xref: /linux/net/mac80211/mlme.c (revision b889fcf63cb62e7fdb7816565e28f44dbe4a76a5)
1 /*
2  * BSS client mode implementation
3  * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
4  * Copyright 2004, Instant802 Networks, Inc.
5  * Copyright 2005, Devicescape Software, Inc.
6  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
7  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
8  *
9  * This program is free software; you can redistribute it and/or modify
10  * it under the terms of the GNU General Public License version 2 as
11  * published by the Free Software Foundation.
12  */
13 
14 #include <linux/delay.h>
15 #include <linux/if_ether.h>
16 #include <linux/skbuff.h>
17 #include <linux/if_arp.h>
18 #include <linux/etherdevice.h>
19 #include <linux/moduleparam.h>
20 #include <linux/rtnetlink.h>
21 #include <linux/pm_qos.h>
22 #include <linux/crc32.h>
23 #include <linux/slab.h>
24 #include <linux/export.h>
25 #include <net/mac80211.h>
26 #include <asm/unaligned.h>
27 
28 #include "ieee80211_i.h"
29 #include "driver-ops.h"
30 #include "rate.h"
31 #include "led.h"
32 
33 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
34 #define IEEE80211_AUTH_MAX_TRIES 3
35 #define IEEE80211_AUTH_WAIT_ASSOC (HZ * 5)
36 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
37 #define IEEE80211_ASSOC_MAX_TRIES 3
38 
39 static int max_nullfunc_tries = 2;
40 module_param(max_nullfunc_tries, int, 0644);
41 MODULE_PARM_DESC(max_nullfunc_tries,
42 		 "Maximum nullfunc tx tries before disconnecting (reason 4).");
43 
44 static int max_probe_tries = 5;
45 module_param(max_probe_tries, int, 0644);
46 MODULE_PARM_DESC(max_probe_tries,
47 		 "Maximum probe tries before disconnecting (reason 4).");
48 
49 /*
50  * Beacon loss timeout is calculated as N frames times the
51  * advertised beacon interval.  This may need to be somewhat
52  * higher than what hardware might detect to account for
53  * delays in the host processing frames. But since we also
54  * probe on beacon miss before declaring the connection lost
55  * default to what we want.
56  */
57 #define IEEE80211_BEACON_LOSS_COUNT	7
58 
59 /*
60  * Time the connection can be idle before we probe
61  * it to see if we can still talk to the AP.
62  */
63 #define IEEE80211_CONNECTION_IDLE_TIME	(30 * HZ)
64 /*
65  * Time we wait for a probe response after sending
66  * a probe request because of beacon loss or for
67  * checking the connection still works.
68  */
69 static int probe_wait_ms = 500;
70 module_param(probe_wait_ms, int, 0644);
71 MODULE_PARM_DESC(probe_wait_ms,
72 		 "Maximum time(ms) to wait for probe response"
73 		 " before disconnecting (reason 4).");
74 
75 /*
76  * Weight given to the latest Beacon frame when calculating average signal
77  * strength for Beacon frames received in the current BSS. This must be
78  * between 1 and 15.
79  */
80 #define IEEE80211_SIGNAL_AVE_WEIGHT	3
81 
82 /*
83  * How many Beacon frames need to have been used in average signal strength
84  * before starting to indicate signal change events.
85  */
86 #define IEEE80211_SIGNAL_AVE_MIN_COUNT	4
87 
88 #define TMR_RUNNING_TIMER	0
89 #define TMR_RUNNING_CHANSW	1
90 
91 /*
92  * All cfg80211 functions have to be called outside a locked
93  * section so that they can acquire a lock themselves... This
94  * is much simpler than queuing up things in cfg80211, but we
95  * do need some indirection for that here.
96  */
97 enum rx_mgmt_action {
98 	/* no action required */
99 	RX_MGMT_NONE,
100 
101 	/* caller must call cfg80211_send_deauth() */
102 	RX_MGMT_CFG80211_DEAUTH,
103 
104 	/* caller must call cfg80211_send_disassoc() */
105 	RX_MGMT_CFG80211_DISASSOC,
106 
107 	/* caller must call cfg80211_send_rx_auth() */
108 	RX_MGMT_CFG80211_RX_AUTH,
109 
110 	/* caller must call cfg80211_send_rx_assoc() */
111 	RX_MGMT_CFG80211_RX_ASSOC,
112 
113 	/* caller must call cfg80211_send_assoc_timeout() */
114 	RX_MGMT_CFG80211_ASSOC_TIMEOUT,
115 };
116 
117 /* utils */
118 static inline void ASSERT_MGD_MTX(struct ieee80211_if_managed *ifmgd)
119 {
120 	lockdep_assert_held(&ifmgd->mtx);
121 }
122 
123 /*
124  * We can have multiple work items (and connection probing)
125  * scheduling this timer, but we need to take care to only
126  * reschedule it when it should fire _earlier_ than it was
127  * asked for before, or if it's not pending right now. This
128  * function ensures that. Note that it then is required to
129  * run this function for all timeouts after the first one
130  * has happened -- the work that runs from this timer will
131  * do that.
132  */
133 static void run_again(struct ieee80211_if_managed *ifmgd, unsigned long timeout)
134 {
135 	ASSERT_MGD_MTX(ifmgd);
136 
137 	if (!timer_pending(&ifmgd->timer) ||
138 	    time_before(timeout, ifmgd->timer.expires))
139 		mod_timer(&ifmgd->timer, timeout);
140 }
141 
142 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
143 {
144 	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
145 		return;
146 
147 	if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
148 		return;
149 
150 	mod_timer(&sdata->u.mgd.bcn_mon_timer,
151 		  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
152 }
153 
154 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
155 {
156 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
157 
158 	if (unlikely(!sdata->u.mgd.associated))
159 		return;
160 
161 	if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
162 		return;
163 
164 	mod_timer(&sdata->u.mgd.conn_mon_timer,
165 		  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
166 
167 	ifmgd->probe_send_count = 0;
168 }
169 
170 static int ecw2cw(int ecw)
171 {
172 	return (1 << ecw) - 1;
173 }
174 
175 static u32 ieee80211_config_ht_tx(struct ieee80211_sub_if_data *sdata,
176 				  struct ieee80211_ht_operation *ht_oper,
177 				  const u8 *bssid, bool reconfig)
178 {
179 	struct ieee80211_local *local = sdata->local;
180 	struct ieee80211_supported_band *sband;
181 	struct ieee80211_chanctx_conf *chanctx_conf;
182 	struct ieee80211_channel *chan;
183 	struct sta_info *sta;
184 	u32 changed = 0;
185 	u16 ht_opmode;
186 	bool disable_40 = false;
187 
188 	rcu_read_lock();
189 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
190 	if (WARN_ON(!chanctx_conf)) {
191 		rcu_read_unlock();
192 		return 0;
193 	}
194 	chan = chanctx_conf->def.chan;
195 	rcu_read_unlock();
196 	sband = local->hw.wiphy->bands[chan->band];
197 
198 	switch (sdata->vif.bss_conf.chandef.width) {
199 	case NL80211_CHAN_WIDTH_40:
200 		if (sdata->vif.bss_conf.chandef.chan->center_freq >
201 				sdata->vif.bss_conf.chandef.center_freq1 &&
202 		    chan->flags & IEEE80211_CHAN_NO_HT40PLUS)
203 			disable_40 = true;
204 		if (sdata->vif.bss_conf.chandef.chan->center_freq <
205 				sdata->vif.bss_conf.chandef.center_freq1 &&
206 		    chan->flags & IEEE80211_CHAN_NO_HT40MINUS)
207 			disable_40 = true;
208 		break;
209 	default:
210 		break;
211 	}
212 
213 	/* This can change during the lifetime of the BSS */
214 	if (!(ht_oper->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY))
215 		disable_40 = true;
216 
217 	mutex_lock(&local->sta_mtx);
218 	sta = sta_info_get(sdata, bssid);
219 
220 	WARN_ON_ONCE(!sta);
221 
222 	if (sta && !sta->supports_40mhz)
223 		disable_40 = true;
224 
225 	if (sta && (!reconfig ||
226 		    (disable_40 != !(sta->sta.ht_cap.cap &
227 					IEEE80211_HT_CAP_SUP_WIDTH_20_40)))) {
228 
229 		if (disable_40)
230 			sta->sta.ht_cap.cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
231 		else
232 			sta->sta.ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
233 
234 		rate_control_rate_update(local, sband, sta,
235 					 IEEE80211_RC_BW_CHANGED);
236 	}
237 	mutex_unlock(&local->sta_mtx);
238 
239 	ht_opmode = le16_to_cpu(ht_oper->operation_mode);
240 
241 	/* if bss configuration changed store the new one */
242 	if (!reconfig || (sdata->vif.bss_conf.ht_operation_mode != ht_opmode)) {
243 		changed |= BSS_CHANGED_HT;
244 		sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
245 	}
246 
247 	return changed;
248 }
249 
250 /* frame sending functions */
251 
252 static int ieee80211_compatible_rates(const u8 *supp_rates, int supp_rates_len,
253 				      struct ieee80211_supported_band *sband,
254 				      u32 *rates)
255 {
256 	int i, j, count;
257 	*rates = 0;
258 	count = 0;
259 	for (i = 0; i < supp_rates_len; i++) {
260 		int rate = (supp_rates[i] & 0x7F) * 5;
261 
262 		for (j = 0; j < sband->n_bitrates; j++)
263 			if (sband->bitrates[j].bitrate == rate) {
264 				*rates |= BIT(j);
265 				count++;
266 				break;
267 			}
268 	}
269 
270 	return count;
271 }
272 
273 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
274 				struct sk_buff *skb, u8 ap_ht_param,
275 				struct ieee80211_supported_band *sband,
276 				struct ieee80211_channel *channel,
277 				enum ieee80211_smps_mode smps)
278 {
279 	u8 *pos;
280 	u32 flags = channel->flags;
281 	u16 cap;
282 	struct ieee80211_sta_ht_cap ht_cap;
283 
284 	BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
285 
286 	memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
287 	ieee80211_apply_htcap_overrides(sdata, &ht_cap);
288 
289 	/* determine capability flags */
290 	cap = ht_cap.cap;
291 
292 	switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
293 	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
294 		if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
295 			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
296 			cap &= ~IEEE80211_HT_CAP_SGI_40;
297 		}
298 		break;
299 	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
300 		if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
301 			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
302 			cap &= ~IEEE80211_HT_CAP_SGI_40;
303 		}
304 		break;
305 	}
306 
307 	/*
308 	 * If 40 MHz was disabled associate as though we weren't
309 	 * capable of 40 MHz -- some broken APs will never fall
310 	 * back to trying to transmit in 20 MHz.
311 	 */
312 	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
313 		cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
314 		cap &= ~IEEE80211_HT_CAP_SGI_40;
315 	}
316 
317 	/* set SM PS mode properly */
318 	cap &= ~IEEE80211_HT_CAP_SM_PS;
319 	switch (smps) {
320 	case IEEE80211_SMPS_AUTOMATIC:
321 	case IEEE80211_SMPS_NUM_MODES:
322 		WARN_ON(1);
323 	case IEEE80211_SMPS_OFF:
324 		cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
325 			IEEE80211_HT_CAP_SM_PS_SHIFT;
326 		break;
327 	case IEEE80211_SMPS_STATIC:
328 		cap |= WLAN_HT_CAP_SM_PS_STATIC <<
329 			IEEE80211_HT_CAP_SM_PS_SHIFT;
330 		break;
331 	case IEEE80211_SMPS_DYNAMIC:
332 		cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
333 			IEEE80211_HT_CAP_SM_PS_SHIFT;
334 		break;
335 	}
336 
337 	/* reserve and fill IE */
338 	pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
339 	ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
340 }
341 
342 static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
343 				 struct sk_buff *skb,
344 				 struct ieee80211_supported_band *sband)
345 {
346 	u8 *pos;
347 	u32 cap;
348 	struct ieee80211_sta_vht_cap vht_cap;
349 
350 	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
351 
352 	memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
353 
354 	/* determine capability flags */
355 	cap = vht_cap.cap;
356 
357 	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
358 		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
359 		cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
360 	}
361 
362 	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
363 		cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
364 		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
365 	}
366 
367 	/* reserve and fill IE */
368 	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
369 	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
370 }
371 
372 static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
373 {
374 	struct ieee80211_local *local = sdata->local;
375 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
376 	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
377 	struct sk_buff *skb;
378 	struct ieee80211_mgmt *mgmt;
379 	u8 *pos, qos_info;
380 	size_t offset = 0, noffset;
381 	int i, count, rates_len, supp_rates_len;
382 	u16 capab;
383 	struct ieee80211_supported_band *sband;
384 	struct ieee80211_chanctx_conf *chanctx_conf;
385 	struct ieee80211_channel *chan;
386 	u32 rates = 0;
387 
388 	lockdep_assert_held(&ifmgd->mtx);
389 
390 	rcu_read_lock();
391 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
392 	if (WARN_ON(!chanctx_conf)) {
393 		rcu_read_unlock();
394 		return;
395 	}
396 	chan = chanctx_conf->def.chan;
397 	rcu_read_unlock();
398 	sband = local->hw.wiphy->bands[chan->band];
399 
400 	if (assoc_data->supp_rates_len) {
401 		/*
402 		 * Get all rates supported by the device and the AP as
403 		 * some APs don't like getting a superset of their rates
404 		 * in the association request (e.g. D-Link DAP 1353 in
405 		 * b-only mode)...
406 		 */
407 		rates_len = ieee80211_compatible_rates(assoc_data->supp_rates,
408 						       assoc_data->supp_rates_len,
409 						       sband, &rates);
410 	} else {
411 		/*
412 		 * In case AP not provide any supported rates information
413 		 * before association, we send information element(s) with
414 		 * all rates that we support.
415 		 */
416 		rates = ~0;
417 		rates_len = sband->n_bitrates;
418 	}
419 
420 	skb = alloc_skb(local->hw.extra_tx_headroom +
421 			sizeof(*mgmt) + /* bit too much but doesn't matter */
422 			2 + assoc_data->ssid_len + /* SSID */
423 			4 + rates_len + /* (extended) rates */
424 			4 + /* power capability */
425 			2 + 2 * sband->n_channels + /* supported channels */
426 			2 + sizeof(struct ieee80211_ht_cap) + /* HT */
427 			2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
428 			assoc_data->ie_len + /* extra IEs */
429 			9, /* WMM */
430 			GFP_KERNEL);
431 	if (!skb)
432 		return;
433 
434 	skb_reserve(skb, local->hw.extra_tx_headroom);
435 
436 	capab = WLAN_CAPABILITY_ESS;
437 
438 	if (sband->band == IEEE80211_BAND_2GHZ) {
439 		if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
440 			capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
441 		if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
442 			capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
443 	}
444 
445 	if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
446 		capab |= WLAN_CAPABILITY_PRIVACY;
447 
448 	if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
449 	    (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
450 		capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
451 
452 	mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
453 	memset(mgmt, 0, 24);
454 	memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
455 	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
456 	memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);
457 
458 	if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
459 		skb_put(skb, 10);
460 		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
461 						  IEEE80211_STYPE_REASSOC_REQ);
462 		mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
463 		mgmt->u.reassoc_req.listen_interval =
464 				cpu_to_le16(local->hw.conf.listen_interval);
465 		memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
466 		       ETH_ALEN);
467 	} else {
468 		skb_put(skb, 4);
469 		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
470 						  IEEE80211_STYPE_ASSOC_REQ);
471 		mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
472 		mgmt->u.assoc_req.listen_interval =
473 				cpu_to_le16(local->hw.conf.listen_interval);
474 	}
475 
476 	/* SSID */
477 	pos = skb_put(skb, 2 + assoc_data->ssid_len);
478 	*pos++ = WLAN_EID_SSID;
479 	*pos++ = assoc_data->ssid_len;
480 	memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);
481 
482 	/* add all rates which were marked to be used above */
483 	supp_rates_len = rates_len;
484 	if (supp_rates_len > 8)
485 		supp_rates_len = 8;
486 
487 	pos = skb_put(skb, supp_rates_len + 2);
488 	*pos++ = WLAN_EID_SUPP_RATES;
489 	*pos++ = supp_rates_len;
490 
491 	count = 0;
492 	for (i = 0; i < sband->n_bitrates; i++) {
493 		if (BIT(i) & rates) {
494 			int rate = sband->bitrates[i].bitrate;
495 			*pos++ = (u8) (rate / 5);
496 			if (++count == 8)
497 				break;
498 		}
499 	}
500 
501 	if (rates_len > count) {
502 		pos = skb_put(skb, rates_len - count + 2);
503 		*pos++ = WLAN_EID_EXT_SUPP_RATES;
504 		*pos++ = rates_len - count;
505 
506 		for (i++; i < sband->n_bitrates; i++) {
507 			if (BIT(i) & rates) {
508 				int rate = sband->bitrates[i].bitrate;
509 				*pos++ = (u8) (rate / 5);
510 			}
511 		}
512 	}
513 
514 	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
515 		/* 1. power capabilities */
516 		pos = skb_put(skb, 4);
517 		*pos++ = WLAN_EID_PWR_CAPABILITY;
518 		*pos++ = 2;
519 		*pos++ = 0; /* min tx power */
520 		*pos++ = chan->max_power; /* max tx power */
521 
522 		/* 2. supported channels */
523 		/* TODO: get this in reg domain format */
524 		pos = skb_put(skb, 2 * sband->n_channels + 2);
525 		*pos++ = WLAN_EID_SUPPORTED_CHANNELS;
526 		*pos++ = 2 * sband->n_channels;
527 		for (i = 0; i < sband->n_channels; i++) {
528 			*pos++ = ieee80211_frequency_to_channel(
529 					sband->channels[i].center_freq);
530 			*pos++ = 1; /* one channel in the subband*/
531 		}
532 	}
533 
534 	/* if present, add any custom IEs that go before HT */
535 	if (assoc_data->ie_len && assoc_data->ie) {
536 		static const u8 before_ht[] = {
537 			WLAN_EID_SSID,
538 			WLAN_EID_SUPP_RATES,
539 			WLAN_EID_EXT_SUPP_RATES,
540 			WLAN_EID_PWR_CAPABILITY,
541 			WLAN_EID_SUPPORTED_CHANNELS,
542 			WLAN_EID_RSN,
543 			WLAN_EID_QOS_CAPA,
544 			WLAN_EID_RRM_ENABLED_CAPABILITIES,
545 			WLAN_EID_MOBILITY_DOMAIN,
546 			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
547 		};
548 		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
549 					     before_ht, ARRAY_SIZE(before_ht),
550 					     offset);
551 		pos = skb_put(skb, noffset - offset);
552 		memcpy(pos, assoc_data->ie + offset, noffset - offset);
553 		offset = noffset;
554 	}
555 
556 	if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
557 			 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
558 		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
559 
560 	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
561 		ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
562 				    sband, chan, sdata->smps_mode);
563 
564 	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
565 		ieee80211_add_vht_ie(sdata, skb, sband);
566 
567 	/* if present, add any custom non-vendor IEs that go after HT */
568 	if (assoc_data->ie_len && assoc_data->ie) {
569 		noffset = ieee80211_ie_split_vendor(assoc_data->ie,
570 						    assoc_data->ie_len,
571 						    offset);
572 		pos = skb_put(skb, noffset - offset);
573 		memcpy(pos, assoc_data->ie + offset, noffset - offset);
574 		offset = noffset;
575 	}
576 
577 	if (assoc_data->wmm) {
578 		if (assoc_data->uapsd) {
579 			qos_info = ifmgd->uapsd_queues;
580 			qos_info |= (ifmgd->uapsd_max_sp_len <<
581 				     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
582 		} else {
583 			qos_info = 0;
584 		}
585 
586 		pos = skb_put(skb, 9);
587 		*pos++ = WLAN_EID_VENDOR_SPECIFIC;
588 		*pos++ = 7; /* len */
589 		*pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
590 		*pos++ = 0x50;
591 		*pos++ = 0xf2;
592 		*pos++ = 2; /* WME */
593 		*pos++ = 0; /* WME info */
594 		*pos++ = 1; /* WME ver */
595 		*pos++ = qos_info;
596 	}
597 
598 	/* add any remaining custom (i.e. vendor specific here) IEs */
599 	if (assoc_data->ie_len && assoc_data->ie) {
600 		noffset = assoc_data->ie_len;
601 		pos = skb_put(skb, noffset - offset);
602 		memcpy(pos, assoc_data->ie + offset, noffset - offset);
603 	}
604 
605 	drv_mgd_prepare_tx(local, sdata);
606 
607 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
608 	ieee80211_tx_skb(sdata, skb);
609 }
610 
611 void ieee80211_send_pspoll(struct ieee80211_local *local,
612 			   struct ieee80211_sub_if_data *sdata)
613 {
614 	struct ieee80211_pspoll *pspoll;
615 	struct sk_buff *skb;
616 
617 	skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
618 	if (!skb)
619 		return;
620 
621 	pspoll = (struct ieee80211_pspoll *) skb->data;
622 	pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
623 
624 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
625 	ieee80211_tx_skb(sdata, skb);
626 }
627 
628 void ieee80211_send_nullfunc(struct ieee80211_local *local,
629 			     struct ieee80211_sub_if_data *sdata,
630 			     int powersave)
631 {
632 	struct sk_buff *skb;
633 	struct ieee80211_hdr_3addr *nullfunc;
634 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
635 
636 	skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
637 	if (!skb)
638 		return;
639 
640 	nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
641 	if (powersave)
642 		nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
643 
644 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
645 	if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
646 			    IEEE80211_STA_CONNECTION_POLL))
647 		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
648 
649 	ieee80211_tx_skb(sdata, skb);
650 }
651 
652 static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
653 					  struct ieee80211_sub_if_data *sdata)
654 {
655 	struct sk_buff *skb;
656 	struct ieee80211_hdr *nullfunc;
657 	__le16 fc;
658 
659 	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
660 		return;
661 
662 	skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
663 	if (!skb)
664 		return;
665 
666 	skb_reserve(skb, local->hw.extra_tx_headroom);
667 
668 	nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30);
669 	memset(nullfunc, 0, 30);
670 	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
671 			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
672 	nullfunc->frame_control = fc;
673 	memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
674 	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
675 	memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
676 	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
677 
678 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
679 	ieee80211_tx_skb(sdata, skb);
680 }
681 
682 /* spectrum management related things */
683 static void ieee80211_chswitch_work(struct work_struct *work)
684 {
685 	struct ieee80211_sub_if_data *sdata =
686 		container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
687 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
688 
689 	if (!ieee80211_sdata_running(sdata))
690 		return;
691 
692 	mutex_lock(&ifmgd->mtx);
693 	if (!ifmgd->associated)
694 		goto out;
695 
696 	sdata->local->_oper_channel = sdata->local->csa_channel;
697 	if (!sdata->local->ops->channel_switch) {
698 		/* call "hw_config" only if doing sw channel switch */
699 		ieee80211_hw_config(sdata->local,
700 			IEEE80211_CONF_CHANGE_CHANNEL);
701 	} else {
702 		/* update the device channel directly */
703 		sdata->local->hw.conf.channel = sdata->local->_oper_channel;
704 	}
705 
706 	/* XXX: shouldn't really modify cfg80211-owned data! */
707 	ifmgd->associated->channel = sdata->local->_oper_channel;
708 
709 	/* XXX: wait for a beacon first? */
710 	ieee80211_wake_queues_by_reason(&sdata->local->hw,
711 					IEEE80211_QUEUE_STOP_REASON_CSA);
712  out:
713 	ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
714 	mutex_unlock(&ifmgd->mtx);
715 }
716 
717 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
718 {
719 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
720 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
721 
722 	trace_api_chswitch_done(sdata, success);
723 	if (!success) {
724 		sdata_info(sdata,
725 			   "driver channel switch failed, disconnecting\n");
726 		ieee80211_queue_work(&sdata->local->hw,
727 				     &ifmgd->csa_connection_drop_work);
728 	} else {
729 		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
730 	}
731 }
732 EXPORT_SYMBOL(ieee80211_chswitch_done);
733 
734 static void ieee80211_chswitch_timer(unsigned long data)
735 {
736 	struct ieee80211_sub_if_data *sdata =
737 		(struct ieee80211_sub_if_data *) data;
738 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
739 
740 	if (sdata->local->quiescing) {
741 		set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running);
742 		return;
743 	}
744 
745 	ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
746 }
747 
748 void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
749 				      struct ieee80211_channel_sw_ie *sw_elem,
750 				      struct ieee80211_bss *bss,
751 				      u64 timestamp)
752 {
753 	struct cfg80211_bss *cbss =
754 		container_of((void *)bss, struct cfg80211_bss, priv);
755 	struct ieee80211_channel *new_ch;
756 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
757 	int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num,
758 						      cbss->channel->band);
759 	struct ieee80211_chanctx *chanctx;
760 
761 	ASSERT_MGD_MTX(ifmgd);
762 
763 	if (!ifmgd->associated)
764 		return;
765 
766 	if (sdata->local->scanning)
767 		return;
768 
769 	/* Disregard subsequent beacons if we are already running a timer
770 	   processing a CSA */
771 
772 	if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
773 		return;
774 
775 	new_ch = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
776 	if (!new_ch || new_ch->flags & IEEE80211_CHAN_DISABLED) {
777 		sdata_info(sdata,
778 			   "AP %pM switches to unsupported channel (%d MHz), disconnecting\n",
779 			   ifmgd->associated->bssid, new_freq);
780 		ieee80211_queue_work(&sdata->local->hw,
781 				     &ifmgd->csa_connection_drop_work);
782 		return;
783 	}
784 
785 	ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
786 
787 	if (sdata->local->use_chanctx) {
788 		sdata_info(sdata,
789 			   "not handling channel switch with channel contexts\n");
790 		ieee80211_queue_work(&sdata->local->hw,
791 				     &ifmgd->csa_connection_drop_work);
792 		return;
793 	}
794 
795 	mutex_lock(&sdata->local->chanctx_mtx);
796 	if (WARN_ON(!rcu_access_pointer(sdata->vif.chanctx_conf))) {
797 		mutex_unlock(&sdata->local->chanctx_mtx);
798 		return;
799 	}
800 	chanctx = container_of(rcu_access_pointer(sdata->vif.chanctx_conf),
801 			       struct ieee80211_chanctx, conf);
802 	if (chanctx->refcount > 1) {
803 		sdata_info(sdata,
804 			   "channel switch with multiple interfaces on the same channel, disconnecting\n");
805 		ieee80211_queue_work(&sdata->local->hw,
806 				     &ifmgd->csa_connection_drop_work);
807 		mutex_unlock(&sdata->local->chanctx_mtx);
808 		return;
809 	}
810 	mutex_unlock(&sdata->local->chanctx_mtx);
811 
812 	sdata->local->csa_channel = new_ch;
813 
814 	if (sw_elem->mode)
815 		ieee80211_stop_queues_by_reason(&sdata->local->hw,
816 				IEEE80211_QUEUE_STOP_REASON_CSA);
817 
818 	if (sdata->local->ops->channel_switch) {
819 		/* use driver's channel switch callback */
820 		struct ieee80211_channel_switch ch_switch = {
821 			.timestamp = timestamp,
822 			.block_tx = sw_elem->mode,
823 			.channel = new_ch,
824 			.count = sw_elem->count,
825 		};
826 
827 		drv_channel_switch(sdata->local, &ch_switch);
828 		return;
829 	}
830 
831 	/* channel switch handled in software */
832 	if (sw_elem->count <= 1)
833 		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
834 	else
835 		mod_timer(&ifmgd->chswitch_timer,
836 			  TU_TO_EXP_TIME(sw_elem->count *
837 					 cbss->beacon_interval));
838 }
839 
840 static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
841 				       struct ieee80211_channel *channel,
842 				       const u8 *country_ie, u8 country_ie_len,
843 				       const u8 *pwr_constr_elem)
844 {
845 	struct ieee80211_country_ie_triplet *triplet;
846 	int chan = ieee80211_frequency_to_channel(channel->center_freq);
847 	int i, chan_pwr, chan_increment, new_ap_level;
848 	bool have_chan_pwr = false;
849 
850 	/* Invalid IE */
851 	if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
852 		return 0;
853 
854 	triplet = (void *)(country_ie + 3);
855 	country_ie_len -= 3;
856 
857 	switch (channel->band) {
858 	default:
859 		WARN_ON_ONCE(1);
860 		/* fall through */
861 	case IEEE80211_BAND_2GHZ:
862 	case IEEE80211_BAND_60GHZ:
863 		chan_increment = 1;
864 		break;
865 	case IEEE80211_BAND_5GHZ:
866 		chan_increment = 4;
867 		break;
868 	}
869 
870 	/* find channel */
871 	while (country_ie_len >= 3) {
872 		u8 first_channel = triplet->chans.first_channel;
873 
874 		if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
875 			goto next;
876 
877 		for (i = 0; i < triplet->chans.num_channels; i++) {
878 			if (first_channel + i * chan_increment == chan) {
879 				have_chan_pwr = true;
880 				chan_pwr = triplet->chans.max_power;
881 				break;
882 			}
883 		}
884 		if (have_chan_pwr)
885 			break;
886 
887  next:
888 		triplet++;
889 		country_ie_len -= 3;
890 	}
891 
892 	if (!have_chan_pwr)
893 		return 0;
894 
895 	new_ap_level = max_t(int, 0, chan_pwr - *pwr_constr_elem);
896 
897 	if (sdata->ap_power_level == new_ap_level)
898 		return 0;
899 
900 	sdata_info(sdata,
901 		   "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
902 		   new_ap_level, chan_pwr, *pwr_constr_elem,
903 		   sdata->u.mgd.bssid);
904 	sdata->ap_power_level = new_ap_level;
905 	if (__ieee80211_recalc_txpower(sdata))
906 		return BSS_CHANGED_TXPOWER;
907 	return 0;
908 }
909 
910 void ieee80211_enable_dyn_ps(struct ieee80211_vif *vif)
911 {
912 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
913 	struct ieee80211_local *local = sdata->local;
914 	struct ieee80211_conf *conf = &local->hw.conf;
915 
916 	WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
917 		!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS) ||
918 		(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS));
919 
920 	local->disable_dynamic_ps = false;
921 	conf->dynamic_ps_timeout = local->dynamic_ps_user_timeout;
922 }
923 EXPORT_SYMBOL(ieee80211_enable_dyn_ps);
924 
925 void ieee80211_disable_dyn_ps(struct ieee80211_vif *vif)
926 {
927 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
928 	struct ieee80211_local *local = sdata->local;
929 	struct ieee80211_conf *conf = &local->hw.conf;
930 
931 	WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
932 		!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS) ||
933 		(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS));
934 
935 	local->disable_dynamic_ps = true;
936 	conf->dynamic_ps_timeout = 0;
937 	del_timer_sync(&local->dynamic_ps_timer);
938 	ieee80211_queue_work(&local->hw,
939 			     &local->dynamic_ps_enable_work);
940 }
941 EXPORT_SYMBOL(ieee80211_disable_dyn_ps);
942 
943 /* powersave */
944 static void ieee80211_enable_ps(struct ieee80211_local *local,
945 				struct ieee80211_sub_if_data *sdata)
946 {
947 	struct ieee80211_conf *conf = &local->hw.conf;
948 
949 	/*
950 	 * If we are scanning right now then the parameters will
951 	 * take effect when scan finishes.
952 	 */
953 	if (local->scanning)
954 		return;
955 
956 	if (conf->dynamic_ps_timeout > 0 &&
957 	    !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
958 		mod_timer(&local->dynamic_ps_timer, jiffies +
959 			  msecs_to_jiffies(conf->dynamic_ps_timeout));
960 	} else {
961 		if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
962 			ieee80211_send_nullfunc(local, sdata, 1);
963 
964 		if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
965 		    (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS))
966 			return;
967 
968 		conf->flags |= IEEE80211_CONF_PS;
969 		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
970 	}
971 }
972 
973 static void ieee80211_change_ps(struct ieee80211_local *local)
974 {
975 	struct ieee80211_conf *conf = &local->hw.conf;
976 
977 	if (local->ps_sdata) {
978 		ieee80211_enable_ps(local, local->ps_sdata);
979 	} else if (conf->flags & IEEE80211_CONF_PS) {
980 		conf->flags &= ~IEEE80211_CONF_PS;
981 		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
982 		del_timer_sync(&local->dynamic_ps_timer);
983 		cancel_work_sync(&local->dynamic_ps_enable_work);
984 	}
985 }
986 
987 static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
988 {
989 	struct ieee80211_if_managed *mgd = &sdata->u.mgd;
990 	struct sta_info *sta = NULL;
991 	bool authorized = false;
992 
993 	if (!mgd->powersave)
994 		return false;
995 
996 	if (mgd->broken_ap)
997 		return false;
998 
999 	if (!mgd->associated)
1000 		return false;
1001 
1002 	if (mgd->flags & (IEEE80211_STA_BEACON_POLL |
1003 			  IEEE80211_STA_CONNECTION_POLL))
1004 		return false;
1005 
1006 	rcu_read_lock();
1007 	sta = sta_info_get(sdata, mgd->bssid);
1008 	if (sta)
1009 		authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1010 	rcu_read_unlock();
1011 
1012 	return authorized;
1013 }
1014 
1015 /* need to hold RTNL or interface lock */
1016 void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
1017 {
1018 	struct ieee80211_sub_if_data *sdata, *found = NULL;
1019 	int count = 0;
1020 	int timeout;
1021 
1022 	if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS)) {
1023 		local->ps_sdata = NULL;
1024 		return;
1025 	}
1026 
1027 	list_for_each_entry(sdata, &local->interfaces, list) {
1028 		if (!ieee80211_sdata_running(sdata))
1029 			continue;
1030 		if (sdata->vif.type == NL80211_IFTYPE_AP) {
1031 			/* If an AP vif is found, then disable PS
1032 			 * by setting the count to zero thereby setting
1033 			 * ps_sdata to NULL.
1034 			 */
1035 			count = 0;
1036 			break;
1037 		}
1038 		if (sdata->vif.type != NL80211_IFTYPE_STATION)
1039 			continue;
1040 		found = sdata;
1041 		count++;
1042 	}
1043 
1044 	if (count == 1 && ieee80211_powersave_allowed(found)) {
1045 		struct ieee80211_conf *conf = &local->hw.conf;
1046 		s32 beaconint_us;
1047 
1048 		if (latency < 0)
1049 			latency = pm_qos_request(PM_QOS_NETWORK_LATENCY);
1050 
1051 		beaconint_us = ieee80211_tu_to_usec(
1052 					found->vif.bss_conf.beacon_int);
1053 
1054 		timeout = local->dynamic_ps_forced_timeout;
1055 		if (timeout < 0) {
1056 			/*
1057 			 * Go to full PSM if the user configures a very low
1058 			 * latency requirement.
1059 			 * The 2000 second value is there for compatibility
1060 			 * until the PM_QOS_NETWORK_LATENCY is configured
1061 			 * with real values.
1062 			 */
1063 			if (latency > (1900 * USEC_PER_MSEC) &&
1064 			    latency != (2000 * USEC_PER_SEC))
1065 				timeout = 0;
1066 			else
1067 				timeout = 100;
1068 		}
1069 		local->dynamic_ps_user_timeout = timeout;
1070 		if (!local->disable_dynamic_ps)
1071 			conf->dynamic_ps_timeout =
1072 				local->dynamic_ps_user_timeout;
1073 
1074 		if (beaconint_us > latency) {
1075 			local->ps_sdata = NULL;
1076 		} else {
1077 			struct ieee80211_bss *bss;
1078 			int maxslp = 1;
1079 			u8 dtimper;
1080 
1081 			bss = (void *)found->u.mgd.associated->priv;
1082 			dtimper = bss->dtim_period;
1083 
1084 			/* If the TIM IE is invalid, pretend the value is 1 */
1085 			if (!dtimper)
1086 				dtimper = 1;
1087 			else if (dtimper > 1)
1088 				maxslp = min_t(int, dtimper,
1089 						    latency / beaconint_us);
1090 
1091 			local->hw.conf.max_sleep_period = maxslp;
1092 			local->hw.conf.ps_dtim_period = dtimper;
1093 			local->ps_sdata = found;
1094 		}
1095 	} else {
1096 		local->ps_sdata = NULL;
1097 	}
1098 
1099 	ieee80211_change_ps(local);
1100 }
1101 
1102 void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
1103 {
1104 	bool ps_allowed = ieee80211_powersave_allowed(sdata);
1105 
1106 	if (sdata->vif.bss_conf.ps != ps_allowed) {
1107 		sdata->vif.bss_conf.ps = ps_allowed;
1108 		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
1109 	}
1110 }
1111 
1112 void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
1113 {
1114 	struct ieee80211_local *local =
1115 		container_of(work, struct ieee80211_local,
1116 			     dynamic_ps_disable_work);
1117 
1118 	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1119 		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1120 		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1121 	}
1122 
1123 	ieee80211_wake_queues_by_reason(&local->hw,
1124 					IEEE80211_QUEUE_STOP_REASON_PS);
1125 }
1126 
1127 void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
1128 {
1129 	struct ieee80211_local *local =
1130 		container_of(work, struct ieee80211_local,
1131 			     dynamic_ps_enable_work);
1132 	struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1133 	struct ieee80211_if_managed *ifmgd;
1134 	unsigned long flags;
1135 	int q;
1136 
1137 	/* can only happen when PS was just disabled anyway */
1138 	if (!sdata)
1139 		return;
1140 
1141 	ifmgd = &sdata->u.mgd;
1142 
1143 	if (local->hw.conf.flags & IEEE80211_CONF_PS)
1144 		return;
1145 
1146 	if (!local->disable_dynamic_ps &&
1147 	    local->hw.conf.dynamic_ps_timeout > 0) {
1148 		/* don't enter PS if TX frames are pending */
1149 		if (drv_tx_frames_pending(local)) {
1150 			mod_timer(&local->dynamic_ps_timer, jiffies +
1151 				  msecs_to_jiffies(
1152 				  local->hw.conf.dynamic_ps_timeout));
1153 			return;
1154 		}
1155 
1156 		/*
1157 		 * transmission can be stopped by others which leads to
1158 		 * dynamic_ps_timer expiry. Postpone the ps timer if it
1159 		 * is not the actual idle state.
1160 		 */
1161 		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
1162 		for (q = 0; q < local->hw.queues; q++) {
1163 			if (local->queue_stop_reasons[q]) {
1164 				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1165 						       flags);
1166 				mod_timer(&local->dynamic_ps_timer, jiffies +
1167 					  msecs_to_jiffies(
1168 					  local->hw.conf.dynamic_ps_timeout));
1169 				return;
1170 			}
1171 		}
1172 		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1173 	}
1174 
1175 	if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
1176 	    !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1177 		netif_tx_stop_all_queues(sdata->dev);
1178 
1179 		if (drv_tx_frames_pending(local))
1180 			mod_timer(&local->dynamic_ps_timer, jiffies +
1181 				  msecs_to_jiffies(
1182 				  local->hw.conf.dynamic_ps_timeout));
1183 		else {
1184 			ieee80211_send_nullfunc(local, sdata, 1);
1185 			/* Flush to get the tx status of nullfunc frame */
1186 			drv_flush(local, false);
1187 		}
1188 	}
1189 
1190 	if (!((local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
1191 	      (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)) ||
1192 	    (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1193 		ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
1194 		local->hw.conf.flags |= IEEE80211_CONF_PS;
1195 		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1196 	}
1197 
1198 	if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
1199 		netif_tx_wake_all_queues(sdata->dev);
1200 }
1201 
1202 void ieee80211_dynamic_ps_timer(unsigned long data)
1203 {
1204 	struct ieee80211_local *local = (void *) data;
1205 
1206 	if (local->quiescing || local->suspended)
1207 		return;
1208 
1209 	ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1210 }
1211 
1212 /* MLME */
1213 static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
1214 				     struct ieee80211_sub_if_data *sdata,
1215 				     u8 *wmm_param, size_t wmm_param_len)
1216 {
1217 	struct ieee80211_tx_queue_params params;
1218 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1219 	size_t left;
1220 	int count;
1221 	u8 *pos, uapsd_queues = 0;
1222 
1223 	if (!local->ops->conf_tx)
1224 		return false;
1225 
1226 	if (local->hw.queues < IEEE80211_NUM_ACS)
1227 		return false;
1228 
1229 	if (!wmm_param)
1230 		return false;
1231 
1232 	if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1233 		return false;
1234 
1235 	if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1236 		uapsd_queues = ifmgd->uapsd_queues;
1237 
1238 	count = wmm_param[6] & 0x0f;
1239 	if (count == ifmgd->wmm_last_param_set)
1240 		return false;
1241 	ifmgd->wmm_last_param_set = count;
1242 
1243 	pos = wmm_param + 8;
1244 	left = wmm_param_len - 8;
1245 
1246 	memset(&params, 0, sizeof(params));
1247 
1248 	sdata->wmm_acm = 0;
1249 	for (; left >= 4; left -= 4, pos += 4) {
1250 		int aci = (pos[0] >> 5) & 0x03;
1251 		int acm = (pos[0] >> 4) & 0x01;
1252 		bool uapsd = false;
1253 		int queue;
1254 
1255 		switch (aci) {
1256 		case 1: /* AC_BK */
1257 			queue = 3;
1258 			if (acm)
1259 				sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
1260 			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
1261 				uapsd = true;
1262 			break;
1263 		case 2: /* AC_VI */
1264 			queue = 1;
1265 			if (acm)
1266 				sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
1267 			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
1268 				uapsd = true;
1269 			break;
1270 		case 3: /* AC_VO */
1271 			queue = 0;
1272 			if (acm)
1273 				sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
1274 			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
1275 				uapsd = true;
1276 			break;
1277 		case 0: /* AC_BE */
1278 		default:
1279 			queue = 2;
1280 			if (acm)
1281 				sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
1282 			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
1283 				uapsd = true;
1284 			break;
1285 		}
1286 
1287 		params.aifs = pos[0] & 0x0f;
1288 		params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
1289 		params.cw_min = ecw2cw(pos[1] & 0x0f);
1290 		params.txop = get_unaligned_le16(pos + 2);
1291 		params.uapsd = uapsd;
1292 
1293 		mlme_dbg(sdata,
1294 			 "WMM queue=%d aci=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d\n",
1295 			 queue, aci, acm,
1296 			 params.aifs, params.cw_min, params.cw_max,
1297 			 params.txop, params.uapsd);
1298 		sdata->tx_conf[queue] = params;
1299 		if (drv_conf_tx(local, sdata, queue, &params))
1300 			sdata_err(sdata,
1301 				  "failed to set TX queue parameters for queue %d\n",
1302 				  queue);
1303 	}
1304 
1305 	/* enable WMM or activate new settings */
1306 	sdata->vif.bss_conf.qos = true;
1307 	return true;
1308 }
1309 
1310 static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
1311 {
1312 	lockdep_assert_held(&sdata->local->mtx);
1313 
1314 	sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
1315 				IEEE80211_STA_BEACON_POLL);
1316 	ieee80211_run_deferred_scan(sdata->local);
1317 }
1318 
1319 static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
1320 {
1321 	mutex_lock(&sdata->local->mtx);
1322 	__ieee80211_stop_poll(sdata);
1323 	mutex_unlock(&sdata->local->mtx);
1324 }
1325 
1326 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
1327 					   u16 capab, bool erp_valid, u8 erp)
1328 {
1329 	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1330 	u32 changed = 0;
1331 	bool use_protection;
1332 	bool use_short_preamble;
1333 	bool use_short_slot;
1334 
1335 	if (erp_valid) {
1336 		use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
1337 		use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
1338 	} else {
1339 		use_protection = false;
1340 		use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
1341 	}
1342 
1343 	use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
1344 	if (ieee80211_get_sdata_band(sdata) == IEEE80211_BAND_5GHZ)
1345 		use_short_slot = true;
1346 
1347 	if (use_protection != bss_conf->use_cts_prot) {
1348 		bss_conf->use_cts_prot = use_protection;
1349 		changed |= BSS_CHANGED_ERP_CTS_PROT;
1350 	}
1351 
1352 	if (use_short_preamble != bss_conf->use_short_preamble) {
1353 		bss_conf->use_short_preamble = use_short_preamble;
1354 		changed |= BSS_CHANGED_ERP_PREAMBLE;
1355 	}
1356 
1357 	if (use_short_slot != bss_conf->use_short_slot) {
1358 		bss_conf->use_short_slot = use_short_slot;
1359 		changed |= BSS_CHANGED_ERP_SLOT;
1360 	}
1361 
1362 	return changed;
1363 }
1364 
1365 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
1366 				     struct cfg80211_bss *cbss,
1367 				     u32 bss_info_changed)
1368 {
1369 	struct ieee80211_bss *bss = (void *)cbss->priv;
1370 	struct ieee80211_local *local = sdata->local;
1371 	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1372 
1373 	bss_info_changed |= BSS_CHANGED_ASSOC;
1374 	bss_info_changed |= ieee80211_handle_bss_capability(sdata,
1375 		bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
1376 
1377 	sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
1378 		IEEE80211_BEACON_LOSS_COUNT * bss_conf->beacon_int));
1379 
1380 	sdata->u.mgd.associated = cbss;
1381 	memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
1382 
1383 	sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;
1384 
1385 	if (sdata->vif.p2p) {
1386 		const struct cfg80211_bss_ies *ies;
1387 
1388 		rcu_read_lock();
1389 		ies = rcu_dereference(cbss->ies);
1390 		if (ies) {
1391 			u8 noa[2];
1392 			int ret;
1393 
1394 			ret = cfg80211_get_p2p_attr(
1395 					ies->data, ies->len,
1396 					IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
1397 					noa, sizeof(noa));
1398 			if (ret >= 2) {
1399 				bss_conf->p2p_oppps = noa[1] & 0x80;
1400 				bss_conf->p2p_ctwindow = noa[1] & 0x7f;
1401 				bss_info_changed |= BSS_CHANGED_P2P_PS;
1402 				sdata->u.mgd.p2p_noa_index = noa[0];
1403 			}
1404 		}
1405 		rcu_read_unlock();
1406 	}
1407 
1408 	/* just to be sure */
1409 	ieee80211_stop_poll(sdata);
1410 
1411 	ieee80211_led_assoc(local, 1);
1412 
1413 	if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD)
1414 		bss_conf->dtim_period = bss->dtim_period;
1415 	else
1416 		bss_conf->dtim_period = 0;
1417 
1418 	bss_conf->assoc = 1;
1419 
1420 	/* Tell the driver to monitor connection quality (if supported) */
1421 	if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
1422 	    bss_conf->cqm_rssi_thold)
1423 		bss_info_changed |= BSS_CHANGED_CQM;
1424 
1425 	/* Enable ARP filtering */
1426 	if (bss_conf->arp_filter_enabled != sdata->arp_filter_state) {
1427 		bss_conf->arp_filter_enabled = sdata->arp_filter_state;
1428 		bss_info_changed |= BSS_CHANGED_ARP_FILTER;
1429 	}
1430 
1431 	ieee80211_bss_info_change_notify(sdata, bss_info_changed);
1432 
1433 	mutex_lock(&local->iflist_mtx);
1434 	ieee80211_recalc_ps(local, -1);
1435 	mutex_unlock(&local->iflist_mtx);
1436 
1437 	ieee80211_recalc_smps(sdata);
1438 	ieee80211_recalc_ps_vif(sdata);
1439 
1440 	netif_tx_start_all_queues(sdata->dev);
1441 	netif_carrier_on(sdata->dev);
1442 }
1443 
1444 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
1445 				   u16 stype, u16 reason, bool tx,
1446 				   u8 *frame_buf)
1447 {
1448 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1449 	struct ieee80211_local *local = sdata->local;
1450 	struct sta_info *sta;
1451 	u32 changed = 0;
1452 
1453 	ASSERT_MGD_MTX(ifmgd);
1454 
1455 	if (WARN_ON_ONCE(tx && !frame_buf))
1456 		return;
1457 
1458 	if (WARN_ON(!ifmgd->associated))
1459 		return;
1460 
1461 	ieee80211_stop_poll(sdata);
1462 
1463 	ifmgd->associated = NULL;
1464 
1465 	/*
1466 	 * we need to commit the associated = NULL change because the
1467 	 * scan code uses that to determine whether this iface should
1468 	 * go to/wake up from powersave or not -- and could otherwise
1469 	 * wake the queues erroneously.
1470 	 */
1471 	smp_mb();
1472 
1473 	/*
1474 	 * Thus, we can only afterwards stop the queues -- to account
1475 	 * for the case where another CPU is finishing a scan at this
1476 	 * time -- we don't want the scan code to enable queues.
1477 	 */
1478 
1479 	netif_tx_stop_all_queues(sdata->dev);
1480 	netif_carrier_off(sdata->dev);
1481 
1482 	mutex_lock(&local->sta_mtx);
1483 	sta = sta_info_get(sdata, ifmgd->bssid);
1484 	if (sta) {
1485 		set_sta_flag(sta, WLAN_STA_BLOCK_BA);
1486 		ieee80211_sta_tear_down_BA_sessions(sta, false);
1487 	}
1488 	mutex_unlock(&local->sta_mtx);
1489 
1490 	/*
1491 	 * if we want to get out of ps before disassoc (why?) we have
1492 	 * to do it before sending disassoc, as otherwise the null-packet
1493 	 * won't be valid.
1494 	 */
1495 	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1496 		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
1497 		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1498 	}
1499 	local->ps_sdata = NULL;
1500 
1501 	/* disable per-vif ps */
1502 	ieee80211_recalc_ps_vif(sdata);
1503 
1504 	/* flush out any pending frame (e.g. DELBA) before deauth/disassoc */
1505 	if (tx)
1506 		drv_flush(local, false);
1507 
1508 	/* deauthenticate/disassociate now */
1509 	if (tx || frame_buf)
1510 		ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
1511 					       reason, tx, frame_buf);
1512 
1513 	/* flush out frame */
1514 	if (tx)
1515 		drv_flush(local, false);
1516 
1517 	/* clear bssid only after building the needed mgmt frames */
1518 	memset(ifmgd->bssid, 0, ETH_ALEN);
1519 
1520 	/* remove AP and TDLS peers */
1521 	sta_info_flush(local, sdata);
1522 
1523 	/* finally reset all BSS / config parameters */
1524 	changed |= ieee80211_reset_erp_info(sdata);
1525 
1526 	ieee80211_led_assoc(local, 0);
1527 	changed |= BSS_CHANGED_ASSOC;
1528 	sdata->vif.bss_conf.assoc = false;
1529 
1530 	sdata->vif.bss_conf.p2p_ctwindow = 0;
1531 	sdata->vif.bss_conf.p2p_oppps = false;
1532 
1533 	/* on the next assoc, re-program HT parameters */
1534 	memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
1535 	memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
1536 
1537 	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
1538 
1539 	del_timer_sync(&local->dynamic_ps_timer);
1540 	cancel_work_sync(&local->dynamic_ps_enable_work);
1541 
1542 	/* Disable ARP filtering */
1543 	if (sdata->vif.bss_conf.arp_filter_enabled) {
1544 		sdata->vif.bss_conf.arp_filter_enabled = false;
1545 		changed |= BSS_CHANGED_ARP_FILTER;
1546 	}
1547 
1548 	sdata->vif.bss_conf.qos = false;
1549 	changed |= BSS_CHANGED_QOS;
1550 
1551 	/* The BSSID (not really interesting) and HT changed */
1552 	changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
1553 	ieee80211_bss_info_change_notify(sdata, changed);
1554 
1555 	/* disassociated - set to defaults now */
1556 	ieee80211_set_wmm_default(sdata, false);
1557 
1558 	del_timer_sync(&sdata->u.mgd.conn_mon_timer);
1559 	del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
1560 	del_timer_sync(&sdata->u.mgd.timer);
1561 	del_timer_sync(&sdata->u.mgd.chswitch_timer);
1562 
1563 	sdata->u.mgd.timers_running = 0;
1564 
1565 	ifmgd->flags = 0;
1566 	ieee80211_vif_release_channel(sdata);
1567 }
1568 
1569 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
1570 			     struct ieee80211_hdr *hdr)
1571 {
1572 	/*
1573 	 * We can postpone the mgd.timer whenever receiving unicast frames
1574 	 * from AP because we know that the connection is working both ways
1575 	 * at that time. But multicast frames (and hence also beacons) must
1576 	 * be ignored here, because we need to trigger the timer during
1577 	 * data idle periods for sending the periodic probe request to the
1578 	 * AP we're connected to.
1579 	 */
1580 	if (is_multicast_ether_addr(hdr->addr1))
1581 		return;
1582 
1583 	ieee80211_sta_reset_conn_monitor(sdata);
1584 }
1585 
1586 static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
1587 {
1588 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1589 	struct ieee80211_local *local = sdata->local;
1590 
1591 	mutex_lock(&local->mtx);
1592 	if (!(ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
1593 			      IEEE80211_STA_CONNECTION_POLL))) {
1594 		mutex_unlock(&local->mtx);
1595 		return;
1596 	}
1597 
1598 	__ieee80211_stop_poll(sdata);
1599 
1600 	mutex_lock(&local->iflist_mtx);
1601 	ieee80211_recalc_ps(local, -1);
1602 	mutex_unlock(&local->iflist_mtx);
1603 
1604 	if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
1605 		goto out;
1606 
1607 	/*
1608 	 * We've received a probe response, but are not sure whether
1609 	 * we have or will be receiving any beacons or data, so let's
1610 	 * schedule the timers again, just in case.
1611 	 */
1612 	ieee80211_sta_reset_beacon_monitor(sdata);
1613 
1614 	mod_timer(&ifmgd->conn_mon_timer,
1615 		  round_jiffies_up(jiffies +
1616 				   IEEE80211_CONNECTION_IDLE_TIME));
1617 out:
1618 	mutex_unlock(&local->mtx);
1619 }
1620 
1621 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
1622 			     struct ieee80211_hdr *hdr, bool ack)
1623 {
1624 	if (!ieee80211_is_data(hdr->frame_control))
1625 	    return;
1626 
1627 	if (ack)
1628 		ieee80211_sta_reset_conn_monitor(sdata);
1629 
1630 	if (ieee80211_is_nullfunc(hdr->frame_control) &&
1631 	    sdata->u.mgd.probe_send_count > 0) {
1632 		if (ack)
1633 			sdata->u.mgd.probe_send_count = 0;
1634 		else
1635 			sdata->u.mgd.nullfunc_failed = true;
1636 		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
1637 	}
1638 }
1639 
1640 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
1641 {
1642 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1643 	const u8 *ssid;
1644 	u8 *dst = ifmgd->associated->bssid;
1645 	u8 unicast_limit = max(1, max_probe_tries - 3);
1646 
1647 	/*
1648 	 * Try sending broadcast probe requests for the last three
1649 	 * probe requests after the first ones failed since some
1650 	 * buggy APs only support broadcast probe requests.
1651 	 */
1652 	if (ifmgd->probe_send_count >= unicast_limit)
1653 		dst = NULL;
1654 
1655 	/*
1656 	 * When the hardware reports an accurate Tx ACK status, it's
1657 	 * better to send a nullfunc frame instead of a probe request,
1658 	 * as it will kick us off the AP quickly if we aren't associated
1659 	 * anymore. The timeout will be reset if the frame is ACKed by
1660 	 * the AP.
1661 	 */
1662 	ifmgd->probe_send_count++;
1663 
1664 	if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
1665 		ifmgd->nullfunc_failed = false;
1666 		ieee80211_send_nullfunc(sdata->local, sdata, 0);
1667 	} else {
1668 		int ssid_len;
1669 
1670 		rcu_read_lock();
1671 		ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
1672 		if (WARN_ON_ONCE(ssid == NULL))
1673 			ssid_len = 0;
1674 		else
1675 			ssid_len = ssid[1];
1676 
1677 		ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid_len, NULL,
1678 					 0, (u32) -1, true, false,
1679 					 ifmgd->associated->channel, false);
1680 		rcu_read_unlock();
1681 	}
1682 
1683 	ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
1684 	run_again(ifmgd, ifmgd->probe_timeout);
1685 	if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
1686 		drv_flush(sdata->local, false);
1687 }
1688 
1689 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
1690 				   bool beacon)
1691 {
1692 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1693 	bool already = false;
1694 
1695 	if (!ieee80211_sdata_running(sdata))
1696 		return;
1697 
1698 	mutex_lock(&ifmgd->mtx);
1699 
1700 	if (!ifmgd->associated)
1701 		goto out;
1702 
1703 	mutex_lock(&sdata->local->mtx);
1704 
1705 	if (sdata->local->tmp_channel || sdata->local->scanning) {
1706 		mutex_unlock(&sdata->local->mtx);
1707 		goto out;
1708 	}
1709 
1710 	if (beacon)
1711 		mlme_dbg_ratelimited(sdata,
1712 				     "detected beacon loss from AP - sending probe request\n");
1713 
1714 	ieee80211_cqm_rssi_notify(&sdata->vif,
1715 		NL80211_CQM_RSSI_BEACON_LOSS_EVENT, GFP_KERNEL);
1716 
1717 	/*
1718 	 * The driver/our work has already reported this event or the
1719 	 * connection monitoring has kicked in and we have already sent
1720 	 * a probe request. Or maybe the AP died and the driver keeps
1721 	 * reporting until we disassociate...
1722 	 *
1723 	 * In either case we have to ignore the current call to this
1724 	 * function (except for setting the correct probe reason bit)
1725 	 * because otherwise we would reset the timer every time and
1726 	 * never check whether we received a probe response!
1727 	 */
1728 	if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
1729 			    IEEE80211_STA_CONNECTION_POLL))
1730 		already = true;
1731 
1732 	if (beacon)
1733 		ifmgd->flags |= IEEE80211_STA_BEACON_POLL;
1734 	else
1735 		ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
1736 
1737 	mutex_unlock(&sdata->local->mtx);
1738 
1739 	if (already)
1740 		goto out;
1741 
1742 	mutex_lock(&sdata->local->iflist_mtx);
1743 	ieee80211_recalc_ps(sdata->local, -1);
1744 	mutex_unlock(&sdata->local->iflist_mtx);
1745 
1746 	ifmgd->probe_send_count = 0;
1747 	ieee80211_mgd_probe_ap_send(sdata);
1748  out:
1749 	mutex_unlock(&ifmgd->mtx);
1750 }
1751 
1752 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
1753 					  struct ieee80211_vif *vif)
1754 {
1755 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1756 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1757 	struct cfg80211_bss *cbss;
1758 	struct sk_buff *skb;
1759 	const u8 *ssid;
1760 	int ssid_len;
1761 
1762 	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
1763 		return NULL;
1764 
1765 	ASSERT_MGD_MTX(ifmgd);
1766 
1767 	if (ifmgd->associated)
1768 		cbss = ifmgd->associated;
1769 	else if (ifmgd->auth_data)
1770 		cbss = ifmgd->auth_data->bss;
1771 	else if (ifmgd->assoc_data)
1772 		cbss = ifmgd->assoc_data->bss;
1773 	else
1774 		return NULL;
1775 
1776 	rcu_read_lock();
1777 	ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
1778 	if (WARN_ON_ONCE(ssid == NULL))
1779 		ssid_len = 0;
1780 	else
1781 		ssid_len = ssid[1];
1782 
1783 	skb = ieee80211_build_probe_req(sdata, cbss->bssid,
1784 					(u32) -1, cbss->channel,
1785 					ssid + 2, ssid_len,
1786 					NULL, 0, true);
1787 	rcu_read_unlock();
1788 
1789 	return skb;
1790 }
1791 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
1792 
1793 static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata,
1794 				   bool transmit_frame)
1795 {
1796 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1797 	struct ieee80211_local *local = sdata->local;
1798 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
1799 
1800 	mutex_lock(&ifmgd->mtx);
1801 	if (!ifmgd->associated) {
1802 		mutex_unlock(&ifmgd->mtx);
1803 		return;
1804 	}
1805 
1806 	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
1807 			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
1808 			       transmit_frame, frame_buf);
1809 	ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
1810 	mutex_unlock(&ifmgd->mtx);
1811 
1812 	/*
1813 	 * must be outside lock due to cfg80211,
1814 	 * but that's not a problem.
1815 	 */
1816 	cfg80211_send_deauth(sdata->dev, frame_buf, IEEE80211_DEAUTH_FRAME_LEN);
1817 
1818 	mutex_lock(&local->mtx);
1819 	ieee80211_recalc_idle(local);
1820 	mutex_unlock(&local->mtx);
1821 }
1822 
1823 static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
1824 {
1825 	struct ieee80211_sub_if_data *sdata =
1826 		container_of(work, struct ieee80211_sub_if_data,
1827 			     u.mgd.beacon_connection_loss_work);
1828 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1829 	struct sta_info *sta;
1830 
1831 	if (ifmgd->associated) {
1832 		rcu_read_lock();
1833 		sta = sta_info_get(sdata, ifmgd->bssid);
1834 		if (sta)
1835 			sta->beacon_loss_count++;
1836 		rcu_read_unlock();
1837 	}
1838 
1839 	if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR) {
1840 		sdata_info(sdata, "Connection to AP %pM lost\n",
1841 			   ifmgd->bssid);
1842 		__ieee80211_disconnect(sdata, false);
1843 	} else {
1844 		ieee80211_mgd_probe_ap(sdata, true);
1845 	}
1846 }
1847 
1848 static void ieee80211_csa_connection_drop_work(struct work_struct *work)
1849 {
1850 	struct ieee80211_sub_if_data *sdata =
1851 		container_of(work, struct ieee80211_sub_if_data,
1852 			     u.mgd.csa_connection_drop_work);
1853 
1854 	ieee80211_wake_queues_by_reason(&sdata->local->hw,
1855 					IEEE80211_QUEUE_STOP_REASON_CSA);
1856 	__ieee80211_disconnect(sdata, true);
1857 }
1858 
1859 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
1860 {
1861 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1862 	struct ieee80211_hw *hw = &sdata->local->hw;
1863 
1864 	trace_api_beacon_loss(sdata);
1865 
1866 	WARN_ON(hw->flags & IEEE80211_HW_CONNECTION_MONITOR);
1867 	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
1868 }
1869 EXPORT_SYMBOL(ieee80211_beacon_loss);
1870 
1871 void ieee80211_connection_loss(struct ieee80211_vif *vif)
1872 {
1873 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1874 	struct ieee80211_hw *hw = &sdata->local->hw;
1875 
1876 	trace_api_connection_loss(sdata);
1877 
1878 	WARN_ON(!(hw->flags & IEEE80211_HW_CONNECTION_MONITOR));
1879 	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
1880 }
1881 EXPORT_SYMBOL(ieee80211_connection_loss);
1882 
1883 
1884 static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
1885 					bool assoc)
1886 {
1887 	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
1888 
1889 	lockdep_assert_held(&sdata->u.mgd.mtx);
1890 
1891 	if (!assoc) {
1892 		sta_info_destroy_addr(sdata, auth_data->bss->bssid);
1893 
1894 		memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
1895 		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
1896 		sdata->u.mgd.flags = 0;
1897 		ieee80211_vif_release_channel(sdata);
1898 	}
1899 
1900 	cfg80211_put_bss(auth_data->bss);
1901 	kfree(auth_data);
1902 	sdata->u.mgd.auth_data = NULL;
1903 }
1904 
1905 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
1906 				     struct ieee80211_mgmt *mgmt, size_t len)
1907 {
1908 	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
1909 	u8 *pos;
1910 	struct ieee802_11_elems elems;
1911 
1912 	pos = mgmt->u.auth.variable;
1913 	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
1914 	if (!elems.challenge)
1915 		return;
1916 	auth_data->expected_transaction = 4;
1917 	drv_mgd_prepare_tx(sdata->local, sdata);
1918 	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
1919 			    elems.challenge - 2, elems.challenge_len + 2,
1920 			    auth_data->bss->bssid, auth_data->bss->bssid,
1921 			    auth_data->key, auth_data->key_len,
1922 			    auth_data->key_idx);
1923 }
1924 
1925 static enum rx_mgmt_action __must_check
1926 ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
1927 		       struct ieee80211_mgmt *mgmt, size_t len)
1928 {
1929 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1930 	u8 bssid[ETH_ALEN];
1931 	u16 auth_alg, auth_transaction, status_code;
1932 	struct sta_info *sta;
1933 
1934 	lockdep_assert_held(&ifmgd->mtx);
1935 
1936 	if (len < 24 + 6)
1937 		return RX_MGMT_NONE;
1938 
1939 	if (!ifmgd->auth_data || ifmgd->auth_data->done)
1940 		return RX_MGMT_NONE;
1941 
1942 	memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
1943 
1944 	if (!ether_addr_equal(bssid, mgmt->bssid))
1945 		return RX_MGMT_NONE;
1946 
1947 	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
1948 	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
1949 	status_code = le16_to_cpu(mgmt->u.auth.status_code);
1950 
1951 	if (auth_alg != ifmgd->auth_data->algorithm ||
1952 	    auth_transaction != ifmgd->auth_data->expected_transaction) {
1953 		sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
1954 			   mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
1955 			   auth_transaction,
1956 			   ifmgd->auth_data->expected_transaction);
1957 		return RX_MGMT_NONE;
1958 	}
1959 
1960 	if (status_code != WLAN_STATUS_SUCCESS) {
1961 		sdata_info(sdata, "%pM denied authentication (status %d)\n",
1962 			   mgmt->sa, status_code);
1963 		ieee80211_destroy_auth_data(sdata, false);
1964 		return RX_MGMT_CFG80211_RX_AUTH;
1965 	}
1966 
1967 	switch (ifmgd->auth_data->algorithm) {
1968 	case WLAN_AUTH_OPEN:
1969 	case WLAN_AUTH_LEAP:
1970 	case WLAN_AUTH_FT:
1971 	case WLAN_AUTH_SAE:
1972 		break;
1973 	case WLAN_AUTH_SHARED_KEY:
1974 		if (ifmgd->auth_data->expected_transaction != 4) {
1975 			ieee80211_auth_challenge(sdata, mgmt, len);
1976 			/* need another frame */
1977 			return RX_MGMT_NONE;
1978 		}
1979 		break;
1980 	default:
1981 		WARN_ONCE(1, "invalid auth alg %d",
1982 			  ifmgd->auth_data->algorithm);
1983 		return RX_MGMT_NONE;
1984 	}
1985 
1986 	sdata_info(sdata, "authenticated\n");
1987 	ifmgd->auth_data->done = true;
1988 	ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
1989 	run_again(ifmgd, ifmgd->auth_data->timeout);
1990 
1991 	if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
1992 	    ifmgd->auth_data->expected_transaction != 2) {
1993 		/*
1994 		 * Report auth frame to user space for processing since another
1995 		 * round of Authentication frames is still needed.
1996 		 */
1997 		return RX_MGMT_CFG80211_RX_AUTH;
1998 	}
1999 
2000 	/* move station state to auth */
2001 	mutex_lock(&sdata->local->sta_mtx);
2002 	sta = sta_info_get(sdata, bssid);
2003 	if (!sta) {
2004 		WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
2005 		goto out_err;
2006 	}
2007 	if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
2008 		sdata_info(sdata, "failed moving %pM to auth\n", bssid);
2009 		goto out_err;
2010 	}
2011 	mutex_unlock(&sdata->local->sta_mtx);
2012 
2013 	return RX_MGMT_CFG80211_RX_AUTH;
2014  out_err:
2015 	mutex_unlock(&sdata->local->sta_mtx);
2016 	/* ignore frame -- wait for timeout */
2017 	return RX_MGMT_NONE;
2018 }
2019 
2020 
2021 static enum rx_mgmt_action __must_check
2022 ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
2023 			 struct ieee80211_mgmt *mgmt, size_t len)
2024 {
2025 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2026 	const u8 *bssid = NULL;
2027 	u16 reason_code;
2028 
2029 	lockdep_assert_held(&ifmgd->mtx);
2030 
2031 	if (len < 24 + 2)
2032 		return RX_MGMT_NONE;
2033 
2034 	if (!ifmgd->associated ||
2035 	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2036 		return RX_MGMT_NONE;
2037 
2038 	bssid = ifmgd->associated->bssid;
2039 
2040 	reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
2041 
2042 	sdata_info(sdata, "deauthenticated from %pM (Reason: %u)\n",
2043 		   bssid, reason_code);
2044 
2045 	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2046 
2047 	mutex_lock(&sdata->local->mtx);
2048 	ieee80211_recalc_idle(sdata->local);
2049 	mutex_unlock(&sdata->local->mtx);
2050 
2051 	return RX_MGMT_CFG80211_DEAUTH;
2052 }
2053 
2054 
2055 static enum rx_mgmt_action __must_check
2056 ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
2057 			   struct ieee80211_mgmt *mgmt, size_t len)
2058 {
2059 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2060 	u16 reason_code;
2061 
2062 	lockdep_assert_held(&ifmgd->mtx);
2063 
2064 	if (len < 24 + 2)
2065 		return RX_MGMT_NONE;
2066 
2067 	if (!ifmgd->associated ||
2068 	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2069 		return RX_MGMT_NONE;
2070 
2071 	reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
2072 
2073 	sdata_info(sdata, "disassociated from %pM (Reason: %u)\n",
2074 		   mgmt->sa, reason_code);
2075 
2076 	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
2077 
2078 	mutex_lock(&sdata->local->mtx);
2079 	ieee80211_recalc_idle(sdata->local);
2080 	mutex_unlock(&sdata->local->mtx);
2081 
2082 	return RX_MGMT_CFG80211_DISASSOC;
2083 }
2084 
2085 static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
2086 				u8 *supp_rates, unsigned int supp_rates_len,
2087 				u32 *rates, u32 *basic_rates,
2088 				bool *have_higher_than_11mbit,
2089 				int *min_rate, int *min_rate_index)
2090 {
2091 	int i, j;
2092 
2093 	for (i = 0; i < supp_rates_len; i++) {
2094 		int rate = (supp_rates[i] & 0x7f) * 5;
2095 		bool is_basic = !!(supp_rates[i] & 0x80);
2096 
2097 		if (rate > 110)
2098 			*have_higher_than_11mbit = true;
2099 
2100 		/*
2101 		 * BSS_MEMBERSHIP_SELECTOR_HT_PHY is defined in 802.11n-2009
2102 		 * 7.3.2.2 as a magic value instead of a rate. Hence, skip it.
2103 		 *
2104 		 * Note: Even through the membership selector and the basic
2105 		 *	 rate flag share the same bit, they are not exactly
2106 		 *	 the same.
2107 		 */
2108 		if (!!(supp_rates[i] & 0x80) &&
2109 		    (supp_rates[i] & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
2110 			continue;
2111 
2112 		for (j = 0; j < sband->n_bitrates; j++) {
2113 			if (sband->bitrates[j].bitrate == rate) {
2114 				*rates |= BIT(j);
2115 				if (is_basic)
2116 					*basic_rates |= BIT(j);
2117 				if (rate < *min_rate) {
2118 					*min_rate = rate;
2119 					*min_rate_index = j;
2120 				}
2121 				break;
2122 			}
2123 		}
2124 	}
2125 }
2126 
2127 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
2128 					 bool assoc)
2129 {
2130 	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
2131 
2132 	lockdep_assert_held(&sdata->u.mgd.mtx);
2133 
2134 	if (!assoc) {
2135 		sta_info_destroy_addr(sdata, assoc_data->bss->bssid);
2136 
2137 		memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
2138 		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2139 		sdata->u.mgd.flags = 0;
2140 		ieee80211_vif_release_channel(sdata);
2141 	}
2142 
2143 	kfree(assoc_data);
2144 	sdata->u.mgd.assoc_data = NULL;
2145 }
2146 
2147 static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
2148 				    struct cfg80211_bss *cbss,
2149 				    struct ieee80211_mgmt *mgmt, size_t len)
2150 {
2151 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2152 	struct ieee80211_local *local = sdata->local;
2153 	struct ieee80211_supported_band *sband;
2154 	struct sta_info *sta;
2155 	u8 *pos;
2156 	u16 capab_info, aid;
2157 	struct ieee802_11_elems elems;
2158 	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2159 	u32 changed = 0;
2160 	int err;
2161 
2162 	/* AssocResp and ReassocResp have identical structure */
2163 
2164 	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
2165 	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2166 
2167 	if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
2168 		sdata_info(sdata, "invalid AID value 0x%x; bits 15:14 not set\n",
2169 			   aid);
2170 	aid &= ~(BIT(15) | BIT(14));
2171 
2172 	ifmgd->broken_ap = false;
2173 
2174 	if (aid == 0 || aid > IEEE80211_MAX_AID) {
2175 		sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
2176 			   aid);
2177 		aid = 0;
2178 		ifmgd->broken_ap = true;
2179 	}
2180 
2181 	pos = mgmt->u.assoc_resp.variable;
2182 	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
2183 
2184 	if (!elems.supp_rates) {
2185 		sdata_info(sdata, "no SuppRates element in AssocResp\n");
2186 		return false;
2187 	}
2188 
2189 	ifmgd->aid = aid;
2190 
2191 	mutex_lock(&sdata->local->sta_mtx);
2192 	/*
2193 	 * station info was already allocated and inserted before
2194 	 * the association and should be available to us
2195 	 */
2196 	sta = sta_info_get(sdata, cbss->bssid);
2197 	if (WARN_ON(!sta)) {
2198 		mutex_unlock(&sdata->local->sta_mtx);
2199 		return false;
2200 	}
2201 
2202 	sband = local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
2203 
2204 	if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
2205 		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
2206 				elems.ht_cap_elem, &sta->sta.ht_cap);
2207 
2208 	sta->supports_40mhz =
2209 		sta->sta.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40;
2210 
2211 	if (elems.vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
2212 		ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
2213 						    elems.vht_cap_elem,
2214 						    &sta->sta.vht_cap);
2215 
2216 	rate_control_rate_init(sta);
2217 
2218 	if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED)
2219 		set_sta_flag(sta, WLAN_STA_MFP);
2220 
2221 	if (elems.wmm_param)
2222 		set_sta_flag(sta, WLAN_STA_WME);
2223 
2224 	err = sta_info_move_state(sta, IEEE80211_STA_AUTH);
2225 	if (!err)
2226 		err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
2227 	if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
2228 		err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
2229 	if (err) {
2230 		sdata_info(sdata,
2231 			   "failed to move station %pM to desired state\n",
2232 			   sta->sta.addr);
2233 		WARN_ON(__sta_info_destroy(sta));
2234 		mutex_unlock(&sdata->local->sta_mtx);
2235 		return false;
2236 	}
2237 
2238 	mutex_unlock(&sdata->local->sta_mtx);
2239 
2240 	/*
2241 	 * Always handle WMM once after association regardless
2242 	 * of the first value the AP uses. Setting -1 here has
2243 	 * that effect because the AP values is an unsigned
2244 	 * 4-bit value.
2245 	 */
2246 	ifmgd->wmm_last_param_set = -1;
2247 
2248 	if (elems.wmm_param)
2249 		ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
2250 					 elems.wmm_param_len);
2251 	else
2252 		ieee80211_set_wmm_default(sdata, false);
2253 	changed |= BSS_CHANGED_QOS;
2254 
2255 	if (elems.ht_operation && elems.wmm_param &&
2256 	    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
2257 		changed |= ieee80211_config_ht_tx(sdata, elems.ht_operation,
2258 						  cbss->bssid, false);
2259 
2260 	/* set AID and assoc capability,
2261 	 * ieee80211_set_associated() will tell the driver */
2262 	bss_conf->aid = aid;
2263 	bss_conf->assoc_capability = capab_info;
2264 	ieee80211_set_associated(sdata, cbss, changed);
2265 
2266 	/*
2267 	 * If we're using 4-addr mode, let the AP know that we're
2268 	 * doing so, so that it can create the STA VLAN on its side
2269 	 */
2270 	if (ifmgd->use_4addr)
2271 		ieee80211_send_4addr_nullfunc(local, sdata);
2272 
2273 	/*
2274 	 * Start timer to probe the connection to the AP now.
2275 	 * Also start the timer that will detect beacon loss.
2276 	 */
2277 	ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
2278 	ieee80211_sta_reset_beacon_monitor(sdata);
2279 
2280 	return true;
2281 }
2282 
2283 static enum rx_mgmt_action __must_check
2284 ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
2285 			     struct ieee80211_mgmt *mgmt, size_t len,
2286 			     struct cfg80211_bss **bss)
2287 {
2288 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2289 	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
2290 	u16 capab_info, status_code, aid;
2291 	struct ieee802_11_elems elems;
2292 	u8 *pos;
2293 	bool reassoc;
2294 
2295 	lockdep_assert_held(&ifmgd->mtx);
2296 
2297 	if (!assoc_data)
2298 		return RX_MGMT_NONE;
2299 	if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
2300 		return RX_MGMT_NONE;
2301 
2302 	/*
2303 	 * AssocResp and ReassocResp have identical structure, so process both
2304 	 * of them in this function.
2305 	 */
2306 
2307 	if (len < 24 + 6)
2308 		return RX_MGMT_NONE;
2309 
2310 	reassoc = ieee80211_is_reassoc_req(mgmt->frame_control);
2311 	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2312 	status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
2313 	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
2314 
2315 	sdata_info(sdata,
2316 		   "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
2317 		   reassoc ? "Rea" : "A", mgmt->sa,
2318 		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
2319 
2320 	pos = mgmt->u.assoc_resp.variable;
2321 	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
2322 
2323 	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
2324 	    elems.timeout_int && elems.timeout_int_len == 5 &&
2325 	    elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) {
2326 		u32 tu, ms;
2327 		tu = get_unaligned_le32(elems.timeout_int + 1);
2328 		ms = tu * 1024 / 1000;
2329 		sdata_info(sdata,
2330 			   "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
2331 			   mgmt->sa, tu, ms);
2332 		assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
2333 		if (ms > IEEE80211_ASSOC_TIMEOUT)
2334 			run_again(ifmgd, assoc_data->timeout);
2335 		return RX_MGMT_NONE;
2336 	}
2337 
2338 	*bss = assoc_data->bss;
2339 
2340 	if (status_code != WLAN_STATUS_SUCCESS) {
2341 		sdata_info(sdata, "%pM denied association (code=%d)\n",
2342 			   mgmt->sa, status_code);
2343 		ieee80211_destroy_assoc_data(sdata, false);
2344 	} else {
2345 		if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
2346 			/* oops -- internal error -- send timeout for now */
2347 			ieee80211_destroy_assoc_data(sdata, false);
2348 			cfg80211_put_bss(*bss);
2349 			return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
2350 		}
2351 		sdata_info(sdata, "associated\n");
2352 
2353 		/*
2354 		 * destroy assoc_data afterwards, as otherwise an idle
2355 		 * recalc after assoc_data is NULL but before associated
2356 		 * is set can cause the interface to go idle
2357 		 */
2358 		ieee80211_destroy_assoc_data(sdata, true);
2359 	}
2360 
2361 	return RX_MGMT_CFG80211_RX_ASSOC;
2362 }
2363 
2364 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
2365 				  struct ieee80211_mgmt *mgmt, size_t len,
2366 				  struct ieee80211_rx_status *rx_status,
2367 				  struct ieee802_11_elems *elems,
2368 				  bool beacon)
2369 {
2370 	struct ieee80211_local *local = sdata->local;
2371 	int freq;
2372 	struct ieee80211_bss *bss;
2373 	struct ieee80211_channel *channel;
2374 	bool need_ps = false;
2375 
2376 	if (sdata->u.mgd.associated &&
2377 	    ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) {
2378 		bss = (void *)sdata->u.mgd.associated->priv;
2379 		/* not previously set so we may need to recalc */
2380 		need_ps = !bss->dtim_period;
2381 	}
2382 
2383 	if (elems->ds_params && elems->ds_params_len == 1)
2384 		freq = ieee80211_channel_to_frequency(elems->ds_params[0],
2385 						      rx_status->band);
2386 	else
2387 		freq = rx_status->freq;
2388 
2389 	channel = ieee80211_get_channel(local->hw.wiphy, freq);
2390 
2391 	if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
2392 		return;
2393 
2394 	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
2395 					channel, beacon);
2396 	if (bss)
2397 		ieee80211_rx_bss_put(local, bss);
2398 
2399 	if (!sdata->u.mgd.associated)
2400 		return;
2401 
2402 	if (need_ps) {
2403 		mutex_lock(&local->iflist_mtx);
2404 		ieee80211_recalc_ps(local, -1);
2405 		mutex_unlock(&local->iflist_mtx);
2406 	}
2407 
2408 	if (elems->ch_switch_ie &&
2409 	    memcmp(mgmt->bssid, sdata->u.mgd.associated->bssid, ETH_ALEN) == 0)
2410 		ieee80211_sta_process_chanswitch(sdata, elems->ch_switch_ie,
2411 						 bss, rx_status->mactime);
2412 }
2413 
2414 
2415 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
2416 					 struct sk_buff *skb)
2417 {
2418 	struct ieee80211_mgmt *mgmt = (void *)skb->data;
2419 	struct ieee80211_if_managed *ifmgd;
2420 	struct ieee80211_rx_status *rx_status = (void *) skb->cb;
2421 	size_t baselen, len = skb->len;
2422 	struct ieee802_11_elems elems;
2423 
2424 	ifmgd = &sdata->u.mgd;
2425 
2426 	ASSERT_MGD_MTX(ifmgd);
2427 
2428 	if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
2429 		return; /* ignore ProbeResp to foreign address */
2430 
2431 	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
2432 	if (baselen > len)
2433 		return;
2434 
2435 	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
2436 				&elems);
2437 
2438 	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
2439 
2440 	if (ifmgd->associated &&
2441 	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2442 		ieee80211_reset_ap_probe(sdata);
2443 
2444 	if (ifmgd->auth_data && !ifmgd->auth_data->bss->proberesp_ies &&
2445 	    ether_addr_equal(mgmt->bssid, ifmgd->auth_data->bss->bssid)) {
2446 		/* got probe response, continue with auth */
2447 		sdata_info(sdata, "direct probe responded\n");
2448 		ifmgd->auth_data->tries = 0;
2449 		ifmgd->auth_data->timeout = jiffies;
2450 		run_again(ifmgd, ifmgd->auth_data->timeout);
2451 	}
2452 }
2453 
2454 /*
2455  * This is the canonical list of information elements we care about,
2456  * the filter code also gives us all changes to the Microsoft OUI
2457  * (00:50:F2) vendor IE which is used for WMM which we need to track.
2458  *
2459  * We implement beacon filtering in software since that means we can
2460  * avoid processing the frame here and in cfg80211, and userspace
2461  * will not be able to tell whether the hardware supports it or not.
2462  *
2463  * XXX: This list needs to be dynamic -- userspace needs to be able to
2464  *	add items it requires. It also needs to be able to tell us to
2465  *	look out for other vendor IEs.
2466  */
2467 static const u64 care_about_ies =
2468 	(1ULL << WLAN_EID_COUNTRY) |
2469 	(1ULL << WLAN_EID_ERP_INFO) |
2470 	(1ULL << WLAN_EID_CHANNEL_SWITCH) |
2471 	(1ULL << WLAN_EID_PWR_CONSTRAINT) |
2472 	(1ULL << WLAN_EID_HT_CAPABILITY) |
2473 	(1ULL << WLAN_EID_HT_OPERATION);
2474 
2475 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
2476 				     struct ieee80211_mgmt *mgmt,
2477 				     size_t len,
2478 				     struct ieee80211_rx_status *rx_status)
2479 {
2480 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2481 	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2482 	size_t baselen;
2483 	struct ieee802_11_elems elems;
2484 	struct ieee80211_local *local = sdata->local;
2485 	struct ieee80211_chanctx_conf *chanctx_conf;
2486 	struct ieee80211_channel *chan;
2487 	u32 changed = 0;
2488 	bool erp_valid;
2489 	u8 erp_value = 0;
2490 	u32 ncrc;
2491 	u8 *bssid;
2492 
2493 	lockdep_assert_held(&ifmgd->mtx);
2494 
2495 	/* Process beacon from the current BSS */
2496 	baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
2497 	if (baselen > len)
2498 		return;
2499 
2500 	rcu_read_lock();
2501 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2502 	if (!chanctx_conf) {
2503 		rcu_read_unlock();
2504 		return;
2505 	}
2506 
2507 	if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
2508 		rcu_read_unlock();
2509 		return;
2510 	}
2511 	chan = chanctx_conf->def.chan;
2512 	rcu_read_unlock();
2513 
2514 	if (ifmgd->assoc_data && !ifmgd->assoc_data->have_beacon &&
2515 	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
2516 		ieee802_11_parse_elems(mgmt->u.beacon.variable,
2517 				       len - baselen, &elems);
2518 
2519 		ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems,
2520 				      false);
2521 		ifmgd->assoc_data->have_beacon = true;
2522 		ifmgd->assoc_data->sent_assoc = false;
2523 		/* continue assoc process */
2524 		ifmgd->assoc_data->timeout = jiffies;
2525 		run_again(ifmgd, ifmgd->assoc_data->timeout);
2526 		return;
2527 	}
2528 
2529 	if (!ifmgd->associated ||
2530 	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2531 		return;
2532 	bssid = ifmgd->associated->bssid;
2533 
2534 	/* Track average RSSI from the Beacon frames of the current AP */
2535 	ifmgd->last_beacon_signal = rx_status->signal;
2536 	if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
2537 		ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
2538 		ifmgd->ave_beacon_signal = rx_status->signal * 16;
2539 		ifmgd->last_cqm_event_signal = 0;
2540 		ifmgd->count_beacon_signal = 1;
2541 		ifmgd->last_ave_beacon_signal = 0;
2542 	} else {
2543 		ifmgd->ave_beacon_signal =
2544 			(IEEE80211_SIGNAL_AVE_WEIGHT * rx_status->signal * 16 +
2545 			 (16 - IEEE80211_SIGNAL_AVE_WEIGHT) *
2546 			 ifmgd->ave_beacon_signal) / 16;
2547 		ifmgd->count_beacon_signal++;
2548 	}
2549 
2550 	if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
2551 	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
2552 		int sig = ifmgd->ave_beacon_signal;
2553 		int last_sig = ifmgd->last_ave_beacon_signal;
2554 
2555 		/*
2556 		 * if signal crosses either of the boundaries, invoke callback
2557 		 * with appropriate parameters
2558 		 */
2559 		if (sig > ifmgd->rssi_max_thold &&
2560 		    (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
2561 			ifmgd->last_ave_beacon_signal = sig;
2562 			drv_rssi_callback(local, RSSI_EVENT_HIGH);
2563 		} else if (sig < ifmgd->rssi_min_thold &&
2564 			   (last_sig >= ifmgd->rssi_max_thold ||
2565 			   last_sig == 0)) {
2566 			ifmgd->last_ave_beacon_signal = sig;
2567 			drv_rssi_callback(local, RSSI_EVENT_LOW);
2568 		}
2569 	}
2570 
2571 	if (bss_conf->cqm_rssi_thold &&
2572 	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
2573 	    !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
2574 		int sig = ifmgd->ave_beacon_signal / 16;
2575 		int last_event = ifmgd->last_cqm_event_signal;
2576 		int thold = bss_conf->cqm_rssi_thold;
2577 		int hyst = bss_conf->cqm_rssi_hyst;
2578 		if (sig < thold &&
2579 		    (last_event == 0 || sig < last_event - hyst)) {
2580 			ifmgd->last_cqm_event_signal = sig;
2581 			ieee80211_cqm_rssi_notify(
2582 				&sdata->vif,
2583 				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
2584 				GFP_KERNEL);
2585 		} else if (sig > thold &&
2586 			   (last_event == 0 || sig > last_event + hyst)) {
2587 			ifmgd->last_cqm_event_signal = sig;
2588 			ieee80211_cqm_rssi_notify(
2589 				&sdata->vif,
2590 				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
2591 				GFP_KERNEL);
2592 		}
2593 	}
2594 
2595 	if (ifmgd->flags & IEEE80211_STA_BEACON_POLL) {
2596 		mlme_dbg_ratelimited(sdata,
2597 				     "cancelling probereq poll due to a received beacon\n");
2598 		mutex_lock(&local->mtx);
2599 		ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL;
2600 		ieee80211_run_deferred_scan(local);
2601 		mutex_unlock(&local->mtx);
2602 
2603 		mutex_lock(&local->iflist_mtx);
2604 		ieee80211_recalc_ps(local, -1);
2605 		mutex_unlock(&local->iflist_mtx);
2606 	}
2607 
2608 	/*
2609 	 * Push the beacon loss detection into the future since
2610 	 * we are processing a beacon from the AP just now.
2611 	 */
2612 	ieee80211_sta_reset_beacon_monitor(sdata);
2613 
2614 	ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
2615 	ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
2616 					  len - baselen, &elems,
2617 					  care_about_ies, ncrc);
2618 
2619 	if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
2620 		bool directed_tim = ieee80211_check_tim(elems.tim,
2621 							elems.tim_len,
2622 							ifmgd->aid);
2623 		if (directed_tim) {
2624 			if (local->hw.conf.dynamic_ps_timeout > 0) {
2625 				if (local->hw.conf.flags & IEEE80211_CONF_PS) {
2626 					local->hw.conf.flags &= ~IEEE80211_CONF_PS;
2627 					ieee80211_hw_config(local,
2628 							    IEEE80211_CONF_CHANGE_PS);
2629 				}
2630 				ieee80211_send_nullfunc(local, sdata, 0);
2631 			} else if (!local->pspolling && sdata->u.mgd.powersave) {
2632 				local->pspolling = true;
2633 
2634 				/*
2635 				 * Here is assumed that the driver will be
2636 				 * able to send ps-poll frame and receive a
2637 				 * response even though power save mode is
2638 				 * enabled, but some drivers might require
2639 				 * to disable power save here. This needs
2640 				 * to be investigated.
2641 				 */
2642 				ieee80211_send_pspoll(local, sdata);
2643 			}
2644 		}
2645 	}
2646 
2647 	if (sdata->vif.p2p) {
2648 		u8 noa[2];
2649 		int ret;
2650 
2651 		ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
2652 					    len - baselen,
2653 					    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
2654 					    noa, sizeof(noa));
2655 		if (ret >= 2 && sdata->u.mgd.p2p_noa_index != noa[0]) {
2656 			bss_conf->p2p_oppps = noa[1] & 0x80;
2657 			bss_conf->p2p_ctwindow = noa[1] & 0x7f;
2658 			changed |= BSS_CHANGED_P2P_PS;
2659 			sdata->u.mgd.p2p_noa_index = noa[0];
2660 			/*
2661 			 * make sure we update all information, the CRC
2662 			 * mechanism doesn't look at P2P attributes.
2663 			 */
2664 			ifmgd->beacon_crc_valid = false;
2665 		}
2666 	}
2667 
2668 	if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
2669 		return;
2670 	ifmgd->beacon_crc = ncrc;
2671 	ifmgd->beacon_crc_valid = true;
2672 
2673 	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems,
2674 			      true);
2675 
2676 	if (ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
2677 				     elems.wmm_param_len))
2678 		changed |= BSS_CHANGED_QOS;
2679 
2680 	if (elems.erp_info && elems.erp_info_len >= 1) {
2681 		erp_valid = true;
2682 		erp_value = elems.erp_info[0];
2683 	} else {
2684 		erp_valid = false;
2685 	}
2686 	changed |= ieee80211_handle_bss_capability(sdata,
2687 			le16_to_cpu(mgmt->u.beacon.capab_info),
2688 			erp_valid, erp_value);
2689 
2690 
2691 	if (elems.ht_cap_elem && elems.ht_operation && elems.wmm_param &&
2692 	    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
2693 		changed |= ieee80211_config_ht_tx(sdata, elems.ht_operation,
2694 						  bssid, true);
2695 
2696 	if (elems.country_elem && elems.pwr_constr_elem &&
2697 	    mgmt->u.probe_resp.capab_info &
2698 				cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT))
2699 		changed |= ieee80211_handle_pwr_constr(sdata, chan,
2700 						       elems.country_elem,
2701 						       elems.country_elem_len,
2702 						       elems.pwr_constr_elem);
2703 
2704 	ieee80211_bss_info_change_notify(sdata, changed);
2705 }
2706 
2707 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
2708 				  struct sk_buff *skb)
2709 {
2710 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2711 	struct ieee80211_rx_status *rx_status;
2712 	struct ieee80211_mgmt *mgmt;
2713 	struct cfg80211_bss *bss = NULL;
2714 	enum rx_mgmt_action rma = RX_MGMT_NONE;
2715 	u16 fc;
2716 
2717 	rx_status = (struct ieee80211_rx_status *) skb->cb;
2718 	mgmt = (struct ieee80211_mgmt *) skb->data;
2719 	fc = le16_to_cpu(mgmt->frame_control);
2720 
2721 	mutex_lock(&ifmgd->mtx);
2722 
2723 	switch (fc & IEEE80211_FCTL_STYPE) {
2724 	case IEEE80211_STYPE_BEACON:
2725 		ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
2726 		break;
2727 	case IEEE80211_STYPE_PROBE_RESP:
2728 		ieee80211_rx_mgmt_probe_resp(sdata, skb);
2729 		break;
2730 	case IEEE80211_STYPE_AUTH:
2731 		rma = ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
2732 		break;
2733 	case IEEE80211_STYPE_DEAUTH:
2734 		rma = ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
2735 		break;
2736 	case IEEE80211_STYPE_DISASSOC:
2737 		rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
2738 		break;
2739 	case IEEE80211_STYPE_ASSOC_RESP:
2740 	case IEEE80211_STYPE_REASSOC_RESP:
2741 		rma = ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, &bss);
2742 		break;
2743 	case IEEE80211_STYPE_ACTION:
2744 		switch (mgmt->u.action.category) {
2745 		case WLAN_CATEGORY_SPECTRUM_MGMT:
2746 			ieee80211_sta_process_chanswitch(sdata,
2747 					&mgmt->u.action.u.chan_switch.sw_elem,
2748 					(void *)ifmgd->associated->priv,
2749 					rx_status->mactime);
2750 			break;
2751 		}
2752 	}
2753 	mutex_unlock(&ifmgd->mtx);
2754 
2755 	switch (rma) {
2756 	case RX_MGMT_NONE:
2757 		/* no action */
2758 		break;
2759 	case RX_MGMT_CFG80211_DEAUTH:
2760 		cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
2761 		break;
2762 	case RX_MGMT_CFG80211_DISASSOC:
2763 		cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
2764 		break;
2765 	case RX_MGMT_CFG80211_RX_AUTH:
2766 		cfg80211_send_rx_auth(sdata->dev, (u8 *)mgmt, skb->len);
2767 		break;
2768 	case RX_MGMT_CFG80211_RX_ASSOC:
2769 		cfg80211_send_rx_assoc(sdata->dev, bss, (u8 *)mgmt, skb->len);
2770 		break;
2771 	case RX_MGMT_CFG80211_ASSOC_TIMEOUT:
2772 		cfg80211_send_assoc_timeout(sdata->dev, mgmt->bssid);
2773 		break;
2774 	default:
2775 		WARN(1, "unexpected: %d", rma);
2776 	}
2777 }
2778 
2779 static void ieee80211_sta_timer(unsigned long data)
2780 {
2781 	struct ieee80211_sub_if_data *sdata =
2782 		(struct ieee80211_sub_if_data *) data;
2783 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2784 	struct ieee80211_local *local = sdata->local;
2785 
2786 	if (local->quiescing) {
2787 		set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
2788 		return;
2789 	}
2790 
2791 	ieee80211_queue_work(&local->hw, &sdata->work);
2792 }
2793 
2794 static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
2795 					  u8 *bssid, u8 reason)
2796 {
2797 	struct ieee80211_local *local = sdata->local;
2798 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2799 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2800 
2801 	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
2802 			       false, frame_buf);
2803 	mutex_unlock(&ifmgd->mtx);
2804 
2805 	/*
2806 	 * must be outside lock due to cfg80211,
2807 	 * but that's not a problem.
2808 	 */
2809 	cfg80211_send_deauth(sdata->dev, frame_buf, IEEE80211_DEAUTH_FRAME_LEN);
2810 
2811 	mutex_lock(&local->mtx);
2812 	ieee80211_recalc_idle(local);
2813 	mutex_unlock(&local->mtx);
2814 
2815 	mutex_lock(&ifmgd->mtx);
2816 }
2817 
2818 static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
2819 {
2820 	struct ieee80211_local *local = sdata->local;
2821 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2822 	struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
2823 
2824 	lockdep_assert_held(&ifmgd->mtx);
2825 
2826 	if (WARN_ON_ONCE(!auth_data))
2827 		return -EINVAL;
2828 
2829 	auth_data->tries++;
2830 
2831 	if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
2832 		sdata_info(sdata, "authentication with %pM timed out\n",
2833 			   auth_data->bss->bssid);
2834 
2835 		/*
2836 		 * Most likely AP is not in the range so remove the
2837 		 * bss struct for that AP.
2838 		 */
2839 		cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);
2840 
2841 		return -ETIMEDOUT;
2842 	}
2843 
2844 	drv_mgd_prepare_tx(local, sdata);
2845 
2846 	if (auth_data->bss->proberesp_ies) {
2847 		u16 trans = 1;
2848 		u16 status = 0;
2849 
2850 		sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
2851 			   auth_data->bss->bssid, auth_data->tries,
2852 			   IEEE80211_AUTH_MAX_TRIES);
2853 
2854 		auth_data->expected_transaction = 2;
2855 
2856 		if (auth_data->algorithm == WLAN_AUTH_SAE) {
2857 			trans = auth_data->sae_trans;
2858 			status = auth_data->sae_status;
2859 			auth_data->expected_transaction = trans;
2860 		}
2861 
2862 		ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
2863 				    auth_data->data, auth_data->data_len,
2864 				    auth_data->bss->bssid,
2865 				    auth_data->bss->bssid, NULL, 0, 0);
2866 	} else {
2867 		const u8 *ssidie;
2868 
2869 		sdata_info(sdata, "direct probe to %pM (try %d/%i)\n",
2870 			   auth_data->bss->bssid, auth_data->tries,
2871 			   IEEE80211_AUTH_MAX_TRIES);
2872 
2873 		rcu_read_lock();
2874 		ssidie = ieee80211_bss_get_ie(auth_data->bss, WLAN_EID_SSID);
2875 		if (!ssidie) {
2876 			rcu_read_unlock();
2877 			return -EINVAL;
2878 		}
2879 		/*
2880 		 * Direct probe is sent to broadcast address as some APs
2881 		 * will not answer to direct packet in unassociated state.
2882 		 */
2883 		ieee80211_send_probe_req(sdata, NULL, ssidie + 2, ssidie[1],
2884 					 NULL, 0, (u32) -1, true, false,
2885 					 auth_data->bss->channel, false);
2886 		rcu_read_unlock();
2887 	}
2888 
2889 	auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
2890 	run_again(ifmgd, auth_data->timeout);
2891 
2892 	return 0;
2893 }
2894 
2895 static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
2896 {
2897 	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
2898 	struct ieee80211_local *local = sdata->local;
2899 
2900 	lockdep_assert_held(&sdata->u.mgd.mtx);
2901 
2902 	assoc_data->tries++;
2903 	if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
2904 		sdata_info(sdata, "association with %pM timed out\n",
2905 			   assoc_data->bss->bssid);
2906 
2907 		/*
2908 		 * Most likely AP is not in the range so remove the
2909 		 * bss struct for that AP.
2910 		 */
2911 		cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);
2912 
2913 		return -ETIMEDOUT;
2914 	}
2915 
2916 	sdata_info(sdata, "associate with %pM (try %d/%d)\n",
2917 		   assoc_data->bss->bssid, assoc_data->tries,
2918 		   IEEE80211_ASSOC_MAX_TRIES);
2919 	ieee80211_send_assoc(sdata);
2920 
2921 	assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
2922 	run_again(&sdata->u.mgd, assoc_data->timeout);
2923 
2924 	return 0;
2925 }
2926 
2927 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
2928 {
2929 	struct ieee80211_local *local = sdata->local;
2930 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2931 
2932 	mutex_lock(&ifmgd->mtx);
2933 
2934 	if (ifmgd->auth_data &&
2935 	    time_after(jiffies, ifmgd->auth_data->timeout)) {
2936 		if (ifmgd->auth_data->done) {
2937 			/*
2938 			 * ok ... we waited for assoc but userspace didn't,
2939 			 * so let's just kill the auth data
2940 			 */
2941 			ieee80211_destroy_auth_data(sdata, false);
2942 		} else if (ieee80211_probe_auth(sdata)) {
2943 			u8 bssid[ETH_ALEN];
2944 
2945 			memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
2946 
2947 			ieee80211_destroy_auth_data(sdata, false);
2948 
2949 			mutex_unlock(&ifmgd->mtx);
2950 			cfg80211_send_auth_timeout(sdata->dev, bssid);
2951 			mutex_lock(&ifmgd->mtx);
2952 		}
2953 	} else if (ifmgd->auth_data)
2954 		run_again(ifmgd, ifmgd->auth_data->timeout);
2955 
2956 	if (ifmgd->assoc_data &&
2957 	    time_after(jiffies, ifmgd->assoc_data->timeout)) {
2958 		if (!ifmgd->assoc_data->have_beacon ||
2959 		    ieee80211_do_assoc(sdata)) {
2960 			u8 bssid[ETH_ALEN];
2961 
2962 			memcpy(bssid, ifmgd->assoc_data->bss->bssid, ETH_ALEN);
2963 
2964 			ieee80211_destroy_assoc_data(sdata, false);
2965 
2966 			mutex_unlock(&ifmgd->mtx);
2967 			cfg80211_send_assoc_timeout(sdata->dev, bssid);
2968 			mutex_lock(&ifmgd->mtx);
2969 		}
2970 	} else if (ifmgd->assoc_data)
2971 		run_again(ifmgd, ifmgd->assoc_data->timeout);
2972 
2973 	if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
2974 			    IEEE80211_STA_CONNECTION_POLL) &&
2975 	    ifmgd->associated) {
2976 		u8 bssid[ETH_ALEN];
2977 		int max_tries;
2978 
2979 		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
2980 
2981 		if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
2982 			max_tries = max_nullfunc_tries;
2983 		else
2984 			max_tries = max_probe_tries;
2985 
2986 		/* ACK received for nullfunc probing frame */
2987 		if (!ifmgd->probe_send_count)
2988 			ieee80211_reset_ap_probe(sdata);
2989 		else if (ifmgd->nullfunc_failed) {
2990 			if (ifmgd->probe_send_count < max_tries) {
2991 				mlme_dbg(sdata,
2992 					 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
2993 					 bssid, ifmgd->probe_send_count,
2994 					 max_tries);
2995 				ieee80211_mgd_probe_ap_send(sdata);
2996 			} else {
2997 				mlme_dbg(sdata,
2998 					 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
2999 					 bssid);
3000 				ieee80211_sta_connection_lost(sdata, bssid,
3001 					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
3002 			}
3003 		} else if (time_is_after_jiffies(ifmgd->probe_timeout))
3004 			run_again(ifmgd, ifmgd->probe_timeout);
3005 		else if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
3006 			mlme_dbg(sdata,
3007 				 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
3008 				 bssid, probe_wait_ms);
3009 			ieee80211_sta_connection_lost(sdata, bssid,
3010 				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
3011 		} else if (ifmgd->probe_send_count < max_tries) {
3012 			mlme_dbg(sdata,
3013 				 "No probe response from AP %pM after %dms, try %d/%i\n",
3014 				 bssid, probe_wait_ms,
3015 				 ifmgd->probe_send_count, max_tries);
3016 			ieee80211_mgd_probe_ap_send(sdata);
3017 		} else {
3018 			/*
3019 			 * We actually lost the connection ... or did we?
3020 			 * Let's make sure!
3021 			 */
3022 			wiphy_debug(local->hw.wiphy,
3023 				    "%s: No probe response from AP %pM"
3024 				    " after %dms, disconnecting.\n",
3025 				    sdata->name,
3026 				    bssid, probe_wait_ms);
3027 
3028 			ieee80211_sta_connection_lost(sdata, bssid,
3029 				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
3030 		}
3031 	}
3032 
3033 	mutex_unlock(&ifmgd->mtx);
3034 
3035 	mutex_lock(&local->mtx);
3036 	ieee80211_recalc_idle(local);
3037 	mutex_unlock(&local->mtx);
3038 }
3039 
3040 static void ieee80211_sta_bcn_mon_timer(unsigned long data)
3041 {
3042 	struct ieee80211_sub_if_data *sdata =
3043 		(struct ieee80211_sub_if_data *) data;
3044 	struct ieee80211_local *local = sdata->local;
3045 
3046 	if (local->quiescing)
3047 		return;
3048 
3049 	ieee80211_queue_work(&sdata->local->hw,
3050 			     &sdata->u.mgd.beacon_connection_loss_work);
3051 }
3052 
3053 static void ieee80211_sta_conn_mon_timer(unsigned long data)
3054 {
3055 	struct ieee80211_sub_if_data *sdata =
3056 		(struct ieee80211_sub_if_data *) data;
3057 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3058 	struct ieee80211_local *local = sdata->local;
3059 
3060 	if (local->quiescing)
3061 		return;
3062 
3063 	ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
3064 }
3065 
3066 static void ieee80211_sta_monitor_work(struct work_struct *work)
3067 {
3068 	struct ieee80211_sub_if_data *sdata =
3069 		container_of(work, struct ieee80211_sub_if_data,
3070 			     u.mgd.monitor_work);
3071 
3072 	ieee80211_mgd_probe_ap(sdata, false);
3073 }
3074 
3075 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
3076 {
3077 	u32 flags;
3078 
3079 	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
3080 		__ieee80211_stop_poll(sdata);
3081 
3082 		/* let's probe the connection once */
3083 		flags = sdata->local->hw.flags;
3084 		if (!(flags & IEEE80211_HW_CONNECTION_MONITOR))
3085 			ieee80211_queue_work(&sdata->local->hw,
3086 					     &sdata->u.mgd.monitor_work);
3087 		/* and do all the other regular work too */
3088 		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3089 	}
3090 }
3091 
3092 #ifdef CONFIG_PM
3093 void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
3094 {
3095 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3096 
3097 	/*
3098 	 * we need to use atomic bitops for the running bits
3099 	 * only because both timers might fire at the same
3100 	 * time -- the code here is properly synchronised.
3101 	 */
3102 
3103 	cancel_work_sync(&ifmgd->request_smps_work);
3104 
3105 	cancel_work_sync(&ifmgd->monitor_work);
3106 	cancel_work_sync(&ifmgd->beacon_connection_loss_work);
3107 	cancel_work_sync(&ifmgd->csa_connection_drop_work);
3108 	if (del_timer_sync(&ifmgd->timer))
3109 		set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
3110 
3111 	cancel_work_sync(&ifmgd->chswitch_work);
3112 	if (del_timer_sync(&ifmgd->chswitch_timer))
3113 		set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running);
3114 
3115 	/* these will just be re-established on connection */
3116 	del_timer_sync(&ifmgd->conn_mon_timer);
3117 	del_timer_sync(&ifmgd->bcn_mon_timer);
3118 }
3119 
3120 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
3121 {
3122 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3123 
3124 	if (!ifmgd->associated)
3125 		return;
3126 
3127 	if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
3128 		sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
3129 		mutex_lock(&ifmgd->mtx);
3130 		if (ifmgd->associated) {
3131 			mlme_dbg(sdata,
3132 				 "driver requested disconnect after resume\n");
3133 			ieee80211_sta_connection_lost(sdata,
3134 				ifmgd->associated->bssid,
3135 				WLAN_REASON_UNSPECIFIED);
3136 			mutex_unlock(&ifmgd->mtx);
3137 			return;
3138 		}
3139 		mutex_unlock(&ifmgd->mtx);
3140 	}
3141 
3142 	if (test_and_clear_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running))
3143 		add_timer(&ifmgd->timer);
3144 	if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running))
3145 		add_timer(&ifmgd->chswitch_timer);
3146 	ieee80211_sta_reset_beacon_monitor(sdata);
3147 
3148 	mutex_lock(&sdata->local->mtx);
3149 	ieee80211_restart_sta_timer(sdata);
3150 	mutex_unlock(&sdata->local->mtx);
3151 }
3152 #endif
3153 
3154 /* interface setup */
3155 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
3156 {
3157 	struct ieee80211_if_managed *ifmgd;
3158 
3159 	ifmgd = &sdata->u.mgd;
3160 	INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
3161 	INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
3162 	INIT_WORK(&ifmgd->beacon_connection_loss_work,
3163 		  ieee80211_beacon_connection_loss_work);
3164 	INIT_WORK(&ifmgd->csa_connection_drop_work,
3165 		  ieee80211_csa_connection_drop_work);
3166 	INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_work);
3167 	setup_timer(&ifmgd->timer, ieee80211_sta_timer,
3168 		    (unsigned long) sdata);
3169 	setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
3170 		    (unsigned long) sdata);
3171 	setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer,
3172 		    (unsigned long) sdata);
3173 	setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
3174 		    (unsigned long) sdata);
3175 
3176 	ifmgd->flags = 0;
3177 	ifmgd->powersave = sdata->wdev.ps;
3178 	ifmgd->uapsd_queues = IEEE80211_DEFAULT_UAPSD_QUEUES;
3179 	ifmgd->uapsd_max_sp_len = IEEE80211_DEFAULT_MAX_SP_LEN;
3180 
3181 	mutex_init(&ifmgd->mtx);
3182 
3183 	if (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS)
3184 		ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
3185 	else
3186 		ifmgd->req_smps = IEEE80211_SMPS_OFF;
3187 }
3188 
3189 /* scan finished notification */
3190 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
3191 {
3192 	struct ieee80211_sub_if_data *sdata;
3193 
3194 	/* Restart STA timers */
3195 	rcu_read_lock();
3196 	list_for_each_entry_rcu(sdata, &local->interfaces, list)
3197 		ieee80211_restart_sta_timer(sdata);
3198 	rcu_read_unlock();
3199 }
3200 
3201 int ieee80211_max_network_latency(struct notifier_block *nb,
3202 				  unsigned long data, void *dummy)
3203 {
3204 	s32 latency_usec = (s32) data;
3205 	struct ieee80211_local *local =
3206 		container_of(nb, struct ieee80211_local,
3207 			     network_latency_notifier);
3208 
3209 	mutex_lock(&local->iflist_mtx);
3210 	ieee80211_recalc_ps(local, latency_usec);
3211 	mutex_unlock(&local->iflist_mtx);
3212 
3213 	return 0;
3214 }
3215 
3216 static u32 chandef_downgrade(struct cfg80211_chan_def *c)
3217 {
3218 	u32 ret;
3219 	int tmp;
3220 
3221 	switch (c->width) {
3222 	case NL80211_CHAN_WIDTH_20:
3223 		c->width = NL80211_CHAN_WIDTH_20_NOHT;
3224 		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
3225 		break;
3226 	case NL80211_CHAN_WIDTH_40:
3227 		c->width = NL80211_CHAN_WIDTH_20;
3228 		c->center_freq1 = c->chan->center_freq;
3229 		ret = IEEE80211_STA_DISABLE_40MHZ |
3230 		      IEEE80211_STA_DISABLE_VHT;
3231 		break;
3232 	case NL80211_CHAN_WIDTH_80:
3233 		tmp = (30 + c->chan->center_freq - c->center_freq1)/20;
3234 		/* n_P40 */
3235 		tmp /= 2;
3236 		/* freq_P40 */
3237 		c->center_freq1 = c->center_freq1 - 20 + 40 * tmp;
3238 		c->width = NL80211_CHAN_WIDTH_40;
3239 		ret = IEEE80211_STA_DISABLE_VHT;
3240 		break;
3241 	case NL80211_CHAN_WIDTH_80P80:
3242 		c->center_freq2 = 0;
3243 		c->width = NL80211_CHAN_WIDTH_80;
3244 		ret = IEEE80211_STA_DISABLE_80P80MHZ |
3245 		      IEEE80211_STA_DISABLE_160MHZ;
3246 		break;
3247 	case NL80211_CHAN_WIDTH_160:
3248 		/* n_P20 */
3249 		tmp = (70 + c->chan->center_freq - c->center_freq1)/20;
3250 		/* n_P80 */
3251 		tmp /= 4;
3252 		c->center_freq1 = c->center_freq1 - 40 + 80 * tmp;
3253 		c->width = NL80211_CHAN_WIDTH_80;
3254 		ret = IEEE80211_STA_DISABLE_80P80MHZ |
3255 		      IEEE80211_STA_DISABLE_160MHZ;
3256 		break;
3257 	default:
3258 	case NL80211_CHAN_WIDTH_20_NOHT:
3259 		WARN_ON_ONCE(1);
3260 		c->width = NL80211_CHAN_WIDTH_20_NOHT;
3261 		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
3262 		break;
3263 	}
3264 
3265 	WARN_ON_ONCE(!cfg80211_chandef_valid(c));
3266 
3267 	return ret;
3268 }
3269 
3270 static u32
3271 ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
3272 			     struct ieee80211_supported_band *sband,
3273 			     struct ieee80211_channel *channel,
3274 			     const struct ieee80211_ht_operation *ht_oper,
3275 			     const struct ieee80211_vht_operation *vht_oper,
3276 			     struct cfg80211_chan_def *chandef)
3277 {
3278 	struct cfg80211_chan_def vht_chandef;
3279 	u32 ht_cfreq, ret;
3280 
3281 	chandef->chan = channel;
3282 	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3283 	chandef->center_freq1 = channel->center_freq;
3284 	chandef->center_freq2 = 0;
3285 
3286 	if (!ht_oper || !sband->ht_cap.ht_supported) {
3287 		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
3288 		goto out;
3289 	}
3290 
3291 	chandef->width = NL80211_CHAN_WIDTH_20;
3292 
3293 	ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
3294 						  channel->band);
3295 	/* check that channel matches the right operating channel */
3296 	if (channel->center_freq != ht_cfreq) {
3297 		/*
3298 		 * It's possible that some APs are confused here;
3299 		 * Netgear WNDR3700 sometimes reports 4 higher than
3300 		 * the actual channel in association responses, but
3301 		 * since we look at probe response/beacon data here
3302 		 * it should be OK.
3303 		 */
3304 		sdata_info(sdata,
3305 			   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
3306 			   channel->center_freq, ht_cfreq,
3307 			   ht_oper->primary_chan, channel->band);
3308 		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
3309 		goto out;
3310 	}
3311 
3312 	/* check 40 MHz support, if we have it */
3313 	if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
3314 		switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
3315 		case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
3316 			chandef->width = NL80211_CHAN_WIDTH_40;
3317 			chandef->center_freq1 += 10;
3318 			break;
3319 		case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
3320 			chandef->width = NL80211_CHAN_WIDTH_40;
3321 			chandef->center_freq1 -= 10;
3322 			break;
3323 		}
3324 	} else {
3325 		/* 40 MHz (and 80 MHz) must be supported for VHT */
3326 		ret = IEEE80211_STA_DISABLE_VHT;
3327 		goto out;
3328 	}
3329 
3330 	if (!vht_oper || !sband->vht_cap.vht_supported) {
3331 		ret = IEEE80211_STA_DISABLE_VHT;
3332 		goto out;
3333 	}
3334 
3335 	vht_chandef.chan = channel;
3336 	vht_chandef.center_freq1 =
3337 		ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx,
3338 					       channel->band);
3339 	vht_chandef.center_freq2 = 0;
3340 
3341 	if (vht_oper->center_freq_seg2_idx)
3342 		vht_chandef.center_freq2 =
3343 			ieee80211_channel_to_frequency(
3344 				vht_oper->center_freq_seg2_idx,
3345 				channel->band);
3346 
3347 	switch (vht_oper->chan_width) {
3348 	case IEEE80211_VHT_CHANWIDTH_USE_HT:
3349 		vht_chandef.width = chandef->width;
3350 		break;
3351 	case IEEE80211_VHT_CHANWIDTH_80MHZ:
3352 		vht_chandef.width = NL80211_CHAN_WIDTH_80;
3353 		break;
3354 	case IEEE80211_VHT_CHANWIDTH_160MHZ:
3355 		vht_chandef.width = NL80211_CHAN_WIDTH_160;
3356 		break;
3357 	case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
3358 		vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
3359 		break;
3360 	default:
3361 		sdata_info(sdata,
3362 			   "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
3363 			   vht_oper->chan_width);
3364 		ret = IEEE80211_STA_DISABLE_VHT;
3365 		goto out;
3366 	}
3367 
3368 	if (!cfg80211_chandef_valid(&vht_chandef)) {
3369 		sdata_info(sdata,
3370 			   "AP VHT information is invalid, disable VHT\n");
3371 		ret = IEEE80211_STA_DISABLE_VHT;
3372 		goto out;
3373 	}
3374 
3375 	if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
3376 		ret = 0;
3377 		goto out;
3378 	}
3379 
3380 	if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
3381 		sdata_info(sdata,
3382 			   "AP VHT information doesn't match HT, disable VHT\n");
3383 		ret = IEEE80211_STA_DISABLE_VHT;
3384 		goto out;
3385 	}
3386 
3387 	*chandef = vht_chandef;
3388 
3389 	ret = 0;
3390 
3391 	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
3392 					IEEE80211_CHAN_DISABLED)) {
3393 		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
3394 			ret = IEEE80211_STA_DISABLE_HT |
3395 			      IEEE80211_STA_DISABLE_VHT;
3396 			goto out;
3397 		}
3398 
3399 		ret = chandef_downgrade(chandef);
3400 	}
3401 
3402 	if (chandef->width != vht_chandef.width)
3403 		sdata_info(sdata,
3404 			   "local regulatory prevented using AP HT/VHT configuration, downgraded\n");
3405 
3406 out:
3407 	WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
3408 	return ret;
3409 }
3410 
3411 static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
3412 				     struct cfg80211_bss *cbss)
3413 {
3414 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3415 	const u8 *ht_cap_ie, *vht_cap_ie;
3416 	const struct ieee80211_ht_cap *ht_cap;
3417 	const struct ieee80211_vht_cap *vht_cap;
3418 	u8 chains = 1;
3419 
3420 	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
3421 		return chains;
3422 
3423 	ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
3424 	if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
3425 		ht_cap = (void *)(ht_cap_ie + 2);
3426 		chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
3427 		/*
3428 		 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
3429 		 *	 "Tx Unequal Modulation Supported" fields.
3430 		 */
3431 	}
3432 
3433 	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
3434 		return chains;
3435 
3436 	vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
3437 	if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
3438 		u8 nss;
3439 		u16 tx_mcs_map;
3440 
3441 		vht_cap = (void *)(vht_cap_ie + 2);
3442 		tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
3443 		for (nss = 8; nss > 0; nss--) {
3444 			if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
3445 					IEEE80211_VHT_MCS_NOT_SUPPORTED)
3446 				break;
3447 		}
3448 		/* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
3449 		chains = max(chains, nss);
3450 	}
3451 
3452 	return chains;
3453 }
3454 
3455 static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
3456 				  struct cfg80211_bss *cbss)
3457 {
3458 	struct ieee80211_local *local = sdata->local;
3459 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3460 	const struct ieee80211_ht_operation *ht_oper = NULL;
3461 	const struct ieee80211_vht_operation *vht_oper = NULL;
3462 	struct ieee80211_supported_band *sband;
3463 	struct cfg80211_chan_def chandef;
3464 	int ret;
3465 
3466 	sband = local->hw.wiphy->bands[cbss->channel->band];
3467 
3468 	ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
3469 			  IEEE80211_STA_DISABLE_80P80MHZ |
3470 			  IEEE80211_STA_DISABLE_160MHZ);
3471 
3472 	rcu_read_lock();
3473 
3474 	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3475 	    sband->ht_cap.ht_supported) {
3476 		const u8 *ht_oper_ie;
3477 
3478 		ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
3479 		if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
3480 			ht_oper = (void *)(ht_oper_ie + 2);
3481 	}
3482 
3483 	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3484 	    sband->vht_cap.vht_supported) {
3485 		const u8 *vht_oper_ie;
3486 
3487 		vht_oper_ie = ieee80211_bss_get_ie(cbss,
3488 						   WLAN_EID_VHT_OPERATION);
3489 		if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
3490 			vht_oper = (void *)(vht_oper_ie + 2);
3491 		if (vht_oper && !ht_oper) {
3492 			vht_oper = NULL;
3493 			sdata_info(sdata,
3494 				   "AP advertised VHT without HT, disabling both\n");
3495 			sdata->flags |= IEEE80211_STA_DISABLE_HT;
3496 			sdata->flags |= IEEE80211_STA_DISABLE_VHT;
3497 		}
3498 	}
3499 
3500 	ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
3501 						     cbss->channel,
3502 						     ht_oper, vht_oper,
3503 						     &chandef);
3504 
3505 	sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
3506 				      local->rx_chains);
3507 
3508 	rcu_read_unlock();
3509 
3510 	/* will change later if needed */
3511 	sdata->smps_mode = IEEE80211_SMPS_OFF;
3512 
3513 	/*
3514 	 * If this fails (possibly due to channel context sharing
3515 	 * on incompatible channels, e.g. 80+80 and 160 sharing the
3516 	 * same control channel) try to use a smaller bandwidth.
3517 	 */
3518 	ret = ieee80211_vif_use_channel(sdata, &chandef,
3519 					IEEE80211_CHANCTX_SHARED);
3520 	while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT)
3521 		ifmgd->flags |= chandef_downgrade(&chandef);
3522 	return ret;
3523 }
3524 
3525 static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
3526 				     struct cfg80211_bss *cbss, bool assoc)
3527 {
3528 	struct ieee80211_local *local = sdata->local;
3529 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3530 	struct ieee80211_bss *bss = (void *)cbss->priv;
3531 	struct sta_info *new_sta = NULL;
3532 	bool have_sta = false;
3533 	int err;
3534 
3535 	if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
3536 		return -EINVAL;
3537 
3538 	if (assoc) {
3539 		rcu_read_lock();
3540 		have_sta = sta_info_get(sdata, cbss->bssid);
3541 		rcu_read_unlock();
3542 	}
3543 
3544 	if (!have_sta) {
3545 		new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
3546 		if (!new_sta)
3547 			return -ENOMEM;
3548 	}
3549 
3550 	mutex_lock(&local->mtx);
3551 	ieee80211_recalc_idle(sdata->local);
3552 	mutex_unlock(&local->mtx);
3553 
3554 	if (new_sta) {
3555 		u32 rates = 0, basic_rates = 0;
3556 		bool have_higher_than_11mbit;
3557 		int min_rate = INT_MAX, min_rate_index = -1;
3558 		struct ieee80211_supported_band *sband;
3559 
3560 		sband = local->hw.wiphy->bands[cbss->channel->band];
3561 
3562 		err = ieee80211_prep_channel(sdata, cbss);
3563 		if (err) {
3564 			sta_info_free(local, new_sta);
3565 			return err;
3566 		}
3567 
3568 		ieee80211_get_rates(sband, bss->supp_rates,
3569 				    bss->supp_rates_len,
3570 				    &rates, &basic_rates,
3571 				    &have_higher_than_11mbit,
3572 				    &min_rate, &min_rate_index);
3573 
3574 		/*
3575 		 * This used to be a workaround for basic rates missing
3576 		 * in the association response frame. Now that we no
3577 		 * longer use the basic rates from there, it probably
3578 		 * doesn't happen any more, but keep the workaround so
3579 		 * in case some *other* APs are buggy in different ways
3580 		 * we can connect -- with a warning.
3581 		 */
3582 		if (!basic_rates && min_rate_index >= 0) {
3583 			sdata_info(sdata,
3584 				   "No basic rates, using min rate instead\n");
3585 			basic_rates = BIT(min_rate_index);
3586 		}
3587 
3588 		new_sta->sta.supp_rates[cbss->channel->band] = rates;
3589 		sdata->vif.bss_conf.basic_rates = basic_rates;
3590 
3591 		/* cf. IEEE 802.11 9.2.12 */
3592 		if (cbss->channel->band == IEEE80211_BAND_2GHZ &&
3593 		    have_higher_than_11mbit)
3594 			sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
3595 		else
3596 			sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
3597 
3598 		memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);
3599 
3600 		/* set timing information */
3601 		sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
3602 		sdata->vif.bss_conf.sync_tsf = cbss->tsf;
3603 		sdata->vif.bss_conf.sync_device_ts = bss->device_ts;
3604 
3605 		/* tell driver about BSSID, basic rates and timing */
3606 		ieee80211_bss_info_change_notify(sdata,
3607 			BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
3608 			BSS_CHANGED_BEACON_INT);
3609 
3610 		if (assoc)
3611 			sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
3612 
3613 		err = sta_info_insert(new_sta);
3614 		new_sta = NULL;
3615 		if (err) {
3616 			sdata_info(sdata,
3617 				   "failed to insert STA entry for the AP (error %d)\n",
3618 				   err);
3619 			return err;
3620 		}
3621 	} else
3622 		WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
3623 
3624 	return 0;
3625 }
3626 
3627 /* config hooks */
3628 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
3629 		       struct cfg80211_auth_request *req)
3630 {
3631 	struct ieee80211_local *local = sdata->local;
3632 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3633 	struct ieee80211_mgd_auth_data *auth_data;
3634 	u16 auth_alg;
3635 	int err;
3636 
3637 	/* prepare auth data structure */
3638 
3639 	switch (req->auth_type) {
3640 	case NL80211_AUTHTYPE_OPEN_SYSTEM:
3641 		auth_alg = WLAN_AUTH_OPEN;
3642 		break;
3643 	case NL80211_AUTHTYPE_SHARED_KEY:
3644 		if (IS_ERR(local->wep_tx_tfm))
3645 			return -EOPNOTSUPP;
3646 		auth_alg = WLAN_AUTH_SHARED_KEY;
3647 		break;
3648 	case NL80211_AUTHTYPE_FT:
3649 		auth_alg = WLAN_AUTH_FT;
3650 		break;
3651 	case NL80211_AUTHTYPE_NETWORK_EAP:
3652 		auth_alg = WLAN_AUTH_LEAP;
3653 		break;
3654 	case NL80211_AUTHTYPE_SAE:
3655 		auth_alg = WLAN_AUTH_SAE;
3656 		break;
3657 	default:
3658 		return -EOPNOTSUPP;
3659 	}
3660 
3661 	auth_data = kzalloc(sizeof(*auth_data) + req->sae_data_len +
3662 			    req->ie_len, GFP_KERNEL);
3663 	if (!auth_data)
3664 		return -ENOMEM;
3665 
3666 	auth_data->bss = req->bss;
3667 
3668 	if (req->sae_data_len >= 4) {
3669 		__le16 *pos = (__le16 *) req->sae_data;
3670 		auth_data->sae_trans = le16_to_cpu(pos[0]);
3671 		auth_data->sae_status = le16_to_cpu(pos[1]);
3672 		memcpy(auth_data->data, req->sae_data + 4,
3673 		       req->sae_data_len - 4);
3674 		auth_data->data_len += req->sae_data_len - 4;
3675 	}
3676 
3677 	if (req->ie && req->ie_len) {
3678 		memcpy(&auth_data->data[auth_data->data_len],
3679 		       req->ie, req->ie_len);
3680 		auth_data->data_len += req->ie_len;
3681 	}
3682 
3683 	if (req->key && req->key_len) {
3684 		auth_data->key_len = req->key_len;
3685 		auth_data->key_idx = req->key_idx;
3686 		memcpy(auth_data->key, req->key, req->key_len);
3687 	}
3688 
3689 	auth_data->algorithm = auth_alg;
3690 
3691 	/* try to authenticate/probe */
3692 
3693 	mutex_lock(&ifmgd->mtx);
3694 
3695 	if ((ifmgd->auth_data && !ifmgd->auth_data->done) ||
3696 	    ifmgd->assoc_data) {
3697 		err = -EBUSY;
3698 		goto err_free;
3699 	}
3700 
3701 	if (ifmgd->auth_data)
3702 		ieee80211_destroy_auth_data(sdata, false);
3703 
3704 	/* prep auth_data so we don't go into idle on disassoc */
3705 	ifmgd->auth_data = auth_data;
3706 
3707 	if (ifmgd->associated)
3708 		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3709 
3710 	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
3711 
3712 	err = ieee80211_prep_connection(sdata, req->bss, false);
3713 	if (err)
3714 		goto err_clear;
3715 
3716 	err = ieee80211_probe_auth(sdata);
3717 	if (err) {
3718 		sta_info_destroy_addr(sdata, req->bss->bssid);
3719 		goto err_clear;
3720 	}
3721 
3722 	/* hold our own reference */
3723 	cfg80211_ref_bss(auth_data->bss);
3724 	err = 0;
3725 	goto out_unlock;
3726 
3727  err_clear:
3728 	memset(ifmgd->bssid, 0, ETH_ALEN);
3729 	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
3730 	ifmgd->auth_data = NULL;
3731  err_free:
3732 	kfree(auth_data);
3733  out_unlock:
3734 	mutex_unlock(&ifmgd->mtx);
3735 
3736 	return err;
3737 }
3738 
3739 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
3740 			struct cfg80211_assoc_request *req)
3741 {
3742 	struct ieee80211_local *local = sdata->local;
3743 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3744 	struct ieee80211_bss *bss = (void *)req->bss->priv;
3745 	struct ieee80211_mgd_assoc_data *assoc_data;
3746 	struct ieee80211_supported_band *sband;
3747 	const u8 *ssidie, *ht_ie;
3748 	int i, err;
3749 
3750 	assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
3751 	if (!assoc_data)
3752 		return -ENOMEM;
3753 
3754 	rcu_read_lock();
3755 	ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
3756 	if (!ssidie) {
3757 		rcu_read_unlock();
3758 		kfree(assoc_data);
3759 		return -EINVAL;
3760 	}
3761 	memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
3762 	assoc_data->ssid_len = ssidie[1];
3763 	rcu_read_unlock();
3764 
3765 	mutex_lock(&ifmgd->mtx);
3766 
3767 	if (ifmgd->associated)
3768 		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3769 
3770 	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
3771 		err = -EBUSY;
3772 		goto err_free;
3773 	}
3774 
3775 	if (ifmgd->assoc_data) {
3776 		err = -EBUSY;
3777 		goto err_free;
3778 	}
3779 
3780 	if (ifmgd->auth_data) {
3781 		bool match;
3782 
3783 		/* keep sta info, bssid if matching */
3784 		match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
3785 		ieee80211_destroy_auth_data(sdata, match);
3786 	}
3787 
3788 	/* prepare assoc data */
3789 
3790 	ifmgd->beacon_crc_valid = false;
3791 
3792 	/*
3793 	 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
3794 	 * We still associate in non-HT mode (11a/b/g) if any one of these
3795 	 * ciphers is configured as pairwise.
3796 	 * We can set this to true for non-11n hardware, that'll be checked
3797 	 * separately along with the peer capabilities.
3798 	 */
3799 	for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
3800 		if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
3801 		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
3802 		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
3803 			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
3804 			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
3805 			netdev_info(sdata->dev,
3806 				    "disabling HT/VHT due to WEP/TKIP use\n");
3807 		}
3808 	}
3809 
3810 	if (req->flags & ASSOC_REQ_DISABLE_HT) {
3811 		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
3812 		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
3813 	}
3814 
3815 	/* Also disable HT if we don't support it or the AP doesn't use WMM */
3816 	sband = local->hw.wiphy->bands[req->bss->channel->band];
3817 	if (!sband->ht_cap.ht_supported ||
3818 	    local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used) {
3819 		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
3820 		if (!bss->wmm_used)
3821 			netdev_info(sdata->dev,
3822 				    "disabling HT as WMM/QoS is not supported by the AP\n");
3823 	}
3824 
3825 	/* disable VHT if we don't support it or the AP doesn't use WMM */
3826 	if (!sband->vht_cap.vht_supported ||
3827 	    local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used) {
3828 		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
3829 		if (!bss->wmm_used)
3830 			netdev_info(sdata->dev,
3831 				    "disabling VHT as WMM/QoS is not supported by the AP\n");
3832 	}
3833 
3834 	memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
3835 	memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
3836 	       sizeof(ifmgd->ht_capa_mask));
3837 
3838 	if (req->ie && req->ie_len) {
3839 		memcpy(assoc_data->ie, req->ie, req->ie_len);
3840 		assoc_data->ie_len = req->ie_len;
3841 	}
3842 
3843 	assoc_data->bss = req->bss;
3844 
3845 	if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
3846 		if (ifmgd->powersave)
3847 			sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
3848 		else
3849 			sdata->smps_mode = IEEE80211_SMPS_OFF;
3850 	} else
3851 		sdata->smps_mode = ifmgd->req_smps;
3852 
3853 	assoc_data->capability = req->bss->capability;
3854 	assoc_data->wmm = bss->wmm_used &&
3855 			  (local->hw.queues >= IEEE80211_NUM_ACS);
3856 	assoc_data->supp_rates = bss->supp_rates;
3857 	assoc_data->supp_rates_len = bss->supp_rates_len;
3858 
3859 	rcu_read_lock();
3860 	ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
3861 	if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
3862 		assoc_data->ap_ht_param =
3863 			((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
3864 	else
3865 		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
3866 	rcu_read_unlock();
3867 
3868 	if (bss->wmm_used && bss->uapsd_supported &&
3869 	    (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
3870 		assoc_data->uapsd = true;
3871 		ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
3872 	} else {
3873 		assoc_data->uapsd = false;
3874 		ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
3875 	}
3876 
3877 	if (req->prev_bssid)
3878 		memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
3879 
3880 	if (req->use_mfp) {
3881 		ifmgd->mfp = IEEE80211_MFP_REQUIRED;
3882 		ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
3883 	} else {
3884 		ifmgd->mfp = IEEE80211_MFP_DISABLED;
3885 		ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
3886 	}
3887 
3888 	if (req->crypto.control_port)
3889 		ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
3890 	else
3891 		ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
3892 
3893 	sdata->control_port_protocol = req->crypto.control_port_ethertype;
3894 	sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
3895 
3896 	/* kick off associate process */
3897 
3898 	ifmgd->assoc_data = assoc_data;
3899 
3900 	err = ieee80211_prep_connection(sdata, req->bss, true);
3901 	if (err)
3902 		goto err_clear;
3903 
3904 	if (!bss->dtim_period &&
3905 	    sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) {
3906 		/*
3907 		 * Wait up to one beacon interval ...
3908 		 * should this be more if we miss one?
3909 		 */
3910 		sdata_info(sdata, "waiting for beacon from %pM\n",
3911 			   ifmgd->bssid);
3912 		assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
3913 	} else {
3914 		assoc_data->have_beacon = true;
3915 		assoc_data->sent_assoc = false;
3916 		assoc_data->timeout = jiffies;
3917 	}
3918 	run_again(ifmgd, assoc_data->timeout);
3919 
3920 	if (bss->corrupt_data) {
3921 		char *corrupt_type = "data";
3922 		if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
3923 			if (bss->corrupt_data &
3924 					IEEE80211_BSS_CORRUPT_PROBE_RESP)
3925 				corrupt_type = "beacon and probe response";
3926 			else
3927 				corrupt_type = "beacon";
3928 		} else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
3929 			corrupt_type = "probe response";
3930 		sdata_info(sdata, "associating with AP with corrupt %s\n",
3931 			   corrupt_type);
3932 	}
3933 
3934 	err = 0;
3935 	goto out;
3936  err_clear:
3937 	memset(ifmgd->bssid, 0, ETH_ALEN);
3938 	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
3939 	ifmgd->assoc_data = NULL;
3940  err_free:
3941 	kfree(assoc_data);
3942  out:
3943 	mutex_unlock(&ifmgd->mtx);
3944 
3945 	return err;
3946 }
3947 
3948 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
3949 			 struct cfg80211_deauth_request *req)
3950 {
3951 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3952 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3953 	bool tx = !req->local_state_change;
3954 	bool sent_frame = false;
3955 
3956 	mutex_lock(&ifmgd->mtx);
3957 
3958 	sdata_info(sdata,
3959 		   "deauthenticating from %pM by local choice (reason=%d)\n",
3960 		   req->bssid, req->reason_code);
3961 
3962 	if (ifmgd->auth_data) {
3963 		drv_mgd_prepare_tx(sdata->local, sdata);
3964 		ieee80211_send_deauth_disassoc(sdata, req->bssid,
3965 					       IEEE80211_STYPE_DEAUTH,
3966 					       req->reason_code, tx,
3967 					       frame_buf);
3968 		ieee80211_destroy_auth_data(sdata, false);
3969 		mutex_unlock(&ifmgd->mtx);
3970 
3971 		sent_frame = tx;
3972 		goto out;
3973 	}
3974 
3975 	if (ifmgd->associated &&
3976 	    ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
3977 		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
3978 				       req->reason_code, tx, frame_buf);
3979 		sent_frame = tx;
3980 	}
3981 	mutex_unlock(&ifmgd->mtx);
3982 
3983  out:
3984 	mutex_lock(&sdata->local->mtx);
3985 	ieee80211_recalc_idle(sdata->local);
3986 	mutex_unlock(&sdata->local->mtx);
3987 
3988 	if (sent_frame)
3989 		__cfg80211_send_deauth(sdata->dev, frame_buf,
3990 				       IEEE80211_DEAUTH_FRAME_LEN);
3991 
3992 	return 0;
3993 }
3994 
3995 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
3996 			   struct cfg80211_disassoc_request *req)
3997 {
3998 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3999 	u8 bssid[ETH_ALEN];
4000 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4001 
4002 	mutex_lock(&ifmgd->mtx);
4003 
4004 	/*
4005 	 * cfg80211 should catch this ... but it's racy since
4006 	 * we can receive a disassoc frame, process it, hand it
4007 	 * to cfg80211 while that's in a locked section already
4008 	 * trying to tell us that the user wants to disconnect.
4009 	 */
4010 	if (ifmgd->associated != req->bss) {
4011 		mutex_unlock(&ifmgd->mtx);
4012 		return -ENOLINK;
4013 	}
4014 
4015 	sdata_info(sdata,
4016 		   "disassociating from %pM by local choice (reason=%d)\n",
4017 		   req->bss->bssid, req->reason_code);
4018 
4019 	memcpy(bssid, req->bss->bssid, ETH_ALEN);
4020 	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
4021 			       req->reason_code, !req->local_state_change,
4022 			       frame_buf);
4023 	mutex_unlock(&ifmgd->mtx);
4024 
4025 	__cfg80211_send_disassoc(sdata->dev, frame_buf,
4026 				 IEEE80211_DEAUTH_FRAME_LEN);
4027 
4028 	mutex_lock(&sdata->local->mtx);
4029 	ieee80211_recalc_idle(sdata->local);
4030 	mutex_unlock(&sdata->local->mtx);
4031 
4032 	return 0;
4033 }
4034 
4035 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
4036 {
4037 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4038 
4039 	mutex_lock(&ifmgd->mtx);
4040 	if (ifmgd->assoc_data)
4041 		ieee80211_destroy_assoc_data(sdata, false);
4042 	if (ifmgd->auth_data)
4043 		ieee80211_destroy_auth_data(sdata, false);
4044 	del_timer_sync(&ifmgd->timer);
4045 	mutex_unlock(&ifmgd->mtx);
4046 }
4047 
4048 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
4049 			       enum nl80211_cqm_rssi_threshold_event rssi_event,
4050 			       gfp_t gfp)
4051 {
4052 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
4053 
4054 	trace_api_cqm_rssi_notify(sdata, rssi_event);
4055 
4056 	cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, gfp);
4057 }
4058 EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
4059