = link->link_id;
4010 	struct ieee80211_elems_parse_params parse_params = {
4011 		.start = elem_start,
4012 		.len = elem_len,
4013 		.link_id = link_id == assoc_data->assoc_link_id ? -1 : link_id,
4014 		.from_ap = true,
4015 	};
4016 	bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
4017 	bool is_s1g = cbss->channel->band == NL80211_BAND_S1GHZ;
4018 	const struct cfg80211_bss_ies *bss_ies = NULL;
4019 	struct ieee80211_supported_band *sband;
4020 	struct ieee802_11_elems *elems;
4021 	const __le16 prof_bss_param_ch_present =
4022 		cpu_to_le16(IEEE80211_MLE_STA_CONTROL_BSS_PARAM_CHANGE_CNT_PRESENT);
4023 	u16 capab_info;
4024 	bool ret;
4025 
4026 	elems = ieee802_11_parse_elems_full(&parse_params);
4027 	if (!elems)
4028 		return false;
4029 
4030 	if (link_id == assoc_data->assoc_link_id) {
4031 		capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
4032 
4033 		/*
4034 		 * we should not get to this flow unless the association was
4035 		 * successful, so set the status directly to success
4036 		 */
4037 		assoc_data->link[link_id].status = WLAN_STATUS_SUCCESS;
4038 		if (elems->ml_basic) {
4039 			if (!(elems->ml_basic->control &
4040 					cpu_to_le16(IEEE80211_MLC_BASIC_PRES_BSS_PARAM_CH_CNT))) {
4041 				ret = false;
4042 				goto out;
4043 			}
4044 			link->u.mgd.bss_param_ch_cnt =
4045 				ieee80211_mle_get_bss_param_ch_cnt(elems->ml_basic);
4046 		}
4047 	} else if (!elems->prof ||
4048 		   !(elems->prof->control & prof_bss_param_ch_present)) {
4049 		ret = false;
4050 		goto out;
4051 	} else {
4052 		const u8 *ptr = elems->prof->variable +
4053 				elems->prof->sta_info_len - 1;
4054 
4055 		/*
4056 		 * During parsing, we validated that these fields exist,
4057 		 * otherwise elems->prof would have been set to NULL.
4058 		 */
4059 		capab_info = get_unaligned_le16(ptr);
4060 		assoc_data->link[link_id].status = get_unaligned_le16(ptr + 2);
4061 		link->u.mgd.bss_param_ch_cnt =
4062 			ieee80211_mle_basic_sta_prof_bss_param_ch_cnt(elems->prof);
4063 
4064 		if (assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) {
4065 			link_info(link, "association response status code=%u\n",
4066 				  assoc_data->link[link_id].status);
4067 			ret = true;
4068 			goto out;
4069 		}
4070 	}
4071 
4072 	if (!is_s1g && !elems->supp_rates) {
4073 		sdata_info(sdata, "no SuppRates element in AssocResp\n");
4074 		ret = false;
4075 		goto out;
4076 	}
4077 
4078 	link->u.mgd.tdls_chan_switch_prohibited =
4079 		elems->ext_capab && elems->ext_capab_len >= 5 &&
4080 		(elems->ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
4081 
4082 	/*
4083 	 * Some APs are erroneously not including some information in their
4084 	 * (re)association response frames. Try to recover by using the data
4085 	 * from the beacon or probe response. This seems to afflict mobile
4086 	 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
4087 	 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
4088 	 */
4089 	if (!is_6ghz &&
4090 	    ((assoc_data->wmm && !elems->wmm_param) ||
4091 	     (!(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT) &&
4092 	      (!elems->ht_cap_elem || !elems->ht_operation)) ||
4093 	     (!(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT) &&
4094 	      (!elems->vht_cap_elem || !elems->vht_operation)))) {
4095 		const struct cfg80211_bss_ies *ies;
4096 		struct ieee802_11_elems *bss_elems;
4097 
4098 		rcu_read_lock();
4099 		ies = rcu_dereference(cbss->ies);
4100 		if (ies)
4101 			bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
4102 					  GFP_ATOMIC);
4103 		rcu_read_unlock();
4104 		if (!bss_ies) {
4105 			ret = false;
4106 			goto out;
4107 		}
4108 
4109 		parse_params.start = bss_ies->data;
4110 		parse_params.len = bss_ies->len;
4111 		parse_params.bss = cbss;
4112 		bss_elems = ieee802_11_parse_elems_full(&parse_params);
4113 		if (!bss_elems) {
4114 			ret = false;
4115 			goto out;
4116 		}
4117 
4118 		if (assoc_data->wmm &&
4119 		    !elems->wmm_param && bss_elems->wmm_param) {
4120 			elems->wmm_param = bss_elems->wmm_param;
4121 			sdata_info(sdata,
4122 				   "AP bug: WMM param missing from AssocResp\n");
4123 		}
4124 
4125 		/*
4126 		 * Also check if we requested HT/VHT, otherwise the AP doesn't
4127 		 * have to include the IEs in the (re)association response.
4128 		 */
4129 		if (!elems->ht_cap_elem && bss_elems->ht_cap_elem &&
4130 		    !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT)) {
4131 			elems->ht_cap_elem = bss_elems->ht_cap_elem;
4132 			sdata_info(sdata,
4133 				   "AP bug: HT capability missing from AssocResp\n");
4134 		}
4135 		if (!elems->ht_operation && bss_elems->ht_operation &&
4136 		    !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT)) {
4137 			elems->ht_operation = bss_elems->ht_operation;
4138 			sdata_info(sdata,
4139 				   "AP bug: HT operation missing from AssocResp\n");
4140 		}
4141 		if (!elems->vht_cap_elem && bss_elems->vht_cap_elem &&
4142 		    !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)) {
4143 			elems->vht_cap_elem = bss_elems->vht_cap_elem;
4144 			sdata_info(sdata,
4145 				   "AP bug: VHT capa missing from AssocResp\n");
4146 		}
4147 		if (!elems->vht_operation && bss_elems->vht_operation &&
4148 		    !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)) {
4149 			elems->vht_operation = bss_elems->vht_operation;
4150 			sdata_info(sdata,
4151 				   "AP bug: VHT operation missing from AssocResp\n");
4152 		}
4153 
4154 		kfree(bss_elems);
4155 	}
4156 
4157 	/*
4158 	 * We previously checked these in the beacon/probe response, so
4159 	 * they should be present here. This is just a safety net.
4160 	 */
4161 	if (!is_6ghz && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT) &&
4162 	    (!elems->wmm_param || !elems->ht_cap_elem || !elems->ht_operation)) {
4163 		sdata_info(sdata,
4164 			   "HT AP is missing WMM params or HT capability/operation\n");
4165 		ret = false;
4166 		goto out;
4167 	}
4168 
4169 	if (!is_6ghz && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT) &&
4170 	    (!elems->vht_cap_elem || !elems->vht_operation)) {
4171 		sdata_info(sdata,
4172 			   "VHT AP is missing VHT capability/operation\n");
4173 		ret = false;
4174 		goto out;
4175 	}
4176 
4177 	if (is_6ghz && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
4178 	    !elems->he_6ghz_capa) {
4179 		sdata_info(sdata,
4180 			   "HE 6 GHz AP is missing HE 6 GHz band capability\n");
4181 		ret = false;
4182 		goto out;
4183 	}
4184 
4185 	if (WARN_ON(!link->conf->chandef.chan)) {
4186 		ret = false;
4187 		goto out;
4188 	}
4189 	sband = local->hw.wiphy->bands[link->conf->chandef.chan->band];
4190 
4191 	if (!(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
4192 	    (!elems->he_cap || !elems->he_operation)) {
4193 		sdata_info(sdata,
4194 			   "HE AP is missing HE capability/operation\n");
4195 		ret = false;
4196 		goto out;
4197 	}
4198 
4199 	/* Set up internal HT/VHT capabilities */
4200 	if (elems->ht_cap_elem && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT))
4201 		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
4202 						  elems->ht_cap_elem,
4203 						  link_sta);
4204 
4205 	if (elems->vht_cap_elem &&
4206 	    !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)) {
4207 		const struct ieee80211_vht_cap *bss_vht_cap = NULL;
4208 		const struct cfg80211_bss_ies *ies;
4209 
4210 		/*
4211 		 * Cisco AP module 9115 with FW 17.3 has a bug and sends a
4212 		 * too large maximum MPDU length in the association response
4213 		 * (indicating 12k) that it cannot actually process ...
4214 		 * Work around that.
4215 		 */
4216 		rcu_read_lock();
4217 		ies = rcu_dereference(cbss->ies);
4218 		if (ies) {
4219 			const struct element *elem;
4220 
4221 			elem = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY,
4222 						  ies->data, ies->len);
4223 			if (elem && elem->datalen >= sizeof(*bss_vht_cap))
4224 				bss_vht_cap = (const void *)elem->data;
4225 		}
4226 
4227 		ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
4228 						    elems->vht_cap_elem,
4229 						    bss_vht_cap, link_sta);
4230 		rcu_read_unlock();
4231 	}
4232 
4233 	if (elems->he_operation && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
4234 	    elems->he_cap) {
4235 		ieee80211_he_cap_ie_to_sta_he_cap(sdata, sband,
4236 						  elems->he_cap,
4237 						  elems->he_cap_len,
4238 						  elems->he_6ghz_capa,
4239 						  link_sta);
4240 
4241 		bss_conf->he_support = link_sta->pub->he_cap.has_he;
4242 		if (elems->rsnx && elems->rsnx_len &&
4243 		    (elems->rsnx[0] & WLAN_RSNX_CAPA_PROTECTED_TWT) &&
4244 		    wiphy_ext_feature_isset(local->hw.wiphy,
4245 					    NL80211_EXT_FEATURE_PROTECTED_TWT))
4246 			bss_conf->twt_protected = true;
4247 		else
4248 			bss_conf->twt_protected = false;
4249 
4250 		*changed |= ieee80211_recalc_twt_req(sdata, sband, link,
4251 						     link_sta, elems);
4252 
4253 		if (elems->eht_operation && elems->eht_cap &&
4254 		    !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_EHT)) {
4255 			ieee80211_eht_cap_ie_to_sta_eht_cap(sdata, sband,
4256 							    elems->he_cap,
4257 							    elems->he_cap_len,
4258 							    elems->eht_cap,
4259 							    elems->eht_cap_len,
4260 							    link_sta);
4261 
4262 			bss_conf->eht_support = link_sta->pub->eht_cap.has_eht;
4263 			*changed |= BSS_CHANGED_EHT_PUNCTURING;
4264 		} else {
4265 			bss_conf->eht_support = false;
4266 		}
4267 	} else {
4268 		bss_conf->he_support = false;
4269 		bss_conf->twt_requester = false;
4270 		bss_conf->twt_protected = false;
4271 		bss_conf->eht_support = false;
4272 	}
4273 
4274 	bss_conf->twt_broadcast =
4275 		ieee80211_twt_bcast_support(sdata, bss_conf, sband, link_sta);
4276 
4277 	if (bss_conf->he_support) {
4278 		bss_conf->he_bss_color.color =
4279 			le32_get_bits(elems->he_operation->he_oper_params,
4280 				      IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
4281 		bss_conf->he_bss_color.partial =
4282 			le32_get_bits(elems->he_operation->he_oper_params,
4283 				      IEEE80211_HE_OPERATION_PARTIAL_BSS_COLOR);
4284 		bss_conf->he_bss_color.enabled =
4285 			!le32_get_bits(elems->he_operation->he_oper_params,
4286 				       IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED);
4287 
4288 		if (bss_conf->he_bss_color.enabled)
4289 			*changed |= BSS_CHANGED_HE_BSS_COLOR;
4290 
4291 		bss_conf->htc_trig_based_pkt_ext =
4292 			le32_get_bits(elems->he_operation->he_oper_params,
4293 				      IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK);
4294 		bss_conf->frame_time_rts_th =
4295 			le32_get_bits(elems->he_operation->he_oper_params,
4296 				      IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
4297 
4298 		bss_conf->uora_exists = !!elems->uora_element;
4299 		if (elems->uora_element)
4300 			bss_conf->uora_ocw_range = elems->uora_element[0];
4301 
4302 		ieee80211_he_op_ie_to_bss_conf(&sdata->vif, elems->he_operation);
4303 		ieee80211_he_spr_ie_to_bss_conf(&sdata->vif, elems->he_spr);
4304 		/* TODO: OPEN: what happens if BSS color disable is set? */
4305 	}
4306 
4307 	if (cbss->transmitted_bss) {
4308 		bss_conf->nontransmitted = true;
4309 		ether_addr_copy(bss_conf->transmitter_bssid,
4310 				cbss->transmitted_bss->bssid);
4311 		bss_conf->bssid_indicator = cbss->max_bssid_indicator;
4312 		bss_conf->bssid_index = cbss->bssid_index;
4313 	}
4314 
4315 	/*
4316 	 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
4317 	 * in their association response, so ignore that data for our own
4318 	 * configuration. If it changed since the last beacon, we'll get the
4319 	 * next beacon and update then.
4320 	 */
4321 
4322 	/*
4323 	 * If an operating mode notification IE is present, override the
4324 	 * NSS calculation (that would be done in rate_control_rate_init())
4325 	 * and use the # of streams from that element.
4326 	 */
4327 	if (elems->opmode_notif &&
4328 	    !(*elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
4329 		u8 nss;
4330 
4331 		nss = *elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
4332 		nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
4333 		nss += 1;
4334 		link_sta->pub->rx_nss = nss;
4335 	}
4336 
4337 	/*
4338 	 * Always handle WMM once after association regardless
4339 	 * of the first value the AP uses. Setting -1 here has
4340 	 * that effect because the AP values is an unsigned
4341 	 * 4-bit value.
4342 	 */
4343 	link->u.mgd.wmm_last_param_set = -1;
4344 	link->u.mgd.mu_edca_last_param_set = -1;
4345 
4346 	if (link->u.mgd.disable_wmm_tracking) {
4347 		ieee80211_set_wmm_default(link, false, false);
4348 	} else if (!ieee80211_sta_wmm_params(local, link, elems->wmm_param,
4349 					     elems->wmm_param_len,
4350 					     elems->mu_edca_param_set)) {
4351 		/* still enable QoS since we might have HT/VHT */
4352 		ieee80211_set_wmm_default(link, false, true);
4353 		/* disable WMM tracking in this case to disable
4354 		 * tracking WMM parameter changes in the beacon if
4355 		 * the parameters weren't actually valid. Doing so
4356 		 * avoids changing parameters very strangely when
4357 		 * the AP is going back and forth between valid and
4358 		 * invalid parameters.
4359 		 */
4360 		link->u.mgd.disable_wmm_tracking = true;
4361 	}
4362 
4363 	if (elems->max_idle_period_ie) {
4364 		bss_conf->max_idle_period =
4365 			le16_to_cpu(elems->max_idle_period_ie->max_idle_period);
4366 		bss_conf->protected_keep_alive =
4367 			!!(elems->max_idle_period_ie->idle_options &
4368 			   WLAN_IDLE_OPTIONS_PROTECTED_KEEP_ALIVE);
4369 		*changed |= BSS_CHANGED_KEEP_ALIVE;
4370 	} else {
4371 		bss_conf->max_idle_period = 0;
4372 		bss_conf->protected_keep_alive = false;
4373 	}
4374 
4375 	/* set assoc capability (AID was already set earlier),
4376 	 * ieee80211_set_associated() will tell the driver */
4377 	bss_conf->assoc_capability = capab_info;
4378 
4379 	ret = true;
4380 out:
4381 	kfree(elems);
4382 	kfree(bss_ies);
4383 	return ret;
4384 }
4385 
ieee80211_mgd_setup_link_sta(struct ieee80211_link_data * link,struct sta_info * sta,struct link_sta_info * link_sta,struct cfg80211_bss * cbss)4386 static int ieee80211_mgd_setup_link_sta(struct ieee80211_link_data *link,
4387 					struct sta_info *sta,
4388 					struct link_sta_info *link_sta,
4389 					struct cfg80211_bss *cbss)
4390 {
4391 	struct ieee80211_sub_if_data *sdata = link->sdata;
4392 	struct ieee80211_local *local = sdata->local;
4393 	struct ieee80211_bss *bss = (void *)cbss->priv;
4394 	u32 rates = 0, basic_rates = 0;
4395 	bool have_higher_than_11mbit = false;
4396 	int min_rate = INT_MAX, min_rate_index = -1;
4397 	/* this is clearly wrong for MLO but we'll just remove it later */
4398 	int shift = ieee80211_vif_get_shift(&sdata->vif);
4399 	struct ieee80211_supported_band *sband;
4400 
4401 	memcpy(link_sta->addr, cbss->bssid, ETH_ALEN);
4402 	memcpy(link_sta->pub->addr, cbss->bssid, ETH_ALEN);
4403 
4404 	/* TODO: S1G Basic Rate Set is expressed elsewhere */
4405 	if (cbss->channel->band == NL80211_BAND_S1GHZ) {
4406 		ieee80211_s1g_sta_rate_init(sta);
4407 		return 0;
4408 	}
4409 
4410 	sband = local->hw.wiphy->bands[cbss->channel->band];
4411 
4412 	ieee80211_get_rates(sband, bss->supp_rates, bss->supp_rates_len,
4413 			    &rates, &basic_rates, &have_higher_than_11mbit,
4414 			    &min_rate, &min_rate_index, shift);
4415 
4416 	/*
4417 	 * This used to be a workaround for basic rates missing
4418 	 * in the association response frame. Now that we no
4419 	 * longer use the basic rates from there, it probably
4420 	 * doesn't happen any more, but keep the workaround so
4421 	 * in case some *other* APs are buggy in different ways
4422 	 * we can connect -- with a warning.
4423 	 * Allow this workaround only in case the AP provided at least
4424 	 * one rate.
4425 	 */
4426 	if (min_rate_index < 0) {
4427 		link_info(link, "No legacy rates in association response\n");
4428 		return -EINVAL;
4429 	} else if (!basic_rates) {
4430 		link_info(link, "No basic rates, using min rate instead\n");
4431 		basic_rates = BIT(min_rate_index);
4432 	}
4433 
4434 	if (rates)
4435 		link_sta->pub->supp_rates[cbss->channel->band] = rates;
4436 	else
4437 		link_info(link, "No rates found, keeping mandatory only\n");
4438 
4439 	link->conf->basic_rates = basic_rates;
4440 
4441 	/* cf. IEEE 802.11 9.2.12 */
4442 	link->operating_11g_mode = sband->band == NL80211_BAND_2GHZ &&
4443 				   have_higher_than_11mbit;
4444 
4445 	return 0;
4446 }
4447 
ieee80211_max_rx_chains(struct ieee80211_link_data * link,struct cfg80211_bss * cbss)4448 static u8 ieee80211_max_rx_chains(struct ieee80211_link_data *link,
4449 				  struct cfg80211_bss *cbss)
4450 {
4451 	struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp;
4452 	const struct element *ht_cap_elem, *vht_cap_elem;
4453 	const struct cfg80211_bss_ies *ies;
4454 	const struct ieee80211_ht_cap *ht_cap;
4455 	const struct ieee80211_vht_cap *vht_cap;
4456 	const struct ieee80211_he_cap_elem *he_cap;
4457 	const struct element *he_cap_elem;
4458 	u16 mcs_80_map, mcs_160_map;
4459 	int i, mcs_nss_size;
4460 	bool support_160;
4461 	u8 chains = 1;
4462 
4463 	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT)
4464 		return chains;
4465 
4466 	ht_cap_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_HT_CAPABILITY);
4467 	if (ht_cap_elem && ht_cap_elem->datalen >= sizeof(*ht_cap)) {
4468 		ht_cap = (void *)ht_cap_elem->data;
4469 		chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
4470 		/*
4471 		 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
4472 		 *	 "Tx Unequal Modulation Supported" fields.
4473 		 */
4474 	}
4475 
4476 	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)
4477 		return chains;
4478 
4479 	vht_cap_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_VHT_CAPABILITY);
4480 	if (vht_cap_elem && vht_cap_elem->datalen >= sizeof(*vht_cap)) {
4481 		u8 nss;
4482 		u16 tx_mcs_map;
4483 
4484 		vht_cap = (void *)vht_cap_elem->data;
4485 		tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
4486 		for (nss = 8; nss > 0; nss--) {
4487 			if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
4488 					IEEE80211_VHT_MCS_NOT_SUPPORTED)
4489 				break;
4490 		}
4491 		/* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
4492 		chains = max(chains, nss);
4493 	}
4494 
4495 	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE)
4496 		return chains;
4497 
4498 	ies = rcu_dereference(cbss->ies);
4499 	he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
4500 					     ies->data, ies->len);
4501 
4502 	if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap))
4503 		return chains;
4504 
4505 	/* skip one byte ext_tag_id */
4506 	he_cap = (void *)(he_cap_elem->data + 1);
4507 	mcs_nss_size = ieee80211_he_mcs_nss_size(he_cap);
4508 
4509 	/* invalid HE IE */
4510 	if (he_cap_elem->datalen < 1 + mcs_nss_size + sizeof(*he_cap))
4511 		return chains;
4512 
4513 	/* mcs_nss is right after he_cap info */
4514 	he_mcs_nss_supp = (void *)(he_cap + 1);
4515 
4516 	mcs_80_map = le16_to_cpu(he_mcs_nss_supp->tx_mcs_80);
4517 
4518 	for (i = 7; i >= 0; i--) {
4519 		u8 mcs_80 = mcs_80_map >> (2 * i) & 3;
4520 
4521 		if (mcs_80 != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
4522 			chains = max_t(u8, chains, i + 1);
4523 			break;
4524 		}
4525 	}
4526 
4527 	support_160 = he_cap->phy_cap_info[0] &
4528 		      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
4529 
4530 	if (!support_160)
4531 		return chains;
4532 
4533 	mcs_160_map = le16_to_cpu(he_mcs_nss_supp->tx_mcs_160);
4534 	for (i = 7; i >= 0; i--) {
4535 		u8 mcs_160 = mcs_160_map >> (2 * i) & 3;
4536 
4537 		if (mcs_160 != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
4538 			chains = max_t(u8, chains, i + 1);
4539 			break;
4540 		}
4541 	}
4542 
4543 	return chains;
4544 }
4545 
4546 static bool
ieee80211_verify_peer_he_mcs_support(struct ieee80211_sub_if_data * sdata,const struct cfg80211_bss_ies * ies,const struct ieee80211_he_operation * he_op)4547 ieee80211_verify_peer_he_mcs_support(struct ieee80211_sub_if_data *sdata,
4548 				     const struct cfg80211_bss_ies *ies,
4549 				     const struct ieee80211_he_operation *he_op)
4550 {
4551 	const struct element *he_cap_elem;
4552 	const struct ieee80211_he_cap_elem *he_cap;
4553 	struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp;
4554 	u16 mcs_80_map_tx, mcs_80_map_rx;
4555 	u16 ap_min_req_set;
4556 	int mcs_nss_size;
4557 	int nss;
4558 
4559 	he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
4560 					     ies->data, ies->len);
4561 
4562 	if (!he_cap_elem)
4563 		return false;
4564 
4565 	/* invalid HE IE */
4566 	if (he_cap_elem->datalen < 1 + sizeof(*he_cap)) {
4567 		sdata_info(sdata,
4568 			   "Invalid HE elem, Disable HE\n");
4569 		return false;
4570 	}
4571 
4572 	/* skip one byte ext_tag_id */
4573 	he_cap = (void *)(he_cap_elem->data + 1);
4574 	mcs_nss_size = ieee80211_he_mcs_nss_size(he_cap);
4575 
4576 	/* invalid HE IE */
4577 	if (he_cap_elem->datalen < 1 + sizeof(*he_cap) + mcs_nss_size) {
4578 		sdata_info(sdata,
4579 			   "Invalid HE elem with nss size, Disable HE\n");
4580 		return false;
4581 	}
4582 
4583 	/* mcs_nss is right after he_cap info */
4584 	he_mcs_nss_supp = (void *)(he_cap + 1);
4585 
4586 	mcs_80_map_tx = le16_to_cpu(he_mcs_nss_supp->tx_mcs_80);
4587 	mcs_80_map_rx = le16_to_cpu(he_mcs_nss_supp->rx_mcs_80);
4588 
4589 	/* P802.11-REVme/D0.3
4590 	 * 27.1.1 Introduction to the HE PHY
4591 	 * ...
4592 	 * An HE STA shall support the following features:
4593 	 * ...
4594 	 * Single spatial stream HE-MCSs 0 to 7 (transmit and receive) in all
4595 	 * supported channel widths for HE SU PPDUs
4596 	 */
4597 	if ((mcs_80_map_tx & 0x3) == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4598 	    (mcs_80_map_rx & 0x3) == IEEE80211_HE_MCS_NOT_SUPPORTED) {
4599 		sdata_info(sdata,
4600 			   "Missing mandatory rates for 1 Nss, rx 0x%x, tx 0x%x, disable HE\n",
4601 			   mcs_80_map_tx, mcs_80_map_rx);
4602 		return false;
4603 	}
4604 
4605 	if (!he_op)
4606 		return true;
4607 
4608 	ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);
4609 
4610 	/*
4611 	 * Apparently iPhone 13 (at least iOS version 15.3.1) sets this to all
4612 	 * zeroes, which is nonsense, and completely inconsistent with itself
4613 	 * (it doesn't have 8 streams). Accept the settings in this case anyway.
4614 	 */
4615 	if (!ap_min_req_set)
4616 		return true;
4617 
4618 	/* make sure the AP is consistent with itself
4619 	 *
4620 	 * P802.11-REVme/D0.3
4621 	 * 26.17.1 Basic HE BSS operation
4622 	 *
4623 	 * A STA that is operating in an HE BSS shall be able to receive and
4624 	 * transmit at each of the <HE-MCS, NSS> tuple values indicated by the
4625 	 * Basic HE-MCS And NSS Set field of the HE Operation parameter of the
4626 	 * MLME-START.request primitive and shall be able to receive at each of
4627 	 * the <HE-MCS, NSS> tuple values indicated by the Supported HE-MCS and
4628 	 * NSS Set field in the HE Capabilities parameter of the MLMESTART.request
4629 	 * primitive
4630 	 */
4631 	for (nss = 8; nss > 0; nss--) {
4632 		u8 ap_op_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;
4633 		u8 ap_rx_val;
4634 		u8 ap_tx_val;
4635 
4636 		if (ap_op_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
4637 			continue;
4638 
4639 		ap_rx_val = (mcs_80_map_rx >> (2 * (nss - 1))) & 3;
4640 		ap_tx_val = (mcs_80_map_tx >> (2 * (nss - 1))) & 3;
4641 
4642 		if (ap_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4643 		    ap_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4644 		    ap_rx_val < ap_op_val || ap_tx_val < ap_op_val) {
4645 			sdata_info(sdata,
4646 				   "Invalid rates for %d Nss, rx %d, tx %d oper %d, disable HE\n",
4647 				   nss, ap_rx_val, ap_rx_val, ap_op_val);
4648 			return false;
4649 		}
4650 	}
4651 
4652 	return true;
4653 }
4654 
4655 static bool
ieee80211_verify_sta_he_mcs_support(struct ieee80211_sub_if_data * sdata,struct ieee80211_supported_band * sband,const struct ieee80211_he_operation * he_op)4656 ieee80211_verify_sta_he_mcs_support(struct ieee80211_sub_if_data *sdata,
4657 				    struct ieee80211_supported_band *sband,
4658 				    const struct ieee80211_he_operation *he_op)
4659 {
4660 	const struct ieee80211_sta_he_cap *sta_he_cap =
4661 		ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
4662 	u16 ap_min_req_set;
4663 	int i;
4664 
4665 	if (!sta_he_cap || !he_op)
4666 		return false;
4667 
4668 	ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);
4669 
4670 	/*
4671 	 * Apparently iPhone 13 (at least iOS version 15.3.1) sets this to all
4672 	 * zeroes, which is nonsense, and completely inconsistent with itself
4673 	 * (it doesn't have 8 streams). Accept the settings in this case anyway.
4674 	 */
4675 	if (!ap_min_req_set)
4676 		return true;
4677 
4678 	/* Need to go over for 80MHz, 160MHz and for 80+80 */
4679 	for (i = 0; i < 3; i++) {
4680 		const struct ieee80211_he_mcs_nss_supp *sta_mcs_nss_supp =
4681 			&sta_he_cap->he_mcs_nss_supp;
4682 		u16 sta_mcs_map_rx =
4683 			le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i]);
4684 		u16 sta_mcs_map_tx =
4685 			le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i + 1]);
4686 		u8 nss;
4687 		bool verified = true;
4688 
4689 		/*
4690 		 * For each band there is a maximum of 8 spatial streams
4691 		 * possible. Each of the sta_mcs_map_* is a 16-bit struct built
4692 		 * of 2 bits per NSS (1-8), with the values defined in enum
4693 		 * ieee80211_he_mcs_support. Need to make sure STA TX and RX
4694 		 * capabilities aren't less than the AP's minimum requirements
4695 		 * for this HE BSS per SS.
4696 		 * It is enough to find one such band that meets the reqs.
4697 		 */
4698 		for (nss = 8; nss > 0; nss--) {
4699 			u8 sta_rx_val = (sta_mcs_map_rx >> (2 * (nss - 1))) & 3;
4700 			u8 sta_tx_val = (sta_mcs_map_tx >> (2 * (nss - 1))) & 3;
4701 			u8 ap_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;
4702 
4703 			if (ap_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
4704 				continue;
4705 
4706 			/*
4707 			 * Make sure the HE AP doesn't require MCSs that aren't
4708 			 * supported by the client as required by spec
4709 			 *
4710 			 * P802.11-REVme/D0.3
4711 			 * 26.17.1 Basic HE BSS operation
4712 			 *
4713 			 * An HE STA shall not attempt to join * (MLME-JOIN.request primitive)
4714 			 * a BSS, unless it supports (i.e., is able to both transmit and
4715 			 * receive using) all of the <HE-MCS, NSS> tuples in the basic
4716 			 * HE-MCS and NSS set.
4717 			 */
4718 			if (sta_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4719 			    sta_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
4720 			    (ap_val > sta_rx_val) || (ap_val > sta_tx_val)) {
4721 				verified = false;
4722 				break;
4723 			}
4724 		}
4725 
4726 		if (verified)
4727 			return true;
4728 	}
4729 
4730 	/* If here, STA doesn't meet AP's HE min requirements */
4731 	return false;
4732 }
4733 
4734 static u8
ieee80211_get_eht_cap_mcs_nss(const struct ieee80211_sta_he_cap * sta_he_cap,const struct ieee80211_sta_eht_cap * sta_eht_cap,unsigned int idx,int bw)4735 ieee80211_get_eht_cap_mcs_nss(const struct ieee80211_sta_he_cap *sta_he_cap,
4736 			      const struct ieee80211_sta_eht_cap *sta_eht_cap,
4737 			      unsigned int idx, int bw)
4738 {
4739 	u8 he_phy_cap0 = sta_he_cap->he_cap_elem.phy_cap_info[0];
4740 	u8 eht_phy_cap0 = sta_eht_cap->eht_cap_elem.phy_cap_info[0];
4741 
4742 	/* handle us being a 20 MHz-only EHT STA - with four values
4743 	 * for MCS 0-7, 8-9, 10-11, 12-13.
4744 	 */
4745 	if (!(he_phy_cap0 & IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_MASK_ALL))
4746 		return sta_eht_cap->eht_mcs_nss_supp.only_20mhz.rx_tx_max_nss[idx];
4747 
4748 	/* the others have MCS 0-9 together, rather than separately from 0-7 */
4749 	if (idx > 0)
4750 		idx--;
4751 
4752 	switch (bw) {
4753 	case 0:
4754 		return sta_eht_cap->eht_mcs_nss_supp.bw._80.rx_tx_max_nss[idx];
4755 	case 1:
4756 		if (!(he_phy_cap0 &
4757 		      (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
4758 		       IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)))
4759 			return 0xff; /* pass check */
4760 		return sta_eht_cap->eht_mcs_nss_supp.bw._160.rx_tx_max_nss[idx];
4761 	case 2:
4762 		if (!(eht_phy_cap0 & IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ))
4763 			return 0xff; /* pass check */
4764 		return sta_eht_cap->eht_mcs_nss_supp.bw._320.rx_tx_max_nss[idx];
4765 	}
4766 
4767 	WARN_ON(1);
4768 	return 0;
4769 }
4770 
4771 static bool
ieee80211_verify_sta_eht_mcs_support(struct ieee80211_sub_if_data * sdata,struct ieee80211_supported_band * sband,const struct ieee80211_eht_operation * eht_op)4772 ieee80211_verify_sta_eht_mcs_support(struct ieee80211_sub_if_data *sdata,
4773 				     struct ieee80211_supported_band *sband,
4774 				     const struct ieee80211_eht_operation *eht_op)
4775 {
4776 	const struct ieee80211_sta_he_cap *sta_he_cap =
4777 		ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
4778 	const struct ieee80211_sta_eht_cap *sta_eht_cap =
4779 		ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif);
4780 	const struct ieee80211_eht_mcs_nss_supp_20mhz_only *req;
4781 	unsigned int i;
4782 
4783 	if (!sta_he_cap || !sta_eht_cap || !eht_op)
4784 		return false;
4785 
4786 	req = &eht_op->basic_mcs_nss;
4787 
4788 	for (i = 0; i < ARRAY_SIZE(req->rx_tx_max_nss); i++) {
4789 		u8 req_rx_nss, req_tx_nss;
4790 		unsigned int bw;
4791 
4792 		req_rx_nss = u8_get_bits(req->rx_tx_max_nss[i],
4793 					 IEEE80211_EHT_MCS_NSS_RX);
4794 		req_tx_nss = u8_get_bits(req->rx_tx_max_nss[i],
4795 					 IEEE80211_EHT_MCS_NSS_TX);
4796 
4797 		for (bw = 0; bw < 3; bw++) {
4798 			u8 have, have_rx_nss, have_tx_nss;
4799 
4800 			have = ieee80211_get_eht_cap_mcs_nss(sta_he_cap,
4801 							     sta_eht_cap,
4802 							     i, bw);
4803 			have_rx_nss = u8_get_bits(have,
4804 						  IEEE80211_EHT_MCS_NSS_RX);
4805 			have_tx_nss = u8_get_bits(have,
4806 						  IEEE80211_EHT_MCS_NSS_TX);
4807 
4808 			if (req_rx_nss > have_rx_nss ||
4809 			    req_tx_nss > have_tx_nss)
4810 				return false;
4811 		}
4812 	}
4813 
4814 	return true;
4815 }
4816 
ieee80211_prep_channel(struct ieee80211_sub_if_data * sdata,struct ieee80211_link_data * link,struct cfg80211_bss * cbss,ieee80211_conn_flags_t * conn_flags)4817 static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
4818 				  struct ieee80211_link_data *link,
4819 				  struct cfg80211_bss *cbss,
4820 				  ieee80211_conn_flags_t *conn_flags)
4821 {
4822 	struct ieee80211_local *local = sdata->local;
4823 	const struct ieee80211_ht_cap *ht_cap = NULL;
4824 	const struct ieee80211_ht_operation *ht_oper = NULL;
4825 	const struct ieee80211_vht_operation *vht_oper = NULL;
4826 	const struct ieee80211_he_operation *he_oper = NULL;
4827 	const struct ieee80211_eht_operation *eht_oper = NULL;
4828 	const struct ieee80211_s1g_oper_ie *s1g_oper = NULL;
4829 	struct ieee80211_supported_band *sband;
4830 	struct cfg80211_chan_def chandef;
4831 	bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
4832 	bool is_5ghz = cbss->channel->band == NL80211_BAND_5GHZ;
4833 	struct ieee80211_bss *bss = (void *)cbss->priv;
4834 	struct ieee80211_elems_parse_params parse_params = {
4835 		.link_id = -1,
4836 		.from_ap = true,
4837 	};
4838 	struct ieee802_11_elems *elems;
4839 	const struct cfg80211_bss_ies *ies;
4840 	int ret;
4841 	u32 i;
4842 	bool have_80mhz;
4843 
4844 	rcu_read_lock();
4845 
4846 	ies = rcu_dereference(cbss->ies);
4847 	parse_params.start = ies->data;
4848 	parse_params.len = ies->len;
4849 	elems = ieee802_11_parse_elems_full(&parse_params);
4850 	if (!elems) {
4851 		rcu_read_unlock();
4852 		return -ENOMEM;
4853 	}
4854 
4855 	sband = local->hw.wiphy->bands[cbss->channel->band];
4856 
4857 	*conn_flags &= ~(IEEE80211_CONN_DISABLE_40MHZ |
4858 			 IEEE80211_CONN_DISABLE_80P80MHZ |
4859 			 IEEE80211_CONN_DISABLE_160MHZ);
4860 
4861 	/* disable HT/VHT/HE if we don't support them */
4862 	if (!sband->ht_cap.ht_supported && !is_6ghz) {
4863 		mlme_dbg(sdata, "HT not supported, disabling HT/VHT/HE/EHT\n");
4864 		*conn_flags |= IEEE80211_CONN_DISABLE_HT;
4865 		*conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4866 		*conn_flags |= IEEE80211_CONN_DISABLE_HE;
4867 		*conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4868 	}
4869 
4870 	if (!sband->vht_cap.vht_supported && is_5ghz) {
4871 		mlme_dbg(sdata, "VHT not supported, disabling VHT/HE/EHT\n");
4872 		*conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4873 		*conn_flags |= IEEE80211_CONN_DISABLE_HE;
4874 		*conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4875 	}
4876 
4877 	if (!ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif)) {
4878 		mlme_dbg(sdata, "HE not supported, disabling HE and EHT\n");
4879 		*conn_flags |= IEEE80211_CONN_DISABLE_HE;
4880 		*conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4881 	}
4882 
4883 	if (!ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif)) {
4884 		mlme_dbg(sdata, "EHT not supported, disabling EHT\n");
4885 		*conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4886 	}
4887 
4888 	if (!(*conn_flags & IEEE80211_CONN_DISABLE_HT) && !is_6ghz) {
4889 		ht_oper = elems->ht_operation;
4890 		ht_cap = elems->ht_cap_elem;
4891 
4892 		if (!ht_cap) {
4893 			*conn_flags |= IEEE80211_CONN_DISABLE_HT;
4894 			ht_oper = NULL;
4895 		}
4896 	}
4897 
4898 	if (!(*conn_flags & IEEE80211_CONN_DISABLE_VHT) && !is_6ghz) {
4899 		vht_oper = elems->vht_operation;
4900 		if (vht_oper && !ht_oper) {
4901 			vht_oper = NULL;
4902 			sdata_info(sdata,
4903 				   "AP advertised VHT without HT, disabling HT/VHT/HE\n");
4904 			*conn_flags |= IEEE80211_CONN_DISABLE_HT;
4905 			*conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4906 			*conn_flags |= IEEE80211_CONN_DISABLE_HE;
4907 			*conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4908 		}
4909 
4910 		if (!elems->vht_cap_elem) {
4911 			*conn_flags |= IEEE80211_CONN_DISABLE_VHT;
4912 			vht_oper = NULL;
4913 		}
4914 	}
4915 
4916 	if (!(*conn_flags & IEEE80211_CONN_DISABLE_HE)) {
4917 		he_oper = elems->he_operation;
4918 
4919 		if (link && is_6ghz) {
4920 			struct ieee80211_bss_conf *bss_conf;
4921 			u8 j = 0;
4922 
4923 			bss_conf = link->conf;
4924 
4925 			if (elems->pwr_constr_elem)
4926 				bss_conf->pwr_reduction = *elems->pwr_constr_elem;
4927 
4928 			BUILD_BUG_ON(ARRAY_SIZE(bss_conf->tx_pwr_env) !=
4929 				     ARRAY_SIZE(elems->tx_pwr_env));
4930 
4931 			for (i = 0; i < elems->tx_pwr_env_num; i++) {
4932 				if (elems->tx_pwr_env_len[i] >
4933 				    sizeof(bss_conf->tx_pwr_env[j]))
4934 					continue;
4935 
4936 				bss_conf->tx_pwr_env_num++;
4937 				memcpy(&bss_conf->tx_pwr_env[j], elems->tx_pwr_env[i],
4938 				       elems->tx_pwr_env_len[i]);
4939 				j++;
4940 			}
4941 		}
4942 
4943 		if (!ieee80211_verify_peer_he_mcs_support(sdata, ies, he_oper) ||
4944 		    !ieee80211_verify_sta_he_mcs_support(sdata, sband, he_oper))
4945 			*conn_flags |= IEEE80211_CONN_DISABLE_HE |
4946 				       IEEE80211_CONN_DISABLE_EHT;
4947 	}
4948 
4949 	/*
4950 	 * EHT requires HE to be supported as well. Specifically for 6 GHz
4951 	 * channels, the operation channel information can only be deduced from
4952 	 * both the 6 GHz operation information (from the HE operation IE) and
4953 	 * EHT operation.
4954 	 */
4955 	if (!(*conn_flags &
4956 			(IEEE80211_CONN_DISABLE_HE |
4957 			 IEEE80211_CONN_DISABLE_EHT)) &&
4958 	    he_oper) {
4959 		const struct cfg80211_bss_ies *cbss_ies;
4960 		const struct element *eht_ml_elem;
4961 		const u8 *eht_oper_ie;
4962 
4963 		cbss_ies = rcu_dereference(cbss->ies);
4964 		eht_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_EHT_OPERATION,
4965 						   cbss_ies->data, cbss_ies->len);
4966 		if (eht_oper_ie && eht_oper_ie[1] >=
4967 		    1 + sizeof(struct ieee80211_eht_operation))
4968 			eht_oper = (void *)(eht_oper_ie + 3);
4969 		else
4970 			eht_oper = NULL;
4971 
4972 		if (!ieee80211_verify_sta_eht_mcs_support(sdata, sband, eht_oper))
4973 			*conn_flags |= IEEE80211_CONN_DISABLE_EHT;
4974 
4975 		eht_ml_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_MULTI_LINK,
4976 						     cbss_ies->data, cbss_ies->len);
4977 
4978 		/* data + 1 / datalen - 1 since it's an extended element */
4979 		if (!(*conn_flags & IEEE80211_CONN_DISABLE_EHT) &&
4980 		    eht_ml_elem &&
4981 		    ieee80211_mle_type_ok(eht_ml_elem->data + 1,
4982 					  IEEE80211_ML_CONTROL_TYPE_BASIC,
4983 					  eht_ml_elem->datalen - 1)) {
4984 			sdata->vif.cfg.eml_cap =
4985 				ieee80211_mle_get_eml_cap(eht_ml_elem->data + 1);
4986 			sdata->vif.cfg.eml_med_sync_delay =
4987 				ieee80211_mle_get_eml_med_sync_delay(eht_ml_elem->data + 1);
4988 		}
4989 	}
4990 
4991 	/* Allow VHT if at least one channel on the sband supports 80 MHz */
4992 	have_80mhz = false;
4993 	for (i = 0; i < sband->n_channels; i++) {
4994 		if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
4995 						IEEE80211_CHAN_NO_80MHZ))
4996 			continue;
4997 
4998 		have_80mhz = true;
4999 		break;
5000 	}
5001 
5002 	if (!have_80mhz) {
5003 		sdata_info(sdata, "80 MHz not supported, disabling VHT\n");
5004 		*conn_flags |= IEEE80211_CONN_DISABLE_VHT;
5005 	}
5006 
5007 	if (sband->band == NL80211_BAND_S1GHZ) {
5008 		s1g_oper = elems->s1g_oper;
5009 		if (!s1g_oper)
5010 			sdata_info(sdata,
5011 				   "AP missing S1G operation element?\n");
5012 	}
5013 
5014 	*conn_flags |=
5015 		ieee80211_determine_chantype(sdata, link, *conn_flags,
5016 					     sband,
5017 					     cbss->channel,
5018 					     bss->vht_cap_info,
5019 					     ht_oper, vht_oper,
5020 					     he_oper, eht_oper,
5021 					     s1g_oper,
5022 					     &chandef, false);
5023 
5024 	if (link)
5025 		link->needed_rx_chains =
5026 			min(ieee80211_max_rx_chains(link, cbss),
5027 			    local->rx_chains);
5028 
5029 	rcu_read_unlock();
5030 	/* the element data was RCU protected so no longer valid anyway */
5031 	kfree(elems);
5032 	elems = NULL;
5033 
5034 	if (*conn_flags & IEEE80211_CONN_DISABLE_HE && is_6ghz) {
5035 		sdata_info(sdata, "Rejecting non-HE 6/7 GHz connection");
5036 		return -EINVAL;
5037 	}
5038 
5039 	if (!link)
5040 		return 0;
5041 
5042 	/* will change later if needed */
5043 	link->smps_mode = IEEE80211_SMPS_OFF;
5044 
5045 	mutex_lock(&local->mtx);
5046 	/*
5047 	 * If this fails (possibly due to channel context sharing
5048 	 * on incompatible channels, e.g. 80+80 and 160 sharing the
5049 	 * same control channel) try to use a smaller bandwidth.
5050 	 */
5051 	ret = ieee80211_link_use_channel(link, &chandef,
5052 					 IEEE80211_CHANCTX_SHARED);
5053 
5054 	/* don't downgrade for 5 and 10 MHz channels, though. */
5055 	if (chandef.width == NL80211_CHAN_WIDTH_5 ||
5056 	    chandef.width == NL80211_CHAN_WIDTH_10)
5057 		goto out;
5058 
5059 	while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
5060 		*conn_flags |=
5061 			ieee80211_chandef_downgrade(&chandef);
5062 		ret = ieee80211_link_use_channel(link, &chandef,
5063 						 IEEE80211_CHANCTX_SHARED);
5064 	}
5065  out:
5066 	mutex_unlock(&local->mtx);
5067 	return ret;
5068 }
5069 
ieee80211_get_dtim(const struct cfg80211_bss_ies * ies,u8 * dtim_count,u8 * dtim_period)5070 static bool ieee80211_get_dtim(const struct cfg80211_bss_ies *ies,
5071 			       u8 *dtim_count, u8 *dtim_period)
5072 {
5073 	const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len);
5074 	const u8 *idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, ies->data,
5075 					 ies->len);
5076 	const struct ieee80211_tim_ie *tim = NULL;
5077 	const struct ieee80211_bssid_index *idx;
5078 	bool valid = tim_ie && tim_ie[1] >= 2;
5079 
5080 	if (valid)
5081 		tim = (void *)(tim_ie + 2);
5082 
5083 	if (dtim_count)
5084 		*dtim_count = valid ? tim->dtim_count : 0;
5085 
5086 	if (dtim_period)
5087 		*dtim_period = valid ? tim->dtim_period : 0;
5088 
5089 	/* Check if value is overridden by non-transmitted profile */
5090 	if (!idx_ie || idx_ie[1] < 3)
5091 		return valid;
5092 
5093 	idx = (void *)(idx_ie + 2);
5094 
5095 	if (dtim_count)
5096 		*dtim_count = idx->dtim_count;
5097 
5098 	if (dtim_period)
5099 		*dtim_period = idx->dtim_period;
5100 
5101 	return true;
5102 }
5103 
ieee80211_assoc_success(struct ieee80211_sub_if_data * sdata,struct ieee80211_mgmt * mgmt,struct ieee802_11_elems * elems,const u8 * elem_start,unsigned int elem_len)5104 static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
5105 				    struct ieee80211_mgmt *mgmt,
5106 				    struct ieee802_11_elems *elems,
5107 				    const u8 *elem_start, unsigned int elem_len)
5108 {
5109 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5110 	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
5111 	struct ieee80211_local *local = sdata->local;
5112 	unsigned int link_id;
5113 	struct sta_info *sta;
5114 	u64 changed[IEEE80211_MLD_MAX_NUM_LINKS] = {};
5115 	u16 valid_links = 0, dormant_links = 0;
5116 	int err;
5117 
5118 	mutex_lock(&sdata->local->sta_mtx);
5119 	/*
5120 	 * station info was already allocated and inserted before
5121 	 * the association and should be available to us
5122 	 */
5123 	sta = sta_info_get(sdata, assoc_data->ap_addr);
5124 	if (WARN_ON(!sta))
5125 		goto out_err;
5126 
5127 	if (ieee80211_vif_is_mld(&sdata->vif)) {
5128 		for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
5129 			if (!assoc_data->link[link_id].bss)
5130 				continue;
5131 
5132 			valid_links |= BIT(link_id);
5133 			if (assoc_data->link[link_id].disabled)
5134 				dormant_links |= BIT(link_id);
5135 
5136 			if (link_id != assoc_data->assoc_link_id) {
5137 				err = ieee80211_sta_allocate_link(sta, link_id);
5138 				if (err)
5139 					goto out_err;
5140 			}
5141 		}
5142 
5143 		ieee80211_vif_set_links(sdata, valid_links, dormant_links);
5144 	}
5145 
5146 	for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
5147 		struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
5148 		struct ieee80211_link_data *link;
5149 		struct link_sta_info *link_sta;
5150 
5151 		if (!cbss)
5152 			continue;
5153 
5154 		link = sdata_dereference(sdata->link[link_id], sdata);
5155 		if (WARN_ON(!link))
5156 			goto out_err;
5157 
5158 		if (ieee80211_vif_is_mld(&sdata->vif))
5159 			link_info(link,
5160 				  "local address %pM, AP link address %pM%s\n",
5161 				  link->conf->addr,
5162 				  assoc_data->link[link_id].bss->bssid,
5163 				  link_id == assoc_data->assoc_link_id ?
5164 					" (assoc)" : "");
5165 
5166 		link_sta = rcu_dereference_protected(sta->link[link_id],
5167 						     lockdep_is_held(&local->sta_mtx));
5168 		if (WARN_ON(!link_sta))
5169 			goto out_err;
5170 
5171 		if (!link->u.mgd.have_beacon) {
5172 			const struct cfg80211_bss_ies *ies;
5173 
5174 			rcu_read_lock();
5175 			ies = rcu_dereference(cbss->beacon_ies);
5176 			if (ies)
5177 				link->u.mgd.have_beacon = true;
5178 			else
5179 				ies = rcu_dereference(cbss->ies);
5180 			ieee80211_get_dtim(ies,
5181 					   &link->conf->sync_dtim_count,
5182 					   &link->u.mgd.dtim_period);
5183 			link->conf->beacon_int = cbss->beacon_interval;
5184 			rcu_read_unlock();
5185 		}
5186 
5187 		link->conf->dtim_period = link->u.mgd.dtim_period ?: 1;
5188 
5189 		if (link_id != assoc_data->assoc_link_id) {
5190 			err = ieee80211_prep_channel(sdata, link, cbss,
5191 						     &link->u.mgd.conn_flags);
5192 			if (err) {
5193 				link_info(link, "prep_channel failed\n");
5194 				goto out_err;
5195 			}
5196 		}
5197 
5198 		err = ieee80211_mgd_setup_link_sta(link, sta, link_sta,
5199 						   assoc_data->link[link_id].bss);
5200 		if (err)
5201 			goto out_err;
5202 
5203 		if (!ieee80211_assoc_config_link(link, link_sta,
5204 						 assoc_data->link[link_id].bss,
5205 						 mgmt, elem_start, elem_len,
5206 						 &changed[link_id]))
5207 			goto out_err;
5208 
5209 		if (assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) {
5210 			valid_links &= ~BIT(link_id);
5211 			ieee80211_sta_remove_link(sta, link_id);
5212 			continue;
5213 		}
5214 
5215 		if (link_id != assoc_data->assoc_link_id) {
5216 			err = ieee80211_sta_activate_link(sta, link_id);
5217 			if (err)
5218 				goto out_err;
5219 		}
5220 	}
5221 
5222 	/* links might have changed due to rejected ones, set them again */
5223 	ieee80211_vif_set_links(sdata, valid_links, dormant_links);
5224 
5225 	rate_control_rate_init(sta);
5226 
5227 	if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) {
5228 		set_sta_flag(sta, WLAN_STA_MFP);
5229 		sta->sta.mfp = true;
5230 	} else {
5231 		sta->sta.mfp = false;
5232 	}
5233 
5234 	ieee80211_sta_set_max_amsdu_subframes(sta, elems->ext_capab,
5235 					      elems->ext_capab_len);
5236 
5237 	sta->sta.wme = (elems->wmm_param || elems->s1g_capab) &&
5238 		       local->hw.queues >= IEEE80211_NUM_ACS;
5239 
5240 	err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
5241 	if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
5242 		err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
5243 	if (err) {
5244 		sdata_info(sdata,
5245 			   "failed to move station %pM to desired state\n",
5246 			   sta->sta.addr);
5247 		WARN_ON(__sta_info_destroy(sta));
5248 		goto out_err;
5249 	}
5250 
5251 	if (sdata->wdev.use_4addr)
5252 		drv_sta_set_4addr(local, sdata, &sta->sta, true);
5253 
5254 	mutex_unlock(&sdata->local->sta_mtx);
5255 
5256 	ieee80211_set_associated(sdata, assoc_data, changed);
5257 
5258 	/*
5259 	 * If we're using 4-addr mode, let the AP know that we're
5260 	 * doing so, so that it can create the STA VLAN on its side
5261 	 */
5262 	if (ifmgd->use_4addr)
5263 		ieee80211_send_4addr_nullfunc(local, sdata);
5264 
5265 	/*
5266 	 * Start timer to probe the connection to the AP now.
5267 	 * Also start the timer that will detect beacon loss.
5268 	 */
5269 	ieee80211_sta_reset_beacon_monitor(sdata);
5270 	ieee80211_sta_reset_conn_monitor(sdata);
5271 
5272 	return true;
5273 out_err:
5274 	eth_zero_addr(sdata->vif.cfg.ap_addr);
5275 	mutex_unlock(&sdata->local->sta_mtx);
5276 	return false;
5277 }
5278 
ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data * sdata,struct ieee80211_mgmt * mgmt,size_t len)5279 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
5280 					 struct ieee80211_mgmt *mgmt,
5281 					 size_t len)
5282 {
5283 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5284 	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
5285 	u16 capab_info, status_code, aid;
5286 	struct ieee80211_elems_parse_params parse_params = {
5287 		.bss = NULL,
5288 		.link_id = -1,
5289 		.from_ap = true,
5290 	};
5291 	struct ieee802_11_elems *elems;
5292 	int ac;
5293 	const u8 *elem_start;
5294 	unsigned int elem_len;
5295 	bool reassoc;
5296 	struct ieee80211_event event = {
5297 		.type = MLME_EVENT,
5298 		.u.mlme.data = ASSOC_EVENT,
5299 	};
5300 	struct ieee80211_prep_tx_info info = {};
5301 	struct cfg80211_rx_assoc_resp resp = {
5302 		.uapsd_queues = -1,
5303 	};
5304 	u8 ap_mld_addr[ETH_ALEN] __aligned(2);
5305 	unsigned int link_id;
5306 
5307 	sdata_assert_lock(sdata);
5308 
5309 	if (!assoc_data)
5310 		return;
5311 
5312 	if (!ether_addr_equal(assoc_data->ap_addr, mgmt->bssid) ||
5313 	    !ether_addr_equal(assoc_data->ap_addr, mgmt->sa))
5314 		return;
5315 
5316 	/*
5317 	 * AssocResp and ReassocResp have identical structure, so process both
5318 	 * of them in this function.
5319 	 */
5320 
5321 	if (len < 24 + 6)
5322 		return;
5323 
5324 	reassoc = ieee80211_is_reassoc_resp(mgmt->frame_control);
5325 	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
5326 	status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
5327 	if (assoc_data->s1g)
5328 		elem_start = mgmt->u.s1g_assoc_resp.variable;
5329 	else
5330 		elem_start = mgmt->u.assoc_resp.variable;
5331 
5332 	/*
5333 	 * Note: this may not be perfect, AP might misbehave - if
5334 	 * anyone needs to rely on perfect complete notification
5335 	 * with the exact right subtype, then we need to track what
5336 	 * we actually transmitted.
5337 	 */
5338 	info.subtype = reassoc ? IEEE80211_STYPE_REASSOC_REQ :
5339 				 IEEE80211_STYPE_ASSOC_REQ;
5340 
5341 	if (assoc_data->fils_kek_len &&
5342 	    fils_decrypt_assoc_resp(sdata, (u8 *)mgmt, &len, assoc_data) < 0)
5343 		return;
5344 
5345 	elem_len = len - (elem_start - (u8 *)mgmt);
5346 	parse_params.start = elem_start;
5347 	parse_params.len = elem_len;
5348 	elems = ieee802_11_parse_elems_full(&parse_params);
5349 	if (!elems)
5350 		goto notify_driver;
5351 
5352 	if (elems->aid_resp)
5353 		aid = le16_to_cpu(elems->aid_resp->aid);
5354 	else if (assoc_data->s1g)
5355 		aid = 0; /* TODO */
5356 	else
5357 		aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
5358 
5359 	/*
5360 	 * The 5 MSB of the AID field are reserved
5361 	 * (802.11-2016 9.4.1.8 AID field)
5362 	 */
5363 	aid &= 0x7ff;
5364 
5365 	sdata_info(sdata,
5366 		   "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
5367 		   reassoc ? "Rea" : "A", assoc_data->ap_addr,
5368 		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
5369 
5370 	ifmgd->broken_ap = false;
5371 
5372 	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
5373 	    elems->timeout_int &&
5374 	    elems->timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
5375 		u32 tu, ms;
5376 
5377 		cfg80211_assoc_comeback(sdata->dev, assoc_data->ap_addr,
5378 					le32_to_cpu(elems->timeout_int->value));
5379 
5380 		tu = le32_to_cpu(elems->timeout_int->value);
5381 		ms = tu * 1024 / 1000;
5382 		sdata_info(sdata,
5383 			   "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
5384 			   assoc_data->ap_addr, tu, ms);
5385 		assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
5386 		assoc_data->timeout_started = true;
5387 		if (ms > IEEE80211_ASSOC_TIMEOUT)
5388 			run_again(sdata, assoc_data->timeout);
5389 		goto notify_driver;
5390 	}
5391 
5392 	if (status_code != WLAN_STATUS_SUCCESS) {
5393 		sdata_info(sdata, "%pM denied association (code=%d)\n",
5394 			   assoc_data->ap_addr, status_code);
5395 		event.u.mlme.status = MLME_DENIED;
5396 		event.u.mlme.reason = status_code;
5397 		drv_event_callback(sdata->local, sdata, &event);
5398 	} else {
5399 		if (aid == 0 || aid > IEEE80211_MAX_AID) {
5400 			sdata_info(sdata,
5401 				   "invalid AID value %d (out of range), turn off PS\n",
5402 				   aid);
5403 			aid = 0;
5404 			ifmgd->broken_ap = true;
5405 		}
5406 
5407 		if (ieee80211_vif_is_mld(&sdata->vif)) {
5408 			if (!elems->ml_basic) {
5409 				sdata_info(sdata,
5410 					   "MLO association with %pM but no multi-link element in response!\n",
5411 					   assoc_data->ap_addr);
5412 				goto abandon_assoc;
5413 			}
5414 
5415 			if (le16_get_bits(elems->ml_basic->control,
5416 					  IEEE80211_ML_CONTROL_TYPE) !=
5417 					IEEE80211_ML_CONTROL_TYPE_BASIC) {
5418 				sdata_info(sdata,
5419 					   "bad multi-link element (control=0x%x)\n",
5420 					   le16_to_cpu(elems->ml_basic->control));
5421 				goto abandon_assoc;
5422 			} else {
5423 				struct ieee80211_mle_basic_common_info *common;
5424 
5425 				common = (void *)elems->ml_basic->variable;
5426 
5427 				if (memcmp(assoc_data->ap_addr,
5428 					   common->mld_mac_addr, ETH_ALEN)) {
5429 					sdata_info(sdata,
5430 						   "AP MLD MAC address mismatch: got %pM expected %pM\n",
5431 						   common->mld_mac_addr,
5432 						   assoc_data->ap_addr);
5433 					goto abandon_assoc;
5434 				}
5435 			}
5436 		}
5437 
5438 		sdata->vif.cfg.aid = aid;
5439 
5440 		if (!ieee80211_assoc_success(sdata, mgmt, elems,
5441 					     elem_start, elem_len)) {
5442 			/* oops -- internal error -- send timeout for now */
5443 			ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
5444 			goto notify_driver;
5445 		}
5446 		event.u.mlme.status = MLME_SUCCESS;
5447 		drv_event_callback(sdata->local, sdata, &event);
5448 		sdata_info(sdata, "associated\n");
5449 
5450 		info.success = 1;
5451 	}
5452 
5453 	for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
5454 		struct ieee80211_link_data *link;
5455 
5456 		if (!assoc_data->link[link_id].bss)
5457 			continue;
5458 
5459 		resp.links[link_id].bss = assoc_data->link[link_id].bss;
5460 		ether_addr_copy(resp.links[link_id].addr,
5461 				assoc_data->link[link_id].addr);
5462 		resp.links[link_id].status = assoc_data->link[link_id].status;
5463 
5464 		link = sdata_dereference(sdata->link[link_id], sdata);
5465 		if (!link)
5466 			continue;
5467 
5468 		/* get uapsd queues configuration - same for all links */
5469 		resp.uapsd_queues = 0;
5470 		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
5471 			if (link->tx_conf[ac].uapsd)
5472 				resp.uapsd_queues |= ieee80211_ac_to_qos_mask[ac];
5473 	}
5474 
5475 	if (ieee80211_vif_is_mld(&sdata->vif)) {
5476 		ether_addr_copy(ap_mld_addr, sdata->vif.cfg.ap_addr);
5477 		resp.ap_mld_addr = ap_mld_addr;
5478 	}
5479 
5480 	ieee80211_destroy_assoc_data(sdata,
5481 				     status_code == WLAN_STATUS_SUCCESS ?
5482 					ASSOC_SUCCESS :
5483 					ASSOC_REJECTED);
5484 
5485 	resp.buf = (u8 *)mgmt;
5486 	resp.len = len;
5487 	resp.req_ies = ifmgd->assoc_req_ies;
5488 	resp.req_ies_len = ifmgd->assoc_req_ies_len;
5489 	cfg80211_rx_assoc_resp(sdata->dev, &resp);
5490 notify_driver:
5491 	drv_mgd_complete_tx(sdata->local, sdata, &info);
5492 	kfree(elems);
5493 	return;
5494 abandon_assoc:
5495 	ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
5496 	goto notify_driver;
5497 }
5498 
ieee80211_rx_bss_info(struct ieee80211_link_data * link,struct ieee80211_mgmt * mgmt,size_t len,struct ieee80211_rx_status * rx_status)5499 static void ieee80211_rx_bss_info(struct ieee80211_link_data *link,
5500 				  struct ieee80211_mgmt *mgmt, size_t len,
5501 				  struct ieee80211_rx_status *rx_status)
5502 {
5503 	struct ieee80211_sub_if_data *sdata = link->sdata;
5504 	struct ieee80211_local *local = sdata->local;
5505 	struct ieee80211_bss *bss;
5506 	struct ieee80211_channel *channel;
5507 
5508 	sdata_assert_lock(sdata);
5509 
5510 	channel = ieee80211_get_channel_khz(local->hw.wiphy,
5511 					ieee80211_rx_status_to_khz(rx_status));
5512 	if (!channel)
5513 		return;
5514 
5515 	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, channel);
5516 	if (bss) {
5517 		link->conf->beacon_rate = bss->beacon_rate;
5518 		ieee80211_rx_bss_put(local, bss);
5519 	}
5520 }
5521 
5522 
ieee80211_rx_mgmt_probe_resp(struct ieee80211_link_data * link,struct sk_buff * skb)5523 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_link_data *link,
5524 					 struct sk_buff *skb)
5525 {
5526 	struct ieee80211_sub_if_data *sdata = link->sdata;
5527 	struct ieee80211_mgmt *mgmt = (void *)skb->data;
5528 	struct ieee80211_if_managed *ifmgd;
5529 	struct ieee80211_rx_status *rx_status = (void *) skb->cb;
5530 	struct ieee80211_channel *channel;
5531 	size_t baselen, len = skb->len;
5532 
5533 	ifmgd = &sdata->u.mgd;
5534 
5535 	sdata_assert_lock(sdata);
5536 
5537 	/*
5538 	 * According to Draft P802.11ax D6.0 clause 26.17.2.3.2:
5539 	 * "If a 6 GHz AP receives a Probe Request frame  and responds with
5540 	 * a Probe Response frame [..], the Address 1 field of the Probe
5541 	 * Response frame shall be set to the broadcast address [..]"
5542 	 * So, on 6GHz band we should also accept broadcast responses.
5543 	 */
5544 	channel = ieee80211_get_channel(sdata->local->hw.wiphy,
5545 					rx_status->freq);
5546 	if (!channel)
5547 		return;
5548 
5549 	if (!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
5550 	    (channel->band != NL80211_BAND_6GHZ ||
5551 	     !is_broadcast_ether_addr(mgmt->da)))
5552 		return; /* ignore ProbeResp to foreign address */
5553 
5554 	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
5555 	if (baselen > len)
5556 		return;
5557 
5558 	ieee80211_rx_bss_info(link, mgmt, len, rx_status);
5559 
5560 	if (ifmgd->associated &&
5561 	    ether_addr_equal(mgmt->bssid, link->u.mgd.bssid))
5562 		ieee80211_reset_ap_probe(sdata);
5563 }
5564 
5565 /*
5566  * This is the canonical list of information elements we care about,
5567  * the filter code also gives us all changes to the Microsoft OUI
5568  * (00:50:F2) vendor IE which is used for WMM which we need to track,
5569  * as well as the DTPC IE (part of the Cisco OUI) used for signaling
5570  * changes to requested client power.
5571  *
5572  * We implement beacon filtering in software since that means we can
5573  * avoid processing the frame here and in cfg80211, and userspace
5574  * will not be able to tell whether the hardware supports it or not.
5575  *
5576  * XXX: This list needs to be dynamic -- userspace needs to be able to
5577  *	add items it requires. It also needs to be able to tell us to
5578  *	look out for other vendor IEs.
5579  */
5580 static const u64 care_about_ies =
5581 	(1ULL << WLAN_EID_COUNTRY) |
5582 	(1ULL << WLAN_EID_ERP_INFO) |
5583 	(1ULL << WLAN_EID_CHANNEL_SWITCH) |
5584 	(1ULL << WLAN_EID_PWR_CONSTRAINT) |
5585 	(1ULL << WLAN_EID_HT_CAPABILITY) |
5586 	(1ULL << WLAN_EID_HT_OPERATION) |
5587 	(1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
5588 
ieee80211_handle_beacon_sig(struct ieee80211_link_data * link,struct ieee80211_if_managed * ifmgd,struct ieee80211_bss_conf * bss_conf,struct ieee80211_local * local,struct ieee80211_rx_status * rx_status)5589 static void ieee80211_handle_beacon_sig(struct ieee80211_link_data *link,
5590 					struct ieee80211_if_managed *ifmgd,
5591 					struct ieee80211_bss_conf *bss_conf,
5592 					struct ieee80211_local *local,
5593 					struct ieee80211_rx_status *rx_status)
5594 {
5595 	struct ieee80211_sub_if_data *sdata = link->sdata;
5596 
5597 	/* Track average RSSI from the Beacon frames of the current AP */
5598 
5599 	if (!link->u.mgd.tracking_signal_avg) {
5600 		link->u.mgd.tracking_signal_avg = true;
5601 		ewma_beacon_signal_init(&link->u.mgd.ave_beacon_signal);
5602 		link->u.mgd.last_cqm_event_signal = 0;
5603 		link->u.mgd.count_beacon_signal = 1;
5604 		link->u.mgd.last_ave_beacon_signal = 0;
5605 	} else {
5606 		link->u.mgd.count_beacon_signal++;
5607 	}
5608 
5609 	ewma_beacon_signal_add(&link->u.mgd.ave_beacon_signal,
5610 			       -rx_status->signal);
5611 
5612 	if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
5613 	    link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
5614 		int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
5615 		int last_sig = link->u.mgd.last_ave_beacon_signal;
5616 		struct ieee80211_event event = {
5617 			.type = RSSI_EVENT,
5618 		};
5619 
5620 		/*
5621 		 * if signal crosses either of the boundaries, invoke callback
5622 		 * with appropriate parameters
5623 		 */
5624 		if (sig > ifmgd->rssi_max_thold &&
5625 		    (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
5626 			link->u.mgd.last_ave_beacon_signal = sig;
5627 			event.u.rssi.data = RSSI_EVENT_HIGH;
5628 			drv_event_callback(local, sdata, &event);
5629 		} else if (sig < ifmgd->rssi_min_thold &&
5630 			   (last_sig >= ifmgd->rssi_max_thold ||
5631 			   last_sig == 0)) {
5632 			link->u.mgd.last_ave_beacon_signal = sig;
5633 			event.u.rssi.data = RSSI_EVENT_LOW;
5634 			drv_event_callback(local, sdata, &event);
5635 		}
5636 	}
5637 
5638 	if (bss_conf->cqm_rssi_thold &&
5639 	    link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
5640 	    !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
5641 		int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
5642 		int last_event = link->u.mgd.last_cqm_event_signal;
5643 		int thold = bss_conf->cqm_rssi_thold;
5644 		int hyst = bss_conf->cqm_rssi_hyst;
5645 
5646 		if (sig < thold &&
5647 		    (last_event == 0 || sig < last_event - hyst)) {
5648 			link->u.mgd.last_cqm_event_signal = sig;
5649 			ieee80211_cqm_rssi_notify(
5650 				&sdata->vif,
5651 				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
5652 				sig, GFP_KERNEL);
5653 		} else if (sig > thold &&
5654 			   (last_event == 0 || sig > last_event + hyst)) {
5655 			link->u.mgd.last_cqm_event_signal = sig;
5656 			ieee80211_cqm_rssi_notify(
5657 				&sdata->vif,
5658 				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
5659 				sig, GFP_KERNEL);
5660 		}
5661 	}
5662 
5663 	if (bss_conf->cqm_rssi_low &&
5664 	    link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
5665 		int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
5666 		int last_event = link->u.mgd.last_cqm_event_signal;
5667 		int low = bss_conf->cqm_rssi_low;
5668 		int high = bss_conf->cqm_rssi_high;
5669 
5670 		if (sig < low &&
5671 		    (last_event == 0 || last_event >= low)) {
5672 			link->u.mgd.last_cqm_event_signal = sig;
5673 			ieee80211_cqm_rssi_notify(
5674 				&sdata->vif,
5675 				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
5676 				sig, GFP_KERNEL);
5677 		} else if (sig > high &&
5678 			   (last_event == 0 || last_event <= high)) {
5679 			link->u.mgd.last_cqm_event_signal = sig;
5680 			ieee80211_cqm_rssi_notify(
5681 				&sdata->vif,
5682 				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
5683 				sig, GFP_KERNEL);
5684 		}
5685 	}
5686 }
5687 
ieee80211_rx_our_beacon(const u8 * tx_bssid,struct cfg80211_bss * bss)5688 static bool ieee80211_rx_our_beacon(const u8 *tx_bssid,
5689 				    struct cfg80211_bss *bss)
5690 {
5691 	if (ether_addr_equal(tx_bssid, bss->bssid))
5692 		return true;
5693 	if (!bss->transmitted_bss)
5694 		return false;
5695 	return ether_addr_equal(tx_bssid, bss->transmitted_bss->bssid);
5696 }
5697 
ieee80211_config_puncturing(struct ieee80211_link_data * link,const struct ieee80211_eht_operation * eht_oper,u64 * changed)5698 static bool ieee80211_config_puncturing(struct ieee80211_link_data *link,
5699 					const struct ieee80211_eht_operation *eht_oper,
5700 					u64 *changed)
5701 {
5702 	u16 bitmap = 0, extracted;
5703 
5704 	if ((eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) &&
5705 	    (eht_oper->params &
5706 	     IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT)) {
5707 		const struct ieee80211_eht_operation_info *info =
5708 			(void *)eht_oper->optional;
5709 		const u8 *disable_subchannel_bitmap = info->optional;
5710 
5711 		bitmap = get_unaligned_le16(disable_subchannel_bitmap);
5712 	}
5713 
5714 	extracted = ieee80211_extract_dis_subch_bmap(eht_oper,
5715 						     &link->conf->chandef,
5716 						     bitmap);
5717 
5718 	/* accept if there are no changes */
5719 	if (!(*changed & BSS_CHANGED_BANDWIDTH) &&
5720 	    extracted == link->conf->eht_puncturing)
5721 		return true;
5722 
5723 	if (!cfg80211_valid_disable_subchannel_bitmap(&bitmap,
5724 						      &link->conf->chandef)) {
5725 		link_info(link,
5726 			  "Got an invalid disable subchannel bitmap from AP %pM: bitmap = 0x%x, bw = 0x%x. disconnect\n",
5727 			  link->u.mgd.bssid,
5728 			  bitmap,
5729 			  link->conf->chandef.width);
5730 		return false;
5731 	}
5732 
5733 	ieee80211_handle_puncturing_bitmap(link, eht_oper, bitmap, changed);
5734 	return true;
5735 }
5736 
ieee80211_ml_reconf_work(struct wiphy * wiphy,struct wiphy_work * work)5737 static void ieee80211_ml_reconf_work(struct wiphy *wiphy,
5738 				     struct wiphy_work *work)
5739 {
5740 	struct ieee80211_sub_if_data *sdata =
5741 		container_of(work, struct ieee80211_sub_if_data,
5742 			     u.mgd.ml_reconf_work.work);
5743 	u16 new_valid_links, new_active_links, new_dormant_links;
5744 	int ret;
5745 
5746 	sdata_lock(sdata);
5747 	if (!sdata->u.mgd.removed_links) {
5748 		sdata_unlock(sdata);
5749 		return;
5750 	}
5751 
5752 	sdata_info(sdata,
5753 		   "MLO Reconfiguration: work: valid=0x%x, removed=0x%x\n",
5754 		   sdata->vif.valid_links, sdata->u.mgd.removed_links);
5755 
5756 	new_valid_links = sdata->vif.valid_links & ~sdata->u.mgd.removed_links;
5757 	if (new_valid_links == sdata->vif.valid_links) {
5758 		sdata_unlock(sdata);
5759 		return;
5760 	}
5761 
5762 	if (!new_valid_links ||
5763 	    !(new_valid_links & ~sdata->vif.dormant_links)) {
5764 		sdata_info(sdata, "No valid links after reconfiguration\n");
5765 		ret = -EINVAL;
5766 		goto out;
5767 	}
5768 
5769 	new_active_links = sdata->vif.active_links & ~sdata->u.mgd.removed_links;
5770 	if (new_active_links != sdata->vif.active_links) {
5771 		if (!new_active_links)
5772 			new_active_links =
5773 				BIT(ffs(new_valid_links &
5774 					~sdata->vif.dormant_links) - 1);
5775 
5776 		ret = __ieee80211_set_active_links(&sdata->vif,
5777 						   new_active_links);
5778 		if (ret) {
5779 			sdata_info(sdata,
5780 				   "Failed setting active links\n");
5781 			goto out;
5782 		}
5783 	}
5784 
5785 	new_dormant_links = sdata->vif.dormant_links & ~sdata->u.mgd.removed_links;
5786 
5787 	ret = ieee80211_vif_set_links(sdata, new_valid_links,
5788 				      new_dormant_links);
5789 	if (ret)
5790 		sdata_info(sdata, "Failed setting valid links\n");
5791 
5792 out:
5793 	if (!ret)
5794 		cfg80211_links_removed(sdata->dev, sdata->u.mgd.removed_links);
5795 	else
5796 		___ieee80211_disconnect(sdata);
5797 
5798 	sdata->u.mgd.removed_links = 0;
5799 
5800 	sdata_unlock(sdata);
5801 }
5802 
ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data * sdata,struct ieee802_11_elems * elems)5803 static void ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data *sdata,
5804 					 struct ieee802_11_elems *elems)
5805 {
5806 	const struct ieee80211_multi_link_elem *ml;
5807 	const struct element *sub;
5808 	ssize_t ml_len;
5809 	unsigned long removed_links = 0;
5810 	u16 link_removal_timeout[IEEE80211_MLD_MAX_NUM_LINKS] = {};
5811 	u8 link_id;
5812 	u32 delay;
5813 
5814 	if (!ieee80211_vif_is_mld(&sdata->vif) || !elems->ml_reconf)
5815 		return;
5816 
5817 	ml_len = cfg80211_defragment_element(elems->ml_reconf_elem,
5818 					     elems->ie_start,
5819 					     elems->total_len,
5820 					     elems->scratch_pos,
5821 					     elems->scratch + elems->scratch_len -
5822 					     elems->scratch_pos,
5823 					     WLAN_EID_FRAGMENT);
5824 	if (ml_len < 0)
5825 		return;
5826 
5827 	elems->ml_reconf = (const void *)elems->scratch_pos;
5828 	elems->ml_reconf_len = ml_len;
5829 	ml = elems->ml_reconf;
5830 
5831 	/* Directly parse the sub elements as the common information doesn't
5832 	 * hold any useful information.
5833 	 */
5834 	for_each_mle_subelement(sub, (u8 *)ml, ml_len) {
5835 		struct ieee80211_mle_per_sta_profile *prof = (void *)sub->data;
5836 		u8 *pos = prof->variable;
5837 		u16 control;
5838 
5839 		if (sub->id != IEEE80211_MLE_SUBELEM_PER_STA_PROFILE)
5840 			continue;
5841 
5842 		if (!ieee80211_mle_reconf_sta_prof_size_ok(sub->data,
5843 							   sub->datalen))
5844 			return;
5845 
5846 		control = le16_to_cpu(prof->control);
5847 		link_id = control & IEEE80211_MLE_STA_RECONF_CONTROL_LINK_ID;
5848 
5849 		removed_links |= BIT(link_id);
5850 
5851 		/* the MAC address should not be included, but handle it */
5852 		if (control &
5853 		    IEEE80211_MLE_STA_RECONF_CONTROL_STA_MAC_ADDR_PRESENT)
5854 			pos += 6;
5855 
5856 		/* According to Draft P802.11be_D3.0, the control should
5857 		 * include the AP Removal Timer present. If the AP Removal Timer
5858 		 * is not present assume immediate removal.
5859 		 */
5860 		if (control &
5861 		    IEEE80211_MLE_STA_RECONF_CONTROL_AP_REM_TIMER_PRESENT)
5862 			link_removal_timeout[link_id] = le16_to_cpu(*(__le16 *)pos);
5863 	}
5864 
5865 	removed_links &= sdata->vif.valid_links;
5866 	if (!removed_links) {
5867 		/* In case the removal was cancelled, abort it */
5868 		if (sdata->u.mgd.removed_links) {
5869 			sdata->u.mgd.removed_links = 0;
5870 			wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
5871 						  &sdata->u.mgd.ml_reconf_work);
5872 		}
5873 		return;
5874 	}
5875 
5876 	delay = 0;
5877 	for_each_set_bit(link_id, &removed_links, IEEE80211_MLD_MAX_NUM_LINKS) {
5878 		struct ieee80211_bss_conf *link_conf =
5879 			sdata_dereference(sdata->vif.link_conf[link_id], sdata);
5880 		u32 link_delay;
5881 
5882 		if (!link_conf) {
5883 			removed_links &= ~BIT(link_id);
5884 			continue;
5885 		}
5886 
5887 		link_delay = link_conf->beacon_int *
5888 			link_removal_timeout[link_id];
5889 
5890 		if (!delay)
5891 			delay = link_delay;
5892 		else
5893 			delay = min(delay, link_delay);
5894 	}
5895 
5896 	sdata->u.mgd.removed_links = removed_links;
5897 	wiphy_delayed_work_queue(sdata->local->hw.wiphy,
5898 				 &sdata->u.mgd.ml_reconf_work,
5899 				 TU_TO_JIFFIES(delay));
5900 }
5901 
ieee80211_rx_mgmt_beacon(struct ieee80211_link_data * link,struct ieee80211_hdr * hdr,size_t len,struct ieee80211_rx_status * rx_status)5902 static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link,
5903 				     struct ieee80211_hdr *hdr, size_t len,
5904 				     struct ieee80211_rx_status *rx_status)
5905 {
5906 	struct ieee80211_sub_if_data *sdata = link->sdata;
5907 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5908 	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
5909 	struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
5910 	struct ieee80211_mgmt *mgmt = (void *) hdr;
5911 	size_t baselen;
5912 	struct ieee802_11_elems *elems;
5913 	struct ieee80211_local *local = sdata->local;
5914 	struct ieee80211_chanctx_conf *chanctx_conf;
5915 	struct ieee80211_supported_band *sband;
5916 	struct ieee80211_channel *chan;
5917 	struct link_sta_info *link_sta;
5918 	struct sta_info *sta;
5919 	u64 changed = 0;
5920 	bool erp_valid;
5921 	u8 erp_value = 0;
5922 	u32 ncrc = 0;
5923 	u8 *bssid, *variable = mgmt->u.beacon.variable;
5924 	u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
5925 	struct ieee80211_elems_parse_params parse_params = {
5926 		.link_id = -1,
5927 		.from_ap = true,
5928 	};
5929 
5930 	sdata_assert_lock(sdata);
5931 
5932 	/* Process beacon from the current BSS */
5933 	bssid = ieee80211_get_bssid(hdr, len, sdata->vif.type);
5934 	if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
5935 		struct ieee80211_ext *ext = (void *) mgmt;
5936 
5937 		if (ieee80211_is_s1g_short_beacon(ext->frame_control))
5938 			variable = ext->u.s1g_short_beacon.variable;
5939 		else
5940 			variable = ext->u.s1g_beacon.variable;
5941 	}
5942 
5943 	baselen = (u8 *) variable - (u8 *) mgmt;
5944 	if (baselen > len)
5945 		return;
5946 
5947 	parse_params.start = variable;
5948 	parse_params.len = len - baselen;
5949 
5950 	rcu_read_lock();
5951 	chanctx_conf = rcu_dereference(link->conf->chanctx_conf);
5952 	if (!chanctx_conf) {
5953 		rcu_read_unlock();
5954 		return;
5955 	}
5956 
5957 	if (ieee80211_rx_status_to_khz(rx_status) !=
5958 	    ieee80211_channel_to_khz(chanctx_conf->def.chan)) {
5959 		rcu_read_unlock();
5960 		return;
5961 	}
5962 	chan = chanctx_conf->def.chan;
5963 	rcu_read_unlock();
5964 
5965 	if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
5966 	    !WARN_ON(ieee80211_vif_is_mld(&sdata->vif)) &&
5967 	    ieee80211_rx_our_beacon(bssid, ifmgd->assoc_data->link[0].bss)) {
5968 		parse_params.bss = ifmgd->assoc_data->link[0].bss;
5969 		elems = ieee802_11_parse_elems_full(&parse_params);
5970 		if (!elems)
5971 			return;
5972 
5973 		ieee80211_rx_bss_info(link, mgmt, len, rx_status);
5974 
5975 		if (elems->dtim_period)
5976 			link->u.mgd.dtim_period = elems->dtim_period;
5977 		link->u.mgd.have_beacon = true;
5978 		ifmgd->assoc_data->need_beacon = false;
5979 		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
5980 			link->conf->sync_tsf =
5981 				le64_to_cpu(mgmt->u.beacon.timestamp);
5982 			link->conf->sync_device_ts =
5983 				rx_status->device_timestamp;
5984 			link->conf->sync_dtim_count = elems->dtim_count;
5985 		}
5986 
5987 		if (elems->mbssid_config_ie)
5988 			bss_conf->profile_periodicity =
5989 				elems->mbssid_config_ie->profile_periodicity;
5990 		else
5991 			bss_conf->profile_periodicity = 0;
5992 
5993 		if (elems->ext_capab_len >= 11 &&
5994 		    (elems->ext_capab[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
5995 			bss_conf->ema_ap = true;
5996 		else
5997 			bss_conf->ema_ap = false;
5998 
5999 		/* continue assoc process */
6000 		ifmgd->assoc_data->timeout = jiffies;
6001 		ifmgd->assoc_data->timeout_started = true;
6002 		run_again(sdata, ifmgd->assoc_data->timeout);
6003 		kfree(elems);
6004 		return;
6005 	}
6006 
6007 	if (!ifmgd->associated ||
6008 	    !ieee80211_rx_our_beacon(bssid, link->u.mgd.bss))
6009 		return;
6010 	bssid = link->u.mgd.bssid;
6011 
6012 	if (!(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
6013 		ieee80211_handle_beacon_sig(link, ifmgd, bss_conf,
6014 					    local, rx_status);
6015 
6016 	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
6017 		mlme_dbg_ratelimited(sdata,
6018 				     "cancelling AP probe due to a received beacon\n");
6019 		ieee80211_reset_ap_probe(sdata);
6020 	}
6021 
6022 	/*
6023 	 * Push the beacon loss detection into the future since
6024 	 * we are processing a beacon from the AP just now.
6025 	 */
6026 	ieee80211_sta_reset_beacon_monitor(sdata);
6027 
6028 	/* TODO: CRC urrently not calculated on S1G Beacon Compatibility
6029 	 * element (which carries the beacon interval). Don't forget to add a
6030 	 * bit to care_about_ies[] above if mac80211 is interested in a
6031 	 * changing S1G element.
6032 	 */
6033 	if (!ieee80211_is_s1g_beacon(hdr->frame_control))
6034 		ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
6035 	parse_params.bss = link->u.mgd.bss;
6036 	parse_params.filter = care_about_ies;
6037 	parse_params.crc = ncrc;
6038 	elems = ieee802_11_parse_elems_full(&parse_params);
6039 	if (!elems)
6040 		return;
6041 	ncrc = elems->crc;
6042 
6043 	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
6044 	    ieee80211_check_tim(elems->tim, elems->tim_len, vif_cfg->aid)) {
6045 		if (local->hw.conf.dynamic_ps_timeout > 0) {
6046 			if (local->hw.conf.flags & IEEE80211_CONF_PS) {
6047 				local->hw.conf.flags &= ~IEEE80211_CONF_PS;
6048 				ieee80211_hw_config(local,
6049 						    IEEE80211_CONF_CHANGE_PS);
6050 			}
6051 			ieee80211_send_nullfunc(local, sdata, false);
6052 		} else if (!local->pspolling && sdata->u.mgd.powersave) {
6053 			local->pspolling = true;
6054 
6055 			/*
6056 			 * Here is assumed that the driver will be
6057 			 * able to send ps-poll frame and receive a
6058 			 * response even though power save mode is
6059 			 * enabled, but some drivers might require
6060 			 * to disable power save here. This needs
6061 			 * to be investigated.
6062 			 */
6063 			ieee80211_send_pspoll(local, sdata);
6064 		}
6065 	}
6066 
6067 	if (sdata->vif.p2p ||
6068 	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
6069 		struct ieee80211_p2p_noa_attr noa = {};
6070 		int ret;
6071 
6072 		ret = cfg80211_get_p2p_attr(variable,
6073 					    len - baselen,
6074 					    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
6075 					    (u8 *) &noa, sizeof(noa));
6076 		if (ret >= 2) {
6077 			if (link->u.mgd.p2p_noa_index != noa.index) {
6078 				/* valid noa_attr and index changed */
6079 				link->u.mgd.p2p_noa_index = noa.index;
6080 				memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
6081 				changed |= BSS_CHANGED_P2P_PS;
6082 				/*
6083 				 * make sure we update all information, the CRC
6084 				 * mechanism doesn't look at P2P attributes.
6085 				 */
6086 				link->u.mgd.beacon_crc_valid = false;
6087 			}
6088 		} else if (link->u.mgd.p2p_noa_index != -1) {
6089 			/* noa_attr not found and we had valid noa_attr before */
6090 			link->u.mgd.p2p_noa_index = -1;
6091 			memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
6092 			changed |= BSS_CHANGED_P2P_PS;
6093 			link->u.mgd.beacon_crc_valid = false;
6094 		}
6095 	}
6096 
6097 	if (link->u.mgd.csa_waiting_bcn)
6098 		ieee80211_chswitch_post_beacon(link);
6099 
6100 	/*
6101 	 * Update beacon timing and dtim count on every beacon appearance. This
6102 	 * will allow the driver to use the most updated values. Do it before
6103 	 * comparing this one with last received beacon.
6104 	 * IMPORTANT: These parameters would possibly be out of sync by the time
6105 	 * the driver will use them. The synchronized view is currently
6106 	 * guaranteed only in certain callbacks.
6107 	 */
6108 	if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY) &&
6109 	    !ieee80211_is_s1g_beacon(hdr->frame_control)) {
6110 		link->conf->sync_tsf =
6111 			le64_to_cpu(mgmt->u.beacon.timestamp);
6112 		link->conf->sync_device_ts =
6113 			rx_status->device_timestamp;
6114 		link->conf->sync_dtim_count = elems->dtim_count;
6115 	}
6116 
6117 	if ((ncrc == link->u.mgd.beacon_crc && link->u.mgd.beacon_crc_valid) ||
6118 	    ieee80211_is_s1g_short_beacon(mgmt->frame_control))
6119 		goto free;
6120 	link->u.mgd.beacon_crc = ncrc;
6121 	link->u.mgd.beacon_crc_valid = true;
6122 
6123 	ieee80211_rx_bss_info(link, mgmt, len, rx_status);
6124 
6125 	ieee80211_sta_process_chanswitch(link, rx_status->mactime,
6126 					 rx_status->device_timestamp,
6127 					 elems, true);
6128 
6129 	if (!link->u.mgd.disable_wmm_tracking &&
6130 	    ieee80211_sta_wmm_params(local, link, elems->wmm_param,
6131 				     elems->wmm_param_len,
6132 				     elems->mu_edca_param_set))
6133 		changed |= BSS_CHANGED_QOS;
6134 
6135 	/*
6136 	 * If we haven't had a beacon before, tell the driver about the
6137 	 * DTIM period (and beacon timing if desired) now.
6138 	 */
6139 	if (!link->u.mgd.have_beacon) {
6140 		/* a few bogus AP send dtim_period = 0 or no TIM IE */
6141 		bss_conf->dtim_period = elems->dtim_period ?: 1;
6142 
6143 		changed |= BSS_CHANGED_BEACON_INFO;
6144 		link->u.mgd.have_beacon = true;
6145 
6146 		mutex_lock(&local->iflist_mtx);
6147 		ieee80211_recalc_ps(local);
6148 		mutex_unlock(&local->iflist_mtx);
6149 
6150 		ieee80211_recalc_ps_vif(sdata);
6151 	}
6152 
6153 	if (elems->erp_info) {
6154 		erp_valid = true;
6155 		erp_value = elems->erp_info[0];
6156 	} else {
6157 		erp_valid = false;
6158 	}
6159 
6160 	if (!ieee80211_is_s1g_beacon(hdr->frame_control))
6161 		changed |= ieee80211_handle_bss_capability(link,
6162 				le16_to_cpu(mgmt->u.beacon.capab_info),
6163 				erp_valid, erp_value);
6164 
6165 	mutex_lock(&local->sta_mtx);
6166 	sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
6167 	if (WARN_ON(!sta)) {
6168 		mutex_unlock(&local->sta_mtx);
6169 		goto free;
6170 	}
6171 	link_sta = rcu_dereference_protected(sta->link[link->link_id],
6172 					     lockdep_is_held(&local->sta_mtx));
6173 	if (WARN_ON(!link_sta)) {
6174 		mutex_unlock(&local->sta_mtx);
6175 		goto free;
6176 	}
6177 
6178 	if (WARN_ON(!link->conf->chandef.chan))
6179 		goto free;
6180 
6181 	sband = local->hw.wiphy->bands[link->conf->chandef.chan->band];
6182 
6183 	changed |= ieee80211_recalc_twt_req(sdata, sband, link, link_sta, elems);
6184 
6185 	if (ieee80211_config_bw(link, elems->ht_cap_elem,
6186 				elems->vht_cap_elem, elems->ht_operation,
6187 				elems->vht_operation, elems->he_operation,
6188 				elems->eht_operation,
6189 				elems->s1g_oper, bssid, &changed)) {
6190 		mutex_unlock(&local->sta_mtx);
6191 		sdata_info(sdata,
6192 			   "failed to follow AP %pM bandwidth change, disconnect\n",
6193 			   bssid);
6194 		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
6195 				       WLAN_REASON_DEAUTH_LEAVING,
6196 				       true, deauth_buf);
6197 		ieee80211_report_disconnect(sdata, deauth_buf,
6198 					    sizeof(deauth_buf), true,
6199 					    WLAN_REASON_DEAUTH_LEAVING,
6200 					    false);
6201 		goto free;
6202 	}
6203 
6204 	if (elems->opmode_notif)
6205 		ieee80211_vht_handle_opmode(sdata, link_sta,
6206 					    *elems->opmode_notif,
6207 					    rx_status->band);
6208 	mutex_unlock(&local->sta_mtx);
6209 
6210 	changed |= ieee80211_handle_pwr_constr(link, chan, mgmt,
6211 					       elems->country_elem,
6212 					       elems->country_elem_len,
6213 					       elems->pwr_constr_elem,
6214 					       elems->cisco_dtpc_elem);
6215 
6216 	if (elems->eht_operation &&
6217 	    !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_EHT)) {
6218 		if (!ieee80211_config_puncturing(link, elems->eht_operation,
6219 						 &changed)) {
6220 			ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
6221 					       WLAN_REASON_DEAUTH_LEAVING,
6222 					       true, deauth_buf);
6223 			ieee80211_report_disconnect(sdata, deauth_buf,
6224 						    sizeof(deauth_buf), true,
6225 						    WLAN_REASON_DEAUTH_LEAVING,
6226 						    false);
6227 			goto free;
6228 		}
6229 	}
6230 
6231 	ieee80211_ml_reconfiguration(sdata, elems);
6232 
6233 	ieee80211_link_info_change_notify(sdata, link, changed);
6234 free:
6235 	kfree(elems);
6236 }
6237 
ieee80211_sta_rx_queued_ext(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb)6238 void ieee80211_sta_rx_queued_ext(struct ieee80211_sub_if_data *sdata,
6239 				 struct sk_buff *skb)
6240 {
6241 	struct ieee80211_link_data *link = &sdata->deflink;
6242 	struct ieee80211_rx_status *rx_status;
6243 	struct ieee80211_hdr *hdr;
6244 	u16 fc;
6245 
6246 	rx_status = (struct ieee80211_rx_status *) skb->cb;
6247 	hdr = (struct ieee80211_hdr *) skb->data;
6248 	fc = le16_to_cpu(hdr->frame_control);
6249 
6250 	sdata_lock(sdata);
6251 	switch (fc & IEEE80211_FCTL_STYPE) {
6252 	case IEEE80211_STYPE_S1G_BEACON:
6253 		ieee80211_rx_mgmt_beacon(link, hdr, skb->len, rx_status);
6254 		break;
6255 	}
6256 	sdata_unlock(sdata);
6257 }
6258 
ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb)6259 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
6260 				  struct sk_buff *skb)
6261 {
6262 	struct ieee80211_link_data *link = &sdata->deflink;
6263 	struct ieee80211_rx_status *rx_status;
6264 	struct ieee80211_mgmt *mgmt;
6265 	u16 fc;
6266 	int ies_len;
6267 
6268 	rx_status = (struct ieee80211_rx_status *) skb->cb;
6269 	mgmt = (struct ieee80211_mgmt *) skb->data;
6270 	fc = le16_to_cpu(mgmt->frame_control);
6271 
6272 	sdata_lock(sdata);
6273 
6274 	if (rx_status->link_valid) {
6275 		link = sdata_dereference(sdata->link[rx_status->link_id],
6276 					 sdata);
6277 		if (!link)
6278 			goto out;
6279 	}
6280 
6281 	switch (fc & IEEE80211_FCTL_STYPE) {
6282 	case IEEE80211_STYPE_BEACON:
6283 		ieee80211_rx_mgmt_beacon(link, (void *)mgmt,
6284 					 skb->len, rx_status);
6285 		break;
6286 	case IEEE80211_STYPE_PROBE_RESP:
6287 		ieee80211_rx_mgmt_probe_resp(link, skb);
6288 		break;
6289 	case IEEE80211_STYPE_AUTH:
6290 		ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
6291 		break;
6292 	case IEEE80211_STYPE_DEAUTH:
6293 		ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
6294 		break;
6295 	case IEEE80211_STYPE_DISASSOC:
6296 		ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
6297 		break;
6298 	case IEEE80211_STYPE_ASSOC_RESP:
6299 	case IEEE80211_STYPE_REASSOC_RESP:
6300 		ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
6301 		break;
6302 	case IEEE80211_STYPE_ACTION:
6303 		if (!sdata->u.mgd.associated ||
6304 		    !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr))
6305 			break;
6306 
6307 		if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
6308 			struct ieee802_11_elems *elems;
6309 
6310 			ies_len = skb->len -
6311 				  offsetof(struct ieee80211_mgmt,
6312 					   u.action.u.chan_switch.variable);
6313 
6314 			if (ies_len < 0)
6315 				break;
6316 
6317 			/* CSA IE cannot be overridden, no need for BSSID */
6318 			elems = ieee802_11_parse_elems(
6319 					mgmt->u.action.u.chan_switch.variable,
6320 					ies_len, true, NULL);
6321 
6322 			if (elems && !elems->parse_error)
6323 				ieee80211_sta_process_chanswitch(link,
6324 								 rx_status->mactime,
6325 								 rx_status->device_timestamp,
6326 								 elems, false);
6327 			kfree(elems);
6328 		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
6329 			struct ieee802_11_elems *elems;
6330 
6331 			ies_len = skb->len -
6332 				  offsetof(struct ieee80211_mgmt,
6333 					   u.action.u.ext_chan_switch.variable);
6334 
6335 			if (ies_len < 0)
6336 				break;
6337 
6338 			/*
6339 			 * extended CSA IE can't be overridden, no need for
6340 			 * BSSID
6341 			 */
6342 			elems = ieee802_11_parse_elems(
6343 					mgmt->u.action.u.ext_chan_switch.variable,
6344 					ies_len, true, NULL);
6345 
6346 			if (elems && !elems->parse_error) {
6347 				/* for the handling code pretend it was an IE */
6348 				elems->ext_chansw_ie =
6349 					&mgmt->u.action.u.ext_chan_switch.data;
6350 
6351 				ieee80211_sta_process_chanswitch(link,
6352 								 rx_status->mactime,
6353 								 rx_status->device_timestamp,
6354 								 elems, false);
6355 			}
6356 
6357 			kfree(elems);
6358 		}
6359 		break;
6360 	}
6361 out:
6362 	sdata_unlock(sdata);
6363 }
6364 
ieee80211_sta_timer(struct timer_list * t)6365 static void ieee80211_sta_timer(struct timer_list *t)
6366 {
6367 	struct ieee80211_sub_if_data *sdata =
6368 		from_timer(sdata, t, u.mgd.timer);
6369 
6370 	wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
6371 }
6372 
ieee80211_sta_connection_lost(struct ieee80211_sub_if_data * sdata,u8 reason,bool tx)6373 void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
6374 				   u8 reason, bool tx)
6375 {
6376 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
6377 
6378 	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
6379 			       tx, frame_buf);
6380 
6381 	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
6382 				    reason, false);
6383 }
6384 
ieee80211_auth(struct ieee80211_sub_if_data * sdata)6385 static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
6386 {
6387 	struct ieee80211_local *local = sdata->local;
6388 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6389 	struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
6390 	u32 tx_flags = 0;
6391 	u16 trans = 1;
6392 	u16 status = 0;
6393 	struct ieee80211_prep_tx_info info = {
6394 		.subtype = IEEE80211_STYPE_AUTH,
6395 	};
6396 
6397 	sdata_assert_lock(sdata);
6398 
6399 	if (WARN_ON_ONCE(!auth_data))
6400 		return -EINVAL;
6401 
6402 	auth_data->tries++;
6403 
6404 	if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
6405 		sdata_info(sdata, "authentication with %pM timed out\n",
6406 			   auth_data->ap_addr);
6407 
6408 		/*
6409 		 * Most likely AP is not in the range so remove the
6410 		 * bss struct for that AP.
6411 		 */
6412 		cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);
6413 
6414 		return -ETIMEDOUT;
6415 	}
6416 
6417 	if (auth_data->algorithm == WLAN_AUTH_SAE)
6418 		info.duration = jiffies_to_msecs(IEEE80211_AUTH_TIMEOUT_SAE);
6419 
6420 	drv_mgd_prepare_tx(local, sdata, &info);
6421 
6422 	sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
6423 		   auth_data->ap_addr, auth_data->tries,
6424 		   IEEE80211_AUTH_MAX_TRIES);
6425 
6426 	auth_data->expected_transaction = 2;
6427 
6428 	if (auth_data->algorithm == WLAN_AUTH_SAE) {
6429 		trans = auth_data->sae_trans;
6430 		status = auth_data->sae_status;
6431 		auth_data->expected_transaction = trans;
6432 	}
6433 
6434 	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
6435 		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
6436 			   IEEE80211_TX_INTFL_MLME_CONN_TX;
6437 
6438 	ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
6439 			    auth_data->data, auth_data->data_len,
6440 			    auth_data->ap_addr, auth_data->ap_addr,
6441 			    NULL, 0, 0, tx_flags);
6442 
6443 	if (tx_flags == 0) {
6444 		if (auth_data->algorithm == WLAN_AUTH_SAE)
6445 			auth_data->timeout = jiffies +
6446 				IEEE80211_AUTH_TIMEOUT_SAE;
6447 		else
6448 			auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
6449 	} else {
6450 		auth_data->timeout =
6451 			round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
6452 	}
6453 
6454 	auth_data->timeout_started = true;
6455 	run_again(sdata, auth_data->timeout);
6456 
6457 	return 0;
6458 }
6459 
ieee80211_do_assoc(struct ieee80211_sub_if_data * sdata)6460 static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
6461 {
6462 	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
6463 	struct ieee80211_local *local = sdata->local;
6464 	int ret;
6465 
6466 	sdata_assert_lock(sdata);
6467 
6468 	assoc_data->tries++;
6469 	if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
6470 		sdata_info(sdata, "association with %pM timed out\n",
6471 			   assoc_data->ap_addr);
6472 
6473 		/*
6474 		 * Most likely AP is not in the range so remove the
6475 		 * bss struct for that AP.
6476 		 */
6477 		cfg80211_unlink_bss(local->hw.wiphy,
6478 				    assoc_data->link[assoc_data->assoc_link_id].bss);
6479 
6480 		return -ETIMEDOUT;
6481 	}
6482 
6483 	sdata_info(sdata, "associate with %pM (try %d/%d)\n",
6484 		   assoc_data->ap_addr, assoc_data->tries,
6485 		   IEEE80211_ASSOC_MAX_TRIES);
6486 	ret = ieee80211_send_assoc(sdata);
6487 	if (ret)
6488 		return ret;
6489 
6490 	if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
6491 		assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
6492 		assoc_data->timeout_started = true;
6493 		run_again(sdata, assoc_data->timeout);
6494 	} else {
6495 		assoc_data->timeout =
6496 			round_jiffies_up(jiffies +
6497 					 IEEE80211_ASSOC_TIMEOUT_LONG);
6498 		assoc_data->timeout_started = true;
6499 		run_again(sdata, assoc_data->timeout);
6500 	}
6501 
6502 	return 0;
6503 }
6504 
ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data * sdata,__le16 fc,bool acked)6505 void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
6506 				  __le16 fc, bool acked)
6507 {
6508 	struct ieee80211_local *local = sdata->local;
6509 
6510 	sdata->u.mgd.status_fc = fc;
6511 	sdata->u.mgd.status_acked = acked;
6512 	sdata->u.mgd.status_received = true;
6513 
6514 	wiphy_work_queue(local->hw.wiphy, &sdata->work);
6515 }
6516 
ieee80211_sta_work(struct ieee80211_sub_if_data * sdata)6517 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
6518 {
6519 	struct ieee80211_local *local = sdata->local;
6520 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6521 
6522 	sdata_lock(sdata);
6523 
6524 	if (ifmgd->status_received) {
6525 		__le16 fc = ifmgd->status_fc;
6526 		bool status_acked = ifmgd->status_acked;
6527 
6528 		ifmgd->status_received = false;
6529 		if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
6530 			if (status_acked) {
6531 				if (ifmgd->auth_data->algorithm ==
6532 				    WLAN_AUTH_SAE)
6533 					ifmgd->auth_data->timeout =
6534 						jiffies +
6535 						IEEE80211_AUTH_TIMEOUT_SAE;
6536 				else
6537 					ifmgd->auth_data->timeout =
6538 						jiffies +
6539 						IEEE80211_AUTH_TIMEOUT_SHORT;
6540 				run_again(sdata, ifmgd->auth_data->timeout);
6541 			} else {
6542 				ifmgd->auth_data->timeout = jiffies - 1;
6543 			}
6544 			ifmgd->auth_data->timeout_started = true;
6545 		} else if (ifmgd->assoc_data &&
6546 			   (ieee80211_is_assoc_req(fc) ||
6547 			    ieee80211_is_reassoc_req(fc))) {
6548 			if (status_acked) {
6549 				ifmgd->assoc_data->timeout =
6550 					jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
6551 				run_again(sdata, ifmgd->assoc_data->timeout);
6552 			} else {
6553 				ifmgd->assoc_data->timeout = jiffies - 1;
6554 			}
6555 			ifmgd->assoc_data->timeout_started = true;
6556 		}
6557 	}
6558 
6559 	if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
6560 	    time_after(jiffies, ifmgd->auth_data->timeout)) {
6561 		if (ifmgd->auth_data->done || ifmgd->auth_data->waiting) {
6562 			/*
6563 			 * ok ... we waited for assoc or continuation but
6564 			 * userspace didn't do it, so kill the auth data
6565 			 */
6566 			ieee80211_destroy_auth_data(sdata, false);
6567 		} else if (ieee80211_auth(sdata)) {
6568 			u8 ap_addr[ETH_ALEN];
6569 			struct ieee80211_event event = {
6570 				.type = MLME_EVENT,
6571 				.u.mlme.data = AUTH_EVENT,
6572 				.u.mlme.status = MLME_TIMEOUT,
6573 			};
6574 
6575 			memcpy(ap_addr, ifmgd->auth_data->ap_addr, ETH_ALEN);
6576 
6577 			ieee80211_destroy_auth_data(sdata, false);
6578 
6579 			cfg80211_auth_timeout(sdata->dev, ap_addr);
6580 			drv_event_callback(sdata->local, sdata, &event);
6581 		}
6582 	} else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
6583 		run_again(sdata, ifmgd->auth_data->timeout);
6584 
6585 	if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
6586 	    time_after(jiffies, ifmgd->assoc_data->timeout)) {
6587 		if ((ifmgd->assoc_data->need_beacon &&
6588 		     !sdata->deflink.u.mgd.have_beacon) ||
6589 		    ieee80211_do_assoc(sdata)) {
6590 			struct ieee80211_event event = {
6591 				.type = MLME_EVENT,
6592 				.u.mlme.data = ASSOC_EVENT,
6593 				.u.mlme.status = MLME_TIMEOUT,
6594 			};
6595 
6596 			ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
6597 			drv_event_callback(sdata->local, sdata, &event);
6598 		}
6599 	} else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
6600 		run_again(sdata, ifmgd->assoc_data->timeout);
6601 
6602 	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
6603 	    ifmgd->associated) {
6604 		u8 *bssid = sdata->deflink.u.mgd.bssid;
6605 		int max_tries;
6606 
6607 		if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
6608 			max_tries = max_nullfunc_tries;
6609 		else
6610 			max_tries = max_probe_tries;
6611 
6612 		/* ACK received for nullfunc probing frame */
6613 		if (!ifmgd->probe_send_count)
6614 			ieee80211_reset_ap_probe(sdata);
6615 		else if (ifmgd->nullfunc_failed) {
6616 			if (ifmgd->probe_send_count < max_tries) {
6617 				mlme_dbg(sdata,
6618 					 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
6619 					 bssid, ifmgd->probe_send_count,
6620 					 max_tries);
6621 				ieee80211_mgd_probe_ap_send(sdata);
6622 			} else {
6623 				mlme_dbg(sdata,
6624 					 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
6625 					 bssid);
6626 				ieee80211_sta_connection_lost(sdata,
6627 					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
6628 					false);
6629 			}
6630 		} else if (time_is_after_jiffies(ifmgd->probe_timeout))
6631 			run_again(sdata, ifmgd->probe_timeout);
6632 		else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
6633 			mlme_dbg(sdata,
6634 				 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
6635 				 bssid, probe_wait_ms);
6636 			ieee80211_sta_connection_lost(sdata,
6637 				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
6638 		} else if (ifmgd->probe_send_count < max_tries) {
6639 			mlme_dbg(sdata,
6640 				 "No probe response from AP %pM after %dms, try %d/%i\n",
6641 				 bssid, probe_wait_ms,
6642 				 ifmgd->probe_send_count, max_tries);
6643 			ieee80211_mgd_probe_ap_send(sdata);
6644 		} else {
6645 			/*
6646 			 * We actually lost the connection ... or did we?
6647 			 * Let's make sure!
6648 			 */
6649 			mlme_dbg(sdata,
6650 				 "No probe response from AP %pM after %dms, disconnecting.\n",
6651 				 bssid, probe_wait_ms);
6652 
6653 			ieee80211_sta_connection_lost(sdata,
6654 				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
6655 		}
6656 	}
6657 
6658 	sdata_unlock(sdata);
6659 }
6660 
ieee80211_sta_bcn_mon_timer(struct timer_list * t)6661 static void ieee80211_sta_bcn_mon_timer(struct timer_list *t)
6662 {
6663 	struct ieee80211_sub_if_data *sdata =
6664 		from_timer(sdata, t, u.mgd.bcn_mon_timer);
6665 
6666 	if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
6667 		return;
6668 
6669 	if (sdata->vif.bss_conf.csa_active &&
6670 	    !sdata->deflink.u.mgd.csa_waiting_bcn)
6671 		return;
6672 
6673 	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
6674 		return;
6675 
6676 	sdata->u.mgd.connection_loss = false;
6677 	wiphy_work_queue(sdata->local->hw.wiphy,
6678 			 &sdata->u.mgd.beacon_connection_loss_work);
6679 }
6680 
ieee80211_sta_conn_mon_timer(struct timer_list * t)6681 static void ieee80211_sta_conn_mon_timer(struct timer_list *t)
6682 {
6683 	struct ieee80211_sub_if_data *sdata =
6684 		from_timer(sdata, t, u.mgd.conn_mon_timer);
6685 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6686 	struct ieee80211_local *local = sdata->local;
6687 	struct sta_info *sta;
6688 	unsigned long timeout;
6689 
6690 	if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
6691 		return;
6692 
6693 	if (sdata->vif.bss_conf.csa_active &&
6694 	    !sdata->deflink.u.mgd.csa_waiting_bcn)
6695 		return;
6696 
6697 	sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
6698 	if (!sta)
6699 		return;
6700 
6701 	timeout = sta->deflink.status_stats.last_ack;
6702 	if (time_before(sta->deflink.status_stats.last_ack, sta->deflink.rx_stats.last_rx))
6703 		timeout = sta->deflink.rx_stats.last_rx;
6704 	timeout += IEEE80211_CONNECTION_IDLE_TIME;
6705 
6706 	/* If timeout is after now, then update timer to fire at
6707 	 * the later date, but do not actually probe at this time.
6708 	 */
6709 	if (time_is_after_jiffies(timeout)) {
6710 		mod_timer(&ifmgd->conn_mon_timer, round_jiffies_up(timeout));
6711 		return;
6712 	}
6713 
6714 	ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
6715 }
6716 
ieee80211_sta_monitor_work(struct work_struct * work)6717 static void ieee80211_sta_monitor_work(struct work_struct *work)
6718 {
6719 	struct ieee80211_sub_if_data *sdata =
6720 		container_of(work, struct ieee80211_sub_if_data,
6721 			     u.mgd.monitor_work);
6722 
6723 	ieee80211_mgd_probe_ap(sdata, false);
6724 }
6725 
ieee80211_restart_sta_timer(struct ieee80211_sub_if_data * sdata)6726 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
6727 {
6728 	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
6729 		__ieee80211_stop_poll(sdata);
6730 
6731 		/* let's probe the connection once */
6732 		if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
6733 			ieee80211_queue_work(&sdata->local->hw,
6734 					     &sdata->u.mgd.monitor_work);
6735 	}
6736 }
6737 
6738 #ifdef CONFIG_PM
ieee80211_mgd_quiesce(struct ieee80211_sub_if_data * sdata)6739 void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
6740 {
6741 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6742 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
6743 
6744 	sdata_lock(sdata);
6745 
6746 	if (ifmgd->auth_data || ifmgd->assoc_data) {
6747 		const u8 *ap_addr = ifmgd->auth_data ?
6748 				ifmgd->auth_data->ap_addr :
6749 				ifmgd->assoc_data->ap_addr;
6750 
6751 		/*
6752 		 * If we are trying to authenticate / associate while suspending,
6753 		 * cfg80211 won't know and won't actually abort those attempts,
6754 		 * thus we need to do that ourselves.
6755 		 */
6756 		ieee80211_send_deauth_disassoc(sdata, ap_addr, ap_addr,
6757 					       IEEE80211_STYPE_DEAUTH,
6758 					       WLAN_REASON_DEAUTH_LEAVING,
6759 					       false, frame_buf);
6760 		if (ifmgd->assoc_data)
6761 			ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
6762 		if (ifmgd->auth_data)
6763 			ieee80211_destroy_auth_data(sdata, false);
6764 		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
6765 				      IEEE80211_DEAUTH_FRAME_LEN,
6766 				      false);
6767 	}
6768 
6769 	/* This is a bit of a hack - we should find a better and more generic
6770 	 * solution to this. Normally when suspending, cfg80211 will in fact
6771 	 * deauthenticate. However, it doesn't (and cannot) stop an ongoing
6772 	 * auth (not so important) or assoc (this is the problem) process.
6773 	 *
6774 	 * As a consequence, it can happen that we are in the process of both
6775 	 * associating and suspending, and receive an association response
6776 	 * after cfg80211 has checked if it needs to disconnect, but before
6777 	 * we actually set the flag to drop incoming frames. This will then
6778 	 * cause the workqueue flush to process the association response in
6779 	 * the suspend, resulting in a successful association just before it
6780 	 * tries to remove the interface from the driver, which now though
6781 	 * has a channel context assigned ... this results in issues.
6782 	 *
6783 	 * To work around this (for now) simply deauth here again if we're
6784 	 * now connected.
6785 	 */
6786 	if (ifmgd->associated && !sdata->local->wowlan) {
6787 		u8 bssid[ETH_ALEN];
6788 		struct cfg80211_deauth_request req = {
6789 			.reason_code = WLAN_REASON_DEAUTH_LEAVING,
6790 			.bssid = bssid,
6791 		};
6792 
6793 		memcpy(bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
6794 		ieee80211_mgd_deauth(sdata, &req);
6795 	}
6796 
6797 	sdata_unlock(sdata);
6798 }
6799 #endif
6800 
ieee80211_sta_restart(struct ieee80211_sub_if_data * sdata)6801 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
6802 {
6803 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6804 
6805 	sdata_lock(sdata);
6806 	if (!ifmgd->associated) {
6807 		sdata_unlock(sdata);
6808 		return;
6809 	}
6810 
6811 	if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
6812 		sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
6813 		mlme_dbg(sdata, "driver requested disconnect after resume\n");
6814 		ieee80211_sta_connection_lost(sdata,
6815 					      WLAN_REASON_UNSPECIFIED,
6816 					      true);
6817 		sdata_unlock(sdata);
6818 		return;
6819 	}
6820 
6821 	if (sdata->flags & IEEE80211_SDATA_DISCONNECT_HW_RESTART) {
6822 		sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_HW_RESTART;
6823 		mlme_dbg(sdata, "driver requested disconnect after hardware restart\n");
6824 		ieee80211_sta_connection_lost(sdata,
6825 					      WLAN_REASON_UNSPECIFIED,
6826 					      true);
6827 		sdata_unlock(sdata);
6828 		return;
6829 	}
6830 
6831 	sdata_unlock(sdata);
6832 }
6833 
ieee80211_request_smps_mgd_work(struct wiphy * wiphy,struct wiphy_work * work)6834 static void ieee80211_request_smps_mgd_work(struct wiphy *wiphy,
6835 					    struct wiphy_work *work)
6836 {
6837 	struct ieee80211_link_data *link =
6838 		container_of(work, struct ieee80211_link_data,
6839 			     u.mgd.request_smps_work);
6840 
6841 	sdata_lock(link->sdata);
6842 	__ieee80211_request_smps_mgd(link->sdata, link,
6843 				     link->u.mgd.driver_smps_mode);
6844 	sdata_unlock(link->sdata);
6845 }
6846 
6847 /* interface setup */
ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data * sdata)6848 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
6849 {
6850 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6851 
6852 	INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
6853 	wiphy_work_init(&ifmgd->beacon_connection_loss_work,
6854 			ieee80211_beacon_connection_loss_work);
6855 	wiphy_work_init(&ifmgd->csa_connection_drop_work,
6856 			ieee80211_csa_connection_drop_work);
6857 	INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
6858 			  ieee80211_tdls_peer_del_work);
6859 	wiphy_delayed_work_init(&ifmgd->ml_reconf_work,
6860 				ieee80211_ml_reconf_work);
6861 	timer_setup(&ifmgd->timer, ieee80211_sta_timer, 0);
6862 	timer_setup(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 0);
6863 	timer_setup(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 0);
6864 	INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
6865 			  ieee80211_sta_handle_tspec_ac_params_wk);
6866 
6867 	ifmgd->flags = 0;
6868 	ifmgd->powersave = sdata->wdev.ps;
6869 	ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
6870 	ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
6871 	/* Setup TDLS data */
6872 	spin_lock_init(&ifmgd->teardown_lock);
6873 	ifmgd->teardown_skb = NULL;
6874 	ifmgd->orig_teardown_skb = NULL;
6875 }
6876 
ieee80211_mgd_setup_link(struct ieee80211_link_data * link)6877 void ieee80211_mgd_setup_link(struct ieee80211_link_data *link)
6878 {
6879 	struct ieee80211_sub_if_data *sdata = link->sdata;
6880 	struct ieee80211_local *local = sdata->local;
6881 	unsigned int link_id = link->link_id;
6882 
6883 	link->u.mgd.p2p_noa_index = -1;
6884 	link->u.mgd.conn_flags = 0;
6885 	link->conf->bssid = link->u.mgd.bssid;
6886 
6887 	wiphy_work_init(&link->u.mgd.request_smps_work,
6888 			ieee80211_request_smps_mgd_work);
6889 	if (local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
6890 		link->u.mgd.req_smps = IEEE80211_SMPS_AUTOMATIC;
6891 	else
6892 		link->u.mgd.req_smps = IEEE80211_SMPS_OFF;
6893 
6894 	wiphy_delayed_work_init(&link->u.mgd.chswitch_work,
6895 				ieee80211_chswitch_work);
6896 
6897 	if (sdata->u.mgd.assoc_data)
6898 		ether_addr_copy(link->conf->addr,
6899 				sdata->u.mgd.assoc_data->link[link_id].addr);
6900 	else if (!is_valid_ether_addr(link->conf->addr))
6901 		eth_random_addr(link->conf->addr);
6902 }
6903 
6904 /* scan finished notification */
ieee80211_mlme_notify_scan_completed(struct ieee80211_local * local)6905 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
6906 {
6907 	struct ieee80211_sub_if_data *sdata;
6908 
6909 	/* Restart STA timers */
6910 	rcu_read_lock();
6911 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
6912 		if (ieee80211_sdata_running(sdata))
6913 			ieee80211_restart_sta_timer(sdata);
6914 	}
6915 	rcu_read_unlock();
6916 }
6917 
ieee80211_prep_connection(struct ieee80211_sub_if_data * sdata,struct cfg80211_bss * cbss,s8 link_id,const u8 * ap_mld_addr,bool assoc,bool override)6918 static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
6919 				     struct cfg80211_bss *cbss, s8 link_id,
6920 				     const u8 *ap_mld_addr, bool assoc,
6921 				     bool override)
6922 {
6923 	struct ieee80211_local *local = sdata->local;
6924 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
6925 	struct ieee80211_bss *bss = (void *)cbss->priv;
6926 	struct sta_info *new_sta = NULL;
6927 	struct ieee80211_link_data *link;
6928 	bool have_sta = false;
6929 	bool mlo;
6930 	int err;
6931 
6932 	if (link_id >= 0) {
6933 		mlo = true;
6934 		if (WARN_ON(!ap_mld_addr))
6935 			return -EINVAL;
6936 		err = ieee80211_vif_set_links(sdata, BIT(link_id), 0);
6937 	} else {
6938 		if (WARN_ON(ap_mld_addr))
6939 			return -EINVAL;
6940 		ap_mld_addr = cbss->bssid;
6941 		err = ieee80211_vif_set_links(sdata, 0, 0);
6942 		link_id = 0;
6943 		mlo = false;
6944 	}
6945 
6946 	if (err)
6947 		return err;
6948 
6949 	link = sdata_dereference(sdata->link[link_id], sdata);
6950 	if (WARN_ON(!link)) {
6951 		err = -ENOLINK;
6952 		goto out_err;
6953 	}
6954 
6955 	if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data)) {
6956 		err = -EINVAL;
6957 		goto out_err;
6958 	}
6959 
6960 	/* If a reconfig is happening, bail out */
6961 	if (local->in_reconfig) {
6962 		err = -EBUSY;
6963 		goto out_err;
6964 	}
6965 
6966 	if (assoc) {
6967 		rcu_read_lock();
6968 		have_sta = sta_info_get(sdata, ap_mld_addr);
6969 		rcu_read_unlock();
6970 	}
6971 
6972 	if (!have_sta) {
6973 		if (mlo)
6974 			new_sta = sta_info_alloc_with_link(sdata, ap_mld_addr,
6975 							   link_id, cbss->bssid,
6976 							   GFP_KERNEL);
6977 		else
6978 			new_sta = sta_info_alloc(sdata, ap_mld_addr, GFP_KERNEL);
6979 
6980 		if (!new_sta) {
6981 			err = -ENOMEM;
6982 			goto out_err;
6983 		}
6984 
6985 		new_sta->sta.mlo = mlo;
6986 	}
6987 
6988 	/*
6989 	 * Set up the information for the new channel before setting the
6990 	 * new channel. We can't - completely race-free - change the basic
6991 	 * rates bitmap and the channel (sband) that it refers to, but if
6992 	 * we set it up before we at least avoid calling into the driver's
6993 	 * bss_info_changed() method with invalid information (since we do
6994 	 * call that from changing the channel - only for IDLE and perhaps
6995 	 * some others, but ...).
6996 	 *
6997 	 * So to avoid that, just set up all the new information before the
6998 	 * channel, but tell the driver to apply it only afterwards, since
6999 	 * it might need the new channel for that.
7000 	 */
7001 	if (new_sta) {
7002 		const struct cfg80211_bss_ies *ies;
7003 		struct link_sta_info *link_sta;
7004 
7005 		rcu_read_lock();
7006 		link_sta = rcu_dereference(new_sta->link[link_id]);
7007 		if (WARN_ON(!link_sta)) {
7008 			rcu_read_unlock();
7009 			sta_info_free(local, new_sta);
7010 			err = -EINVAL;
7011 			goto out_err;
7012 		}
7013 
7014 		err = ieee80211_mgd_setup_link_sta(link, new_sta,
7015 						   link_sta, cbss);
7016 		if (err) {
7017 			rcu_read_unlock();
7018 			sta_info_free(local, new_sta);
7019 			goto out_err;
7020 		}
7021 
7022 		memcpy(link->u.mgd.bssid, cbss->bssid, ETH_ALEN);
7023 
7024 		/* set timing information */
7025 		link->conf->beacon_int = cbss->beacon_interval;
7026 		ies = rcu_dereference(cbss->beacon_ies);
7027 		if (ies) {
7028 			link->conf->sync_tsf = ies->tsf;
7029 			link->conf->sync_device_ts =
7030 				bss->device_ts_beacon;
7031 
7032 			ieee80211_get_dtim(ies,
7033 					   &link->conf->sync_dtim_count,
7034 					   NULL);
7035 		} else if (!ieee80211_hw_check(&sdata->local->hw,
7036 					       TIMING_BEACON_ONLY)) {
7037 			ies = rcu_dereference(cbss->proberesp_ies);
7038 			/* must be non-NULL since beacon IEs were NULL */
7039 			link->conf->sync_tsf = ies->tsf;
7040 			link->conf->sync_device_ts =
7041 				bss->device_ts_presp;
7042 			link->conf->sync_dtim_count = 0;
7043 		} else {
7044 			link->conf->sync_tsf = 0;
7045 			link->conf->sync_device_ts = 0;
7046 			link->conf->sync_dtim_count = 0;
7047 		}
7048 		rcu_read_unlock();
7049 	}
7050 
7051 	if (new_sta || override) {
7052 		err = ieee80211_prep_channel(sdata, link, cbss,
7053 					     &link->u.mgd.conn_flags);
7054 		if (err) {
7055 			if (new_sta)
7056 				sta_info_free(local, new_sta);
7057 			goto out_err;
7058 		}
7059 	}
7060 
7061 	if (new_sta) {
7062 		/*
7063 		 * tell driver about BSSID, basic rates and timing
7064 		 * this was set up above, before setting the channel
7065 		 */
7066 		ieee80211_link_info_change_notify(sdata, link,
7067 						  BSS_CHANGED_BSSID |
7068 						  BSS_CHANGED_BASIC_RATES |
7069 						  BSS_CHANGED_BEACON_INT);
7070 
7071 		if (assoc)
7072 			sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
7073 
7074 		err = sta_info_insert(new_sta);
7075 		new_sta = NULL;
7076 		if (err) {
7077 			sdata_info(sdata,
7078 				   "failed to insert STA entry for the AP (error %d)\n",
7079 				   err);
7080 			goto out_err;
7081 		}
7082 	} else
7083 		WARN_ON_ONCE(!ether_addr_equal(link->u.mgd.bssid, cbss->bssid));
7084 
7085 	/* Cancel scan to ensure that nothing interferes with connection */
7086 	if (local->scanning)
7087 		ieee80211_scan_cancel(local);
7088 
7089 	return 0;
7090 
7091 out_err:
7092 	ieee80211_link_release_channel(&sdata->deflink);
7093 	ieee80211_vif_set_links(sdata, 0, 0);
7094 	return err;
7095 }
7096 
7097 /* config hooks */
ieee80211_mgd_auth(struct ieee80211_sub_if_data * sdata,struct cfg80211_auth_request * req)7098 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
7099 		       struct cfg80211_auth_request *req)
7100 {
7101 	struct ieee80211_local *local = sdata->local;
7102 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7103 	struct ieee80211_mgd_auth_data *auth_data;
7104 	u16 auth_alg;
7105 	int err;
7106 	bool cont_auth;
7107 
7108 	/* prepare auth data structure */
7109 
7110 	switch (req->auth_type) {
7111 	case NL80211_AUTHTYPE_OPEN_SYSTEM:
7112 		auth_alg = WLAN_AUTH_OPEN;
7113 		break;
7114 	case NL80211_AUTHTYPE_SHARED_KEY:
7115 		if (fips_enabled)
7116 			return -EOPNOTSUPP;
7117 		auth_alg = WLAN_AUTH_SHARED_KEY;
7118 		break;
7119 	case NL80211_AUTHTYPE_FT:
7120 		auth_alg = WLAN_AUTH_FT;
7121 		break;
7122 	case NL80211_AUTHTYPE_NETWORK_EAP:
7123 		auth_alg = WLAN_AUTH_LEAP;
7124 		break;
7125 	case NL80211_AUTHTYPE_SAE:
7126 		auth_alg = WLAN_AUTH_SAE;
7127 		break;
7128 	case NL80211_AUTHTYPE_FILS_SK:
7129 		auth_alg = WLAN_AUTH_FILS_SK;
7130 		break;
7131 	case NL80211_AUTHTYPE_FILS_SK_PFS:
7132 		auth_alg = WLAN_AUTH_FILS_SK_PFS;
7133 		break;
7134 	case NL80211_AUTHTYPE_FILS_PK:
7135 		auth_alg = WLAN_AUTH_FILS_PK;
7136 		break;
7137 	default:
7138 		return -EOPNOTSUPP;
7139 	}
7140 
7141 	if (ifmgd->assoc_data)
7142 		return -EBUSY;
7143 
7144 	auth_data = kzalloc(sizeof(*auth_data) + req->auth_data_len +
7145 			    req->ie_len, GFP_KERNEL);
7146 	if (!auth_data)
7147 		return -ENOMEM;
7148 
7149 	memcpy(auth_data->ap_addr,
7150 	       req->ap_mld_addr ?: req->bss->bssid,
7151 	       ETH_ALEN);
7152 	auth_data->bss = req->bss;
7153 	auth_data->link_id = req->link_id;
7154 
7155 	if (req->auth_data_len >= 4) {
7156 		if (req->auth_type == NL80211_AUTHTYPE_SAE) {
7157 			__le16 *pos = (__le16 *) req->auth_data;
7158 
7159 			auth_data->sae_trans = le16_to_cpu(pos[0]);
7160 			auth_data->sae_status = le16_to_cpu(pos[1]);
7161 		}
7162 		memcpy(auth_data->data, req->auth_data + 4,
7163 		       req->auth_data_len - 4);
7164 		auth_data->data_len += req->auth_data_len - 4;
7165 	}
7166 
7167 	/* Check if continuing authentication or trying to authenticate with the
7168 	 * same BSS that we were in the process of authenticating with and avoid
7169 	 * removal and re-addition of the STA entry in
7170 	 * ieee80211_prep_connection().
7171 	 */
7172 	cont_auth = ifmgd->auth_data && req->bss == ifmgd->auth_data->bss &&
7173 		    ifmgd->auth_data->link_id == req->link_id;
7174 
7175 	if (req->ie && req->ie_len) {
7176 		memcpy(&auth_data->data[auth_data->data_len],
7177 		       req->ie, req->ie_len);
7178 		auth_data->data_len += req->ie_len;
7179 	}
7180 
7181 	if (req->key && req->key_len) {
7182 		auth_data->key_len = req->key_len;
7183 		auth_data->key_idx = req->key_idx;
7184 		memcpy(auth_data->key, req->key, req->key_len);
7185 	}
7186 
7187 	auth_data->algorithm = auth_alg;
7188 
7189 	/* try to authenticate/probe */
7190 
7191 	if (ifmgd->auth_data) {
7192 		if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE) {
7193 			auth_data->peer_confirmed =
7194 				ifmgd->auth_data->peer_confirmed;
7195 		}
7196 		ieee80211_destroy_auth_data(sdata, cont_auth);
7197 	}
7198 
7199 	/* prep auth_data so we don't go into idle on disassoc */
7200 	ifmgd->auth_data = auth_data;
7201 
7202 	/* If this is continuation of an ongoing SAE authentication exchange
7203 	 * (i.e., request to send SAE Confirm) and the peer has already
7204 	 * confirmed, mark authentication completed since we are about to send
7205 	 * out SAE Confirm.
7206 	 */
7207 	if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE &&
7208 	    auth_data->peer_confirmed && auth_data->sae_trans == 2)
7209 		ieee80211_mark_sta_auth(sdata);
7210 
7211 	if (ifmgd->associated) {
7212 		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
7213 
7214 		sdata_info(sdata,
7215 			   "disconnect from AP %pM for new auth to %pM\n",
7216 			   sdata->vif.cfg.ap_addr, auth_data->ap_addr);
7217 		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
7218 				       WLAN_REASON_UNSPECIFIED,
7219 				       false, frame_buf);
7220 
7221 		ieee80211_report_disconnect(sdata, frame_buf,
7222 					    sizeof(frame_buf), true,
7223 					    WLAN_REASON_UNSPECIFIED,
7224 					    false);
7225 	}
7226 
7227 	sdata_info(sdata, "authenticate with %pM\n", auth_data->ap_addr);
7228 
7229 	/* needed for transmitting the auth frame(s) properly */
7230 	memcpy(sdata->vif.cfg.ap_addr, auth_data->ap_addr, ETH_ALEN);
7231 
7232 	err = ieee80211_prep_connection(sdata, req->bss, req->link_id,
7233 					req->ap_mld_addr, cont_auth, false);
7234 	if (err)
7235 		goto err_clear;
7236 
7237 	err = ieee80211_auth(sdata);
7238 	if (err) {
7239 		sta_info_destroy_addr(sdata, auth_data->ap_addr);
7240 		goto err_clear;
7241 	}
7242 
7243 	/* hold our own reference */
7244 	cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
7245 	return 0;
7246 
7247  err_clear:
7248 	if (!ieee80211_vif_is_mld(&sdata->vif)) {
7249 		eth_zero_addr(sdata->deflink.u.mgd.bssid);
7250 		ieee80211_link_info_change_notify(sdata, &sdata->deflink,
7251 						  BSS_CHANGED_BSSID);
7252 		mutex_lock(&sdata->local->mtx);
7253 		ieee80211_link_release_channel(&sdata->deflink);
7254 		mutex_unlock(&sdata->local->mtx);
7255 	}
7256 	ifmgd->auth_data = NULL;
7257 	kfree(auth_data);
7258 	return err;
7259 }
7260 
7261 static ieee80211_conn_flags_t
ieee80211_setup_assoc_link(struct ieee80211_sub_if_data * sdata,struct ieee80211_mgd_assoc_data * assoc_data,struct cfg80211_assoc_request * req,ieee80211_conn_flags_t conn_flags,unsigned int link_id)7262 ieee80211_setup_assoc_link(struct ieee80211_sub_if_data *sdata,
7263 			   struct ieee80211_mgd_assoc_data *assoc_data,
7264 			   struct cfg80211_assoc_request *req,
7265 			   ieee80211_conn_flags_t conn_flags,
7266 			   unsigned int link_id)
7267 {
7268 	struct ieee80211_local *local = sdata->local;
7269 	const struct cfg80211_bss_ies *beacon_ies;
7270 	struct ieee80211_supported_band *sband;
7271 	const struct element *ht_elem, *vht_elem;
7272 	struct ieee80211_link_data *link;
7273 	struct cfg80211_bss *cbss;
7274 	struct ieee80211_bss *bss;
7275 	bool is_5ghz, is_6ghz;
7276 
7277 	cbss = assoc_data->link[link_id].bss;
7278 	if (WARN_ON(!cbss))
7279 		return 0;
7280 
7281 	bss = (void *)cbss->priv;
7282 
7283 	sband = local->hw.wiphy->bands[cbss->channel->band];
7284 	if (WARN_ON(!sband))
7285 		return 0;
7286 
7287 	link = sdata_dereference(sdata->link[link_id], sdata);
7288 	if (WARN_ON(!link))
7289 		return 0;
7290 
7291 	is_5ghz = cbss->channel->band == NL80211_BAND_5GHZ;
7292 	is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
7293 
7294 	/* for MLO connections assume advertising all rates is OK */
7295 	if (!req->ap_mld_addr) {
7296 		assoc_data->supp_rates = bss->supp_rates;
7297 		assoc_data->supp_rates_len = bss->supp_rates_len;
7298 	}
7299 
7300 	/* copy and link elems for the STA profile */
7301 	if (req->links[link_id].elems_len) {
7302 		memcpy(assoc_data->ie_pos, req->links[link_id].elems,
7303 		       req->links[link_id].elems_len);
7304 		assoc_data->link[link_id].elems = assoc_data->ie_pos;
7305 		assoc_data->link[link_id].elems_len = req->links[link_id].elems_len;
7306 		assoc_data->ie_pos += req->links[link_id].elems_len;
7307 	}
7308 
7309 	rcu_read_lock();
7310 	ht_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_HT_OPERATION);
7311 	if (ht_elem && ht_elem->datalen >= sizeof(struct ieee80211_ht_operation))
7312 		assoc_data->link[link_id].ap_ht_param =
7313 			((struct ieee80211_ht_operation *)(ht_elem->data))->ht_param;
7314 	else if (!is_6ghz)
7315 		conn_flags |= IEEE80211_CONN_DISABLE_HT;
7316 	vht_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_VHT_CAPABILITY);
7317 	if (vht_elem && vht_elem->datalen >= sizeof(struct ieee80211_vht_cap)) {
7318 		memcpy(&assoc_data->link[link_id].ap_vht_cap, vht_elem->data,
7319 		       sizeof(struct ieee80211_vht_cap));
7320 	} else if (is_5ghz) {
7321 		link_info(link,
7322 			  "VHT capa missing/short, disabling VHT/HE/EHT\n");
7323 		conn_flags |= IEEE80211_CONN_DISABLE_VHT |
7324 			      IEEE80211_CONN_DISABLE_HE |
7325 			      IEEE80211_CONN_DISABLE_EHT;
7326 	}
7327 	rcu_read_unlock();
7328 
7329 	link->u.mgd.beacon_crc_valid = false;
7330 	link->u.mgd.dtim_period = 0;
7331 	link->u.mgd.have_beacon = false;
7332 
7333 	/* override HT/VHT configuration only if the AP and we support it */
7334 	if (!(conn_flags & IEEE80211_CONN_DISABLE_HT)) {
7335 		struct ieee80211_sta_ht_cap sta_ht_cap;
7336 
7337 		memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
7338 		ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
7339 	}
7340 
7341 	link->conf->eht_puncturing = 0;
7342 
7343 	rcu_read_lock();
7344 	beacon_ies = rcu_dereference(cbss->beacon_ies);
7345 	if (beacon_ies) {
7346 		const struct ieee80211_eht_operation *eht_oper;
7347 		const struct element *elem;
7348 		u8 dtim_count = 0;
7349 
7350 		ieee80211_get_dtim(beacon_ies, &dtim_count,
7351 				   &link->u.mgd.dtim_period);
7352 
7353 		sdata->deflink.u.mgd.have_beacon = true;
7354 
7355 		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
7356 			link->conf->sync_tsf = beacon_ies->tsf;
7357 			link->conf->sync_device_ts = bss->device_ts_beacon;
7358 			link->conf->sync_dtim_count = dtim_count;
7359 		}
7360 
7361 		elem = cfg80211_find_ext_elem(WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION,
7362 					      beacon_ies->data, beacon_ies->len);
7363 		if (elem && elem->datalen >= 3)
7364 			link->conf->profile_periodicity = elem->data[2];
7365 		else
7366 			link->conf->profile_periodicity = 0;
7367 
7368 		elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
7369 					  beacon_ies->data, beacon_ies->len);
7370 		if (elem && elem->datalen >= 11 &&
7371 		    (elem->data[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
7372 			link->conf->ema_ap = true;
7373 		else
7374 			link->conf->ema_ap = false;
7375 
7376 		elem = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION,
7377 					      beacon_ies->data, beacon_ies->len);
7378 		eht_oper = (const void *)(elem->data + 1);
7379 
7380 		if (elem &&
7381 		    ieee80211_eht_oper_size_ok((const void *)(elem->data + 1),
7382 					       elem->datalen - 1) &&
7383 		    (eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) &&
7384 		    (eht_oper->params & IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT)) {
7385 			const struct ieee80211_eht_operation_info *info =
7386 				(void *)eht_oper->optional;
7387 			const u8 *disable_subchannel_bitmap = info->optional;
7388 			u16 bitmap;
7389 
7390 			bitmap = get_unaligned_le16(disable_subchannel_bitmap);
7391 			if (cfg80211_valid_disable_subchannel_bitmap(&bitmap,
7392 								     &link->conf->chandef))
7393 				ieee80211_handle_puncturing_bitmap(link,
7394 								   eht_oper,
7395 								   bitmap,
7396 								   NULL);
7397 			else
7398 				conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7399 		}
7400 	}
7401 	rcu_read_unlock();
7402 
7403 	if (bss->corrupt_data) {
7404 		char *corrupt_type = "data";
7405 
7406 		if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
7407 			if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
7408 				corrupt_type = "beacon and probe response";
7409 			else
7410 				corrupt_type = "beacon";
7411 		} else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP) {
7412 			corrupt_type = "probe response";
7413 		}
7414 		sdata_info(sdata, "associating to AP %pM with corrupt %s\n",
7415 			   cbss->bssid, corrupt_type);
7416 	}
7417 
7418 	if (link->u.mgd.req_smps == IEEE80211_SMPS_AUTOMATIC) {
7419 		if (sdata->u.mgd.powersave)
7420 			link->smps_mode = IEEE80211_SMPS_DYNAMIC;
7421 		else
7422 			link->smps_mode = IEEE80211_SMPS_OFF;
7423 	} else {
7424 		link->smps_mode = link->u.mgd.req_smps;
7425 	}
7426 
7427 	return conn_flags;
7428 }
7429 
ieee80211_mgd_assoc(struct ieee80211_sub_if_data * sdata,struct cfg80211_assoc_request * req)7430 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
7431 			struct cfg80211_assoc_request *req)
7432 {
7433 	unsigned int assoc_link_id = req->link_id < 0 ? 0 : req->link_id;
7434 	struct ieee80211_local *local = sdata->local;
7435 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7436 	struct ieee80211_mgd_assoc_data *assoc_data;
7437 	const struct element *ssid_elem;
7438 	struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
7439 	ieee80211_conn_flags_t conn_flags = 0;
7440 	struct ieee80211_link_data *link;
7441 	struct cfg80211_bss *cbss;
7442 	struct ieee80211_bss *bss;
7443 	bool override;
7444 	int i, err;
7445 	size_t size = sizeof(*assoc_data) + req->ie_len;
7446 
7447 	for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++)
7448 		size += req->links[i].elems_len;
7449 
7450 	/* FIXME: no support for 4-addr MLO yet */
7451 	if (sdata->u.mgd.use_4addr && req->link_id >= 0)
7452 		return -EOPNOTSUPP;
7453 
7454 	assoc_data = kzalloc(size, GFP_KERNEL);
7455 	if (!assoc_data)
7456 		return -ENOMEM;
7457 
7458 	cbss = req->link_id < 0 ? req->bss : req->links[req->link_id].bss;
7459 
7460 	rcu_read_lock();
7461 	ssid_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID);
7462 	if (!ssid_elem || ssid_elem->datalen > sizeof(assoc_data->ssid)) {
7463 		rcu_read_unlock();
7464 		kfree(assoc_data);
7465 		return -EINVAL;
7466 	}
7467 	memcpy(assoc_data->ssid, ssid_elem->data, ssid_elem->datalen);
7468 	assoc_data->ssid_len = ssid_elem->datalen;
7469 	memcpy(vif_cfg->ssid, assoc_data->ssid, assoc_data->ssid_len);
7470 	vif_cfg->ssid_len = assoc_data->ssid_len;
7471 	rcu_read_unlock();
7472 
7473 	if (req->ap_mld_addr) {
7474 		for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
7475 			if (!req->links[i].bss)
7476 				continue;
7477 			link = sdata_dereference(sdata->link[i], sdata);
7478 			if (link)
7479 				ether_addr_copy(assoc_data->link[i].addr,
7480 						link->conf->addr);
7481 			else
7482 				eth_random_addr(assoc_data->link[i].addr);
7483 		}
7484 	} else {
7485 		memcpy(assoc_data->link[0].addr, sdata->vif.addr, ETH_ALEN);
7486 	}
7487 
7488 	assoc_data->s1g = cbss->channel->band == NL80211_BAND_S1GHZ;
7489 
7490 	memcpy(assoc_data->ap_addr,
7491 	       req->ap_mld_addr ?: req->bss->bssid,
7492 	       ETH_ALEN);
7493 
7494 	if (ifmgd->associated) {
7495 		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
7496 
7497 		sdata_info(sdata,
7498 			   "disconnect from AP %pM for new assoc to %pM\n",
7499 			   sdata->vif.cfg.ap_addr, assoc_data->ap_addr);
7500 		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
7501 				       WLAN_REASON_UNSPECIFIED,
7502 				       false, frame_buf);
7503 
7504 		ieee80211_report_disconnect(sdata, frame_buf,
7505 					    sizeof(frame_buf), true,
7506 					    WLAN_REASON_UNSPECIFIED,
7507 					    false);
7508 	}
7509 
7510 	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
7511 		err = -EBUSY;
7512 		goto err_free;
7513 	}
7514 
7515 	if (ifmgd->assoc_data) {
7516 		err = -EBUSY;
7517 		goto err_free;
7518 	}
7519 
7520 	if (ifmgd->auth_data) {
7521 		bool match;
7522 
7523 		/* keep sta info, bssid if matching */
7524 		match = ether_addr_equal(ifmgd->auth_data->ap_addr,
7525 					 assoc_data->ap_addr) &&
7526 			ifmgd->auth_data->link_id == req->link_id;
7527 		ieee80211_destroy_auth_data(sdata, match);
7528 	}
7529 
7530 	/* prepare assoc data */
7531 
7532 	bss = (void *)cbss->priv;
7533 	assoc_data->wmm = bss->wmm_used &&
7534 			  (local->hw.queues >= IEEE80211_NUM_ACS);
7535 
7536 	/*
7537 	 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
7538 	 * We still associate in non-HT mode (11a/b/g) if any one of these
7539 	 * ciphers is configured as pairwise.
7540 	 * We can set this to true for non-11n hardware, that'll be checked
7541 	 * separately along with the peer capabilities.
7542 	 */
7543 	for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
7544 		if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
7545 		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
7546 		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
7547 			conn_flags |= IEEE80211_CONN_DISABLE_HT;
7548 			conn_flags |= IEEE80211_CONN_DISABLE_VHT;
7549 			conn_flags |= IEEE80211_CONN_DISABLE_HE;
7550 			conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7551 			netdev_info(sdata->dev,
7552 				    "disabling HT/VHT/HE due to WEP/TKIP use\n");
7553 		}
7554 	}
7555 
7556 	/* also disable HT/VHT/HE/EHT if the AP doesn't use WMM */
7557 	if (!bss->wmm_used) {
7558 		conn_flags |= IEEE80211_CONN_DISABLE_HT;
7559 		conn_flags |= IEEE80211_CONN_DISABLE_VHT;
7560 		conn_flags |= IEEE80211_CONN_DISABLE_HE;
7561 		conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7562 		netdev_info(sdata->dev,
7563 			    "disabling HT/VHT/HE as WMM/QoS is not supported by the AP\n");
7564 	}
7565 
7566 	if (req->flags & ASSOC_REQ_DISABLE_HT) {
7567 		mlme_dbg(sdata, "HT disabled by flag, disabling HT/VHT/HE\n");
7568 		conn_flags |= IEEE80211_CONN_DISABLE_HT;
7569 		conn_flags |= IEEE80211_CONN_DISABLE_VHT;
7570 		conn_flags |= IEEE80211_CONN_DISABLE_HE;
7571 		conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7572 	}
7573 
7574 	if (req->flags & ASSOC_REQ_DISABLE_VHT) {
7575 		mlme_dbg(sdata, "VHT disabled by flag, disabling VHT\n");
7576 		conn_flags |= IEEE80211_CONN_DISABLE_VHT;
7577 	}
7578 
7579 	if (req->flags & ASSOC_REQ_DISABLE_HE) {
7580 		mlme_dbg(sdata, "HE disabled by flag, disabling HE/EHT\n");
7581 		conn_flags |= IEEE80211_CONN_DISABLE_HE;
7582 		conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7583 	}
7584 
7585 	if (req->flags & ASSOC_REQ_DISABLE_EHT)
7586 		conn_flags |= IEEE80211_CONN_DISABLE_EHT;
7587 
7588 	memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
7589 	memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
7590 	       sizeof(ifmgd->ht_capa_mask));
7591 
7592 	memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
7593 	memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
7594 	       sizeof(ifmgd->vht_capa_mask));
7595 
7596 	memcpy(&ifmgd->s1g_capa, &req->s1g_capa, sizeof(ifmgd->s1g_capa));
7597 	memcpy(&ifmgd->s1g_capa_mask, &req->s1g_capa_mask,
7598 	       sizeof(ifmgd->s1g_capa_mask));
7599 
7600 	if (req->ie && req->ie_len) {
7601 		memcpy(assoc_data->ie, req->ie, req->ie_len);
7602 		assoc_data->ie_len = req->ie_len;
7603 		assoc_data->ie_pos = assoc_data->ie + assoc_data->ie_len;
7604 	} else {
7605 		assoc_data->ie_pos = assoc_data->ie;
7606 	}
7607 
7608 	if (req->fils_kek) {
7609 		/* should already be checked in cfg80211 - so warn */
7610 		if (WARN_ON(req->fils_kek_len > FILS_MAX_KEK_LEN)) {
7611 			err = -EINVAL;
7612 			goto err_free;
7613 		}
7614 		memcpy(assoc_data->fils_kek, req->fils_kek,
7615 		       req->fils_kek_len);
7616 		assoc_data->fils_kek_len = req->fils_kek_len;
7617 	}
7618 
7619 	if (req->fils_nonces)
7620 		memcpy(assoc_data->fils_nonces, req->fils_nonces,
7621 		       2 * FILS_NONCE_LEN);
7622 
7623 	/* default timeout */
7624 	assoc_data->timeout = jiffies;
7625 	assoc_data->timeout_started = true;
7626 
7627 	assoc_data->assoc_link_id = assoc_link_id;
7628 
7629 	if (req->ap_mld_addr) {
7630 		for (i = 0; i < ARRAY_SIZE(assoc_data->link); i++) {
7631 			assoc_data->link[i].conn_flags = conn_flags;
7632 			assoc_data->link[i].bss = req->links[i].bss;
7633 			assoc_data->link[i].disabled = req->links[i].disabled;
7634 		}
7635 
7636 		/* if there was no authentication, set up the link */
7637 		err = ieee80211_vif_set_links(sdata, BIT(assoc_link_id), 0);
7638 		if (err)
7639 			goto err_clear;
7640 	} else {
7641 		assoc_data->link[0].conn_flags = conn_flags;
7642 		assoc_data->link[0].bss = cbss;
7643 	}
7644 
7645 	link = sdata_dereference(sdata->link[assoc_link_id], sdata);
7646 	if (WARN_ON(!link)) {
7647 		err = -EINVAL;
7648 		goto err_clear;
7649 	}
7650 
7651 	/* keep old conn_flags from ieee80211_prep_channel() from auth */
7652 	conn_flags |= link->u.mgd.conn_flags;
7653 	conn_flags |= ieee80211_setup_assoc_link(sdata, assoc_data, req,
7654 						 conn_flags, assoc_link_id);
7655 	override = link->u.mgd.conn_flags != conn_flags;
7656 	link->u.mgd.conn_flags |= conn_flags;
7657 
7658 	if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
7659 		 ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
7660 	     "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
7661 		sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
7662 
7663 	if (bss->wmm_used && bss->uapsd_supported &&
7664 	    (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
7665 		assoc_data->uapsd = true;
7666 		ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
7667 	} else {
7668 		assoc_data->uapsd = false;
7669 		ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
7670 	}
7671 
7672 	if (req->prev_bssid)
7673 		memcpy(assoc_data->prev_ap_addr, req->prev_bssid, ETH_ALEN);
7674 
7675 	if (req->use_mfp) {
7676 		ifmgd->mfp = IEEE80211_MFP_REQUIRED;
7677 		ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
7678 	} else {
7679 		ifmgd->mfp = IEEE80211_MFP_DISABLED;
7680 		ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
7681 	}
7682 
7683 	if (req->flags & ASSOC_REQ_USE_RRM)
7684 		ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
7685 	else
7686 		ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;
7687 
7688 	if (req->crypto.control_port)
7689 		ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
7690 	else
7691 		ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
7692 
7693 	sdata->control_port_protocol = req->crypto.control_port_ethertype;
7694 	sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
7695 	sdata->control_port_over_nl80211 =
7696 					req->crypto.control_port_over_nl80211;
7697 	sdata->control_port_no_preauth = req->crypto.control_port_no_preauth;
7698 
7699 	/* kick off associate process */
7700 	ifmgd->assoc_data = assoc_data;
7701 
7702 	for (i = 0; i < ARRAY_SIZE(assoc_data->link); i++) {
7703 		if (!assoc_data->link[i].bss)
7704 			continue;
7705 		if (i == assoc_data->assoc_link_id)
7706 			continue;
7707 		/* only calculate the flags, hence link == NULL */
7708 		err = ieee80211_prep_channel(sdata, NULL, assoc_data->link[i].bss,
7709 					     &assoc_data->link[i].conn_flags);
7710 		if (err)
7711 			goto err_clear;
7712 	}
7713 
7714 	/* needed for transmitting the assoc frames properly */
7715 	memcpy(sdata->vif.cfg.ap_addr, assoc_data->ap_addr, ETH_ALEN);
7716 
7717 	err = ieee80211_prep_connection(sdata, cbss, req->link_id,
7718 					req->ap_mld_addr, true, override);
7719 	if (err)
7720 		goto err_clear;
7721 
7722 	assoc_data->link[assoc_data->assoc_link_id].conn_flags =
7723 		link->u.mgd.conn_flags;
7724 
7725 	if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC)) {
7726 		const struct cfg80211_bss_ies *beacon_ies;
7727 
7728 		rcu_read_lock();
7729 		beacon_ies = rcu_dereference(req->bss->beacon_ies);
7730 		if (!beacon_ies) {
7731 			/*
7732 			 * Wait up to one beacon interval ...
7733 			 * should this be more if we miss one?
7734 			 */
7735 			sdata_info(sdata, "waiting for beacon from %pM\n",
7736 				   link->u.mgd.bssid);
7737 			assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
7738 			assoc_data->timeout_started = true;
7739 			assoc_data->need_beacon = true;
7740 		}
7741 		rcu_read_unlock();
7742 	}
7743 
7744 	run_again(sdata, assoc_data->timeout);
7745 
7746 	return 0;
7747  err_clear:
7748 	eth_zero_addr(sdata->deflink.u.mgd.bssid);
7749 	ieee80211_link_info_change_notify(sdata, &sdata->deflink,
7750 					  BSS_CHANGED_BSSID);
7751 	ifmgd->assoc_data = NULL;
7752  err_free:
7753 	kfree(assoc_data);
7754 	return err;
7755 }
7756 
ieee80211_mgd_deauth(struct ieee80211_sub_if_data * sdata,struct cfg80211_deauth_request * req)7757 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
7758 			 struct cfg80211_deauth_request *req)
7759 {
7760 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7761 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
7762 	bool tx = !req->local_state_change;
7763 	struct ieee80211_prep_tx_info info = {
7764 		.subtype = IEEE80211_STYPE_DEAUTH,
7765 	};
7766 
7767 	if (ifmgd->auth_data &&
7768 	    ether_addr_equal(ifmgd->auth_data->ap_addr, req->bssid)) {
7769 		sdata_info(sdata,
7770 			   "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
7771 			   req->bssid, req->reason_code,
7772 			   ieee80211_get_reason_code_string(req->reason_code));
7773 
7774 		drv_mgd_prepare_tx(sdata->local, sdata, &info);
7775 		ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
7776 					       IEEE80211_STYPE_DEAUTH,
7777 					       req->reason_code, tx,
7778 					       frame_buf);
7779 		ieee80211_destroy_auth_data(sdata, false);
7780 		ieee80211_report_disconnect(sdata, frame_buf,
7781 					    sizeof(frame_buf), true,
7782 					    req->reason_code, false);
7783 		drv_mgd_complete_tx(sdata->local, sdata, &info);
7784 		return 0;
7785 	}
7786 
7787 	if (ifmgd->assoc_data &&
7788 	    ether_addr_equal(ifmgd->assoc_data->ap_addr, req->bssid)) {
7789 		sdata_info(sdata,
7790 			   "aborting association with %pM by local choice (Reason: %u=%s)\n",
7791 			   req->bssid, req->reason_code,
7792 			   ieee80211_get_reason_code_string(req->reason_code));
7793 
7794 		drv_mgd_prepare_tx(sdata->local, sdata, &info);
7795 		ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
7796 					       IEEE80211_STYPE_DEAUTH,
7797 					       req->reason_code, tx,
7798 					       frame_buf);
7799 		ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
7800 		ieee80211_report_disconnect(sdata, frame_buf,
7801 					    sizeof(frame_buf), true,
7802 					    req->reason_code, false);
7803 		drv_mgd_complete_tx(sdata->local, sdata, &info);
7804 		return 0;
7805 	}
7806 
7807 	if (ifmgd->associated &&
7808 	    ether_addr_equal(sdata->vif.cfg.ap_addr, req->bssid)) {
7809 		sdata_info(sdata,
7810 			   "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
7811 			   req->bssid, req->reason_code,
7812 			   ieee80211_get_reason_code_string(req->reason_code));
7813 
7814 		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
7815 				       req->reason_code, tx, frame_buf);
7816 		ieee80211_report_disconnect(sdata, frame_buf,
7817 					    sizeof(frame_buf), true,
7818 					    req->reason_code, false);
7819 		drv_mgd_complete_tx(sdata->local, sdata, &info);
7820 		return 0;
7821 	}
7822 
7823 	return -ENOTCONN;
7824 }
7825 
ieee80211_mgd_disassoc(struct ieee80211_sub_if_data * sdata,struct cfg80211_disassoc_request * req)7826 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
7827 			   struct cfg80211_disassoc_request *req)
7828 {
7829 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
7830 
7831 	if (!sdata->u.mgd.associated ||
7832 	    memcmp(sdata->vif.cfg.ap_addr, req->ap_addr, ETH_ALEN))
7833 		return -ENOTCONN;
7834 
7835 	sdata_info(sdata,
7836 		   "disassociating from %pM by local choice (Reason: %u=%s)\n",
7837 		   req->ap_addr, req->reason_code,
7838 		   ieee80211_get_reason_code_string(req->reason_code));
7839 
7840 	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
7841 			       req->reason_code, !req->local_state_change,
7842 			       frame_buf);
7843 
7844 	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
7845 				    req->reason_code, false);
7846 
7847 	return 0;
7848 }
7849 
ieee80211_mgd_stop_link(struct ieee80211_link_data * link)7850 void ieee80211_mgd_stop_link(struct ieee80211_link_data *link)
7851 {
7852 	wiphy_work_cancel(link->sdata->local->hw.wiphy,
7853 			  &link->u.mgd.request_smps_work);
7854 	wiphy_delayed_work_cancel(link->sdata->local->hw.wiphy,
7855 				  &link->u.mgd.chswitch_work);
7856 }
7857 
ieee80211_mgd_stop(struct ieee80211_sub_if_data * sdata)7858 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
7859 {
7860 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
7861 
7862 	/*
7863 	 * Make sure some work items will not run after this,
7864 	 * they will not do anything but might not have been
7865 	 * cancelled when disconnecting.
7866 	 */
7867 	cancel_work_sync(&ifmgd->monitor_work);
7868 	wiphy_work_cancel(sdata->local->hw.wiphy,
7869 			  &ifmgd->beacon_connection_loss_work);
7870 	wiphy_work_cancel(sdata->local->hw.wiphy,
7871 			  &ifmgd->csa_connection_drop_work);
7872 	cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
7873 	wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
7874 				  &ifmgd->ml_reconf_work);
7875 
7876 	sdata_lock(sdata);
7877 	if (ifmgd->assoc_data)
7878 		ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
7879 	if (ifmgd->auth_data)
7880 		ieee80211_destroy_auth_data(sdata, false);
7881 	spin_lock_bh(&ifmgd->teardown_lock);
7882 	if (ifmgd->teardown_skb) {
7883 		kfree_skb(ifmgd->teardown_skb);
7884 		ifmgd->teardown_skb = NULL;
7885 		ifmgd->orig_teardown_skb = NULL;
7886 	}
7887 	kfree(ifmgd->assoc_req_ies);
7888 	ifmgd->assoc_req_ies = NULL;
7889 	ifmgd->assoc_req_ies_len = 0;
7890 	spin_unlock_bh(&ifmgd->teardown_lock);
7891 	del_timer_sync(&ifmgd->timer);
7892 	sdata_unlock(sdata);
7893 }
7894 
ieee80211_cqm_rssi_notify(struct ieee80211_vif * vif,enum nl80211_cqm_rssi_threshold_event rssi_event,s32 rssi_level,gfp_t gfp)7895 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
7896 			       enum nl80211_cqm_rssi_threshold_event rssi_event,
7897 			       s32 rssi_level,
7898 			       gfp_t gfp)
7899 {
7900 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
7901 
7902 	trace_api_cqm_rssi_notify(sdata, rssi_event, rssi_level);
7903 
7904 	cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, rssi_level, gfp);
7905 }
7906 EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
7907 
ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif * vif,gfp_t gfp)7908 void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
7909 {
7910 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
7911 
7912 	trace_api_cqm_beacon_loss_notify(sdata->local, sdata);
7913 
7914 	cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
7915 }
7916 EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);
7917 
_ieee80211_enable_rssi_reports(struct ieee80211_sub_if_data * sdata,int rssi_min_thold,int rssi_max_thold)7918 static void _ieee80211_enable_rssi_reports(struct ieee80211_sub_if_data *sdata,
7919 					    int rssi_min_thold,
7920 					    int rssi_max_thold)
7921 {
7922 	trace_api_enable_rssi_reports(sdata, rssi_min_thold, rssi_max_thold);
7923 
7924 	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
7925 		return;
7926 
7927 	/*
7928 	 * Scale up threshold values before storing it, as the RSSI averaging
7929 	 * algorithm uses a scaled up value as well. Change this scaling
7930 	 * factor if the RSSI averaging algorithm changes.
7931 	 */
7932 	sdata->u.mgd.rssi_min_thold = rssi_min_thold*16;
7933 	sdata->u.mgd.rssi_max_thold = rssi_max_thold*16;
7934 }
7935 
ieee80211_enable_rssi_reports(struct ieee80211_vif * vif,int rssi_min_thold,int rssi_max_thold)7936 void ieee80211_enable_rssi_reports(struct ieee80211_vif *vif,
7937 				    int rssi_min_thold,
7938 				    int rssi_max_thold)
7939 {
7940 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
7941 
7942 	WARN_ON(rssi_min_thold == rssi_max_thold ||
7943 		rssi_min_thold > rssi_max_thold);
7944 
7945 	_ieee80211_enable_rssi_reports(sdata, rssi_min_thold,
7946 				       rssi_max_thold);
7947 }
7948 EXPORT_SYMBOL(ieee80211_enable_rssi_reports);
7949 
ieee80211_disable_rssi_reports(struct ieee80211_vif * vif)7950 void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif)
7951 {
7952 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
7953 
7954 	_ieee80211_enable_rssi_reports(sdata, 0, 0);
7955 }
7956 EXPORT_SYMBOL(ieee80211_disable_rssi_reports);
7957