~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/mac80211/mlme.c

Version: ~ [ linux-5.6-rc3 ] ~ [ linux-5.5.6 ] ~ [ linux-5.4.22 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.106 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.171 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.214 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.214 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.82 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * BSS client mode implementation
  3  * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
  4  * Copyright 2004, Instant802 Networks, Inc.
  5  * Copyright 2005, Devicescape Software, Inc.
  6  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
  7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  8  *
  9  * This program is free software; you can redistribute it and/or modify
 10  * it under the terms of the GNU General Public License version 2 as
 11  * published by the Free Software Foundation.
 12  */
 13 
 14 #include <linux/delay.h>
 15 #include <linux/if_ether.h>
 16 #include <linux/skbuff.h>
 17 #include <linux/if_arp.h>
 18 #include <linux/etherdevice.h>
 19 #include <linux/moduleparam.h>
 20 #include <linux/rtnetlink.h>
 21 #include <linux/pm_qos.h>
 22 #include <linux/crc32.h>
 23 #include <linux/slab.h>
 24 #include <linux/export.h>
 25 #include <net/mac80211.h>
 26 #include <asm/unaligned.h>
 27 
 28 #include "ieee80211_i.h"
 29 #include "driver-ops.h"
 30 #include "rate.h"
 31 #include "led.h"
 32 
 33 #define IEEE80211_AUTH_TIMEOUT          (HZ / 5)
 34 #define IEEE80211_AUTH_TIMEOUT_SHORT    (HZ / 10)
 35 #define IEEE80211_AUTH_MAX_TRIES        3
 36 #define IEEE80211_AUTH_WAIT_ASSOC       (HZ * 5)
 37 #define IEEE80211_ASSOC_TIMEOUT         (HZ / 5)
 38 #define IEEE80211_ASSOC_TIMEOUT_SHORT   (HZ / 10)
 39 #define IEEE80211_ASSOC_MAX_TRIES       3
 40 
 41 static int max_nullfunc_tries = 2;
 42 module_param(max_nullfunc_tries, int, 0644);
 43 MODULE_PARM_DESC(max_nullfunc_tries,
 44                  "Maximum nullfunc tx tries before disconnecting (reason 4).");
 45 
 46 static int max_probe_tries = 5;
 47 module_param(max_probe_tries, int, 0644);
 48 MODULE_PARM_DESC(max_probe_tries,
 49                  "Maximum probe tries before disconnecting (reason 4).");
 50 
 51 /*
 52  * Beacon loss timeout is calculated as N frames times the
 53  * advertised beacon interval.  This may need to be somewhat
 54  * higher than what hardware might detect to account for
 55  * delays in the host processing frames. But since we also
 56  * probe on beacon miss before declaring the connection lost
 57  * default to what we want.
 58  */
 59 #define IEEE80211_BEACON_LOSS_COUNT     7
 60 
 61 /*
 62  * Time the connection can be idle before we probe
 63  * it to see if we can still talk to the AP.
 64  */
 65 #define IEEE80211_CONNECTION_IDLE_TIME  (30 * HZ)
 66 /*
 67  * Time we wait for a probe response after sending
 68  * a probe request because of beacon loss or for
 69  * checking the connection still works.
 70  */
 71 static int probe_wait_ms = 500;
 72 module_param(probe_wait_ms, int, 0644);
 73 MODULE_PARM_DESC(probe_wait_ms,
 74                  "Maximum time(ms) to wait for probe response"
 75                  " before disconnecting (reason 4).");
 76 
 77 /*
 78  * Weight given to the latest Beacon frame when calculating average signal
 79  * strength for Beacon frames received in the current BSS. This must be
 80  * between 1 and 15.
 81  */
 82 #define IEEE80211_SIGNAL_AVE_WEIGHT     3
 83 
 84 /*
 85  * How many Beacon frames need to have been used in average signal strength
 86  * before starting to indicate signal change events.
 87  */
 88 #define IEEE80211_SIGNAL_AVE_MIN_COUNT  4
 89 
 90 #define TMR_RUNNING_TIMER       0
 91 #define TMR_RUNNING_CHANSW      1
 92 
 93 /*
 94  * All cfg80211 functions have to be called outside a locked
 95  * section so that they can acquire a lock themselves... This
 96  * is much simpler than queuing up things in cfg80211, but we
 97  * do need some indirection for that here.
 98  */
 99 enum rx_mgmt_action {
100         /* no action required */
101         RX_MGMT_NONE,
102 
103         /* caller must call cfg80211_send_deauth() */
104         RX_MGMT_CFG80211_DEAUTH,
105 
106         /* caller must call cfg80211_send_disassoc() */
107         RX_MGMT_CFG80211_DISASSOC,
108 
109         /* caller must call cfg80211_send_rx_auth() */
110         RX_MGMT_CFG80211_RX_AUTH,
111 
112         /* caller must call cfg80211_send_rx_assoc() */
113         RX_MGMT_CFG80211_RX_ASSOC,
114 
115         /* caller must call cfg80211_send_assoc_timeout() */
116         RX_MGMT_CFG80211_ASSOC_TIMEOUT,
117 
118         /* used when a processed beacon causes a deauth */
119         RX_MGMT_CFG80211_TX_DEAUTH,
120 };
121 
122 /* utils */
123 static inline void ASSERT_MGD_MTX(struct ieee80211_if_managed *ifmgd)
124 {
125         lockdep_assert_held(&ifmgd->mtx);
126 }
127 
128 /*
129  * We can have multiple work items (and connection probing)
130  * scheduling this timer, but we need to take care to only
131  * reschedule it when it should fire _earlier_ than it was
132  * asked for before, or if it's not pending right now. This
133  * function ensures that. Note that it then is required to
134  * run this function for all timeouts after the first one
135  * has happened -- the work that runs from this timer will
136  * do that.
137  */
138 static void run_again(struct ieee80211_if_managed *ifmgd, unsigned long timeout)
139 {
140         ASSERT_MGD_MTX(ifmgd);
141 
142         if (!timer_pending(&ifmgd->timer) ||
143             time_before(timeout, ifmgd->timer.expires))
144                 mod_timer(&ifmgd->timer, timeout);
145 }
146 
147 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
148 {
149         if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
150                 return;
151 
152         if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
153                 return;
154 
155         mod_timer(&sdata->u.mgd.bcn_mon_timer,
156                   round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
157 }
158 
159 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
160 {
161         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
162 
163         if (unlikely(!sdata->u.mgd.associated))
164                 return;
165 
166         if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
167                 return;
168 
169         mod_timer(&sdata->u.mgd.conn_mon_timer,
170                   round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
171 
172         ifmgd->probe_send_count = 0;
173 }
174 
175 static int ecw2cw(int ecw)
176 {
177         return (1 << ecw) - 1;
178 }
179 
180 static u32 chandef_downgrade(struct cfg80211_chan_def *c)
181 {
182         u32 ret;
183         int tmp;
184 
185         switch (c->width) {
186         case NL80211_CHAN_WIDTH_20:
187                 c->width = NL80211_CHAN_WIDTH_20_NOHT;
188                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
189                 break;
190         case NL80211_CHAN_WIDTH_40:
191                 c->width = NL80211_CHAN_WIDTH_20;
192                 c->center_freq1 = c->chan->center_freq;
193                 ret = IEEE80211_STA_DISABLE_40MHZ |
194                       IEEE80211_STA_DISABLE_VHT;
195                 break;
196         case NL80211_CHAN_WIDTH_80:
197                 tmp = (30 + c->chan->center_freq - c->center_freq1)/20;
198                 /* n_P40 */
199                 tmp /= 2;
200                 /* freq_P40 */
201                 c->center_freq1 = c->center_freq1 - 20 + 40 * tmp;
202                 c->width = NL80211_CHAN_WIDTH_40;
203                 ret = IEEE80211_STA_DISABLE_VHT;
204                 break;
205         case NL80211_CHAN_WIDTH_80P80:
206                 c->center_freq2 = 0;
207                 c->width = NL80211_CHAN_WIDTH_80;
208                 ret = IEEE80211_STA_DISABLE_80P80MHZ |
209                       IEEE80211_STA_DISABLE_160MHZ;
210                 break;
211         case NL80211_CHAN_WIDTH_160:
212                 /* n_P20 */
213                 tmp = (70 + c->chan->center_freq - c->center_freq1)/20;
214                 /* n_P80 */
215                 tmp /= 4;
216                 c->center_freq1 = c->center_freq1 - 40 + 80 * tmp;
217                 c->width = NL80211_CHAN_WIDTH_80;
218                 ret = IEEE80211_STA_DISABLE_80P80MHZ |
219                       IEEE80211_STA_DISABLE_160MHZ;
220                 break;
221         default:
222         case NL80211_CHAN_WIDTH_20_NOHT:
223                 WARN_ON_ONCE(1);
224                 c->width = NL80211_CHAN_WIDTH_20_NOHT;
225                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
226                 break;
227         }
228 
229         WARN_ON_ONCE(!cfg80211_chandef_valid(c));
230 
231         return ret;
232 }
233 
234 static u32
235 ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
236                              struct ieee80211_supported_band *sband,
237                              struct ieee80211_channel *channel,
238                              const struct ieee80211_ht_operation *ht_oper,
239                              const struct ieee80211_vht_operation *vht_oper,
240                              struct cfg80211_chan_def *chandef, bool verbose)
241 {
242         struct cfg80211_chan_def vht_chandef;
243         u32 ht_cfreq, ret;
244 
245         chandef->chan = channel;
246         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
247         chandef->center_freq1 = channel->center_freq;
248         chandef->center_freq2 = 0;
249 
250         if (!ht_oper || !sband->ht_cap.ht_supported) {
251                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
252                 goto out;
253         }
254 
255         chandef->width = NL80211_CHAN_WIDTH_20;
256 
257         ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
258                                                   channel->band);
259         /* check that channel matches the right operating channel */
260         if (channel->center_freq != ht_cfreq) {
261                 /*
262                  * It's possible that some APs are confused here;
263                  * Netgear WNDR3700 sometimes reports 4 higher than
264                  * the actual channel in association responses, but
265                  * since we look at probe response/beacon data here
266                  * it should be OK.
267                  */
268                 if (verbose)
269                         sdata_info(sdata,
270                                    "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
271                                    channel->center_freq, ht_cfreq,
272                                    ht_oper->primary_chan, channel->band);
273                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
274                 goto out;
275         }
276 
277         /* check 40 MHz support, if we have it */
278         if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
279                 switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
280                 case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
281                         chandef->width = NL80211_CHAN_WIDTH_40;
282                         chandef->center_freq1 += 10;
283                         break;
284                 case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
285                         chandef->width = NL80211_CHAN_WIDTH_40;
286                         chandef->center_freq1 -= 10;
287                         break;
288                 }
289         } else {
290                 /* 40 MHz (and 80 MHz) must be supported for VHT */
291                 ret = IEEE80211_STA_DISABLE_VHT;
292                 goto out;
293         }
294 
295         if (!vht_oper || !sband->vht_cap.vht_supported) {
296                 ret = IEEE80211_STA_DISABLE_VHT;
297                 goto out;
298         }
299 
300         vht_chandef.chan = channel;
301         vht_chandef.center_freq1 =
302                 ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx,
303                                                channel->band);
304         vht_chandef.center_freq2 = 0;
305 
306         if (vht_oper->center_freq_seg2_idx)
307                 vht_chandef.center_freq2 =
308                         ieee80211_channel_to_frequency(
309                                 vht_oper->center_freq_seg2_idx,
310                                 channel->band);
311 
312         switch (vht_oper->chan_width) {
313         case IEEE80211_VHT_CHANWIDTH_USE_HT:
314                 vht_chandef.width = chandef->width;
315                 break;
316         case IEEE80211_VHT_CHANWIDTH_80MHZ:
317                 vht_chandef.width = NL80211_CHAN_WIDTH_80;
318                 break;
319         case IEEE80211_VHT_CHANWIDTH_160MHZ:
320                 vht_chandef.width = NL80211_CHAN_WIDTH_160;
321                 break;
322         case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
323                 vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
324                 break;
325         default:
326                 if (verbose)
327                         sdata_info(sdata,
328                                    "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
329                                    vht_oper->chan_width);
330                 ret = IEEE80211_STA_DISABLE_VHT;
331                 goto out;
332         }
333 
334         if (!cfg80211_chandef_valid(&vht_chandef)) {
335                 if (verbose)
336                         sdata_info(sdata,
337                                    "AP VHT information is invalid, disable VHT\n");
338                 ret = IEEE80211_STA_DISABLE_VHT;
339                 goto out;
340         }
341 
342         if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
343                 ret = 0;
344                 goto out;
345         }
346 
347         if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
348                 if (verbose)
349                         sdata_info(sdata,
350                                    "AP VHT information doesn't match HT, disable VHT\n");
351                 ret = IEEE80211_STA_DISABLE_VHT;
352                 goto out;
353         }
354 
355         *chandef = vht_chandef;
356 
357         ret = 0;
358 
359 out:
360         /* don't print the message below for VHT mismatch if VHT is disabled */
361         if (ret & IEEE80211_STA_DISABLE_VHT)
362                 vht_chandef = *chandef;
363 
364         while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
365                                         IEEE80211_CHAN_DISABLED)) {
366                 if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
367                         ret = IEEE80211_STA_DISABLE_HT |
368                               IEEE80211_STA_DISABLE_VHT;
369                         goto out;
370                 }
371 
372                 ret |= chandef_downgrade(chandef);
373         }
374 
375         if (chandef->width != vht_chandef.width && verbose)
376                 sdata_info(sdata,
377                            "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
378 
379         WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
380         return ret;
381 }
382 
383 static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
384                                struct sta_info *sta,
385                                const struct ieee80211_ht_operation *ht_oper,
386                                const struct ieee80211_vht_operation *vht_oper,
387                                const u8 *bssid, u32 *changed)
388 {
389         struct ieee80211_local *local = sdata->local;
390         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
391         struct ieee80211_supported_band *sband;
392         struct ieee80211_channel *chan;
393         struct cfg80211_chan_def chandef;
394         u16 ht_opmode;
395         u32 flags;
396         enum ieee80211_sta_rx_bandwidth new_sta_bw;
397         int ret;
398 
399         /* if HT was/is disabled, don't track any bandwidth changes */
400         if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
401                 return 0;
402 
403         /* don't check VHT if we associated as non-VHT station */
404         if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
405                 vht_oper = NULL;
406 
407         if (WARN_ON_ONCE(!sta))
408                 return -EINVAL;
409 
410         chan = sdata->vif.bss_conf.chandef.chan;
411         sband = local->hw.wiphy->bands[chan->band];
412 
413         /* calculate new channel (type) based on HT/VHT operation IEs */
414         flags = ieee80211_determine_chantype(sdata, sband, chan, ht_oper,
415                                              vht_oper, &chandef, false);
416 
417         /*
418          * Downgrade the new channel if we associated with restricted
419          * capabilities. For example, if we associated as a 20 MHz STA
420          * to a 40 MHz AP (due to regulatory, capabilities or config
421          * reasons) then switching to a 40 MHz channel now won't do us
422          * any good -- we couldn't use it with the AP.
423          */
424         if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
425             chandef.width == NL80211_CHAN_WIDTH_80P80)
426                 flags |= chandef_downgrade(&chandef);
427         if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
428             chandef.width == NL80211_CHAN_WIDTH_160)
429                 flags |= chandef_downgrade(&chandef);
430         if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
431             chandef.width > NL80211_CHAN_WIDTH_20)
432                 flags |= chandef_downgrade(&chandef);
433 
434         if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
435                 return 0;
436 
437         sdata_info(sdata,
438                    "AP %pM changed bandwidth, new config is %d MHz, width %d (%d/%d MHz)\n",
439                    ifmgd->bssid, chandef.chan->center_freq, chandef.width,
440                    chandef.center_freq1, chandef.center_freq2);
441 
442         if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
443                                       IEEE80211_STA_DISABLE_VHT |
444                                       IEEE80211_STA_DISABLE_40MHZ |
445                                       IEEE80211_STA_DISABLE_80P80MHZ |
446                                       IEEE80211_STA_DISABLE_160MHZ)) ||
447             !cfg80211_chandef_valid(&chandef)) {
448                 sdata_info(sdata,
449                            "AP %pM changed bandwidth in a way we can't support - disconnect\n",
450                            ifmgd->bssid);
451                 return -EINVAL;
452         }
453 
454         switch (chandef.width) {
455         case NL80211_CHAN_WIDTH_20_NOHT:
456         case NL80211_CHAN_WIDTH_20:
457                 new_sta_bw = IEEE80211_STA_RX_BW_20;
458                 break;
459         case NL80211_CHAN_WIDTH_40:
460                 new_sta_bw = IEEE80211_STA_RX_BW_40;
461                 break;
462         case NL80211_CHAN_WIDTH_80:
463                 new_sta_bw = IEEE80211_STA_RX_BW_80;
464                 break;
465         case NL80211_CHAN_WIDTH_80P80:
466         case NL80211_CHAN_WIDTH_160:
467                 new_sta_bw = IEEE80211_STA_RX_BW_160;
468                 break;
469         default:
470                 return -EINVAL;
471         }
472 
473         if (new_sta_bw > sta->cur_max_bandwidth)
474                 new_sta_bw = sta->cur_max_bandwidth;
475 
476         if (new_sta_bw < sta->sta.bandwidth) {
477                 sta->sta.bandwidth = new_sta_bw;
478                 rate_control_rate_update(local, sband, sta,
479                                          IEEE80211_RC_BW_CHANGED);
480         }
481 
482         ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
483         if (ret) {
484                 sdata_info(sdata,
485                            "AP %pM changed bandwidth to incompatible one - disconnect\n",
486                            ifmgd->bssid);
487                 return ret;
488         }
489 
490         if (new_sta_bw > sta->sta.bandwidth) {
491                 sta->sta.bandwidth = new_sta_bw;
492                 rate_control_rate_update(local, sband, sta,
493                                          IEEE80211_RC_BW_CHANGED);
494         }
495 
496         ht_opmode = le16_to_cpu(ht_oper->operation_mode);
497 
498         /* if bss configuration changed store the new one */
499         if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
500                 *changed |= BSS_CHANGED_HT;
501                 sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
502         }
503 
504         return 0;
505 }
506 
507 /* frame sending functions */
508 
509 static int ieee80211_compatible_rates(const u8 *supp_rates, int supp_rates_len,
510                                       struct ieee80211_supported_band *sband,
511                                       u32 *rates)
512 {
513         int i, j, count;
514         *rates = 0;
515         count = 0;
516         for (i = 0; i < supp_rates_len; i++) {
517                 int rate = (supp_rates[i] & 0x7F) * 5;
518 
519                 for (j = 0; j < sband->n_bitrates; j++)
520                         if (sband->bitrates[j].bitrate == rate) {
521                                 *rates |= BIT(j);
522                                 count++;
523                                 break;
524                         }
525         }
526 
527         return count;
528 }
529 
530 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
531                                 struct sk_buff *skb, u8 ap_ht_param,
532                                 struct ieee80211_supported_band *sband,
533                                 struct ieee80211_channel *channel,
534                                 enum ieee80211_smps_mode smps)
535 {
536         u8 *pos;
537         u32 flags = channel->flags;
538         u16 cap;
539         struct ieee80211_sta_ht_cap ht_cap;
540 
541         BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
542 
543         memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
544         ieee80211_apply_htcap_overrides(sdata, &ht_cap);
545 
546         /* determine capability flags */
547         cap = ht_cap.cap;
548 
549         switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
550         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
551                 if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
552                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
553                         cap &= ~IEEE80211_HT_CAP_SGI_40;
554                 }
555                 break;
556         case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
557                 if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
558                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
559                         cap &= ~IEEE80211_HT_CAP_SGI_40;
560                 }
561                 break;
562         }
563 
564         /*
565          * If 40 MHz was disabled associate as though we weren't
566          * capable of 40 MHz -- some broken APs will never fall
567          * back to trying to transmit in 20 MHz.
568          */
569         if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
570                 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
571                 cap &= ~IEEE80211_HT_CAP_SGI_40;
572         }
573 
574         /* set SM PS mode properly */
575         cap &= ~IEEE80211_HT_CAP_SM_PS;
576         switch (smps) {
577         case IEEE80211_SMPS_AUTOMATIC:
578         case IEEE80211_SMPS_NUM_MODES:
579                 WARN_ON(1);
580         case IEEE80211_SMPS_OFF:
581                 cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
582                         IEEE80211_HT_CAP_SM_PS_SHIFT;
583                 break;
584         case IEEE80211_SMPS_STATIC:
585                 cap |= WLAN_HT_CAP_SM_PS_STATIC <<
586                         IEEE80211_HT_CAP_SM_PS_SHIFT;
587                 break;
588         case IEEE80211_SMPS_DYNAMIC:
589                 cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
590                         IEEE80211_HT_CAP_SM_PS_SHIFT;
591                 break;
592         }
593 
594         /* reserve and fill IE */
595         pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
596         ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
597 }
598 
599 static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
600                                  struct sk_buff *skb,
601                                  struct ieee80211_supported_band *sband,
602                                  struct ieee80211_vht_cap *ap_vht_cap)
603 {
604         u8 *pos;
605         u32 cap;
606         struct ieee80211_sta_vht_cap vht_cap;
607         int i;
608 
609         BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
610 
611         memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
612 
613         /* determine capability flags */
614         cap = vht_cap.cap;
615 
616         if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
617                 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
618                 cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
619         }
620 
621         if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
622                 cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
623                 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
624         }
625 
626         /*
627          * Some APs apparently get confused if our capabilities are better
628          * than theirs, so restrict what we advertise in the assoc request.
629          */
630         if (!(ap_vht_cap->vht_cap_info &
631                         cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
632                 cap &= ~IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
633 
634         if (!(ap_vht_cap->vht_cap_info &
635                         cpu_to_le32(IEEE80211_VHT_CAP_TXSTBC)))
636                 cap &= ~(IEEE80211_VHT_CAP_RXSTBC_1 |
637                          IEEE80211_VHT_CAP_RXSTBC_3 |
638                          IEEE80211_VHT_CAP_RXSTBC_4);
639 
640         for (i = 0; i < 8; i++) {
641                 int shift = i * 2;
642                 u16 mask = IEEE80211_VHT_MCS_NOT_SUPPORTED << shift;
643                 u16 ap_mcs, our_mcs;
644 
645                 ap_mcs = (le16_to_cpu(ap_vht_cap->supp_mcs.tx_mcs_map) &
646                                                                 mask) >> shift;
647                 our_mcs = (le16_to_cpu(vht_cap.vht_mcs.rx_mcs_map) &
648                                                                 mask) >> shift;
649 
650                 if (our_mcs == IEEE80211_VHT_MCS_NOT_SUPPORTED)
651                         continue;
652 
653                 switch (ap_mcs) {
654                 default:
655                         if (our_mcs <= ap_mcs)
656                                 break;
657                         /* fall through */
658                 case IEEE80211_VHT_MCS_NOT_SUPPORTED:
659                         vht_cap.vht_mcs.rx_mcs_map &= cpu_to_le16(~mask);
660                         vht_cap.vht_mcs.rx_mcs_map |=
661                                 cpu_to_le16(ap_mcs << shift);
662                 }
663         }
664 
665         /* reserve and fill IE */
666         pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
667         ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
668 }
669 
670 static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
671 {
672         struct ieee80211_local *local = sdata->local;
673         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
674         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
675         struct sk_buff *skb;
676         struct ieee80211_mgmt *mgmt;
677         u8 *pos, qos_info;
678         size_t offset = 0, noffset;
679         int i, count, rates_len, supp_rates_len;
680         u16 capab;
681         struct ieee80211_supported_band *sband;
682         struct ieee80211_chanctx_conf *chanctx_conf;
683         struct ieee80211_channel *chan;
684         u32 rates = 0;
685 
686         lockdep_assert_held(&ifmgd->mtx);
687 
688         rcu_read_lock();
689         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
690         if (WARN_ON(!chanctx_conf)) {
691                 rcu_read_unlock();
692                 return;
693         }
694         chan = chanctx_conf->def.chan;
695         rcu_read_unlock();
696         sband = local->hw.wiphy->bands[chan->band];
697 
698         if (assoc_data->supp_rates_len) {
699                 /*
700                  * Get all rates supported by the device and the AP as
701                  * some APs don't like getting a superset of their rates
702                  * in the association request (e.g. D-Link DAP 1353 in
703                  * b-only mode)...
704                  */
705                 rates_len = ieee80211_compatible_rates(assoc_data->supp_rates,
706                                                        assoc_data->supp_rates_len,
707                                                        sband, &rates);
708         } else {
709                 /*
710                  * In case AP not provide any supported rates information
711                  * before association, we send information element(s) with
712                  * all rates that we support.
713                  */
714                 rates = ~0;
715                 rates_len = sband->n_bitrates;
716         }
717 
718         skb = alloc_skb(local->hw.extra_tx_headroom +
719                         sizeof(*mgmt) + /* bit too much but doesn't matter */
720                         2 + assoc_data->ssid_len + /* SSID */
721                         4 + rates_len + /* (extended) rates */
722                         4 + /* power capability */
723                         2 + 2 * sband->n_channels + /* supported channels */
724                         2 + sizeof(struct ieee80211_ht_cap) + /* HT */
725                         2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
726                         assoc_data->ie_len + /* extra IEs */
727                         9, /* WMM */
728                         GFP_KERNEL);
729         if (!skb)
730                 return;
731 
732         skb_reserve(skb, local->hw.extra_tx_headroom);
733 
734         capab = WLAN_CAPABILITY_ESS;
735 
736         if (sband->band == IEEE80211_BAND_2GHZ) {
737                 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
738                         capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
739                 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
740                         capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
741         }
742 
743         if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
744                 capab |= WLAN_CAPABILITY_PRIVACY;
745 
746         if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
747             (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
748                 capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
749 
750         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
751         memset(mgmt, 0, 24);
752         memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
753         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
754         memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);
755 
756         if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
757                 skb_put(skb, 10);
758                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
759                                                   IEEE80211_STYPE_REASSOC_REQ);
760                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
761                 mgmt->u.reassoc_req.listen_interval =
762                                 cpu_to_le16(local->hw.conf.listen_interval);
763                 memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
764                        ETH_ALEN);
765         } else {
766                 skb_put(skb, 4);
767                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
768                                                   IEEE80211_STYPE_ASSOC_REQ);
769                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
770                 mgmt->u.assoc_req.listen_interval =
771                                 cpu_to_le16(local->hw.conf.listen_interval);
772         }
773 
774         /* SSID */
775         pos = skb_put(skb, 2 + assoc_data->ssid_len);
776         *pos++ = WLAN_EID_SSID;
777         *pos++ = assoc_data->ssid_len;
778         memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);
779 
780         /* add all rates which were marked to be used above */
781         supp_rates_len = rates_len;
782         if (supp_rates_len > 8)
783                 supp_rates_len = 8;
784 
785         pos = skb_put(skb, supp_rates_len + 2);
786         *pos++ = WLAN_EID_SUPP_RATES;
787         *pos++ = supp_rates_len;
788 
789         count = 0;
790         for (i = 0; i < sband->n_bitrates; i++) {
791                 if (BIT(i) & rates) {
792                         int rate = sband->bitrates[i].bitrate;
793                         *pos++ = (u8) (rate / 5);
794                         if (++count == 8)
795                                 break;
796                 }
797         }
798 
799         if (rates_len > count) {
800                 pos = skb_put(skb, rates_len - count + 2);
801                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
802                 *pos++ = rates_len - count;
803 
804                 for (i++; i < sband->n_bitrates; i++) {
805                         if (BIT(i) & rates) {
806                                 int rate = sband->bitrates[i].bitrate;
807                                 *pos++ = (u8) (rate / 5);
808                         }
809                 }
810         }
811 
812         if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
813                 /* 1. power capabilities */
814                 pos = skb_put(skb, 4);
815                 *pos++ = WLAN_EID_PWR_CAPABILITY;
816                 *pos++ = 2;
817                 *pos++ = 0; /* min tx power */
818                 *pos++ = chan->max_power; /* max tx power */
819 
820                 /* 2. supported channels */
821                 /* TODO: get this in reg domain format */
822                 pos = skb_put(skb, 2 * sband->n_channels + 2);
823                 *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
824                 *pos++ = 2 * sband->n_channels;
825                 for (i = 0; i < sband->n_channels; i++) {
826                         *pos++ = ieee80211_frequency_to_channel(
827                                         sband->channels[i].center_freq);
828                         *pos++ = 1; /* one channel in the subband*/
829                 }
830         }
831 
832         /* if present, add any custom IEs that go before HT */
833         if (assoc_data->ie_len && assoc_data->ie) {
834                 static const u8 before_ht[] = {
835                         WLAN_EID_SSID,
836                         WLAN_EID_SUPP_RATES,
837                         WLAN_EID_EXT_SUPP_RATES,
838                         WLAN_EID_PWR_CAPABILITY,
839                         WLAN_EID_SUPPORTED_CHANNELS,
840                         WLAN_EID_RSN,
841                         WLAN_EID_QOS_CAPA,
842                         WLAN_EID_RRM_ENABLED_CAPABILITIES,
843                         WLAN_EID_MOBILITY_DOMAIN,
844                         WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
845                 };
846                 noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
847                                              before_ht, ARRAY_SIZE(before_ht),
848                                              offset);
849                 pos = skb_put(skb, noffset - offset);
850                 memcpy(pos, assoc_data->ie + offset, noffset - offset);
851                 offset = noffset;
852         }
853 
854         if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
855                          !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
856                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
857 
858         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
859                 ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
860                                     sband, chan, sdata->smps_mode);
861 
862         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
863                 ieee80211_add_vht_ie(sdata, skb, sband,
864                                      &assoc_data->ap_vht_cap);
865 
866         /* if present, add any custom non-vendor IEs that go after HT */
867         if (assoc_data->ie_len && assoc_data->ie) {
868                 noffset = ieee80211_ie_split_vendor(assoc_data->ie,
869                                                     assoc_data->ie_len,
870                                                     offset);
871                 pos = skb_put(skb, noffset - offset);
872                 memcpy(pos, assoc_data->ie + offset, noffset - offset);
873                 offset = noffset;
874         }
875 
876         if (assoc_data->wmm) {
877                 if (assoc_data->uapsd) {
878                         qos_info = ifmgd->uapsd_queues;
879                         qos_info |= (ifmgd->uapsd_max_sp_len <<
880                                      IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
881                 } else {
882                         qos_info = 0;
883                 }
884 
885                 pos = skb_put(skb, 9);
886                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
887                 *pos++ = 7; /* len */
888                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
889                 *pos++ = 0x50;
890                 *pos++ = 0xf2;
891                 *pos++ = 2; /* WME */
892                 *pos++ = 0; /* WME info */
893                 *pos++ = 1; /* WME ver */
894                 *pos++ = qos_info;
895         }
896 
897         /* add any remaining custom (i.e. vendor specific here) IEs */
898         if (assoc_data->ie_len && assoc_data->ie) {
899                 noffset = assoc_data->ie_len;
900                 pos = skb_put(skb, noffset - offset);
901                 memcpy(pos, assoc_data->ie + offset, noffset - offset);
902         }
903 
904         drv_mgd_prepare_tx(local, sdata);
905 
906         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
907         if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
908                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
909                                                 IEEE80211_TX_INTFL_MLME_CONN_TX;
910         ieee80211_tx_skb(sdata, skb);
911 }
912 
913 void ieee80211_send_pspoll(struct ieee80211_local *local,
914                            struct ieee80211_sub_if_data *sdata)
915 {
916         struct ieee80211_pspoll *pspoll;
917         struct sk_buff *skb;
918 
919         skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
920         if (!skb)
921                 return;
922 
923         pspoll = (struct ieee80211_pspoll *) skb->data;
924         pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
925 
926         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
927         ieee80211_tx_skb(sdata, skb);
928 }
929 
930 void ieee80211_send_nullfunc(struct ieee80211_local *local,
931                              struct ieee80211_sub_if_data *sdata,
932                              int powersave)
933 {
934         struct sk_buff *skb;
935         struct ieee80211_hdr_3addr *nullfunc;
936         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
937 
938         skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
939         if (!skb)
940                 return;
941 
942         nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
943         if (powersave)
944                 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
945 
946         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
947                                         IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
948         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
949                             IEEE80211_STA_CONNECTION_POLL))
950                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
951 
952         ieee80211_tx_skb(sdata, skb);
953 }
954 
955 static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
956                                           struct ieee80211_sub_if_data *sdata)
957 {
958         struct sk_buff *skb;
959         struct ieee80211_hdr *nullfunc;
960         __le16 fc;
961 
962         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
963                 return;
964 
965         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
966         if (!skb)
967                 return;
968 
969         skb_reserve(skb, local->hw.extra_tx_headroom);
970 
971         nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30);
972         memset(nullfunc, 0, 30);
973         fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
974                          IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
975         nullfunc->frame_control = fc;
976         memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
977         memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
978         memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
979         memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
980 
981         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
982         ieee80211_tx_skb(sdata, skb);
983 }
984 
985 /* spectrum management related things */
986 static void ieee80211_chswitch_work(struct work_struct *work)
987 {
988         struct ieee80211_sub_if_data *sdata =
989                 container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
990         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
991 
992         if (!ieee80211_sdata_running(sdata))
993                 return;
994 
995         mutex_lock(&ifmgd->mtx);
996         if (!ifmgd->associated)
997                 goto out;
998 
999         sdata->local->_oper_channel = sdata->local->csa_channel;
1000         if (!sdata->local->ops->channel_switch) {
1001                 /* call "hw_config" only if doing sw channel switch */
1002                 ieee80211_hw_config(sdata->local,
1003                         IEEE80211_CONF_CHANGE_CHANNEL);
1004         } else {
1005                 /* update the device channel directly */
1006                 sdata->local->hw.conf.channel = sdata->local->_oper_channel;
1007         }
1008 
1009         /* XXX: shouldn't really modify cfg80211-owned data! */
1010         ifmgd->associated->channel = sdata->local->_oper_channel;
1011 
1012         /* XXX: wait for a beacon first? */
1013         ieee80211_wake_queues_by_reason(&sdata->local->hw,
1014                                         IEEE80211_QUEUE_STOP_REASON_CSA);
1015  out:
1016         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
1017         mutex_unlock(&ifmgd->mtx);
1018 }
1019 
1020 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
1021 {
1022         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1023         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1024 
1025         trace_api_chswitch_done(sdata, success);
1026         if (!success) {
1027                 sdata_info(sdata,
1028                            "driver channel switch failed, disconnecting\n");
1029                 ieee80211_queue_work(&sdata->local->hw,
1030                                      &ifmgd->csa_connection_drop_work);
1031         } else {
1032                 ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1033         }
1034 }
1035 EXPORT_SYMBOL(ieee80211_chswitch_done);
1036 
1037 static void ieee80211_chswitch_timer(unsigned long data)
1038 {
1039         struct ieee80211_sub_if_data *sdata =
1040                 (struct ieee80211_sub_if_data *) data;
1041         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1042 
1043         if (sdata->local->quiescing) {
1044                 set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running);
1045                 return;
1046         }
1047 
1048         ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1049 }
1050 
1051 void
1052 ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1053                                  const struct ieee80211_channel_sw_ie *sw_elem,
1054                                  struct ieee80211_bss *bss, u64 timestamp)
1055 {
1056         struct cfg80211_bss *cbss =
1057                 container_of((void *)bss, struct cfg80211_bss, priv);
1058         struct ieee80211_channel *new_ch;
1059         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1060         int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num,
1061                                                       cbss->channel->band);
1062         struct ieee80211_chanctx *chanctx;
1063 
1064         ASSERT_MGD_MTX(ifmgd);
1065 
1066         if (!ifmgd->associated)
1067                 return;
1068 
1069         if (sdata->local->scanning)
1070                 return;
1071 
1072         /* Disregard subsequent beacons if we are already running a timer
1073            processing a CSA */
1074 
1075         if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
1076                 return;
1077 
1078         new_ch = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
1079         if (!new_ch || new_ch->flags & IEEE80211_CHAN_DISABLED) {
1080                 sdata_info(sdata,
1081                            "AP %pM switches to unsupported channel (%d MHz), disconnecting\n",
1082                            ifmgd->associated->bssid, new_freq);
1083                 ieee80211_queue_work(&sdata->local->hw,
1084                                      &ifmgd->csa_connection_drop_work);
1085                 return;
1086         }
1087 
1088         ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
1089 
1090         if (sdata->local->use_chanctx) {
1091                 sdata_info(sdata,
1092                            "not handling channel switch with channel contexts\n");
1093                 ieee80211_queue_work(&sdata->local->hw,
1094                                      &ifmgd->csa_connection_drop_work);
1095                 return;
1096         }
1097 
1098         mutex_lock(&sdata->local->chanctx_mtx);
1099         if (WARN_ON(!rcu_access_pointer(sdata->vif.chanctx_conf))) {
1100                 mutex_unlock(&sdata->local->chanctx_mtx);
1101                 return;
1102         }
1103         chanctx = container_of(rcu_access_pointer(sdata->vif.chanctx_conf),
1104                                struct ieee80211_chanctx, conf);
1105         if (chanctx->refcount > 1) {
1106                 sdata_info(sdata,
1107                            "channel switch with multiple interfaces on the same channel, disconnecting\n");
1108                 ieee80211_queue_work(&sdata->local->hw,
1109                                      &ifmgd->csa_connection_drop_work);
1110                 mutex_unlock(&sdata->local->chanctx_mtx);
1111                 return;
1112         }
1113         mutex_unlock(&sdata->local->chanctx_mtx);
1114 
1115         sdata->local->csa_channel = new_ch;
1116 
1117         if (sw_elem->mode)
1118                 ieee80211_stop_queues_by_reason(&sdata->local->hw,
1119                                 IEEE80211_QUEUE_STOP_REASON_CSA);
1120 
1121         if (sdata->local->ops->channel_switch) {
1122                 /* use driver's channel switch callback */
1123                 struct ieee80211_channel_switch ch_switch = {
1124                         .timestamp = timestamp,
1125                         .block_tx = sw_elem->mode,
1126                         .channel = new_ch,
1127                         .count = sw_elem->count,
1128                 };
1129 
1130                 drv_channel_switch(sdata->local, &ch_switch);
1131                 return;
1132         }
1133 
1134         /* channel switch handled in software */
1135         if (sw_elem->count <= 1)
1136                 ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1137         else
1138                 mod_timer(&ifmgd->chswitch_timer,
1139                           TU_TO_EXP_TIME(sw_elem->count *
1140                                          cbss->beacon_interval));
1141 }
1142 
1143 static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
1144                                        struct ieee80211_channel *channel,
1145                                        const u8 *country_ie, u8 country_ie_len,
1146                                        const u8 *pwr_constr_elem)
1147 {
1148         struct ieee80211_country_ie_triplet *triplet;
1149         int chan = ieee80211_frequency_to_channel(channel->center_freq);
1150         int i, chan_pwr, chan_increment, new_ap_level;
1151         bool have_chan_pwr = false;
1152 
1153         /* Invalid IE */
1154         if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1155                 return 0;
1156 
1157         triplet = (void *)(country_ie + 3);
1158         country_ie_len -= 3;
1159 
1160         switch (channel->band) {
1161         default:
1162                 WARN_ON_ONCE(1);
1163                 /* fall through */
1164         case IEEE80211_BAND_2GHZ:
1165         case IEEE80211_BAND_60GHZ:
1166                 chan_increment = 1;
1167                 break;
1168         case IEEE80211_BAND_5GHZ:
1169                 chan_increment = 4;
1170                 break;
1171         }
1172 
1173         /* find channel */
1174         while (country_ie_len >= 3) {
1175                 u8 first_channel = triplet->chans.first_channel;
1176 
1177                 if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
1178                         goto next;
1179 
1180                 for (i = 0; i < triplet->chans.num_channels; i++) {
1181                         if (first_channel + i * chan_increment == chan) {
1182                                 have_chan_pwr = true;
1183                                 chan_pwr = triplet->chans.max_power;
1184                                 break;
1185                         }
1186                 }
1187                 if (have_chan_pwr)
1188                         break;
1189 
1190  next:
1191                 triplet++;
1192                 country_ie_len -= 3;
1193         }
1194 
1195         if (!have_chan_pwr)
1196                 return 0;
1197 
1198         new_ap_level = max_t(int, 0, chan_pwr - *pwr_constr_elem);
1199 
1200         if (sdata->ap_power_level == new_ap_level)
1201                 return 0;
1202 
1203         sdata_info(sdata,
1204                    "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
1205                    new_ap_level, chan_pwr, *pwr_constr_elem,
1206                    sdata->u.mgd.bssid);
1207         sdata->ap_power_level = new_ap_level;
1208         if (__ieee80211_recalc_txpower(sdata))
1209                 return BSS_CHANGED_TXPOWER;
1210         return 0;
1211 }
1212 
1213 /* powersave */
1214 static void ieee80211_enable_ps(struct ieee80211_local *local,
1215                                 struct ieee80211_sub_if_data *sdata)
1216 {
1217         struct ieee80211_conf *conf = &local->hw.conf;
1218 
1219         /*
1220          * If we are scanning right now then the parameters will
1221          * take effect when scan finishes.
1222          */
1223         if (local->scanning)
1224                 return;
1225 
1226         if (conf->dynamic_ps_timeout > 0 &&
1227             !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
1228                 mod_timer(&local->dynamic_ps_timer, jiffies +
1229                           msecs_to_jiffies(conf->dynamic_ps_timeout));
1230         } else {
1231                 if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
1232                         ieee80211_send_nullfunc(local, sdata, 1);
1233 
1234                 if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
1235                     (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS))
1236                         return;
1237 
1238                 conf->flags |= IEEE80211_CONF_PS;
1239                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1240         }
1241 }
1242 
1243 static void ieee80211_change_ps(struct ieee80211_local *local)
1244 {
1245         struct ieee80211_conf *conf = &local->hw.conf;
1246 
1247         if (local->ps_sdata) {
1248                 ieee80211_enable_ps(local, local->ps_sdata);
1249         } else if (conf->flags & IEEE80211_CONF_PS) {
1250                 conf->flags &= ~IEEE80211_CONF_PS;
1251                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1252                 del_timer_sync(&local->dynamic_ps_timer);
1253                 cancel_work_sync(&local->dynamic_ps_enable_work);
1254         }
1255 }
1256 
1257 static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
1258 {
1259         struct ieee80211_if_managed *mgd = &sdata->u.mgd;
1260         struct sta_info *sta = NULL;
1261         bool authorized = false;
1262 
1263         if (!mgd->powersave)
1264                 return false;
1265 
1266         if (mgd->broken_ap)
1267                 return false;
1268 
1269         if (!mgd->associated)
1270                 return false;
1271 
1272         if (mgd->flags & (IEEE80211_STA_BEACON_POLL |
1273                           IEEE80211_STA_CONNECTION_POLL))
1274                 return false;
1275 
1276         rcu_read_lock();
1277         sta = sta_info_get(sdata, mgd->bssid);
1278         if (sta)
1279                 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1280         rcu_read_unlock();
1281 
1282         return authorized;
1283 }
1284 
1285 /* need to hold RTNL or interface lock */
1286 void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
1287 {
1288         struct ieee80211_sub_if_data *sdata, *found = NULL;
1289         int count = 0;
1290         int timeout;
1291 
1292         if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS)) {
1293                 local->ps_sdata = NULL;
1294                 return;
1295         }
1296 
1297         list_for_each_entry(sdata, &local->interfaces, list) {
1298                 if (!ieee80211_sdata_running(sdata))
1299                         continue;
1300                 if (sdata->vif.type == NL80211_IFTYPE_AP) {
1301                         /* If an AP vif is found, then disable PS
1302                          * by setting the count to zero thereby setting
1303                          * ps_sdata to NULL.
1304                          */
1305                         count = 0;
1306                         break;
1307                 }
1308                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
1309                         continue;
1310                 found = sdata;
1311                 count++;
1312         }
1313 
1314         if (count == 1 && ieee80211_powersave_allowed(found)) {
1315                 s32 beaconint_us;
1316 
1317                 if (latency < 0)
1318                         latency = pm_qos_request(PM_QOS_NETWORK_LATENCY);
1319 
1320                 beaconint_us = ieee80211_tu_to_usec(
1321                                         found->vif.bss_conf.beacon_int);
1322 
1323                 timeout = local->dynamic_ps_forced_timeout;
1324                 if (timeout < 0) {
1325                         /*
1326                          * Go to full PSM if the user configures a very low
1327                          * latency requirement.
1328                          * The 2000 second value is there for compatibility
1329                          * until the PM_QOS_NETWORK_LATENCY is configured
1330                          * with real values.
1331                          */
1332                         if (latency > (1900 * USEC_PER_MSEC) &&
1333                             latency != (2000 * USEC_PER_SEC))
1334                                 timeout = 0;
1335                         else
1336                                 timeout = 100;
1337                 }
1338                 local->hw.conf.dynamic_ps_timeout = timeout;
1339 
1340                 if (beaconint_us > latency) {
1341                         local->ps_sdata = NULL;
1342                 } else {
1343                         int maxslp = 1;
1344                         u8 dtimper = found->u.mgd.dtim_period;
1345 
1346                         /* If the TIM IE is invalid, pretend the value is 1 */
1347                         if (!dtimper)
1348                                 dtimper = 1;
1349                         else if (dtimper > 1)
1350                                 maxslp = min_t(int, dtimper,
1351                                                     latency / beaconint_us);
1352 
1353                         local->hw.conf.max_sleep_period = maxslp;
1354                         local->hw.conf.ps_dtim_period = dtimper;
1355                         local->ps_sdata = found;
1356                 }
1357         } else {
1358                 local->ps_sdata = NULL;
1359         }
1360 
1361         ieee80211_change_ps(local);
1362 }
1363 
1364 void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
1365 {
1366         bool ps_allowed = ieee80211_powersave_allowed(sdata);
1367 
1368         if (sdata->vif.bss_conf.ps != ps_allowed) {
1369                 sdata->vif.bss_conf.ps = ps_allowed;
1370                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
1371         }
1372 }
1373 
1374 void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
1375 {
1376         struct ieee80211_local *local =
1377                 container_of(work, struct ieee80211_local,
1378                              dynamic_ps_disable_work);
1379 
1380         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1381                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1382                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1383         }
1384 
1385         ieee80211_wake_queues_by_reason(&local->hw,
1386                                         IEEE80211_QUEUE_STOP_REASON_PS);
1387 }
1388 
1389 void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
1390 {
1391         struct ieee80211_local *local =
1392                 container_of(work, struct ieee80211_local,
1393                              dynamic_ps_enable_work);
1394         struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1395         struct ieee80211_if_managed *ifmgd;
1396         unsigned long flags;
1397         int q;
1398 
1399         /* can only happen when PS was just disabled anyway */
1400         if (!sdata)
1401                 return;
1402 
1403         ifmgd = &sdata->u.mgd;
1404 
1405         if (local->hw.conf.flags & IEEE80211_CONF_PS)
1406                 return;
1407 
1408         if (local->hw.conf.dynamic_ps_timeout > 0) {
1409                 /* don't enter PS if TX frames are pending */
1410                 if (drv_tx_frames_pending(local)) {
1411                         mod_timer(&local->dynamic_ps_timer, jiffies +
1412                                   msecs_to_jiffies(
1413                                   local->hw.conf.dynamic_ps_timeout));
1414                         return;
1415                 }
1416 
1417                 /*
1418                  * transmission can be stopped by others which leads to
1419                  * dynamic_ps_timer expiry. Postpone the ps timer if it
1420                  * is not the actual idle state.
1421                  */
1422                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
1423                 for (q = 0; q < local->hw.queues; q++) {
1424                         if (local->queue_stop_reasons[q]) {
1425                                 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1426                                                        flags);
1427                                 mod_timer(&local->dynamic_ps_timer, jiffies +
1428                                           msecs_to_jiffies(
1429                                           local->hw.conf.dynamic_ps_timeout));
1430                                 return;
1431                         }
1432                 }
1433                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1434         }
1435 
1436         if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
1437             !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1438                 netif_tx_stop_all_queues(sdata->dev);
1439 
1440                 if (drv_tx_frames_pending(local))
1441                         mod_timer(&local->dynamic_ps_timer, jiffies +
1442                                   msecs_to_jiffies(
1443                                   local->hw.conf.dynamic_ps_timeout));
1444                 else {
1445                         ieee80211_send_nullfunc(local, sdata, 1);
1446                         /* Flush to get the tx status of nullfunc frame */
1447                         drv_flush(local, false);
1448                 }
1449         }
1450 
1451         if (!((local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
1452               (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)) ||
1453             (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1454                 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
1455                 local->hw.conf.flags |= IEEE80211_CONF_PS;
1456                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1457         }
1458 
1459         if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
1460                 netif_tx_wake_all_queues(sdata->dev);
1461 }
1462 
1463 void ieee80211_dynamic_ps_timer(unsigned long data)
1464 {
1465         struct ieee80211_local *local = (void *) data;
1466 
1467         if (local->quiescing || local->suspended)
1468                 return;
1469 
1470         ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1471 }
1472 
1473 void ieee80211_dfs_cac_timer_work(struct work_struct *work)
1474 {
1475         struct delayed_work *delayed_work =
1476                 container_of(work, struct delayed_work, work);
1477         struct ieee80211_sub_if_data *sdata =
1478                 container_of(delayed_work, struct ieee80211_sub_if_data,
1479                              dfs_cac_timer_work);
1480 
1481         ieee80211_vif_release_channel(sdata);
1482 
1483         cfg80211_cac_event(sdata->dev, NL80211_RADAR_CAC_FINISHED, GFP_KERNEL);
1484 }
1485 
1486 /* MLME */
1487 static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
1488                                      struct ieee80211_sub_if_data *sdata,
1489                                      const u8 *wmm_param, size_t wmm_param_len)
1490 {
1491         struct ieee80211_tx_queue_params params;
1492         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1493         size_t left;
1494         int count;
1495         const u8 *pos;
1496         u8 uapsd_queues = 0;
1497 
1498         if (!local->ops->conf_tx)
1499                 return false;
1500 
1501         if (local->hw.queues < IEEE80211_NUM_ACS)
1502                 return false;
1503 
1504         if (!wmm_param)
1505                 return false;
1506 
1507         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1508                 return false;
1509 
1510         if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1511                 uapsd_queues = ifmgd->uapsd_queues;
1512 
1513         count = wmm_param[6] & 0x0f;
1514         if (count == ifmgd->wmm_last_param_set)
1515                 return false;
1516         ifmgd->wmm_last_param_set = count;
1517 
1518         pos = wmm_param + 8;
1519         left = wmm_param_len - 8;
1520 
1521         memset(&params, 0, sizeof(params));
1522 
1523         sdata->wmm_acm = 0;
1524         for (; left >= 4; left -= 4, pos += 4) {
1525                 int aci = (pos[0] >> 5) & 0x03;
1526                 int acm = (pos[0] >> 4) & 0x01;
1527                 bool uapsd = false;
1528                 int queue;
1529 
1530                 switch (aci) {
1531                 case 1: /* AC_BK */
1532                         queue = 3;
1533                         if (acm)
1534                                 sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
1535                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
1536                                 uapsd = true;
1537                         break;
1538                 case 2: /* AC_VI */
1539                         queue = 1;
1540                         if (acm)
1541                                 sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
1542                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
1543                                 uapsd = true;
1544                         break;
1545                 case 3: /* AC_VO */
1546                         queue = 0;
1547                         if (acm)
1548                                 sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
1549                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
1550                                 uapsd = true;
1551                         break;
1552                 case 0: /* AC_BE */
1553                 default:
1554                         queue = 2;
1555                         if (acm)
1556                                 sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
1557                         if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
1558                                 uapsd = true;
1559                         break;
1560                 }
1561 
1562                 params.aifs = pos[0] & 0x0f;
1563                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
1564                 params.cw_min = ecw2cw(pos[1] & 0x0f);
1565                 params.txop = get_unaligned_le16(pos + 2);
1566                 params.uapsd = uapsd;
1567 
1568                 mlme_dbg(sdata,
1569                          "WMM queue=%d aci=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d\n",
1570                          queue, aci, acm,
1571                          params.aifs, params.cw_min, params.cw_max,
1572                          params.txop, params.uapsd);
1573                 sdata->tx_conf[queue] = params;
1574                 if (drv_conf_tx(local, sdata, queue, &params))
1575                         sdata_err(sdata,
1576                                   "failed to set TX queue parameters for queue %d\n",
1577                                   queue);
1578         }
1579 
1580         /* enable WMM or activate new settings */
1581         sdata->vif.bss_conf.qos = true;
1582         return true;
1583 }
1584 
1585 static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
1586 {
1587         lockdep_assert_held(&sdata->local->mtx);
1588 
1589         sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
1590                                 IEEE80211_STA_BEACON_POLL);
1591         ieee80211_run_deferred_scan(sdata->local);
1592 }
1593 
1594 static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
1595 {
1596         mutex_lock(&sdata->local->mtx);
1597         __ieee80211_stop_poll(sdata);
1598         mutex_unlock(&sdata->local->mtx);
1599 }
1600 
1601 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
1602                                            u16 capab, bool erp_valid, u8 erp)
1603 {
1604         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1605         u32 changed = 0;
1606         bool use_protection;
1607         bool use_short_preamble;
1608         bool use_short_slot;
1609 
1610         if (erp_valid) {
1611                 use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
1612                 use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
1613         } else {
1614                 use_protection = false;
1615                 use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
1616         }
1617 
1618         use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
1619         if (ieee80211_get_sdata_band(sdata) == IEEE80211_BAND_5GHZ)
1620                 use_short_slot = true;
1621 
1622         if (use_protection != bss_conf->use_cts_prot) {
1623                 bss_conf->use_cts_prot = use_protection;
1624                 changed |= BSS_CHANGED_ERP_CTS_PROT;
1625         }
1626 
1627         if (use_short_preamble != bss_conf->use_short_preamble) {
1628                 bss_conf->use_short_preamble = use_short_preamble;
1629                 changed |= BSS_CHANGED_ERP_PREAMBLE;
1630         }
1631 
1632         if (use_short_slot != bss_conf->use_short_slot) {
1633                 bss_conf->use_short_slot = use_short_slot;
1634                 changed |= BSS_CHANGED_ERP_SLOT;
1635         }
1636 
1637         return changed;
1638 }
1639 
1640 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
1641                                      struct cfg80211_bss *cbss,
1642                                      u32 bss_info_changed)
1643 {
1644         struct ieee80211_bss *bss = (void *)cbss->priv;
1645         struct ieee80211_local *local = sdata->local;
1646         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1647 
1648         bss_info_changed |= BSS_CHANGED_ASSOC;
1649         bss_info_changed |= ieee80211_handle_bss_capability(sdata,
1650                 bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
1651 
1652         sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
1653                 IEEE80211_BEACON_LOSS_COUNT * bss_conf->beacon_int));
1654 
1655         sdata->u.mgd.associated = cbss;
1656         memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
1657 
1658         sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;
1659 
1660         if (sdata->vif.p2p) {
1661                 const struct cfg80211_bss_ies *ies;
1662 
1663                 rcu_read_lock();
1664                 ies = rcu_dereference(cbss->ies);
1665                 if (ies) {
1666                         u8 noa[2];
1667                         int ret;
1668 
1669                         ret = cfg80211_get_p2p_attr(
1670                                         ies->data, ies->len,
1671                                         IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
1672                                         noa, sizeof(noa));
1673                         if (ret >= 2) {
1674                                 bss_conf->p2p_oppps = noa[1] & 0x80;
1675                                 bss_conf->p2p_ctwindow = noa[1] & 0x7f;
1676                                 bss_info_changed |= BSS_CHANGED_P2P_PS;
1677                                 sdata->u.mgd.p2p_noa_index = noa[0];
1678                         }
1679                 }
1680                 rcu_read_unlock();
1681         }
1682 
1683         /* just to be sure */
1684         ieee80211_stop_poll(sdata);
1685 
1686         ieee80211_led_assoc(local, 1);
1687 
1688         if (sdata->u.mgd.assoc_data->have_beacon) {
1689                 /*
1690                  * If the AP is buggy we may get here with no DTIM period
1691                  * known, so assume it's 1 which is the only safe assumption
1692                  * in that case, although if the TIM IE is broken powersave
1693                  * probably just won't work at all.
1694                  */
1695                 bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
1696                 bss_info_changed |= BSS_CHANGED_DTIM_PERIOD;
1697         } else {
1698                 bss_conf->dtim_period = 0;
1699         }
1700 
1701         bss_conf->assoc = 1;
1702 
1703         /* Tell the driver to monitor connection quality (if supported) */
1704         if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
1705             bss_conf->cqm_rssi_thold)
1706                 bss_info_changed |= BSS_CHANGED_CQM;
1707 
1708         /* Enable ARP filtering */
1709         if (bss_conf->arp_addr_cnt)
1710                 bss_info_changed |= BSS_CHANGED_ARP_FILTER;
1711 
1712         ieee80211_bss_info_change_notify(sdata, bss_info_changed);
1713 
1714         mutex_lock(&local->iflist_mtx);
1715         ieee80211_recalc_ps(local, -1);
1716         mutex_unlock(&local->iflist_mtx);
1717 
1718         ieee80211_recalc_smps(sdata);
1719         ieee80211_recalc_ps_vif(sdata);
1720 
1721         netif_tx_start_all_queues(sdata->dev);
1722         netif_carrier_on(sdata->dev);
1723 }
1724 
1725 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
1726                                    u16 stype, u16 reason, bool tx,
1727                                    u8 *frame_buf)
1728 {
1729         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1730         struct ieee80211_local *local = sdata->local;
1731         u32 changed = 0;
1732 
1733         ASSERT_MGD_MTX(ifmgd);
1734 
1735         if (WARN_ON_ONCE(tx && !frame_buf))
1736                 return;
1737 
1738         if (WARN_ON(!ifmgd->associated))
1739                 return;
1740 
1741         ieee80211_stop_poll(sdata);
1742 
1743         ifmgd->associated = NULL;
1744 
1745         /*
1746          * we need to commit the associated = NULL change because the
1747          * scan code uses that to determine whether this iface should
1748          * go to/wake up from powersave or not -- and could otherwise
1749          * wake the queues erroneously.
1750          */
1751         smp_mb();
1752 
1753         /*
1754          * Thus, we can only afterwards stop the queues -- to account
1755          * for the case where another CPU is finishing a scan at this
1756          * time -- we don't want the scan code to enable queues.
1757          */
1758 
1759         netif_tx_stop_all_queues(sdata->dev);
1760         netif_carrier_off(sdata->dev);
1761 
1762         /*
1763          * if we want to get out of ps before disassoc (why?) we have
1764          * to do it before sending disassoc, as otherwise the null-packet
1765          * won't be valid.
1766          */
1767         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1768                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1769                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1770         }
1771         local->ps_sdata = NULL;
1772 
1773         /* disable per-vif ps */
1774         ieee80211_recalc_ps_vif(sdata);
1775 
1776         /* flush out any pending frame (e.g. DELBA) before deauth/disassoc */
1777         if (tx)
1778                 drv_flush(local, false);
1779 
1780         /* deauthenticate/disassociate now */
1781         if (tx || frame_buf)
1782                 ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
1783                                                reason, tx, frame_buf);
1784 
1785         /* flush out frame */
1786         if (tx)
1787                 drv_flush(local, false);
1788 
1789         /* clear bssid only after building the needed mgmt frames */
1790         memset(ifmgd->bssid, 0, ETH_ALEN);
1791 
1792         /* remove AP and TDLS peers */
1793         sta_info_flush_defer(sdata);
1794 
1795         /* finally reset all BSS / config parameters */
1796         changed |= ieee80211_reset_erp_info(sdata);
1797 
1798         ieee80211_led_assoc(local, 0);
1799         changed |= BSS_CHANGED_ASSOC;
1800         sdata->vif.bss_conf.assoc = false;
1801 
1802         sdata->vif.bss_conf.p2p_ctwindow = 0;
1803         sdata->vif.bss_conf.p2p_oppps = false;
1804 
1805         /* on the next assoc, re-program HT parameters */
1806         memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
1807         memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
1808 
1809         sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
1810 
1811         del_timer_sync(&local->dynamic_ps_timer);
1812         cancel_work_sync(&local->dynamic_ps_enable_work);
1813 
1814         /* Disable ARP filtering */
1815         if (sdata->vif.bss_conf.arp_addr_cnt)
1816                 changed |= BSS_CHANGED_ARP_FILTER;
1817 
1818         sdata->vif.bss_conf.qos = false;
1819         changed |= BSS_CHANGED_QOS;
1820 
1821         /* The BSSID (not really interesting) and HT changed */
1822         changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
1823         ieee80211_bss_info_change_notify(sdata, changed);
1824 
1825         /* disassociated - set to defaults now */
1826         ieee80211_set_wmm_default(sdata, false);
1827 
1828         del_timer_sync(&sdata->u.mgd.conn_mon_timer);
1829         del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
1830         del_timer_sync(&sdata->u.mgd.timer);
1831         del_timer_sync(&sdata->u.mgd.chswitch_timer);
1832 
1833         sdata->u.mgd.timers_running = 0;
1834 
1835         sdata->vif.bss_conf.dtim_period = 0;
1836 
1837         ifmgd->flags = 0;
1838         ieee80211_vif_release_channel(sdata);
1839 }
1840 
1841 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
1842                              struct ieee80211_hdr *hdr)
1843 {
1844         /*
1845          * We can postpone the mgd.timer whenever receiving unicast frames
1846          * from AP because we know that the connection is working both ways
1847          * at that time. But multicast frames (and hence also beacons) must
1848          * be ignored here, because we need to trigger the timer during
1849          * data idle periods for sending the periodic probe request to the
1850          * AP we're connected to.
1851          */
1852         if (is_multicast_ether_addr(hdr->addr1))
1853                 return;
1854 
1855         ieee80211_sta_reset_conn_monitor(sdata);
1856 }
1857 
1858 static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
1859 {
1860         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1861         struct ieee80211_local *local = sdata->local;
1862 
1863         mutex_lock(&local->mtx);
1864         if (!(ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
1865                               IEEE80211_STA_CONNECTION_POLL))) {
1866                 mutex_unlock(&local->mtx);
1867                 return;
1868         }
1869 
1870         __ieee80211_stop_poll(sdata);
1871 
1872         mutex_lock(&local->iflist_mtx);
1873         ieee80211_recalc_ps(local, -1);
1874         mutex_unlock(&local->iflist_mtx);
1875 
1876         if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
1877                 goto out;
1878 
1879         /*
1880          * We've received a probe response, but are not sure whether
1881          * we have or will be receiving any beacons or data, so let's
1882          * schedule the timers again, just in case.
1883          */
1884         ieee80211_sta_reset_beacon_monitor(sdata);
1885 
1886         mod_timer(&ifmgd->conn_mon_timer,
1887                   round_jiffies_up(jiffies +
1888                                    IEEE80211_CONNECTION_IDLE_TIME));
1889 out:
1890         mutex_unlock(&local->mtx);
1891 }
1892 
1893 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
1894                              struct ieee80211_hdr *hdr, bool ack)
1895 {
1896         if (!ieee80211_is_data(hdr->frame_control))
1897             return;
1898 
1899         if (ieee80211_is_nullfunc(hdr->frame_control) &&
1900             sdata->u.mgd.probe_send_count > 0) {
1901                 if (ack)
1902                         ieee80211_sta_reset_conn_monitor(sdata);
1903                 else
1904                         sdata->u.mgd.nullfunc_failed = true;
1905                 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
1906                 return;
1907         }
1908 
1909         if (ack)
1910                 ieee80211_sta_reset_conn_monitor(sdata);
1911 }
1912 
1913 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
1914 {
1915         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1916         const u8 *ssid;
1917         u8 *dst = ifmgd->associated->bssid;
1918         u8 unicast_limit = max(1, max_probe_tries - 3);
1919 
1920         /*
1921          * Try sending broadcast probe requests for the last three
1922          * probe requests after the first ones failed since some
1923          * buggy APs only support broadcast probe requests.
1924          */
1925         if (ifmgd->probe_send_count >= unicast_limit)
1926                 dst = NULL;
1927 
1928         /*
1929          * When the hardware reports an accurate Tx ACK status, it's
1930          * better to send a nullfunc frame instead of a probe request,
1931          * as it will kick us off the AP quickly if we aren't associated
1932          * anymore. The timeout will be reset if the frame is ACKed by
1933          * the AP.
1934          */
1935         ifmgd->probe_send_count++;
1936 
1937         if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
1938                 ifmgd->nullfunc_failed = false;
1939                 ieee80211_send_nullfunc(sdata->local, sdata, 0);
1940         } else {
1941                 int ssid_len;
1942 
1943                 rcu_read_lock();
1944                 ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
1945                 if (WARN_ON_ONCE(ssid == NULL))
1946                         ssid_len = 0;
1947                 else
1948                         ssid_len = ssid[1];
1949 
1950                 ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid_len, NULL,
1951                                          0, (u32) -1, true, 0,
1952                                          ifmgd->associated->channel, false);
1953                 rcu_read_unlock();
1954         }
1955 
1956         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
1957         run_again(ifmgd, ifmgd->probe_timeout);
1958         if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
1959                 drv_flush(sdata->local, false);
1960 }
1961 
1962 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
1963                                    bool beacon)
1964 {
1965         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1966         bool already = false;
1967 
1968         if (!ieee80211_sdata_running(sdata))
1969                 return;
1970 
1971         mutex_lock(&ifmgd->mtx);
1972 
1973         if (!ifmgd->associated)
1974                 goto out;
1975 
1976         mutex_lock(&sdata->local->mtx);
1977 
1978         if (sdata->local->tmp_channel || sdata->local->scanning) {
1979                 mutex_unlock(&sdata->local->mtx);
1980                 goto out;
1981         }
1982 
1983         if (beacon)
1984                 mlme_dbg_ratelimited(sdata,
1985                                      "detected beacon loss from AP - probing\n");
1986 
1987         ieee80211_cqm_rssi_notify(&sdata->vif,
1988                 NL80211_CQM_RSSI_BEACON_LOSS_EVENT, GFP_KERNEL);
1989 
1990         /*
1991          * The driver/our work has already reported this event or the
1992          * connection monitoring has kicked in and we have already sent
1993          * a probe request. Or maybe the AP died and the driver keeps
1994          * reporting until we disassociate...
1995          *
1996          * In either case we have to ignore the current call to this
1997          * function (except for setting the correct probe reason bit)
1998          * because otherwise we would reset the timer every time and
1999          * never check whether we received a probe response!
2000          */
2001         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
2002                             IEEE80211_STA_CONNECTION_POLL))
2003                 already = true;
2004 
2005         if (beacon)
2006                 ifmgd->flags |= IEEE80211_STA_BEACON_POLL;
2007         else
2008                 ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
2009 
2010         mutex_unlock(&sdata->local->mtx);
2011 
2012         if (already)
2013                 goto out;
2014 
2015         mutex_lock(&sdata->local->iflist_mtx);
2016         ieee80211_recalc_ps(sdata->local, -1);
2017         mutex_unlock(&sdata->local->iflist_mtx);
2018 
2019         ifmgd->probe_send_count = 0;
2020         ieee80211_mgd_probe_ap_send(sdata);
2021  out:
2022         mutex_unlock(&ifmgd->mtx);
2023 }
2024 
2025 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
2026                                           struct ieee80211_vif *vif)
2027 {
2028         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2029         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2030         struct cfg80211_bss *cbss;
2031         struct sk_buff *skb;
2032         const u8 *ssid;
2033         int ssid_len;
2034 
2035         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
2036                 return NULL;
2037 
2038         ASSERT_MGD_MTX(ifmgd);
2039 
2040         if (ifmgd->associated)
2041                 cbss = ifmgd->associated;
2042         else if (ifmgd->auth_data)
2043                 cbss = ifmgd->auth_data->bss;
2044         else if (ifmgd->assoc_data)
2045                 cbss = ifmgd->assoc_data->bss;
2046         else
2047                 return NULL;
2048 
2049         rcu_read_lock();
2050         ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2051         if (WARN_ON_ONCE(ssid == NULL))
2052                 ssid_len = 0;
2053         else
2054                 ssid_len = ssid[1];
2055 
2056         skb = ieee80211_build_probe_req(sdata, cbss->bssid,
2057                                         (u32) -1, cbss->channel,
2058                                         ssid + 2, ssid_len,
2059                                         NULL, 0, true);
2060         rcu_read_unlock();
2061 
2062         return skb;
2063 }
2064 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
2065 
2066 static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2067 {
2068         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2069         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2070 
2071         mutex_lock(&ifmgd->mtx);
2072         if (!ifmgd->associated) {
2073                 mutex_unlock(&ifmgd->mtx);
2074                 return;
2075         }
2076 
2077         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
2078                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2079                                true, frame_buf);
2080         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
2081         ieee80211_wake_queues_by_reason(&sdata->local->hw,
2082                                         IEEE80211_QUEUE_STOP_REASON_CSA);
2083         mutex_unlock(&ifmgd->mtx);
2084 
2085         /*
2086          * must be outside lock due to cfg80211,
2087          * but that's not a problem.
2088          */
2089         cfg80211_send_deauth(sdata->dev, frame_buf, IEEE80211_DEAUTH_FRAME_LEN);
2090 }
2091 
2092 static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
2093 {
2094         struct ieee80211_sub_if_data *sdata =
2095                 container_of(work, struct ieee80211_sub_if_data,
2096                              u.mgd.beacon_connection_loss_work);
2097         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2098         struct sta_info *sta;
2099 
2100         if (ifmgd->associated) {
2101                 rcu_read_lock();
2102                 sta = sta_info_get(sdata, ifmgd->bssid);
2103                 if (sta)
2104                         sta->beacon_loss_count++;
2105                 rcu_read_unlock();
2106         }
2107 
2108         if (ifmgd->connection_loss) {
2109                 sdata_info(sdata, "Connection to AP %pM lost\n",
2110                            ifmgd->bssid);
2111                 __ieee80211_disconnect(sdata);
2112         } else {
2113                 ieee80211_mgd_probe_ap(sdata, true);
2114         }
2115 }
2116 
2117 static void ieee80211_csa_connection_drop_work(struct work_struct *work)
2118 {
2119         struct ieee80211_sub_if_data *sdata =
2120                 container_of(work, struct ieee80211_sub_if_data,
2121                              u.mgd.csa_connection_drop_work);
2122 
2123         __ieee80211_disconnect(sdata);
2124 }
2125 
2126 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
2127 {
2128         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2129         struct ieee80211_hw *hw = &sdata->local->hw;
2130 
2131         trace_api_beacon_loss(sdata);
2132 
2133         WARN_ON(hw->flags & IEEE80211_HW_CONNECTION_MONITOR);
2134         sdata->u.mgd.connection_loss = false;
2135         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2136 }
2137 EXPORT_SYMBOL(ieee80211_beacon_loss);
2138 
2139 void ieee80211_connection_loss(struct ieee80211_vif *vif)
2140 {
2141         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2142         struct ieee80211_hw *hw = &sdata->local->hw;
2143 
2144         trace_api_connection_loss(sdata);
2145 
2146         sdata->u.mgd.connection_loss = true;
2147         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2148 }
2149 EXPORT_SYMBOL(ieee80211_connection_loss);
2150 
2151 
2152 static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
2153                                         bool assoc)
2154 {
2155         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
2156 
2157         lockdep_assert_held(&sdata->u.mgd.mtx);
2158 
2159         if (!assoc) {
2160                 sta_info_destroy_addr(sdata, auth_data->bss->bssid);
2161 
2162                 memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
2163                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2164                 sdata->u.mgd.flags = 0;
2165                 ieee80211_vif_release_channel(sdata);
2166         }
2167 
2168         cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
2169         kfree(auth_data);
2170         sdata->u.mgd.auth_data = NULL;
2171 }
2172 
2173 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
2174                                      struct ieee80211_mgmt *mgmt, size_t len)
2175 {
2176         struct ieee80211_local *local = sdata->local;
2177         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
2178         u8 *pos;
2179         struct ieee802_11_elems elems;
2180         u32 tx_flags = 0;
2181 
2182         pos = mgmt->u.auth.variable;
2183         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
2184         if (!elems.challenge)
2185                 return;
2186         auth_data->expected_transaction = 4;
2187         drv_mgd_prepare_tx(sdata->local, sdata);
2188         if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
2189                 tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
2190                            IEEE80211_TX_INTFL_MLME_CONN_TX;
2191         ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
2192                             elems.challenge - 2, elems.challenge_len + 2,
2193                             auth_data->bss->bssid, auth_data->bss->bssid,
2194                             auth_data->key, auth_data->key_len,
2195                             auth_data->key_idx, tx_flags);
2196 }
2197 
2198 static enum rx_mgmt_action __must_check
2199 ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
2200                        struct ieee80211_mgmt *mgmt, size_t len)
2201 {
2202         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2203         u8 bssid[ETH_ALEN];
2204         u16 auth_alg, auth_transaction, status_code;
2205         struct sta_info *sta;
2206 
2207         lockdep_assert_held(&ifmgd->mtx);
2208 
2209         if (len < 24 + 6)
2210                 return RX_MGMT_NONE;
2211 
2212         if (!ifmgd->auth_data || ifmgd->auth_data->done)
2213                 return RX_MGMT_NONE;
2214 
2215         memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
2216 
2217         if (!ether_addr_equal(bssid, mgmt->bssid))
2218                 return RX_MGMT_NONE;
2219 
2220         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
2221         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
2222         status_code = le16_to_cpu(mgmt->u.auth.status_code);
2223 
2224         if (auth_alg != ifmgd->auth_data->algorithm ||
2225             auth_transaction != ifmgd->auth_data->expected_transaction) {
2226                 sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
2227                            mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
2228                            auth_transaction,
2229                            ifmgd->auth_data->expected_transaction);
2230                 return RX_MGMT_NONE;
2231         }
2232 
2233         if (status_code != WLAN_STATUS_SUCCESS) {
2234                 sdata_info(sdata, "%pM denied authentication (status %d)\n",
2235                            mgmt->sa, status_code);
2236                 ieee80211_destroy_auth_data(sdata, false);
2237                 return RX_MGMT_CFG80211_RX_AUTH;
2238         }
2239 
2240         switch (ifmgd->auth_data->algorithm) {
2241         case WLAN_AUTH_OPEN:
2242         case WLAN_AUTH_LEAP:
2243         case WLAN_AUTH_FT:
2244         case WLAN_AUTH_SAE:
2245                 break;
2246         case WLAN_AUTH_SHARED_KEY:
2247                 if (ifmgd->auth_data->expected_transaction != 4) {
2248                         ieee80211_auth_challenge(sdata, mgmt, len);
2249                         /* need another frame */
2250                         return RX_MGMT_NONE;
2251                 }
2252                 break;
2253         default:
2254                 WARN_ONCE(1, "invalid auth alg %d",
2255                           ifmgd->auth_data->algorithm);
2256                 return RX_MGMT_NONE;
2257         }
2258 
2259         sdata_info(sdata, "authenticated\n");
2260         ifmgd->auth_data->done = true;
2261         ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
2262         ifmgd->auth_data->timeout_started = true;
2263         run_again(ifmgd, ifmgd->auth_data->timeout);
2264 
2265         if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
2266             ifmgd->auth_data->expected_transaction != 2) {
2267                 /*
2268                  * Report auth frame to user space for processing since another
2269                  * round of Authentication frames is still needed.
2270                  */
2271                 return RX_MGMT_CFG80211_RX_AUTH;
2272         }
2273 
2274         /* move station state to auth */
2275         mutex_lock(&sdata->local->sta_mtx);
2276         sta = sta_info_get(sdata, bssid);
2277         if (!sta) {
2278                 WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
2279                 goto out_err;
2280         }
2281         if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
2282                 sdata_info(sdata, "failed moving %pM to auth\n", bssid);
2283                 goto out_err;
2284         }
2285         mutex_unlock(&sdata->local->sta_mtx);
2286 
2287         return RX_MGMT_CFG80211_RX_AUTH;
2288  out_err:
2289         mutex_unlock(&sdata->local->sta_mtx);
2290         /* ignore frame -- wait for timeout */
2291         return RX_MGMT_NONE;
2292 }
2293 
2294 
2295 static enum rx_mgmt_action __must_check
2296 ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
2297                          struct ieee80211_mgmt *mgmt, size_t len)
2298 {
2299         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2300         const u8 *bssid = NULL;
2301         u16 reason_code;
2302 
2303         lockdep_assert_held(&ifmgd->mtx);
2304 
2305         if (len < 24 + 2)
2306                 return RX_MGMT_NONE;
2307 
2308         if (!ifmgd->associated ||
2309             !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2310                 return RX_MGMT_NONE;
2311 
2312         bssid = ifmgd->associated->bssid;
2313 
2314         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
2315 
2316         sdata_info(sdata, "deauthenticated from %pM (Reason: %u)\n",
2317                    bssid, reason_code);
2318 
2319         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2320 
2321         return RX_MGMT_CFG80211_DEAUTH;
2322 }
2323 
2324 
2325 static enum rx_mgmt_action __must_check
2326 ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
2327                            struct ieee80211_mgmt *mgmt, size_t len)
2328 {
2329         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2330         u16 reason_code;
2331 
2332         lockdep_assert_held(&ifmgd->mtx);
2333 
2334         if (len < 24 + 2)
2335                 return RX_MGMT_NONE;
2336 
2337         if (!ifmgd->associated ||
2338             !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2339                 return RX_MGMT_NONE;
2340 
2341         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
2342 
2343         sdata_info(sdata, "disassociated from %pM (Reason: %u)\n",
2344                    mgmt->sa, reason_code);
2345 
2346         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2347 
2348         return RX_MGMT_CFG80211_DISASSOC;
2349 }
2350 
2351 static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
2352                                 u8 *supp_rates, unsigned int supp_rates_len,
2353                                 u32 *rates, u32 *basic_rates,
2354                                 bool *have_higher_than_11mbit,
2355                                 int *min_rate, int *min_rate_index)
2356 {
2357         int i, j;
2358 
2359         for (i = 0; i < supp_rates_len; i++) {
2360                 int rate = (supp_rates[i] & 0x7f) * 5;
2361                 bool is_basic = !!(supp_rates[i] & 0x80);
2362 
2363                 if (rate > 110)
2364                         *have_higher_than_11mbit = true;
2365 
2366                 /*
2367                  * BSS_MEMBERSHIP_SELECTOR_HT_PHY is defined in 802.11n-2009
2368                  * 7.3.2.2 as a magic value instead of a rate. Hence, skip it.
2369                  *
2370                  * Note: Even through the membership selector and the basic
2371                  *       rate flag share the same bit, they are not exactly
2372                  *       the same.
2373                  */
2374                 if (!!(supp_rates[i] & 0x80) &&
2375                     (supp_rates[i] & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
2376                         continue;
2377 
2378                 for (j = 0; j < sband->n_bitrates; j++) {
2379                         if (sband->bitrates[j].bitrate == rate) {
2380                                 *rates |= BIT(j);
2381                                 if (is_basic)
2382                                         *basic_rates |= BIT(j);
2383                                 if (rate < *min_rate) {
2384                                         *min_rate = rate;
2385                                         *min_rate_index = j;
2386                                 }
2387                                 break;
2388                         }
2389                 }
2390         }
2391 }
2392 
2393 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
2394                                          bool assoc)
2395 {
2396         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
2397 
2398         lockdep_assert_held(&sdata->u.mgd.mtx);
2399 
2400         if (!assoc) {
2401                 sta_info_destroy_addr(sdata, assoc_data->bss->bssid);
2402 
2403                 memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
2404                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2405                 sdata->u.mgd.flags = 0;
2406                 ieee80211_vif_release_channel(sdata);
2407         }
2408 
2409         kfree(assoc_data);
2410         sdata->u.mgd.assoc_data = NULL;
2411 }
2412 
2413 static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
2414                                     struct cfg80211_bss *cbss,
2415                                     struct ieee80211_mgmt *mgmt, size_t len)
2416 {
2417         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2418         struct ieee80211_local *local = sdata->local;
2419         struct ieee80211_supported_band *sband;
2420         struct sta_info *sta;
2421         u8 *pos;
2422         u16 capab_info, aid;
2423         struct ieee802_11_elems elems;
2424         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2425         const struct cfg80211_bss_ies *bss_ies = NULL;
2426         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
2427         u32 changed = 0;
2428         int err;
2429         bool ret;
2430 
2431         /* AssocResp and ReassocResp have identical structure */
2432 
2433         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
2434         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2435 
2436         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
2437                 sdata_info(sdata, "invalid AID value 0x%x; bits 15:14 not set\n",
2438                            aid);
2439         aid &= ~(BIT(15) | BIT(14));
2440 
2441         ifmgd->broken_ap = false;
2442 
2443         if (aid == 0 || aid > IEEE80211_MAX_AID) {
2444                 sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
2445                            aid);
2446                 aid = 0;
2447                 ifmgd->broken_ap = true;
2448         }
2449 
2450         pos = mgmt->u.assoc_resp.variable;
2451         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
2452 
2453         if (!elems.supp_rates) {
2454                 sdata_info(sdata, "no SuppRates element in AssocResp\n");
2455                 return false;
2456         }
2457 
2458         ifmgd->aid = aid;
2459 
2460         /*
2461          * Some APs are erroneously not including some information in their
2462          * (re)association response frames. Try to recover by using the data
2463          * from the beacon or probe response. This seems to afflict mobile
2464          * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
2465          * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
2466          */
2467         if ((assoc_data->wmm && !elems.wmm_param) ||
2468             (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
2469              (!elems.ht_cap_elem || !elems.ht_operation)) ||
2470             (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
2471              (!elems.vht_cap_elem || !elems.vht_operation))) {
2472                 const struct cfg80211_bss_ies *ies;
2473                 struct ieee802_11_elems bss_elems;
2474 
2475                 rcu_read_lock();
2476                 ies = rcu_dereference(cbss->ies);
2477                 if (ies)
2478                         bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
2479                                           GFP_ATOMIC);
2480                 rcu_read_unlock();
2481                 if (!bss_ies)
2482                         return false;
2483 
2484                 ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
2485                                        &bss_elems);
2486                 if (assoc_data->wmm &&
2487                     !elems.wmm_param && bss_elems.wmm_param) {
2488                         elems.wmm_param = bss_elems.wmm_param;
2489                         sdata_info(sdata,
2490                                    "AP bug: WMM param missing from AssocResp\n");
2491                 }
2492 
2493                 /*
2494                  * Also check if we requested HT/VHT, otherwise the AP doesn't
2495                  * have to include the IEs in the (re)association response.
2496                  */
2497                 if (!elems.ht_cap_elem && bss_elems.ht_cap_elem &&
2498                     !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
2499                         elems.ht_cap_elem = bss_elems.ht_cap_elem;
2500                         sdata_info(sdata,
2501                                    "AP bug: HT capability missing from AssocResp\n");
2502                 }
2503                 if (!elems.ht_operation && bss_elems.ht_operation &&
2504                     !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
2505                         elems.ht_operation = bss_elems.ht_operation;
2506                         sdata_info(sdata,
2507                                    "AP bug: HT operation missing from AssocResp\n");
2508                 }
2509                 if (!elems.vht_cap_elem && bss_elems.vht_cap_elem &&
2510                     !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
2511                         elems.vht_cap_elem = bss_elems.vht_cap_elem;
2512                         sdata_info(sdata,
2513                                    "AP bug: VHT capa missing from AssocResp\n");
2514                 }
2515                 if (!elems.vht_operation && bss_elems.vht_operation &&
2516                     !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
2517                         elems.vht_operation = bss_elems.vht_operation;
2518                         sdata_info(sdata,
2519                                    "AP bug: VHT operation missing from AssocResp\n");
2520                 }
2521         }
2522 
2523         /*
2524          * We previously checked these in the beacon/probe response, so
2525          * they should be present here. This is just a safety net.
2526          */
2527         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
2528             (!elems.wmm_param || !elems.ht_cap_elem || !elems.ht_operation)) {
2529                 sdata_info(sdata,
2530                            "HT AP is missing WMM params or HT capability/operation\n");
2531                 ret = false;
2532                 goto out;
2533         }
2534 
2535         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
2536             (!elems.vht_cap_elem || !elems.vht_operation)) {
2537                 sdata_info(sdata,
2538                            "VHT AP is missing VHT capability/operation\n");
2539                 ret = false;
2540                 goto out;
2541         }
2542 
2543         mutex_lock(&sdata->local->sta_mtx);
2544         /*
2545          * station info was already allocated and inserted before
2546          * the association and should be available to us
2547          */
2548         sta = sta_info_get(sdata, cbss->bssid);
2549         if (WARN_ON(!sta)) {
2550                 mutex_unlock(&sdata->local->sta_mtx);
2551                 ret = false;
2552                 goto out;
2553         }
2554 
2555         sband = local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
2556 
2557         /* Set up internal HT/VHT capabilities */
2558         if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
2559                 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
2560                                                   elems.ht_cap_elem, sta);
2561 
2562         if (elems.vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
2563                 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
2564                                                     elems.vht_cap_elem, sta);
2565 
2566         /*
2567          * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
2568          * in their association response, so ignore that data for our own
2569          * configuration. If it changed since the last beacon, we'll get the
2570          * next beacon and update then.
2571          */
2572 
2573         /*
2574          * If an operating mode notification IE is present, override the
2575          * NSS calculation (that would be done in rate_control_rate_init())
2576          * and use the # of streams from that element.
2577          */
2578         if (elems.opmode_notif &&
2579             !(*elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
2580                 u8 nss;
2581 
2582                 nss = *elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
2583                 nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
2584                 nss += 1;
2585                 sta->sta.rx_nss = nss;
2586         }
2587 
2588         rate_control_rate_init(sta);
2589 
2590         if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED)
2591                 set_sta_flag(sta, WLAN_STA_MFP);
2592 
2593         if (elems.wmm_param)
2594                 set_sta_flag(sta, WLAN_STA_WME);
2595 
2596         err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
2597         if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
2598                 err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
2599         if (err) {
2600                 sdata_info(sdata,
2601                            "failed to move station %pM to desired state\n",
2602                            sta->sta.addr);
2603                 WARN_ON(__sta_info_destroy(sta));
2604                 mutex_unlock(&sdata->local->sta_mtx);
2605                 ret = false;
2606                 goto out;
2607         }
2608 
2609         mutex_unlock(&sdata->local->sta_mtx);
2610 
2611         /*
2612          * Always handle WMM once after association regardless
2613          * of the first value the AP uses. Setting -1 here has
2614          * that effect because the AP values is an unsigned
2615          * 4-bit value.
2616          */
2617         ifmgd->wmm_last_param_set = -1;
2618 
2619         if (elems.wmm_param)
2620                 ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
2621                                          elems.wmm_param_len);
2622         else
2623                 ieee80211_set_wmm_default(sdata, false);
2624         changed |= BSS_CHANGED_QOS;
2625 
2626         /* set AID and assoc capability,
2627          * ieee80211_set_associated() will tell the driver */
2628         bss_conf->aid = aid;
2629         bss_conf->assoc_capability = capab_info;
2630         ieee80211_set_associated(sdata, cbss, changed);
2631 
2632         /*
2633          * If we're using 4-addr mode, let the AP know that we're
2634          * doing so, so that it can create the STA VLAN on its side
2635          */
2636         if (ifmgd->use_4addr)
2637                 ieee80211_send_4addr_nullfunc(local, sdata);
2638 
2639         /*
2640          * Start timer to probe the connection to the AP now.
2641          * Also start the timer that will detect beacon loss.
2642          */
2643         ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
2644         ieee80211_sta_reset_beacon_monitor(sdata);
2645 
2646         ret = true;
2647  out:
2648         kfree(bss_ies);
2649         return ret;
2650 }
2651 
2652 static enum rx_mgmt_action __must_check
2653 ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
2654                              struct ieee80211_mgmt *mgmt, size_t len,
2655                              struct cfg80211_bss **bss)
2656 {
2657         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2658         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
2659         u16 capab_info, status_code, aid;
2660         struct ieee802_11_elems elems;
2661         u8 *pos;
2662         bool reassoc;
2663 
2664         lockdep_assert_held(&ifmgd->mtx);
2665 
2666         if (!assoc_data)
2667                 return RX_MGMT_NONE;
2668         if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
2669                 return RX_MGMT_NONE;
2670 
2671         /*
2672          * AssocResp and ReassocResp have identical structure, so process both
2673          * of them in this function.
2674          */
2675 
2676         if (len < 24 + 6)
2677                 return RX_MGMT_NONE;
2678 
2679         reassoc = ieee80211_is_reassoc_req(mgmt->frame_control);
2680         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2681         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
2682         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
2683 
2684         sdata_info(sdata,
2685                    "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
2686                    reassoc ? "Rea" : "A", mgmt->sa,
2687                    capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
2688 
2689         pos = mgmt->u.assoc_resp.variable;
2690         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
2691 
2692         if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
2693             elems.timeout_int && elems.timeout_int_len == 5 &&
2694             elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) {
2695                 u32 tu, ms;
2696                 tu = get_unaligned_le32(elems.timeout_int + 1);
2697                 ms = tu * 1024 / 1000;
2698                 sdata_info(sdata,
2699                            "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
2700                            mgmt->sa, tu, ms);
2701                 assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
2702                 assoc_data->timeout_started = true;
2703                 if (ms > IEEE80211_ASSOC_TIMEOUT)
2704                         run_again(ifmgd, assoc_data->timeout);
2705                 return RX_MGMT_NONE;
2706         }
2707 
2708         *bss = assoc_data->bss;
2709 
2710         if (status_code != WLAN_STATUS_SUCCESS) {
2711                 sdata_info(sdata, "%pM denied association (code=%d)\n",
2712                            mgmt->sa, status_code);
2713                 ieee80211_destroy_assoc_data(sdata, false);
2714         } else {
2715                 if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
2716                         /* oops -- internal error -- send timeout for now */
2717                         ieee80211_destroy_assoc_data(sdata, false);
2718                         cfg80211_put_bss(sdata->local->hw.wiphy, *bss);
2719                         return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
2720                 }
2721                 sdata_info(sdata, "associated\n");
2722 
2723                 /*
2724                  * destroy assoc_data afterwards, as otherwise an idle
2725                  * recalc after assoc_data is NULL but before associated
2726                  * is set can cause the interface to go idle
2727                  */
2728                 ieee80211_destroy_assoc_data(sdata, true);
2729         }
2730 
2731         return RX_MGMT_CFG80211_RX_ASSOC;
2732 }
2733 
2734 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
2735                                   struct ieee80211_mgmt *mgmt, size_t len,
2736                                   struct ieee80211_rx_status *rx_status,
2737                                   struct ieee802_11_elems *elems)
2738 {
2739         struct ieee80211_local *local = sdata->local;
2740         int freq;
2741         struct ieee80211_bss *bss;
2742         struct ieee80211_channel *channel;
2743         bool need_ps = false;
2744 
2745         if ((sdata->u.mgd.associated &&
2746              ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) ||
2747             (sdata->u.mgd.assoc_data &&
2748              ether_addr_equal(mgmt->bssid,
2749                               sdata->u.mgd.assoc_data->bss->bssid))) {
2750                 /* not previously set so we may need to recalc */
2751                 need_ps = sdata->u.mgd.associated && !sdata->u.mgd.dtim_period;
2752 
2753                 if (elems->tim && !elems->parse_error) {
2754                         const struct ieee80211_tim_ie *tim_ie = elems->tim;
2755                         sdata->u.mgd.dtim_period = tim_ie->dtim_period;
2756                 }
2757         }
2758 
2759         if (elems->ds_params && elems->ds_params_len == 1)
2760                 freq = ieee80211_channel_to_frequency(elems->ds_params[0],
2761                                                       rx_status->band);
2762         else
2763                 freq = rx_status->freq;
2764 
2765         channel = ieee80211_get_channel(local->hw.wiphy, freq);
2766 
2767         if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
2768                 return;
2769 
2770         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
2771                                         channel);
2772         if (bss)
2773                 ieee80211_rx_bss_put(local, bss);
2774 
2775         if (!sdata->u.mgd.associated)
2776                 return;
2777 
2778         if (need_ps) {
2779                 mutex_lock(&local->iflist_mtx);
2780                 ieee80211_recalc_ps(local, -1);
2781                 mutex_unlock(&local->iflist_mtx);
2782         }
2783 
2784         if (elems->ch_switch_ie &&
2785             memcmp(mgmt->bssid, sdata->u.mgd.associated->bssid, ETH_ALEN) == 0)
2786                 ieee80211_sta_process_chanswitch(sdata, elems->ch_switch_ie,
2787                                                  bss, rx_status->mactime);
2788 }
2789 
2790 
2791 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
2792                                          struct sk_buff *skb)
2793 {
2794         struct ieee80211_mgmt *mgmt = (void *)skb->data;
2795         struct ieee80211_if_managed *ifmgd;
2796         struct ieee80211_rx_status *rx_status = (void *) skb->cb;
2797         size_t baselen, len = skb->len;
2798         struct ieee802_11_elems elems;
2799 
2800         ifmgd = &sdata->u.mgd;
2801 
2802         ASSERT_MGD_MTX(ifmgd);
2803 
2804         if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
2805                 return; /* ignore ProbeResp to foreign address */
2806 
2807         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
2808         if (baselen > len)
2809                 return;
2810 
2811         ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
2812                                 &elems);
2813 
2814         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
2815 
2816         if (ifmgd->associated &&
2817             ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2818                 ieee80211_reset_ap_probe(sdata);
2819 
2820         if (ifmgd->auth_data && !ifmgd->auth_data->bss->proberesp_ies &&
2821             ether_addr_equal(mgmt->bssid, ifmgd->auth_data->bss->bssid)) {
2822                 /* got probe response, continue with auth */
2823                 sdata_info(sdata, "direct probe responded\n");
2824                 ifmgd->auth_data->tries = 0;
2825                 ifmgd->auth_data->timeout = jiffies;
2826                 ifmgd->auth_data->timeout_started = true;
2827                 run_again(ifmgd, ifmgd->auth_data->timeout);
2828         }
2829 }
2830 
2831 /*
2832  * This is the canonical list of information elements we care about,
2833  * the filter code also gives us all changes to the Microsoft OUI
2834  * (00:50:F2) vendor IE which is used for WMM which we need to track.
2835  *
2836  * We implement beacon filtering in software since that means we can
2837  * avoid processing the frame here and in cfg80211, and userspace
2838  * will not be able to tell whether the hardware supports it or not.
2839  *
2840  * XXX: This list needs to be dynamic -- userspace needs to be able to
2841  *      add items it requires. It also needs to be able to tell us to
2842  *      look out for other vendor IEs.
2843  */
2844 static const u64 care_about_ies =
2845         (1ULL << WLAN_EID_COUNTRY) |
2846         (1ULL << WLAN_EID_ERP_INFO) |
2847         (1ULL << WLAN_EID_CHANNEL_SWITCH) |
2848         (1ULL << WLAN_EID_PWR_CONSTRAINT) |
2849         (1ULL << WLAN_EID_HT_CAPABILITY) |
2850         (1ULL << WLAN_EID_HT_OPERATION);
2851 
2852 static enum rx_mgmt_action
2853 ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
2854                          struct ieee80211_mgmt *mgmt, size_t len,
2855                          u8 *deauth_buf, struct ieee80211_rx_status *rx_status)
2856 {
2857         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2858         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2859         size_t baselen;
2860         struct ieee802_11_elems elems;
2861         struct ieee80211_local *local = sdata->local;
2862         struct ieee80211_chanctx_conf *chanctx_conf;
2863         struct ieee80211_channel *chan;
2864         struct sta_info *sta;
2865         u32 changed = 0;
2866         bool erp_valid;
2867         u8 erp_value = 0;
2868         u32 ncrc;
2869         u8 *bssid;
2870 
2871         lockdep_assert_held(&ifmgd->mtx);
2872 
2873         /* Process beacon from the current BSS */
2874         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
2875         if (baselen > len)
2876                 return RX_MGMT_NONE;
2877 
2878         rcu_read_lock();
2879         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2880         if (!chanctx_conf) {
2881                 rcu_read_unlock();
2882                 return RX_MGMT_NONE;
2883         }
2884 
2885         if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
2886                 rcu_read_unlock();
2887                 return RX_MGMT_NONE;
2888         }
2889         chan = chanctx_conf->def.chan;
2890         rcu_read_unlock();
2891 
2892         if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
2893             ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
2894                 ieee802_11_parse_elems(mgmt->u.beacon.variable,
2895                                        len - baselen, &elems);
2896 
2897                 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
2898                 ifmgd->assoc_data->have_beacon = true;
2899                 ifmgd->assoc_data->need_beacon = false;
2900                 if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
2901                         sdata->vif.bss_conf.sync_tsf =
2902                                 le64_to_cpu(mgmt->u.beacon.timestamp);
2903                         sdata->vif.bss_conf.sync_device_ts =
2904                                 rx_status->device_timestamp;
2905                         if (elems.tim)
2906                                 sdata->vif.bss_conf.sync_dtim_count =
2907                                         elems.tim->dtim_count;
2908                         else
2909                                 sdata->vif.bss_conf.sync_dtim_count = 0;
2910                 }
2911                 /* continue assoc process */
2912                 ifmgd->assoc_data->timeout = jiffies;
2913                 ifmgd->assoc_data->timeout_started = true;
2914                 run_again(ifmgd, ifmgd->assoc_data->timeout);
2915                 return RX_MGMT_NONE;
2916         }
2917 
2918         if (!ifmgd->associated ||
2919             !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2920                 return RX_MGMT_NONE;
2921         bssid = ifmgd->associated->bssid;
2922 
2923         /* Track average RSSI from the Beacon frames of the current AP */
2924         ifmgd->last_beacon_signal = rx_status->signal;
2925         if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
2926                 ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
2927                 ifmgd->ave_beacon_signal = rx_status->signal * 16;
2928                 ifmgd->last_cqm_event_signal = 0;
2929                 ifmgd->count_beacon_signal = 1;
2930                 ifmgd->last_ave_beacon_signal = 0;
2931         } else {
2932                 ifmgd->ave_beacon_signal =
2933                         (IEEE80211_SIGNAL_AVE_WEIGHT * rx_status->signal * 16 +
2934                          (16 - IEEE80211_SIGNAL_AVE_WEIGHT) *
2935                          ifmgd->ave_beacon_signal) / 16;
2936                 ifmgd->count_beacon_signal++;
2937         }
2938 
2939         if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
2940             ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
2941                 int sig = ifmgd->ave_beacon_signal;
2942                 int last_sig = ifmgd->last_ave_beacon_signal;
2943 
2944                 /*
2945                  * if signal crosses either of the boundaries, invoke callback
2946                  * with appropriate parameters
2947                  */
2948                 if (sig > ifmgd->rssi_max_thold &&
2949                     (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
2950                         ifmgd->last_ave_beacon_signal = sig;
2951                         drv_rssi_callback(local, sdata, RSSI_EVENT_HIGH);
2952                 } else if (sig < ifmgd->rssi_min_thold &&
2953                            (last_sig >= ifmgd->rssi_max_thold ||
2954                            last_sig == 0)) {
2955                         ifmgd->last_ave_beacon_signal = sig;
2956                         drv_rssi_callback(local, sdata, RSSI_EVENT_LOW);
2957                 }
2958         }
2959 
2960         if (bss_conf->cqm_rssi_thold &&
2961             ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
2962             !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
2963                 int sig = ifmgd->ave_beacon_signal / 16;
2964                 int last_event = ifmgd->last_cqm_event_signal;
2965                 int thold = bss_conf->cqm_rssi_thold;
2966                 int hyst = bss_conf->cqm_rssi_hyst;
2967                 if (sig < thold &&
2968                     (last_event == 0 || sig < last_event - hyst)) {
2969                         ifmgd->last_cqm_event_signal = sig;
2970                         ieee80211_cqm_rssi_notify(
2971                                 &sdata->vif,
2972                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
2973                                 GFP_KERNEL);
2974                 } else if (sig > thold &&
2975                            (last_event == 0 || sig > last_event + hyst)) {
2976                         ifmgd->last_cqm_event_signal = sig;
2977                         ieee80211_cqm_rssi_notify(
2978                                 &sdata->vif,
2979                                 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
2980                                 GFP_KERNEL);
2981                 }
2982         }
2983 
2984         if (ifmgd->flags & IEEE80211_STA_BEACON_POLL) {
2985                 mlme_dbg_ratelimited(sdata,
2986                                      "cancelling AP probe due to a received beacon\n");
2987                 mutex_lock(&local->mtx);
2988                 ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL;
2989                 ieee80211_run_deferred_scan(local);
2990                 mutex_unlock(&local->mtx);
2991 
2992                 mutex_lock(&local->iflist_mtx);
2993                 ieee80211_recalc_ps(local, -1);
2994                 mutex_unlock(&local->iflist_mtx);
2995         }
2996 
2997         /*
2998          * Push the beacon loss detection into the future since
2999          * we are processing a beacon from the AP just now.
3000          */
3001         ieee80211_sta_reset_beacon_monitor(sdata);
3002 
3003         ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
3004         ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
3005                                           len - baselen, &elems,
3006                                           care_about_ies, ncrc);
3007 
3008         if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
3009                 bool directed_tim = ieee80211_check_tim(elems.tim,
3010                                                         elems.tim_len,
3011                                                         ifmgd->aid);
3012                 if (directed_tim) {
3013                         if (local->hw.conf.dynamic_ps_timeout > 0) {
3014                                 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
3015                                         local->hw.conf.flags &= ~IEEE80211_CONF_PS;
3016                                         ieee80211_hw_config(local,
3017                                                             IEEE80211_CONF_CHANGE_PS);
3018                                 }
3019                                 ieee80211_send_nullfunc(local, sdata, 0);
3020                         } else if (!local->pspolling && sdata->u.mgd.powersave) {
3021                                 local->pspolling = true;
3022 
3023                                 /*
3024                                  * Here is assumed that the driver will be
3025                                  * able to send ps-poll frame and receive a
3026                                  * response even though power save mode is
3027                                  * enabled, but some drivers might require
3028                                  * to disable power save here. This needs
3029                                  * to be investigated.
3030                                  */
3031                                 ieee80211_send_pspoll(local, sdata);
3032                         }
3033                 }
3034         }
3035 
3036         if (sdata->vif.p2p) {
3037                 u8 noa[2];
3038                 int ret;
3039 
3040                 ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
3041                                             len - baselen,
3042                                             IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
3043                                             noa, sizeof(noa));
3044                 if (ret >= 2 && sdata->u.mgd.p2p_noa_index != noa[0]) {
3045                         bss_conf->p2p_oppps = noa[1] & 0x80;
3046                         bss_conf->p2p_ctwindow = noa[1] & 0x7f;
3047                         changed |= BSS_CHANGED_P2P_PS;
3048                         sdata->u.mgd.p2p_noa_index = noa[0];
3049                         /*
3050                          * make sure we update all information, the CRC
3051                          * mechanism doesn't look at P2P attributes.
3052                          */
3053                         ifmgd->beacon_crc_valid = false;
3054                 }
3055         }
3056 
3057         if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
3058                 return RX_MGMT_NONE;
3059         ifmgd->beacon_crc = ncrc;
3060         ifmgd->beacon_crc_valid = true;
3061 
3062         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3063 
3064         if (ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
3065                                      elems.wmm_param_len))
3066                 changed |= BSS_CHANGED_QOS;
3067 
3068         /*
3069          * If we haven't had a beacon before, tell the driver about the
3070          * DTIM period (and beacon timing if desired) now.
3071          */
3072         if (!bss_conf->dtim_period) {
3073                 /* a few bogus AP send dtim_period = 0 or no TIM IE */
3074                 if (elems.tim)
3075                         bss_conf->dtim_period = elems.tim->dtim_period ?: 1;
3076                 else
3077                         bss_conf->dtim_period = 1;
3078 
3079                 if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
3080                         sdata->vif.bss_conf.sync_tsf =
3081                                 le64_to_cpu(mgmt->u.beacon.timestamp);
3082                         sdata->vif.bss_conf.sync_device_ts =
3083                                 rx_status->device_timestamp;
3084                         if (elems.tim)
3085                                 sdata->vif.bss_conf.sync_dtim_count =
3086                                         elems.tim->dtim_count;
3087                         else
3088                                 sdata->vif.bss_conf.sync_dtim_count = 0;
3089                 }
3090 
3091                 changed |= BSS_CHANGED_DTIM_PERIOD;
3092         }
3093 
3094         if (elems.erp_info && elems.erp_info_len >= 1) {
3095                 erp_valid = true;
3096                 erp_value = elems.erp_info[0];
3097         } else {
3098                 erp_valid = false;
3099         }
3100         changed |= ieee80211_handle_bss_capability(sdata,
3101                         le16_to_cpu(mgmt->u.beacon.capab_info),
3102                         erp_valid, erp_value);
3103 
3104         mutex_lock(&local->sta_mtx);
3105         sta = sta_info_get(sdata, bssid);
3106 
3107         if (ieee80211_config_bw(sdata, sta, elems.ht_operation,
3108                                 elems.vht_operation, bssid, &changed)) {
3109                 mutex_unlock(&local->sta_mtx);
3110                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
3111                                        WLAN_REASON_DEAUTH_LEAVING,
3112                                        true, deauth_buf);
3113                 return RX_MGMT_CFG80211_TX_DEAUTH;
3114         }
3115 
3116         if (sta && elems.opmode_notif)
3117                 ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
3118                                             rx_status->band, true);
3119         mutex_unlock(&local->sta_mtx);
3120 
3121         if (elems.country_elem && elems.pwr_constr_elem &&
3122             mgmt->u.probe_resp.capab_info &
3123                                 cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT))
3124                 changed |= ieee80211_handle_pwr_constr(sdata, chan,
3125                                                        elems.country_elem,
3126                                                        elems.country_elem_len,
3127                                                        elems.pwr_constr_elem);
3128 
3129         ieee80211_bss_info_change_notify(sdata, changed);
3130 
3131         return RX_MGMT_NONE;
3132 }
3133 
3134 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
3135                                   struct sk_buff *skb)
3136 {
3137         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3138         struct ieee80211_rx_status *rx_status;
3139         struct ieee80211_mgmt *mgmt;
3140         struct cfg80211_bss *bss = NULL;
3141         enum rx_mgmt_action rma = RX_MGMT_NONE;
3142         u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
3143         u16 fc;
3144 
3145         rx_status = (struct ieee80211_rx_status *) skb->cb;
3146         mgmt = (struct ieee80211_mgmt *) skb->data;
3147         fc = le16_to_cpu(mgmt->frame_control);
3148 
3149         mutex_lock(&ifmgd->mtx);
3150 
3151         switch (fc & IEEE80211_FCTL_STYPE) {
3152         case IEEE80211_STYPE_BEACON:
3153                 rma = ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
3154                                                deauth_buf, rx_status);
3155                 break;
3156         case IEEE80211_STYPE_PROBE_RESP:
3157                 ieee80211_rx_mgmt_probe_resp(sdata, skb);
3158                 break;
3159         case IEEE80211_STYPE_AUTH:
3160                 rma = ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
3161                 break;
3162         case IEEE80211_STYPE_DEAUTH:
3163                 rma = ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
3164                 break;
3165         case IEEE80211_STYPE_DISASSOC:
3166                 rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
3167                 break;
3168         case IEEE80211_STYPE_ASSOC_RESP:
3169         case IEEE80211_STYPE_REASSOC_RESP:
3170                 rma = ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, &bss);
3171                 break;
3172         case IEEE80211_STYPE_ACTION:
3173                 switch (mgmt->u.action.category) {
3174                 case WLAN_CATEGORY_SPECTRUM_MGMT:
3175                         ieee80211_sta_process_chanswitch(sdata,
3176                                         &mgmt->u.action.u.chan_switch.sw_elem,
3177                                         (void *)ifmgd->associated->priv,
3178                                         rx_status->mactime);
3179                         break;
3180                 }
3181         }
3182         mutex_unlock(&ifmgd->mtx);
3183 
3184         switch (rma) {
3185         case RX_MGMT_NONE:
3186                 /* no action */
3187                 break;
3188         case RX_MGMT_CFG80211_DEAUTH:
3189                 cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
3190                 break;
3191         case RX_MGMT_CFG80211_DISASSOC:
3192                 cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
3193                 break;
3194         case RX_MGMT_CFG80211_RX_AUTH:
3195                 cfg80211_send_rx_auth(sdata->dev, (u8 *)mgmt, skb->len);
3196                 break;
3197         case RX_MGMT_CFG80211_RX_ASSOC:
3198                 cfg80211_send_rx_assoc(sdata->dev, bss, (u8 *)mgmt, skb->len);
3199                 break;
3200         case RX_MGMT_CFG80211_ASSOC_TIMEOUT:
3201                 cfg80211_send_assoc_timeout(sdata->dev, mgmt->bssid);
3202                 break;
3203         case RX_MGMT_CFG80211_TX_DEAUTH:
3204                 cfg80211_send_deauth(sdata->dev, deauth_buf,
3205                                      sizeof(deauth_buf));
3206                 break;
3207         default:
3208                 WARN(1, "unexpected: %d", rma);
3209         }
3210 }
3211 
3212 static void ieee80211_sta_timer(unsigned long data)
3213 {
3214         struct ieee80211_sub_if_data *sdata =
3215                 (struct ieee80211_sub_if_data *) data;
3216         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3217         struct ieee80211_local *local = sdata->local;
3218 
3219         if (local->quiescing) {
3220                 set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
3221                 return;
3222         }
3223 
3224         ieee80211_queue_work(&local->hw, &sdata->work);
3225 }
3226 
3227 static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
3228                                           u8 *bssid, u8 reason, bool tx)
3229 {
3230         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3231         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3232 
3233         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
3234                                tx, frame_buf);
3235         mutex_unlock(&ifmgd->mtx);
3236 
3237         /*
3238          * must be outside lock due to cfg80211,
3239          * but that's not a problem.
3240          */
3241         cfg80211_send_deauth(sdata->dev, frame_buf, IEEE80211_DEAUTH_FRAME_LEN);
3242 
3243         mutex_lock(&ifmgd->mtx);
3244 }
3245 
3246 static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
3247 {
3248         struct ieee80211_local *local = sdata->local;
3249         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3250         struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
3251         u32 tx_flags = 0;
3252 
3253         lockdep_assert_held(&ifmgd->mtx);
3254 
3255         if (WARN_ON_ONCE(!auth_data))
3256                 return -EINVAL;
3257 
3258         auth_data->tries++;
3259 
3260         if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
3261                 sdata_info(sdata, "authentication with %pM timed out\n",
3262                            auth_data->bss->bssid);
3263 
3264                 /*
3265                  * Most likely AP is not in the range so remove the
3266                  * bss struct for that AP.
3267                  */
3268                 cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);
3269 
3270                 return -ETIMEDOUT;
3271         }
3272 
3273         drv_mgd_prepare_tx(local, sdata);
3274 
3275         if (auth_data->bss->proberesp_ies) {
3276                 u16 trans = 1;
3277                 u16 status = 0;
3278 
3279                 sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
3280                            auth_data->bss->bssid, auth_data->tries,
3281                            IEEE80211_AUTH_MAX_TRIES);
3282 
3283                 auth_data->expected_transaction = 2;
3284 
3285                 if (auth_data->algorithm == WLAN_AUTH_SAE) {
3286                         trans = auth_data->sae_trans;
3287                         status = auth_data->sae_status;
3288                         auth_data->expected_transaction = trans;
3289                 }
3290 
3291                 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
3292                         tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
3293                                    IEEE80211_TX_INTFL_MLME_CONN_TX;
3294 
3295                 ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
3296                                     auth_data->data, auth_data->data_len,
3297                                     auth_data->bss->bssid,
3298                                     auth_data->bss->bssid, NULL, 0, 0,
3299                                     tx_flags);
3300         } else {
3301                 const u8 *ssidie;
3302 
3303                 sdata_info(sdata, "direct probe to %pM (try %d/%i)\n",
3304                            auth_data->bss->bssid, auth_data->tries,
3305                            IEEE80211_AUTH_MAX_TRIES);
3306 
3307                 rcu_read_lock();
3308                 ssidie = ieee80211_bss_get_ie(auth_data->bss, WLAN_EID_SSID);
3309                 if (!ssidie) {
3310                         rcu_read_unlock();
3311                         return -EINVAL;
3312                 }
3313                 /*
3314                  * Direct probe is sent to broadcast address as some APs
3315                  * will not answer to direct packet in unassociated state.
3316                  */
3317                 ieee80211_send_probe_req(sdata, NULL, ssidie + 2, ssidie[1],
3318                                          NULL, 0, (u32) -1, true, 0,
3319                                          auth_data->bss->channel, false);
3320                 rcu_read_unlock();
3321         }
3322 
3323         if (tx_flags == 0) {
3324                 auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
3325                 ifmgd->auth_data->timeout_started = true;
3326                 run_again(ifmgd, auth_data->timeout);
3327         } else {
3328                 auth_data->timeout_started = false;
3329         }
3330 
3331         return 0;
3332 }
3333 
3334 static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
3335 {
3336         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
3337         struct ieee80211_local *local = sdata->local;
3338 
3339         lockdep_assert_held(&sdata->u.mgd.mtx);
3340 
3341         assoc_data->tries++;
3342         if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
3343                 sdata_info(sdata, "association with %pM timed out\n",
3344                            assoc_data->bss->bssid);
3345 
3346                 /*
3347                  * Most likely AP is not in the range so remove the
3348                  * bss struct for that AP.
3349                  */
3350                 cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);
3351 
3352                 return -ETIMEDOUT;
3353         }
3354 
3355         sdata_info(sdata, "associate with %pM (try %d/%d)\n",
3356                    assoc_data->bss->bssid, assoc_data->tries,
3357                    IEEE80211_ASSOC_MAX_TRIES);
3358         ieee80211_send_assoc(sdata);
3359 
3360         if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
3361                 assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
3362                 assoc_data->timeout_started = true;
3363                 run_again(&sdata->u.mgd, assoc_data->timeout);
3364         } else {
3365                 assoc_data->timeout_started = false;
3366         }
3367 
3368         return 0;
3369 }
3370 
3371 void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
3372                                   __le16 fc, bool acked)
3373 {
3374         struct ieee80211_local *local = sdata->local;
3375 
3376         sdata->u.mgd.status_fc = fc;
3377         sdata->u.mgd.status_acked = acked;
3378         sdata->u.mgd.status_received = true;
3379 
3380         ieee80211_queue_work(&local->hw, &sdata->work);
3381 }
3382 
3383 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
3384 {
3385         struct ieee80211_local *local = sdata->local;
3386         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3387 
3388         mutex_lock(&ifmgd->mtx);
3389 
3390         if (ifmgd->status_received) {
3391                 __le16 fc = ifmgd->status_fc;
3392                 bool status_acked = ifmgd->status_acked;
3393 
3394                 ifmgd->status_received = false;
3395                 if (ifmgd->auth_data &&
3396                     (ieee80211_is_probe_req(fc) || ieee80211_is_auth(fc))) {
3397                         if (status_acked) {
3398                                 ifmgd->auth_data->timeout =
3399                                         jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
3400                                 run_again(ifmgd, ifmgd->auth_data->timeout);
3401                         } else {
3402                                 ifmgd->auth_data->timeout = jiffies - 1;
3403                         }
3404                         ifmgd->auth_data->timeout_started = true;
3405                 } else if (ifmgd->assoc_data &&
3406                            (ieee80211_is_assoc_req(fc) ||
3407                             ieee80211_is_reassoc_req(fc))) {
3408                         if (status_acked) {
3409                                 ifmgd->assoc_data->timeout =
3410                                         jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
3411                                 run_again(ifmgd, ifmgd->assoc_data->timeout);
3412                         } else {
3413                                 ifmgd->assoc_data->timeout = jiffies - 1;
3414                         }
3415                         ifmgd->assoc_data->timeout_started = true;
3416                 }
3417         }
3418 
3419         if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
3420             time_after(jiffies, ifmgd->auth_data->timeout)) {
3421                 if (ifmgd->auth_data->done) {
3422                         /*
3423                          * ok ... we waited for assoc but userspace didn't,
3424                          * so let's just kill the auth data
3425                          */
3426                         ieee80211_destroy_auth_data(sdata, false);
3427                 } else if (ieee80211_probe_auth(sdata)) {
3428                         u8 bssid[ETH_ALEN];
3429 
3430                         memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
3431 
3432                         ieee80211_destroy_auth_data(sdata, false);
3433 
3434                         mutex_unlock(&ifmgd->mtx);
3435                         cfg80211_send_auth_timeout(sdata->dev, bssid);
3436                         mutex_lock(&ifmgd->mtx);
3437                 }
3438         } else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
3439                 run_again(ifmgd, ifmgd->auth_data->timeout);
3440 
3441         if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
3442             time_after(jiffies, ifmgd->assoc_data->timeout)) {
3443                 if ((ifmgd->assoc_data->need_beacon &&
3444                      !ifmgd->assoc_data->have_beacon) ||
3445                     ieee80211_do_assoc(sdata)) {
3446                         u8 bssid[ETH_ALEN];
3447 
3448                         memcpy(bssid, ifmgd->assoc_data->bss->bssid, ETH_ALEN);
3449 
3450                         ieee80211_destroy_assoc_data(sdata, false);
3451 
3452                         mutex_unlock(&ifmgd->mtx);
3453                         cfg80211_send_assoc_timeout(sdata->dev, bssid);
3454                         mutex_lock(&ifmgd->mtx);
3455                 }
3456         } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
3457                 run_again(ifmgd, ifmgd->assoc_data->timeout);
3458 
3459         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
3460                             IEEE80211_STA_CONNECTION_POLL) &&
3461             ifmgd->associated) {
3462                 u8 bssid[ETH_ALEN];
3463                 int max_tries;
3464 
3465                 memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
3466 
3467                 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
3468                         max_tries = max_nullfunc_tries;
3469                 else
3470                         max_tries = max_probe_tries;
3471 
3472                 /* ACK received for nullfunc probing frame */
3473                 if (!ifmgd->probe_send_count)
3474                         ieee80211_reset_ap_probe(sdata);
3475                 else if (ifmgd->nullfunc_failed) {
3476                         if (ifmgd->probe_send_count < max_tries) {
3477                                 mlme_dbg(sdata,
3478                                          "No ack for nullfunc frame to AP %pM, try %d/%i\n",
3479                                          bssid, ifmgd->probe_send_count,
3480                                          max_tries);
3481                                 ieee80211_mgd_probe_ap_send(sdata);
3482                         } else {
3483                                 mlme_dbg(sdata,
3484                                          "No ack for nullfunc frame to AP %pM, disconnecting.\n",
3485                                          bssid);
3486                                 ieee80211_sta_connection_lost(sdata, bssid,
3487                                         WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
3488                                         false);
3489                         }
3490                 } else if (time_is_after_jiffies(ifmgd->probe_timeout))
3491                         run_again(ifmgd, ifmgd->probe_timeout);
3492                 else if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
3493                         mlme_dbg(sdata,
3494                                  "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
3495                                  bssid, probe_wait_ms);
3496                         ieee80211_sta_connection_lost(sdata, bssid,
3497                                 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
3498                 } else if (ifmgd->probe_send_count < max_tries) {
3499                         mlme_dbg(sdata,
3500                                  "No probe response from AP %pM after %dms, try %d/%i\n",
3501                                  bssid, probe_wait_ms,
3502                                  ifmgd->probe_send_count, max_tries);
3503                         ieee80211_mgd_probe_ap_send(sdata);
3504                 } else {
3505                         /*
3506                          * We actually lost the connection ... or did we?
3507                          * Let's make sure!
3508                          */
3509                         wiphy_debug(local->hw.wiphy,
3510                                     "%s: No probe response from AP %pM"
3511                                     " after %dms, disconnecting.\n",
3512                                     sdata->name,
3513                                     bssid, probe_wait_ms);
3514 
3515                         ieee80211_sta_connection_lost(sdata, bssid,
3516                                 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
3517                 }
3518         }
3519 
3520         mutex_unlock(&ifmgd->mtx);
3521 }
3522 
3523 static void ieee80211_sta_bcn_mon_timer(unsigned long data)
3524 {
3525         struct ieee80211_sub_if_data *sdata =
3526                 (struct ieee80211_sub_if_data *) data;
3527         struct ieee80211_local *local = sdata->local;
3528 
3529         if (local->quiescing)
3530                 return;
3531 
3532         sdata->u.mgd.connection_loss = false;
3533         ieee80211_queue_work(&sdata->local->hw,
3534                              &sdata->u.mgd.beacon_connection_loss_work);
3535 }
3536 
3537 static void ieee80211_sta_conn_mon_timer(unsigned long data)
3538 {
3539         struct ieee80211_sub_if_data *sdata =
3540                 (struct ieee80211_sub_if_data *) data;
3541         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3542         struct ieee80211_local *local = sdata->local;
3543 
3544         if (local->quiescing)
3545                 return;
3546 
3547         ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
3548 }
3549 
3550 static void ieee80211_sta_monitor_work(struct work_struct *work)
3551 {
3552         struct ieee80211_sub_if_data *sdata =
3553                 container_of(work, struct ieee80211_sub_if_data,
3554                              u.mgd.monitor_work);
3555 
3556         ieee80211_mgd_probe_ap(sdata, false);
3557 }
3558 
3559 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
3560 {
3561         u32 flags;
3562 
3563         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
3564                 __ieee80211_stop_poll(sdata);
3565 
3566                 /* let's probe the connection once */
3567                 flags = sdata->local->hw.flags;
3568                 if (!(flags & IEEE80211_HW_CONNECTION_MONITOR))
3569                         ieee80211_queue_work(&sdata->local->hw,
3570                                              &sdata->u.mgd.monitor_work);
3571                 /* and do all the other regular work too */
3572                 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3573         }
3574 }
3575 
3576 #ifdef CONFIG_PM
3577 void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
3578 {
3579         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3580 
3581         /*
3582          * Stop timers before deleting work items, as timers
3583          * could race and re-add the work-items. They will be
3584          * re-established on connection.
3585          */
3586         del_timer_sync(&ifmgd->conn_mon_timer);
3587         del_timer_sync(&ifmgd->bcn_mon_timer);
3588 
3589         /*
3590          * we need to use atomic bitops for the running bits
3591          * only because both timers might fire at the same
3592          * time -- the code here is properly synchronised.
3593          */
3594 
3595         cancel_work_sync(&ifmgd->request_smps_work);
3596 
3597         cancel_work_sync(&ifmgd->monitor_work);
3598         cancel_work_sync(&ifmgd->beacon_connection_loss_work);
3599         cancel_work_sync(&ifmgd->csa_connection_drop_work);
3600         if (del_timer_sync(&ifmgd->timer))
3601                 set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
3602 
3603         if (del_timer_sync(&ifmgd->chswitch_timer))
3604                 set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running);
3605         cancel_work_sync(&ifmgd->chswitch_work);
3606 }
3607 
3608 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
3609 {
3610         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3611 
3612         mutex_lock(&ifmgd->mtx);
3613         if (!ifmgd->associated) {
3614                 mutex_unlock(&ifmgd->mtx);
3615                 return;
3616         }
3617 
3618         if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
3619                 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
3620                 mlme_dbg(sdata, "driver requested disconnect after resume\n");
3621                 ieee80211_sta_connection_lost(sdata,
3622                                               ifmgd->associated->bssid,
3623                                               WLAN_REASON_UNSPECIFIED,
3624                                               true);
3625                 mutex_unlock(&ifmgd->mtx);
3626                 return;
3627         }
3628         mutex_unlock(&ifmgd->mtx);
3629 
3630         if (test_and_clear_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running))
3631                 add_timer(&ifmgd->timer);
3632         if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running))
3633                 add_timer(&ifmgd->chswitch_timer);
3634         ieee80211_sta_reset_beacon_monitor(sdata);
3635 
3636         mutex_lock(&sdata->local->mtx);
3637         ieee80211_restart_sta_timer(sdata);
3638         mutex_unlock(&sdata->local->mtx);
3639 }
3640 #endif
3641 
3642 /* interface setup */
3643 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
3644 {
3645         struct ieee80211_if_managed *ifmgd;
3646 
3647         ifmgd = &sdata->u.mgd;
3648         INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
3649         INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
3650         INIT_WORK(&ifmgd->beacon_connection_loss_work,
3651                   ieee80211_beacon_connection_loss_work);
3652         INIT_WORK(&ifmgd->csa_connection_drop_work,
3653                   ieee80211_csa_connection_drop_work);
3654         INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_work);
3655         setup_timer(&ifmgd->timer, ieee80211_sta_timer,
3656                     (unsigned long) sdata);
3657         setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
3658                     (unsigned long) sdata);
3659         setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer,
3660                     (unsigned long) sdata);
3661         setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
3662                     (unsigned long) sdata);
3663 
3664         ifmgd->flags = 0;
3665         ifmgd->powersave = sdata->wdev.ps;
3666         ifmgd->uapsd_queues = IEEE80211_DEFAULT_UAPSD_QUEUES;
3667         ifmgd->uapsd_max_sp_len = IEEE80211_DEFAULT_MAX_SP_LEN;
3668 
3669         mutex_init(&ifmgd->mtx);
3670 
3671         if (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS)
3672                 ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
3673         else
3674                 ifmgd->req_smps = IEEE80211_SMPS_OFF;
3675 }
3676 
3677 /* scan finished notification */
3678 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
3679 {
3680         struct ieee80211_sub_if_data *sdata;
3681 
3682         /* Restart STA timers */
3683         rcu_read_lock();
3684         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3685                 if (ieee80211_sdata_running(sdata))
3686                         ieee80211_restart_sta_timer(sdata);
3687         }
3688         rcu_read_unlock();
3689 }
3690 
3691 int ieee80211_max_network_latency(struct notifier_block *nb,
3692                                   unsigned long data, void *dummy)
3693 {
3694         s32 latency_usec = (s32) data;
3695         struct ieee80211_local *local =
3696                 container_of(nb, struct ieee80211_local,
3697                              network_latency_notifier);
3698 
3699         mutex_lock(&local->iflist_mtx);
3700         ieee80211_recalc_ps(local, latency_usec);
3701         mutex_unlock(&local->iflist_mtx);
3702 
3703         return 0;
3704 }
3705 
3706 static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
3707                                      struct cfg80211_bss *cbss)
3708 {
3709         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3710         const u8 *ht_cap_ie, *vht_cap_ie;
3711         const struct ieee80211_ht_cap *ht_cap;
3712         const struct ieee80211_vht_cap *vht_cap;
3713         u8 chains = 1;
3714 
3715         if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
3716                 return chains;
3717 
3718         ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
3719         if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
3720                 ht_cap = (void *)(ht_cap_ie + 2);
3721                 chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
3722                 /*
3723                  * TODO: use "Tx Maximum Number Spatial Streams Supported" and
3724                  *       "Tx Unequal Modulation Supported" fields.
3725                  */
3726         }
3727 
3728         if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
3729                 return chains;
3730 
3731         vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
3732         if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
3733                 u8 nss;
3734                 u16 tx_mcs_map;
3735 
3736                 vht_cap = (void *)(vht_cap_ie + 2);
3737                 tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
3738                 for (nss = 8; nss > 0; nss--) {
3739                         if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
3740                                         IEEE80211_VHT_MCS_NOT_SUPPORTED)
3741                                 break;
3742                 }
3743                 /* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
3744                 chains = max(chains, nss);
3745         }
3746 
3747         return chains;
3748 }
3749 
3750 static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
3751                                   struct cfg80211_bss *cbss)
3752 {
3753         struct ieee80211_local *local = sdata->local;
3754         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3755         const struct ieee80211_ht_operation *ht_oper = NULL;
3756         const struct ieee80211_vht_operation *vht_oper = NULL;
3757         struct ieee80211_supported_band *sband;
3758         struct cfg80211_chan_def chandef;
3759         int ret;
3760 
3761         sband = local->hw.wiphy->bands[cbss->channel->band];
3762 
3763         ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
3764                           IEEE80211_STA_DISABLE_80P80MHZ |
3765                           IEEE80211_STA_DISABLE_160MHZ);
3766 
3767         rcu_read_lock();
3768 
3769         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3770             sband->ht_cap.ht_supported) {
3771                 const u8 *ht_oper_ie, *ht_cap;
3772 
3773                 ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
3774                 if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
3775                         ht_oper = (void *)(ht_oper_ie + 2);
3776 
3777                 ht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
3778                 if (!ht_cap || ht_cap[1] < sizeof(struct ieee80211_ht_cap)) {
3779                         ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
3780                         ht_oper = NULL;
3781                 }
3782         }
3783 
3784         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3785             sband->vht_cap.vht_supported) {
3786                 const u8 *vht_oper_ie, *vht_cap;
3787 
3788                 vht_oper_ie = ieee80211_bss_get_ie(cbss,
3789                                                    WLAN_EID_VHT_OPERATION);
3790                 if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
3791                         vht_oper = (void *)(vht_oper_ie + 2);
3792                 if (vht_oper && !ht_oper) {
3793                         vht_oper = NULL;
3794                         sdata_info(sdata,
3795                                    "AP advertised VHT without HT, disabling both\n");
3796                         ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
3797                         ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
3798                 }
3799 
3800                 vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
3801                 if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
3802                         ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
3803                         vht_oper = NULL;
3804                 }
3805         }
3806 
3807         ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
3808                                                      cbss->channel,
3809                                                      ht_oper, vht_oper,
3810                                                      &chandef, true);
3811 
3812         sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
3813                                       local->rx_chains);
3814 
3815         rcu_read_unlock();
3816 
3817         /* will change later if needed */
3818         sdata->smps_mode = IEEE80211_SMPS_OFF;
3819 
3820         /*
3821          * If this fails (possibly due to channel context sharing
3822          * on incompatible channels, e.g. 80+80 and 160 sharing the
3823          * same control channel) try to use a smaller bandwidth.
3824          */
3825         ret = ieee80211_vif_use_channel(sdata, &chandef,
3826                                         IEEE80211_CHANCTX_SHARED);
3827         while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
3828                 ifmgd->flags |= chandef_downgrade(&chandef);
3829                 ret = ieee80211_vif_use_channel(sdata, &chandef,
3830                                                 IEEE80211_CHANCTX_SHARED);
3831         }
3832         return ret;
3833 }
3834 
3835 static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
3836                                      struct cfg80211_bss *cbss, bool assoc)
3837 {
3838         struct ieee80211_local *local = sdata->local;
3839         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3840         struct ieee80211_bss *bss = (void *)cbss->priv;
3841         struct sta_info *new_sta = NULL;
3842         bool have_sta = false;
3843         int err;
3844 
3845         if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
3846                 return -EINVAL;
3847 
3848         if (assoc) {
3849                 rcu_read_lock();
3850                 have_sta = sta_info_get(sdata, cbss->bssid);
3851                 rcu_read_unlock();
3852         }
3853 
3854         if (!have_sta) {
3855                 new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
3856                 if (!new_sta)
3857                         return -ENOMEM;
3858         }
3859 
3860         if (new_sta) {
3861                 u32 rates = 0, basic_rates = 0;
3862                 bool have_higher_than_11mbit;
3863                 int min_rate = INT_MAX, min_rate_index = -1;
3864                 struct ieee80211_supported_band *sband;
3865                 const struct cfg80211_bss_ies *ies;
3866 
3867                 sband = local->hw.wiphy->bands[cbss->channel->band];
3868 
3869                 err = ieee80211_prep_channel(sdata, cbss);
3870                 if (err) {
3871                         sta_info_free(local, new_sta);
3872                         return err;
3873                 }
3874 
3875                 ieee80211_get_rates(sband, bss->supp_rates,
3876                                     bss->supp_rates_len,
3877                                     &rates, &basic_rates,
3878                                     &have_higher_than_11mbit,
3879                                     &min_rate, &min_rate_index);
3880 
3881                 /*
3882                  * This used to be a workaround for basic rates missing
3883                  * in the association response frame. Now that we no
3884                  * longer use the basic rates from there, it probably
3885                  * doesn't happen any more, but keep the workaround so
3886                  * in case some *other* APs are buggy in different ways
3887                  * we can connect -- with a warning.
3888                  */
3889                 if (!basic_rates && min_rate_index >= 0) {
3890                         sdata_info(sdata,
3891                                    "No basic rates, using min rate instead\n");
3892                         basic_rates = BIT(min_rate_index);
3893                 }
3894 
3895                 new_sta->sta.supp_rates[cbss->channel->band] = rates;
3896                 sdata->vif.bss_conf.basic_rates = basic_rates;
3897 
3898                 /* cf. IEEE 802.11 9.2.12 */
3899                 if (cbss->channel->band == IEEE80211_BAND_2GHZ &&
3900                     have_higher_than_11mbit)
3901                         sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
3902                 else
3903                         sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
3904 
3905                 memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);
3906 
3907                 /* set timing information */
3908                 sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
3909                 rcu_read_lock();
3910                 ies = rcu_dereference(cbss->beacon_ies);
3911                 if (ies) {
3912                         const u8 *tim_ie;
3913 
3914                         sdata->vif.bss_conf.sync_tsf = ies->tsf;
3915                         sdata->vif.bss_conf.sync_device_ts =
3916                                 bss->device_ts_beacon;
3917                         tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
3918                                                   ies->data, ies->len);
3919                         if (tim_ie && tim_ie[1] >= 2)
3920                                 sdata->vif.bss_conf.sync_dtim_count = tim_ie[2];
3921                         else
3922                                 sdata->vif.bss_conf.sync_dtim_count = 0;
3923                 } else if (!(local->hw.flags &
3924                                         IEEE80211_HW_TIMING_BEACON_ONLY)) {
3925                         ies = rcu_dereference(cbss->proberesp_ies);
3926                         /* must be non-NULL since beacon IEs were NULL */
3927                         sdata->vif.bss_conf.sync_tsf = ies->tsf;
3928                         sdata->vif.bss_conf.sync_device_ts =
3929                                 bss->device_ts_presp;
3930                         sdata->vif.bss_conf.sync_dtim_count = 0;
3931                 } else {
3932                         sdata->vif.bss_conf.sync_tsf = 0;
3933                         sdata->vif.bss_conf.sync_device_ts = 0;
3934                         sdata->vif.bss_conf.sync_dtim_count = 0;
3935                 }
3936                 rcu_read_unlock();
3937 
3938                 /* tell driver about BSSID, basic rates and timing */
3939                 ieee80211_bss_info_change_notify(sdata,
3940                         BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
3941                         BSS_CHANGED_BEACON_INT);
3942 
3943                 if (assoc)
3944                         sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
3945 
3946                 err = sta_info_insert(new_sta);
3947                 new_sta = NULL;
3948                 if (err) {
3949                         sdata_info(sdata,
3950                                    "failed to insert STA entry for the AP (error %d)\n",
3951                                    err);
3952                         return err;
3953                 }
3954         } else
3955                 WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
3956 
3957         return 0;
3958 }
3959 
3960 /* config hooks */
3961 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
3962                        struct cfg80211_auth_request *req)
3963 {
3964         struct ieee80211_local *local = sdata->local;
3965         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3966         struct ieee80211_mgd_auth_data *auth_data;
3967         u16 auth_alg;
3968         int err;
3969 
3970         /* prepare auth data structure */
3971 
3972         switch (req->auth_type) {
3973         case NL80211_AUTHTYPE_OPEN_SYSTEM:
3974                 auth_alg = WLAN_AUTH_OPEN;
3975                 break;
3976         case NL80211_AUTHTYPE_SHARED_KEY:
3977                 if (IS_ERR(local->wep_tx_tfm))
3978                         return -EOPNOTSUPP;
3979                 auth_alg = WLAN_AUTH_SHARED_KEY;
3980                 break;
3981         case NL80211_AUTHTYPE_FT:
3982                 auth_alg = WLAN_AUTH_FT;
3983                 break;
3984         case NL80211_AUTHTYPE_NETWORK_EAP:
3985                 auth_alg = WLAN_AUTH_LEAP;
3986                 break;
3987         case NL80211_AUTHTYPE_SAE:
3988                 auth_alg = WLAN_AUTH_SAE;
3989                 break;
3990         default:
3991                 return -EOPNOTSUPP;
3992         }
3993 
3994         auth_data = kzalloc(sizeof(*auth_data) + req->sae_data_len +
3995                             req->ie_len, GFP_KERNEL);
3996         if (!auth_data)
3997                 return -ENOMEM;
3998 
3999         auth_data->bss = req->bss;
4000 
4001         if (req->sae_data_len >= 4) {
4002                 __le16 *pos = (__le16 *) req->sae_data;
4003                 auth_data->sae_trans = le16_to_cpu(pos[0]);
4004                 auth_data->sae_status = le16_to_cpu(pos[1]);
4005                 memcpy(auth_data->data, req->sae_data + 4,
4006                        req->sae_data_len - 4);
4007                 auth_data->data_len += req->sae_data_len - 4;
4008         }
4009 
4010         if (req->ie && req->ie_len) {
4011                 memcpy(&auth_data->data[auth_data->data_len],
4012                        req->ie, req->ie_len);
4013                 auth_data->data_len += req->ie_len;
4014         }
4015 
4016         if (req->key && req->key_len) {
4017                 auth_data->key_len = req->key_len;
4018                 auth_data->key_idx = req->key_idx;
4019                 memcpy(auth_data->key, req->key, req->key_len);
4020         }
4021 
4022         auth_data->algorithm = auth_alg;
4023 
4024         /* try to authenticate/probe */
4025 
4026         mutex_lock(&ifmgd->mtx);
4027 
4028         if ((ifmgd->auth_data && !ifmgd->auth_data->done) ||
4029             ifmgd->assoc_data) {
4030                 err = -EBUSY;
4031                 goto err_free;
4032         }
4033 
4034         if (ifmgd->auth_data)
4035                 ieee80211_destroy_auth_data(sdata, false);
4036 
4037         /* prep auth_data so we don't go into idle on disassoc */
4038         ifmgd->auth_data = auth_data;
4039 
4040         if (ifmgd->associated) {
4041                 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4042 
4043                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4044                                        WLAN_REASON_UNSPECIFIED,
4045                                        false, frame_buf);
4046 
4047                 __cfg80211_send_deauth(sdata->dev, frame_buf,
4048                                        sizeof(frame_buf));
4049         }
4050 
4051         sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
4052 
4053         err = ieee80211_prep_connection(sdata, req->bss, false);
4054         if (err)
4055                 goto err_clear;
4056 
4057         err = ieee80211_probe_auth(sdata);
4058         if (err) {
4059                 sta_info_destroy_addr(sdata, req->bss->bssid);
4060                 goto err_clear;
4061         }
4062 
4063         /* hold our own reference */
4064         cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
4065         err = 0;
4066         goto out_unlock;
4067 
4068  err_clear:
4069         memset(ifmgd->bssid, 0, ETH_ALEN);
4070         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
4071         ifmgd->auth_data = NULL;
4072  err_free:
4073         kfree(auth_data);
4074  out_unlock:
4075         mutex_unlock(&ifmgd->mtx);
4076 
4077         return err;
4078 }
4079 
4080 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
4081                         struct cfg80211_assoc_request *req)
4082 {
4083         struct ieee80211_local *local = sdata->local;
4084         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4085         struct ieee80211_bss *bss = (void *)req->bss->priv;
4086         struct ieee80211_mgd_assoc_data *assoc_data;
4087         const struct cfg80211_bss_ies *beacon_ies;
4088         struct ieee80211_supported_band *sband;
4089         const u8 *ssidie, *ht_ie, *vht_ie;
4090         int i, err;
4091 
4092         assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
4093         if (!assoc_data)
4094                 return -ENOMEM;
4095 
4096         rcu_read_lock();
4097         ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
4098         if (!ssidie) {
4099                 rcu_read_unlock();
4100                 kfree(assoc_data);
4101                 return -EINVAL;
4102         }
4103         memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
4104         assoc_data->ssid_len = ssidie[1];
4105         rcu_read_unlock();
4106 
4107         mutex_lock(&ifmgd->mtx);
4108 
4109         if (ifmgd->associated) {
4110                 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4111 
4112                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4113                                        WLAN_REASON_UNSPECIFIED,
4114                                        false, frame_buf);
4115 
4116                 __cfg80211_send_deauth(sdata->dev, frame_buf,
4117                                        sizeof(frame_buf));
4118         }
4119 
4120         if (ifmgd->auth_data && !ifmgd->auth_data->done) {
4121                 err = -EBUSY;
4122                 goto err_free;
4123         }
4124 
4125         if (ifmgd->assoc_data) {
4126                 err = -EBUSY;
4127                 goto err_free;
4128         }
4129 
4130         if (ifmgd->auth_data) {
4131                 bool match;
4132 
4133                 /* keep sta info, bssid if matching */
4134                 match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
4135                 ieee80211_destroy_auth_data(sdata, match);
4136         }
4137 
4138         /* prepare assoc data */
4139         
4140         ifmgd->beacon_crc_valid = false;
4141 
4142         /*
4143          * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
4144          * We still associate in non-HT mode (11a/b/g) if any one of these
4145          * ciphers is configured as pairwise.
4146          * We can set this to true for non-11n hardware, that'll be checked
4147          * separately along with the peer capabilities.
4148          */
4149         for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
4150                 if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
4151                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
4152                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
4153                         ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4154                         ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4155                         netdev_info(sdata->dev,
4156                                     "disabling HT/VHT due to WEP/TKIP use\n");
4157                 }
4158         }
4159 
4160         if (req->flags & ASSOC_REQ_DISABLE_HT) {
4161                 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4162                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4163         }
4164 
4165         /* Also disable HT if we don't support it or the AP doesn't use WMM */
4166         sband = local->hw.wiphy->bands[req->bss->channel->band];
4167         if (!sband->ht_cap.ht_supported ||
4168             local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used) {
4169                 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4170                 if (!bss->wmm_used)
4171                         netdev_info(sdata->dev,
4172                                     "disabling HT as WMM/QoS is not supported by the AP\n");
4173         }
4174 
4175         /* disable VHT if we don't support it or the AP doesn't use WMM */
4176         if (!sband->vht_cap.vht_supported ||
4177             local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used) {
4178                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4179                 if (!bss->wmm_used)
4180                         netdev_info(sdata->dev,
4181                                     "disabling VHT as WMM/QoS is not supported by the AP\n");
4182         }
4183 
4184         memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
4185         memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
4186                sizeof(ifmgd->ht_capa_mask));
4187 
4188         if (req->ie && req->ie_len) {
4189                 memcpy(assoc_data->ie, req->ie, req->ie_len);
4190                 assoc_data->ie_len = req->ie_len;
4191         }
4192 
4193         assoc_data->bss = req->bss;
4194 
4195         if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
4196                 if (ifmgd->powersave)
4197                         sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
4198                 else
4199                         sdata->smps_mode = IEEE80211_SMPS_OFF;
4200         } else
4201                 sdata->smps_mode = ifmgd->req_smps;
4202 
4203         assoc_data->capability = req->bss->capability;
4204         assoc_data->wmm = bss->wmm_used &&
4205                           (local->hw.queues >= IEEE80211_NUM_ACS);
4206         assoc_data->supp_rates = bss->supp_rates;
4207         assoc_data->supp_rates_len = bss->supp_rates_len;
4208 
4209         rcu_read_lock();
4210         ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
4211         if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
4212                 assoc_data->ap_ht_param =
4213                         ((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
4214         else
4215                 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4216         vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
4217         if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
4218                 memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
4219                        sizeof(struct ieee80211_vht_cap));
4220         else
4221                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4222         rcu_read_unlock();
4223 
4224         if (bss->wmm_used && bss->uapsd_supported &&
4225             (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
4226                 assoc_data->uapsd = true;
4227                 ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
4228         } else {
4229                 assoc_data->uapsd = false;
4230                 ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
4231         }
4232 
4233         if (req->prev_bssid)
4234                 memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
4235 
4236         if (req->use_mfp) {
4237                 ifmgd->mfp = IEEE80211_MFP_REQUIRED;
4238                 ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
4239         } else {
4240                 ifmgd->mfp = IEEE80211_MFP_DISABLED;
4241                 ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
4242         }
4243 
4244         if (req->crypto.control_port)
4245                 ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
4246         else
4247                 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
4248 
4249         sdata->control_port_protocol = req->crypto.control_port_ethertype;
4250         sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
4251 
4252         /* kick off associate process */
4253 
4254         ifmgd->assoc_data = assoc_data;
4255         ifmgd->dtim_period = 0;
4256 
4257         err = ieee80211_prep_connection(sdata, req->bss, true);
4258         if (err)
4259                 goto err_clear;
4260 
4261         rcu_read_lock();
4262         beacon_ies = rcu_dereference(req->bss->beacon_ies);
4263 
4264         if (sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC &&
4265             !beacon_ies) {
4266                 /*
4267                  * Wait up to one beacon interval ...
4268                  * should this be more if we miss one?
4269                  */
4270                 sdata_info(sdata, "waiting for beacon from %pM\n",
4271                            ifmgd->bssid);
4272                 assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
4273                 assoc_data->timeout_started = true;
4274                 assoc_data->need_beacon = true;
4275         } else if (beacon_ies) {
4276                 const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
4277                                                     beacon_ies->data,
4278                                                     beacon_ies->len);
4279                 u8 dtim_count = 0;
4280 
4281                 if (tim_ie && tim_ie[1] >= sizeof(struct ieee80211_tim_ie)) {
4282                         const struct ieee80211_tim_ie *tim;
4283                         tim = (void *)(tim_ie + 2);
4284                         ifmgd->dtim_period = tim->dtim_period;
4285                         dtim_count = tim->dtim_count;
4286                 }
4287                 assoc_data->have_beacon = true;
4288                 assoc_data->timeout = jiffies;
4289                 assoc_data->timeout_started = true;
4290 
4291                 if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
4292                         sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
4293                         sdata->vif.bss_conf.sync_device_ts =
4294                                 bss->device_ts_beacon;
4295                         sdata->vif.bss_conf.sync_dtim_count = dtim_count;
4296                 }
4297         } else {
4298                 assoc_data->timeout = jiffies;
4299                 assoc_data->timeout_started = true;
4300         }
4301         rcu_read_unlock();
4302 
4303         run_again(ifmgd, assoc_data->timeout);
4304 
4305         if (bss->corrupt_data) {
4306                 char *corrupt_type = "data";
4307                 if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
4308                         if (bss->corrupt_data &
4309                                         IEEE80211_BSS_CORRUPT_PROBE_RESP)
4310                                 corrupt_type = "beacon and probe response";
4311                         else
4312                                 corrupt_type = "beacon";
4313                 } else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
4314                         corrupt_type = "probe response";
4315                 sdata_info(sdata, "associating with AP with corrupt %s\n",
4316                            corrupt_type);
4317         }
4318 
4319         err = 0;
4320         goto out;
4321  err_clear:
4322         memset(ifmgd->bssid, 0, ETH_ALEN);
4323         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
4324         ifmgd->assoc_data = NULL;
4325  err_free:
4326         kfree(assoc_data);
4327  out:
4328         mutex_unlock(&ifmgd->mtx);
4329 
4330         return err;
4331 }
4332 
4333 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
4334                          struct cfg80211_deauth_request *req)
4335 {
4336         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4337         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4338         bool tx = !req->local_state_change;
4339         bool sent_frame = false;
4340 
4341         mutex_lock(&ifmgd->mtx);
4342 
4343         sdata_info(sdata,
4344                    "deauthenticating from %pM by local choice (reason=%d)\n",
4345                    req->bssid, req->reason_code);
4346 
4347         if (ifmgd->auth_data) {
4348                 drv_mgd_prepare_tx(sdata->local, sdata);
4349                 ieee80211_send_deauth_disassoc(sdata, req->bssid,
4350                                                IEEE80211_STYPE_DEAUTH,
4351                                                req->reason_code, tx,
4352                                                frame_buf);
4353                 ieee80211_destroy_auth_data(sdata, false);
4354                 mutex_unlock(&ifmgd->mtx);
4355 
4356                 sent_frame = tx;
4357                 goto out;
4358         }
4359 
4360         if (ifmgd->associated &&
4361             ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
4362                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
4363                                        req->reason_code, tx, frame_buf);
4364                 sent_frame = tx;
4365         }
4366         mutex_unlock(&ifmgd->mtx);
4367 
4368  out:
4369         if (sent_frame)
4370                 __cfg80211_send_deauth(sdata->dev, frame_buf,
4371                                        IEEE80211_DEAUTH_FRAME_LEN);
4372 
4373         return 0;
4374 }
4375 
4376 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
4377                            struct cfg80211_disassoc_request *req)
4378 {
4379         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4380         u8 bssid[ETH_ALEN];
4381         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4382 
4383         mutex_lock(&ifmgd->mtx);
4384 
4385         /*
4386          * cfg80211 should catch this ... but it's racy since
4387          * we can receive a disassoc frame, process it, hand it
4388          * to cfg80211 while that's in a locked section already
4389          * trying to tell us that the user wants to disconnect.
4390          */
4391         if (ifmgd->associated != req->bss) {
4392                 mutex_unlock(&ifmgd->mtx);
4393                 return -ENOLINK;
4394         }
4395 
4396         sdata_info(sdata,
4397                    "disassociating from %pM by local choice (reason=%d)\n",
4398                    req->bss->bssid, req->reason_code);
4399 
4400         memcpy(bssid, req->bss->bssid, ETH_ALEN);
4401         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
4402                                req->reason_code, !req->local_state_change,
4403                                frame_buf);
4404         mutex_unlock(&ifmgd->mtx);
4405 
4406         __cfg80211_send_disassoc(sdata->dev, frame_buf,
4407                                  IEEE80211_DEAUTH_FRAME_LEN);
4408 
4409         return 0;
4410 }
4411 
4412 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
4413 {
4414         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4415 
4416         /*
4417          * Make sure some work items will not run after this,
4418          * they will not do anything but might not have been
4419          * cancelled when disconnecting.
4420          */
4421         cancel_work_sync(&ifmgd->monitor_work);
4422         cancel_work_sync(&ifmgd->beacon_connection_loss_work);
4423         cancel_work_sync(&ifmgd->request_smps_work);
4424         cancel_work_sync(&ifmgd->csa_connection_drop_work);
4425         cancel_work_sync(&ifmgd->chswitch_work);
4426 
4427         mutex_lock(&ifmgd->mtx);
4428         if (ifmgd->assoc_data)
4429                 ieee80211_destroy_assoc_data(sdata, false);
4430         if (ifmgd->auth_data)
4431                 ieee80211_destroy_auth_data(sdata, false);
4432         del_timer_sync(&ifmgd->timer);
4433         mutex_unlock(&ifmgd->mtx);
4434 }
4435 
4436 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
4437                                enum nl80211_cqm_rssi_threshold_event rssi_event,
4438                                gfp_t gfp)
4439 {
4440         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
4441 
4442         trace_api_cqm_rssi_notify(sdata, rssi_event);
4443 
4444         cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, gfp);
4445 }
4446 EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
4447 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp