+ * Copyright (C) 2018 - 2025 Intel Corporation

+ if (ieee80211_hw_check(&sdata->local->hw, STRICT))

+ ignore_ht_channel_mismatch = false;

+

+ieee80211_verify_sta_ht_mcs_support(struct ieee80211_sub_if_data *sdata,

+ struct ieee80211_supported_band *sband,

+ const struct ieee80211_ht_operation *ht_op)

+{

+ struct ieee80211_sta_ht_cap sta_ht_cap;

+ int i;

+

+ if (sband->band == NL80211_BAND_6GHZ)

+ return true;

+

+ if (!ht_op)

+ return false;

+

+ memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));

+ ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

+

+ /*

+ * P802.11REVme/D7.0 - 6.5.4.2.4

+ * ...

+ * If the MLME of an HT STA receives an MLME-JOIN.request primitive

+ * with the SelectedBSS parameter containing a Basic HT-MCS Set field

+ * in the HT Operation parameter that contains any unsupported MCSs,

+ * the MLME response in the resulting MLME-JOIN.confirm primitive shall

+ * contain a ResultCode parameter that is not set to the value SUCCESS.

+ * ...

+ */

+

+ /* Simply check that all basic rates are in the STA RX mask */

+ for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {

+ if ((ht_op->basic_set[i] & sta_ht_cap.mcs.rx_mask[i]) !=

+ ht_op->basic_set[i])

+ return false;

+ }

+

+ return true;

+}

+

+static bool

+ieee80211_verify_sta_vht_mcs_support(struct ieee80211_sub_if_data *sdata,

+ int link_id,

+ struct ieee80211_supported_band *sband,

+ const struct ieee80211_vht_operation *vht_op)

+{

+ struct ieee80211_sta_vht_cap sta_vht_cap;

+ u16 ap_min_req_set, sta_rx_mcs_map, sta_tx_mcs_map;

+ int nss;

+

+ if (sband->band != NL80211_BAND_5GHZ)

+ return true;

+

+ if (!vht_op)

+ return false;

+

+ memcpy(&sta_vht_cap, &sband->vht_cap, sizeof(sta_vht_cap));

+ ieee80211_apply_vhtcap_overrides(sdata, &sta_vht_cap);

+

+ ap_min_req_set = le16_to_cpu(vht_op->basic_mcs_set);

+ sta_rx_mcs_map = le16_to_cpu(sta_vht_cap.vht_mcs.rx_mcs_map);

+ sta_tx_mcs_map = le16_to_cpu(sta_vht_cap.vht_mcs.tx_mcs_map);

+

+ /*

+ * Many APs are incorrectly advertising an all-zero value here,

+ * which really means MCS 0-7 are required for 1-8 streams, but

+ * they don't really mean it that way.

+ * Some other APs are incorrectly advertising 3 spatial streams

+ * with MCS 0-7 are required, but don't really mean it that way

+ * and we'll connect only with HT, rather than even HE.

+ * As a result, unfortunately the VHT basic MCS/NSS set cannot

+ * be used at all, so check it only in strict mode.

+ */

+ if (!ieee80211_hw_check(&sdata->local->hw, STRICT))

+ return true;

+

+ /*

+ * P802.11REVme/D7.0 - 6.5.4.2.4

+ * ...

+ * If the MLME of a VHT STA receives an MLME-JOIN.request primitive

+ * with a SelectedBSS parameter containing a Basic VHT-MCS And NSS Set

+ * field in the VHT Operation parameter that contains any unsupported

+ * <VHT-MCS, NSS> tuple, the MLME response in the resulting

+ * MLME-JOIN.confirm primitive shall contain a ResultCode parameter

+ * that is not set to the value SUCCESS.

+ * ...

+ */

+ for (nss = 8; nss > 0; nss--) {

+ u8 ap_op_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;

+ u8 sta_rx_val;

+ u8 sta_tx_val;

+

+ if (ap_op_val == IEEE80211_HE_MCS_NOT_SUPPORTED)

+ continue;

+

+ sta_rx_val = (sta_rx_mcs_map >> (2 * (nss - 1))) & 3;

+ sta_tx_val = (sta_tx_mcs_map >> (2 * (nss - 1))) & 3;

+

+ if (sta_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||

+ sta_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||

+ sta_rx_val < ap_op_val || sta_tx_val < ap_op_val) {

+ link_id_info(sdata, link_id,

+ "Missing mandatory rates for %d Nss, rx %d, tx %d oper %d, disable VHT\n",

+ nss, sta_rx_val, sta_tx_val, ap_op_val);

+ return false;

+ }

+ }

+

+ return true;

+}

+

+static bool

+ int link_id,

+ link_id_info(sdata, link_id,

+ "Missing mandatory rates for 1 Nss, rx 0x%x, tx 0x%x, disable HE\n",

+ mcs_80_map_tx, mcs_80_map_rx);

+ if (!ieee80211_hw_check(&sdata->local->hw, STRICT) && !ap_min_req_set)

+ link_id_info(sdata, link_id,

+ "Invalid rates for %d Nss, rx %d, tx %d oper %d, disable HE\n",

+ nss, ap_rx_val, ap_tx_val, ap_op_val);

+ if (!ieee80211_hw_check(&sdata->local->hw, STRICT) && !ap_min_req_set)

+static void ieee80211_get_rates(struct ieee80211_supported_band *sband,

+ const u8 *supp_rates,

+ unsigned int supp_rates_len,

+ const u8 *ext_supp_rates,

+ unsigned int ext_supp_rates_len,

+ u32 *rates, u32 *basic_rates,

+ unsigned long *unknown_rates_selectors,

+ bool *have_higher_than_11mbit,

+ int *min_rate, int *min_rate_index)

+{

+ int i, j;

+

+ for (i = 0; i < supp_rates_len + ext_supp_rates_len; i++) {

+ u8 supp_rate = i < supp_rates_len ?

+ supp_rates[i] :

+ ext_supp_rates[i - supp_rates_len];

+ int rate = supp_rate & 0x7f;

+ bool is_basic = !!(supp_rate & 0x80);

+

+ if ((rate * 5) > 110 && have_higher_than_11mbit)

+ *have_higher_than_11mbit = true;

+

+ /*

+ * Skip membership selectors since they're not rates.

+ *

+ * Note: Even though the membership selector and the basic

+ * rate flag share the same bit, they are not exactly

+ * the same.

+ */

+ if (is_basic && rate >= BSS_MEMBERSHIP_SELECTOR_MIN) {

+ if (unknown_rates_selectors)

+ set_bit(rate, unknown_rates_selectors);

+ continue;

+ }

+

+ for (j = 0; j < sband->n_bitrates; j++) {

+ struct ieee80211_rate *br;

+ int brate;

+

+ br = &sband->bitrates[j];

+

+ brate = DIV_ROUND_UP(br->bitrate, 5);

+ if (brate == rate) {

+ if (rates)

+ *rates |= BIT(j);

+ if (is_basic && basic_rates)

+ *basic_rates |= BIT(j);

+ if (min_rate && (rate * 5) < *min_rate) {

+ *min_rate = rate * 5;

+ if (min_rate_index)

+ *min_rate_index = j;

+ }

+ break;

+ }

+ }

+

+ /* Handle an unknown entry as if it is an unknown selector */

+ if (is_basic && unknown_rates_selectors && j == sband->n_bitrates)

+ set_bit(rate, unknown_rates_selectors);

+ }

+}

+

+ return cfg80211_chandef_get_width(c) / 20;

+VISIBLE_IF_MAC80211_KUNIT struct ieee802_11_elems *

+ struct cfg80211_chan_def *ap_chandef,

+ unsigned long *userspace_selectors)

+ unsigned long unknown_rates_selectors[BITS_TO_LONGS(128)] = {};

+ unsigned long sta_selectors[BITS_TO_LONGS(128)] = {};

+ ieee80211_get_rates(sband, elems->supp_rates, elems->supp_rates_len,

+ elems->ext_supp_rates, elems->ext_supp_rates_len,

+ NULL, NULL, unknown_rates_selectors, NULL, NULL,

+ NULL);

+

+ link_id_info(sdata, link_id,

+ "Rejecting non-HE 6/7 GHz connection");

+ bitmap_copy(sta_selectors, userspace_selectors, 128);

+ if (conn->mode >= IEEE80211_CONN_MODE_HT)

+ set_bit(BSS_MEMBERSHIP_SELECTOR_HT_PHY, sta_selectors);

+ if (conn->mode >= IEEE80211_CONN_MODE_VHT)

+ set_bit(BSS_MEMBERSHIP_SELECTOR_VHT_PHY, sta_selectors);

+ if (conn->mode >= IEEE80211_CONN_MODE_HE)

+ set_bit(BSS_MEMBERSHIP_SELECTOR_HE_PHY, sta_selectors);

+ if (conn->mode >= IEEE80211_CONN_MODE_EHT)

+ set_bit(BSS_MEMBERSHIP_SELECTOR_EHT_PHY, sta_selectors);

+

+ /*

+ * We do not support EPD or GLK so never add them.

+ * SAE_H2E is handled through userspace_selectors.

+ */

+

+ /* Check if we support all required features */

+ if (!bitmap_subset(unknown_rates_selectors, sta_selectors, 128)) {

+ link_id_info(sdata, link_id,

+ "required basic rate or BSS membership selectors not supported or disabled, rejecting connection\n");

+ ret = -EINVAL;

+ goto free;

+ }

+

+ link_id_info(sdata, link_id,

+ "regulatory prevented using AP config, downgraded\n");

+

+ if (conn->mode >= IEEE80211_CONN_MODE_HT &&

+ !ieee80211_verify_sta_ht_mcs_support(sdata, sband,

+ elems->ht_operation)) {

+ conn->mode = IEEE80211_CONN_MODE_LEGACY;

+ conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20;

+ link_id_info(sdata, link_id,

+ "required MCSes not supported, disabling HT\n");

+ }

+

+ if (conn->mode >= IEEE80211_CONN_MODE_VHT &&

+ !ieee80211_verify_sta_vht_mcs_support(sdata, link_id, sband,

+ elems->vht_operation)) {

+ conn->mode = IEEE80211_CONN_MODE_HT;

+ conn->bw_limit = min_t(enum ieee80211_conn_bw_limit,

+ conn->bw_limit,

+ IEEE80211_CONN_BW_LIMIT_40);

+ link_id_info(sdata, link_id,

+ "required MCSes not supported, disabling VHT\n");

+ }

+ (!ieee80211_verify_peer_he_mcs_support(sdata, link_id,

+ (void *)elems->he_cap,

+ link_id_info(sdata, link_id,

+ "required MCSes not supported, disabling HE\n");

+ link_id_info(sdata, link_id,

+ "required MCSes not supported, disabling EHT\n");

+EXPORT_SYMBOL_IF_MAC80211_KUNIT(ieee80211_determine_chan_mode);

+ bool update, u64 *changed,

+ const char *frame)

+ "AP %pM appears to change mode (expected %s, found %s) in %s, disconnect\n",

+ link->u.mgd.bssid,

+ ieee80211_conn_mode_str(ap_mode), frame);

+ "AP %pM changed bandwidth in %s, new used config is %d.%03d MHz, width %d (%d.%03d/%d MHz)\n",

+ link->u.mgd.bssid, frame, chanreq.oper.chan->center_freq,

+ "AP %pM changed caps/bw in %s in a way we can't support - disconnect\n",

+ link->u.mgd.bssid, frame);

+ "AP %pM changed bandwidth in %s to incompatible one - disconnect\n",

+ link->u.mgd.bssid, frame);

+ if (!ieee80211_hw_check(&local->hw, STRICT)) {

+ if (!(ap_vht_cap->vht_cap_info &

+ cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))

+ cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |

+ IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);

+ else if (!(ap_vht_cap->vht_cap_info &

+ cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))

+ cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;

+ }

+static void ieee80211_assoc_add_rates(struct ieee80211_local *local,

+ struct sk_buff *skb,

+ if (assoc_data->supp_rates_len &&

+ !ieee80211_hw_check(&local->hw, STRICT)) {

+static void

+ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata,

+ struct sk_buff *skb, u16 capab,

+ const struct element *ext_capa,

+ const u16 *present_elems,

+ struct ieee80211_mgd_assoc_data *assoc_data);

+

+static size_t

+ieee80211_add_link_elems(struct ieee80211_sub_if_data *sdata,

+ struct sk_buff *skb, u16 *capab,

+ const struct element *ext_capa,

+ const u8 *extra_elems,

+ size_t extra_elems_len,

+ unsigned int link_id,

+ struct ieee80211_link_data *link,

+ u16 *present_elems,

+ struct ieee80211_mgd_assoc_data *assoc_data)

+ ieee80211_assoc_add_rates(local, skb, width, sband, assoc_data);

+ present_elems, assoc_data);

+static void

+ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata,

+ struct sk_buff *skb, u16 capab,

+ const struct element *ext_capa,

+ const u16 *outer_present_elems,

+ struct ieee80211_mgd_assoc_data *assoc_data)

+ /* Many APs have broken parsing of the extended MLD capa/ops field,

+ * dropping (re-)association request frames or replying with association

+ * response with a failure status if it's present. Without a clear

+ * indication as to whether the AP supports parsing this field or not do

+ * not include it in the common information unless strict mode is set.

+ */

+ if (ieee80211_hw_check(&local->hw, STRICT) &&

+ assoc_data->ext_mld_capa_ops) {

+ ml_elem->control |=

+ cpu_to_le16(IEEE80211_MLC_BASIC_PRES_EXT_MLD_CAPA_OP);

+ common->len += 2;

+ skb_put_data(skb, &assoc_data->ext_mld_capa_ops,

+ sizeof(assoc_data->ext_mld_capa_ops));

+ }

+

+ * calling ieee80211_add_link_elems().

+ extra_used = ieee80211_add_link_elems(sdata, skb, &capab,

+ ext_capa,

+ extra_elems,

+ extra_elems_len,

+ link_id, NULL,

+ link_present_elems,

+ assoc_data);

+static int

+ieee80211_link_common_elems_size(struct ieee80211_sub_if_data *sdata,

+ enum nl80211_iftype iftype,

+ struct cfg80211_bss *cbss,

+ size_t elems_len)

+{

+ struct ieee80211_local *local = sdata->local;

+ const struct ieee80211_sband_iftype_data *iftd;

+ struct ieee80211_supported_band *sband;

+ size_t size = 0;

+

+ if (!cbss)

+ return size;

+

+ sband = local->hw.wiphy->bands[cbss->channel->band];

+

+ /* add STA profile elements length */

+ size += elems_len;

+

+ /* and supported rates length */

+ size += 4 + sband->n_bitrates;

+

+ /* supported channels */

+ size += 2 + 2 * sband->n_channels;

+

+ iftd = ieee80211_get_sband_iftype_data(sband, iftype);

+ if (iftd)

+ size += iftd->vendor_elems.len;

+

+ /* power capability */

+ size += 4;

+

+ /* HT, VHT, HE, EHT */

+ size += 2 + sizeof(struct ieee80211_ht_cap);

+ size += 2 + sizeof(struct ieee80211_vht_cap);

+ size += 2 + 1 + sizeof(struct ieee80211_he_cap_elem) +

+ sizeof(struct ieee80211_he_mcs_nss_supp) +

+ IEEE80211_HE_PPE_THRES_MAX_LEN;

+

+ if (sband->band == NL80211_BAND_6GHZ)

+ size += 2 + 1 + sizeof(struct ieee80211_he_6ghz_capa);

+

+ size += 2 + 1 + sizeof(struct ieee80211_eht_cap_elem) +

+ sizeof(struct ieee80211_eht_mcs_nss_supp) +

+ IEEE80211_EHT_PPE_THRES_MAX_LEN;

+

+ return size;

+}

+

+ size_t elems_len = assoc_data->link[link_id].elems_len;

+

+ size += ieee80211_link_common_elems_size(sdata, iftype, cbss,

+ elems_len);

+ 2 + /* ext capa & op */

+ if (link->u.mgd.conn.mode < IEEE80211_CONN_MODE_EHT &&

+ !ieee80211_hw_check(&local->hw, STRICT))

+ offset = ieee80211_add_link_elems(sdata, skb, &link_capab,

+ ext_capa,

+ assoc_data->ie,

+ assoc_data->ie_len,

+ assoc_data->assoc_link_id, link,

+ present_elems, assoc_data);

+_ieee80211_sta_wmm_params(struct ieee80211_local *local,

+ struct ieee80211_link_data *link,

+ const u8 *wmm_param, size_t wmm_param_len,

+ const struct ieee80211_mu_edca_param_set *mu_edca)

+ return true;

+}

+

+static bool

+ieee80211_sta_wmm_params(struct ieee80211_local *local,

+ struct ieee80211_link_data *link,

+ const u8 *wmm_param, size_t wmm_param_len,

+ const struct ieee80211_mu_edca_param_set *mu_edca)

+{

+ if (!_ieee80211_sta_wmm_params(local, link, wmm_param, wmm_param_len,

+ mu_edca))

+ return false;

+

+static void ieee80211_ml_reconf_reset(struct ieee80211_sub_if_data *sdata)

+{

+ struct ieee80211_mgd_assoc_data *add_links_data =

+ sdata->u.mgd.reconf.add_links_data;

+

+ if (!ieee80211_vif_is_mld(&sdata->vif) ||

+ !(sdata->u.mgd.reconf.added_links |

+ sdata->u.mgd.reconf.removed_links))

+ return;

+

+ wiphy_delayed_work_cancel(sdata->local->hw.wiphy,

+ &sdata->u.mgd.reconf.wk);

+ sdata->u.mgd.reconf.added_links = 0;

+ sdata->u.mgd.reconf.removed_links = 0;

+ sdata->u.mgd.reconf.dialog_token = 0;

+

+ if (add_links_data) {

+ struct cfg80211_mlo_reconf_done_data done_data = {};

+ u8 link_id;

+

+ for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS;

+ link_id++)

+ done_data.links[link_id].bss =

+ add_links_data->link[link_id].bss;

+

+ cfg80211_mlo_reconf_add_done(sdata->dev, &done_data);

+

+ kfree(sdata->u.mgd.reconf.add_links_data);

+ sdata->u.mgd.reconf.add_links_data = NULL;

+ }

+}

+

+ struct sta_info *ap_sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);

+ if (WARN_ON(!ap_sta))

+ return;

+

+ if (tx) {

+ bool tx_link_found = false;

+

+ for (link_id = 0;

+ link_id < ARRAY_SIZE(sdata->link);

+ link_id++) {

+ struct ieee80211_link_data *link;

+

+ if (!ieee80211_vif_link_active(&sdata->vif, link_id))

+ continue;

+

+ link = sdata_dereference(sdata->link[link_id], sdata);

+ if (WARN_ON_ONCE(!link))

+ continue;

+

+ if (link->u.mgd.csa.blocked_tx)

+ continue;

+

+ tx_link_found = true;

+ break;

+ }

+

+ tx = tx_link_found;

+ }

+

+ sdata->deflink.conf->epcs_support = false;

+ ieee80211_flush_queues(local, sdata, true);

+ if (tx) {

+ reason, true, frame_buf);

+ /* flush out frame - make sure the deauth was actually sent */

+ drv_mgd_complete_tx(sdata->local, sdata, &info);

+ } else if (frame_buf) {

+ ieee80211_send_deauth_disassoc(sdata, sdata->vif.cfg.ap_addr,

+ sdata->vif.cfg.ap_addr, stype,

+ reason, false, frame_buf);

+ }

+ /* Remove TDLS peers */

+ __sta_info_flush(sdata, false, -1, ap_sta);

+

+ if (sdata->vif.driver_flags & IEEE80211_VIF_REMOVE_AP_AFTER_DISASSOC) {

+ /* Only move the AP state */

+ sta_info_move_state(ap_sta, IEEE80211_STA_NONE);

+ } else {

+ /* Remove AP peer */

+ sta_info_flush(sdata, -1);

+ }

+ if (sdata->vif.driver_flags & IEEE80211_VIF_REMOVE_AP_AFTER_DISASSOC) {

+ /*

+ * After notifying the driver about the disassoc,

+ * remove the ap sta.

+ */

+ sta_info_flush(sdata, -1);

+ }

+

+ /* if disconnection happens in the middle of the ML reconfiguration

+ * flow, cfg80211 must called to release the BSS references obtained

+ * when the flow started.

+ */

+ ieee80211_ml_reconf_reset(sdata);

+

+

+ ifmgd->epcs.enabled = false;

+ ifmgd->epcs.dialog_token = 0;

+

+ memset(ifmgd->userspace_selectors, 0,

+ sizeof(ifmgd->userspace_selectors));

+ if (!link || !link->conf->bss)

+ true, frame_buf);

+ ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,

+ sdata->u.mgd.auth_data = NULL;

+

+ sdata->u.mgd.assoc_data = NULL;

+

+ info.link_id = ifmgd->auth_data->link_id;

+

+static void ieee80211_epcs_changed(struct ieee80211_sub_if_data *sdata,

+ bool enabled)

+{

+ /* in any case this is called, dialog token should be reset */

+ sdata->u.mgd.epcs.dialog_token = 0;

+

+ if (sdata->u.mgd.epcs.enabled == enabled)

+ return;

+

+ sdata->u.mgd.epcs.enabled = enabled;

+ cfg80211_epcs_changed(sdata->dev, enabled);

+}

+

+static void ieee80211_epcs_teardown(struct ieee80211_sub_if_data *sdata)

+{

+ struct ieee80211_local *local = sdata->local;

+ u8 link_id;

+

+ if (!sdata->u.mgd.epcs.enabled)

+ return;

+

+ lockdep_assert_wiphy(local->hw.wiphy);

+

+ for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {

+ struct ieee802_11_elems *elems;

+ struct ieee80211_link_data *link;

+ const struct cfg80211_bss_ies *ies;

+ bool ret;

+

+ rcu_read_lock();

+

+ link = sdata_dereference(sdata->link[link_id], sdata);

+ if (!link || !link->conf || !link->conf->bss) {

+ rcu_read_unlock();

+ continue;

+ }

+

+ if (link->u.mgd.disable_wmm_tracking) {

+ rcu_read_unlock();

+ ieee80211_set_wmm_default(link, false, false);

+ continue;

+ }

+

+ ies = rcu_dereference(link->conf->bss->beacon_ies);

+ if (!ies) {

+ rcu_read_unlock();

+ ieee80211_set_wmm_default(link, false, false);

+ continue;

+ }

+

+ elems = ieee802_11_parse_elems(ies->data, ies->len, false,

+ NULL);

+ if (!elems) {

+ rcu_read_unlock();

+ ieee80211_set_wmm_default(link, false, false);

+ continue;

+ }

+

+ ret = _ieee80211_sta_wmm_params(local, link,

+ elems->wmm_param,

+ elems->wmm_param_len,

+ elems->mu_edca_param_set);

+

+ kfree(elems);

+ rcu_read_unlock();

+

+ if (!ret) {

+ ieee80211_set_wmm_default(link, false, false);

+ continue;

+ }

+

+ ieee80211_mgd_set_link_qos_params(link);

+ ieee80211_link_info_change_notify(sdata, link, BSS_CHANGED_QOS);

+ }

+}

+

+ struct ieee80211_mgd_assoc_data *assoc_data =

+ sdata->u.mgd.assoc_data ?: sdata->u.mgd.reconf.add_links_data;

+ if (!ieee80211_hw_check(&local->hw, STRICT) && !is_6ghz &&

+ parse_params.link_id = -1;

+ changed, "assoc response")) {

+ if (ieee80211_hw_check(&local->hw, STRICT) &&

+ (!bss_vht_cap || memcmp(bss_vht_cap, elems->vht_cap_elem,

+ sizeof(*bss_vht_cap)))) {

+ rcu_read_unlock();

+ ret = false;

+ link_info(link, "VHT capabilities mismatch\n");

+ goto out;

+ }

+

+ bss_conf->epcs_support = bss_conf->eht_support &&

+ !!(elems->eht_cap->fixed.mac_cap_info[0] &

+ IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS);

+

+ /* EPCS might be already enabled but a new added link

+ * does not support EPCS. This should not really happen

+ * in practice.

+ */

+ if (sdata->u.mgd.epcs.enabled &&

+ !bss_conf->epcs_support)

+ ieee80211_epcs_teardown(sdata);

+ bss_conf->epcs_support = false;

+ bss_conf->epcs_support = false;

+ NULL, 0,

+ &rates, &basic_rates, NULL,

+ &have_higher_than_11mbit,

+ struct ieee80211_conn_settings *conn,

+ unsigned long *userspace_selectors)

+ &chanreq, &ap_chandef,

+ userspace_selectors);

+ true, &link->u.mgd.conn,

+ sdata->u.mgd.userspace_selectors);

+ info.link_id = assoc_data->assoc_link_id;

+

+ if (!sdata->u.mgd.epcs.enabled &&

+ !link->u.mgd.disable_wmm_tracking &&

+ if (ieee80211_config_bw(link, elems, true, &changed, "beacon")) {

+void ieee80211_process_ttlm_teardown(struct ieee80211_sub_if_data *sdata)

+static void ieee80211_teardown_ttlm_work(struct wiphy *wiphy,

+ struct wiphy_work *work)

+{

+ struct ieee80211_sub_if_data *sdata =

+ container_of(work, struct ieee80211_sub_if_data,

+ u.mgd.teardown_ttlm_work);

+

+ ieee80211_process_ttlm_teardown(sdata);

+}

+

+static void ieee80211_ml_sta_reconf_timeout(struct wiphy *wiphy,

+ struct wiphy_work *work)

+{

+ struct ieee80211_sub_if_data *sdata =

+ container_of(work, struct ieee80211_sub_if_data,

+ u.mgd.reconf.wk.work);

+

+ if (!sdata->u.mgd.reconf.added_links &&

+ !sdata->u.mgd.reconf.removed_links)

+ return;

+

+ sdata_info(sdata,

+ "mlo: reconf: timeout: added=0x%x, removed=0x%x\n",

+ sdata->u.mgd.reconf.added_links,

+ sdata->u.mgd.reconf.removed_links);

+

+ __ieee80211_disconnect(sdata);

+}

+

+ wiphy_delayed_work_init(&ifmgd->reconf.wk,

+ ieee80211_ml_sta_reconf_timeout);

+ else if (sdata->u.mgd.reconf.add_links_data)

+ ether_addr_copy(link->conf->addr,

+ sdata->u.mgd.reconf.add_links_data->link[link_id].addr);

+ bool override,

+ unsigned long *userspace_selectors)

+ mlo, &link->u.mgd.conn,

+ userspace_selectors);

+static void ieee80211_parse_cfg_selectors(unsigned long *userspace_selectors,

+ const u8 *supported_selectors,

+ u8 supported_selectors_len)

+{

+ if (supported_selectors) {

+ for (int i = 0; i < supported_selectors_len; i++) {

+ set_bit(supported_selectors[i],

+ userspace_selectors);

+ }

+ } else {

+ /* Assume SAE_H2E support for backward compatibility. */

+ set_bit(BSS_MEMBERSHIP_SELECTOR_SAE_H2E,

+ userspace_selectors);

+ }

+}

+

+ ieee80211_parse_cfg_selectors(auth_data->userspace_selectors,

+ req->supported_selectors,

+ req->supported_selectors_len);

+

+ &conn, false,

+ auth_data->userspace_selectors);

+ assoc_data->ext_mld_capa_ops = cpu_to_le16(req->ext_mld_capa_ops);

+

+ memset(sdata->u.mgd.userspace_selectors, 0,

+ sizeof(sdata->u.mgd.userspace_selectors));

+ ieee80211_parse_cfg_selectors(sdata->u.mgd.userspace_selectors,

+ req->supported_selectors,

+ req->supported_selectors_len);

+

+ &assoc_data->link[i].conn,

+ sdata->u.mgd.userspace_selectors);

+ override,

+ sdata->u.mgd.userspace_selectors);

+

+void ieee80211_process_ml_reconf_resp(struct ieee80211_sub_if_data *sdata,

+ struct ieee80211_mgmt *mgmt, size_t len)

+{

+ struct ieee80211_local *local = sdata->local;

+ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

+ struct ieee80211_mgd_assoc_data *add_links_data =

+ ifmgd->reconf.add_links_data;

+ struct sta_info *sta;

+ struct cfg80211_mlo_reconf_done_data done_data = {};

+ u16 sta_changed_links = sdata->u.mgd.reconf.added_links |

+ sdata->u.mgd.reconf.removed_links;

+ u16 link_mask, valid_links;

+ unsigned int link_id;

+ size_t orig_len = len;

+ u8 i, group_key_data_len;

+ u8 *pos;

+

+ if (!ieee80211_vif_is_mld(&sdata->vif) ||

+ len < offsetofend(typeof(*mgmt), u.action.u.ml_reconf_resp) ||

+ mgmt->u.action.u.ml_reconf_resp.dialog_token !=

+ sdata->u.mgd.reconf.dialog_token ||

+ !sta_changed_links)

+ return;

+

+ pos = mgmt->u.action.u.ml_reconf_resp.variable;

+ len -= offsetofend(typeof(*mgmt), u.action.u.ml_reconf_resp);

+

+ /* each status duple is 3 octets */

+ if (len < mgmt->u.action.u.ml_reconf_resp.count * 3) {

+ sdata_info(sdata,

+ "mlo: reconf: unexpected len=%zu, count=%u\n",

+ len, mgmt->u.action.u.ml_reconf_resp.count);

+ goto disconnect;

+ }

+

+ link_mask = sta_changed_links;

+ for (i = 0; i < mgmt->u.action.u.ml_reconf_resp.count; i++) {

+ u16 status = get_unaligned_le16(pos + 1);

+

+ link_id = *pos;

+

+ if (!(link_mask & BIT(link_id))) {

+ sdata_info(sdata,

+ "mlo: reconf: unexpected link: %u, changed=0x%x\n",

+ link_id, sta_changed_links);

+ goto disconnect;

+ }

+

+ /* clear the corresponding link, to detect the case that

+ * the same link was included more than one time

+ */

+ link_mask &= ~BIT(link_id);

+

+ /* Handle failure to remove links here. Failure to remove added

+ * links will be done later in the flow.

+ */

+ if (status != WLAN_STATUS_SUCCESS) {

+ sdata_info(sdata,

+ "mlo: reconf: failed on link=%u, status=%u\n",

+ link_id, status);

+

+ /* The AP MLD failed to remove a link that was already

+ * removed locally. As this is not expected behavior,

+ * disconnect

+ */

+ if (sdata->u.mgd.reconf.removed_links & BIT(link_id))

+ goto disconnect;

+

+ /* The AP MLD failed to add a link. Remove it from the

+ * added links.

+ */

+ sdata->u.mgd.reconf.added_links &= ~BIT(link_id);

+ }

+

+ pos += 3;

+ len -= 3;

+ }

+

+ if (link_mask) {

+ sdata_info(sdata,

+ "mlo: reconf: no response for links=0x%x\n",

+ link_mask);

+ goto disconnect;

+ }

+

+ if (!sdata->u.mgd.reconf.added_links)

+ goto out;

+

+ if (len < 1 || len < 1 + *pos) {

+ sdata_info(sdata,

+ "mlo: reconf: invalid group key data length");

+ goto disconnect;

+ }

+

+ /* The Group Key Data field must be present when links are added. This

+ * field should be processed by userland.

+ */

+ group_key_data_len = *pos++;

+

+ pos += group_key_data_len;

+ len -= group_key_data_len + 1;

+

+ /* Process the information for the added links */

+ sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);

+ if (WARN_ON(!sta))

+ goto disconnect;

+

+ valid_links = sdata->vif.valid_links;

+ for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {

+ if (!add_links_data->link[link_id].bss ||

+ !(sdata->u.mgd.reconf.added_links & BIT(link_id)))

+

+ continue;

+

+ valid_links |= BIT(link_id);

+ if (ieee80211_sta_allocate_link(sta, link_id))

+ goto disconnect;

+ }

+

+ ieee80211_vif_set_links(sdata, valid_links, sdata->vif.dormant_links);

+ link_mask = 0;

+ for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {

+ struct cfg80211_bss *cbss = add_links_data->link[link_id].bss;

+ struct ieee80211_link_data *link;

+ struct link_sta_info *link_sta;

+ u64 changed = 0;

+

+ if (!cbss)

+ continue;

+

+ link = sdata_dereference(sdata->link[link_id], sdata);

+ if (WARN_ON(!link))

+ goto disconnect;

+

+ link_info(link,

+ "mlo: reconf: local address %pM, AP link address %pM\n",

+ add_links_data->link[link_id].addr,

+ add_links_data->link[link_id].bss->bssid);

+

+ link_sta = rcu_dereference_protected(sta->link[link_id],

+ lockdep_is_held(&local->hw.wiphy->mtx));

+ if (WARN_ON(!link_sta))

+ goto disconnect;

+

+ if (!link->u.mgd.have_beacon) {

+ const struct cfg80211_bss_ies *ies;

+

+ rcu_read_lock();

+ ies = rcu_dereference(cbss->beacon_ies);

+ if (ies)

+ link->u.mgd.have_beacon = true;

+ else

+ ies = rcu_dereference(cbss->ies);

+ ieee80211_get_dtim(ies,

+ &link->conf->sync_dtim_count,

+ &link->u.mgd.dtim_period);

+ link->conf->beacon_int = cbss->beacon_interval;

+ rcu_read_unlock();

+ }

+

+ link->conf->dtim_period = link->u.mgd.dtim_period ?: 1;

+

+ link->u.mgd.conn = add_links_data->link[link_id].conn;

+ if (ieee80211_prep_channel(sdata, link, link_id, cbss,

+ true, &link->u.mgd.conn,

+ sdata->u.mgd.userspace_selectors)) {

+ link_info(link, "mlo: reconf: prep_channel failed\n");

+ goto disconnect;

+ }

+

+ if (ieee80211_mgd_setup_link_sta(link, sta, link_sta,

+ add_links_data->link[link_id].bss))

+ goto disconnect;

+

+ if (!ieee80211_assoc_config_link(link, link_sta,

+ add_links_data->link[link_id].bss,

+ mgmt, pos, len,

+ &changed))

+ goto disconnect;

+

+ /* The AP MLD indicated success for this link, but the station

+ * profile status indicated otherwise. Since there is an

+ * inconsistency in the ML reconfiguration response, disconnect

+ */

+ if (add_links_data->link[link_id].status != WLAN_STATUS_SUCCESS)

+ goto disconnect;

+

+ ieee80211_sta_init_nss(link_sta);

+ if (ieee80211_sta_activate_link(sta, link_id))

+ goto disconnect;

+

+ changed |= ieee80211_link_set_associated(link, cbss);

+ ieee80211_link_info_change_notify(sdata, link, changed);

+

+ ieee80211_recalc_smps(sdata, link);

+ link_mask |= BIT(link_id);

+ }

+

+ sdata_info(sdata,

+ "mlo: reconf: current valid_links=0x%x, added=0x%x\n",

+ valid_links, link_mask);

+

+ /* links might have changed due to rejected ones, set them again */

+ ieee80211_vif_set_links(sdata, valid_links, sdata->vif.dormant_links);

+ ieee80211_vif_cfg_change_notify(sdata, BSS_CHANGED_MLD_VALID_LINKS);

+

+ ieee80211_recalc_ps(local);

+ ieee80211_recalc_ps_vif(sdata);

+

+ done_data.buf = (const u8 *)mgmt;

+ done_data.len = orig_len;

+ done_data.added_links = link_mask;

+

+ for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {

+ done_data.links[link_id].bss = add_links_data->link[link_id].bss;

+ done_data.links[link_id].addr =

+ add_links_data->link[link_id].addr;

+ }

+

+ cfg80211_mlo_reconf_add_done(sdata->dev, &done_data);

+ kfree(sdata->u.mgd.reconf.add_links_data);

+ sdata->u.mgd.reconf.add_links_data = NULL;

+out:

+ ieee80211_ml_reconf_reset(sdata);

+ return;

+

+disconnect:

+ __ieee80211_disconnect(sdata);

+}

+

+static struct sk_buff *

+ieee80211_build_ml_reconf_req(struct ieee80211_sub_if_data *sdata,

+ struct ieee80211_mgd_assoc_data *add_links_data,

+ u16 removed_links, __le16 ext_mld_capa_ops)

+{

+ struct ieee80211_local *local = sdata->local;

+ struct ieee80211_mgmt *mgmt;

+ struct ieee80211_multi_link_elem *ml_elem;

+ struct ieee80211_mle_basic_common_info *common;

+ enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);

+ struct sk_buff *skb;

+ size_t size;

+ unsigned int link_id;

+ __le16 eml_capa = 0, mld_capa_ops = 0;

+ struct ieee80211_tx_info *info;

+ u8 common_size, var_common_size;

+ u8 *ml_elem_len;

+ u16 capab = 0;

+

+ size = local->hw.extra_tx_headroom + sizeof(*mgmt);

+

+ /* Consider the maximal length of the reconfiguration ML element */

+ size += sizeof(struct ieee80211_multi_link_elem);

+

+ /* The Basic ML element and the Reconfiguration ML element have the same

+ * fixed common information fields in the context of ML reconfiguration

+ * action frame. The AP MLD MAC address must always be present

+ */

+ common_size = sizeof(*common);

+

+ /* when adding links, the MLD capabilities must be present */

+ var_common_size = 0;

+ if (add_links_data) {

+ const struct wiphy_iftype_ext_capab *ift_ext_capa =

+ cfg80211_get_iftype_ext_capa(local->hw.wiphy,

+ ieee80211_vif_type_p2p(&sdata->vif));

+

+ if (ift_ext_capa) {

+ eml_capa = cpu_to_le16(ift_ext_capa->eml_capabilities);

+ mld_capa_ops =

+ cpu_to_le16(ift_ext_capa->mld_capa_and_ops);

+ }

+

+ /* MLD capabilities and operation */

+ var_common_size += 2;

+

+ /* EML capabilities */

+ if (eml_capa & cpu_to_le16((IEEE80211_EML_CAP_EMLSR_SUPP |

+ IEEE80211_EML_CAP_EMLMR_SUPPORT)))

+ var_common_size += 2;

+ }

+

+ if (ext_mld_capa_ops)

+ var_common_size += 2;

+

+ /* Add the common information length */

+ size += common_size + var_common_size;

+

+ for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {

+ struct cfg80211_bss *cbss;

+ size_t elems_len;

+

+ if (removed_links & BIT(link_id)) {

+ size += sizeof(struct ieee80211_mle_per_sta_profile) +

+ ETH_ALEN;

+ continue;

+ }

+

+ if (!add_links_data || !add_links_data->link[link_id].bss)

+ continue;

+

+ elems_len = add_links_data->link[link_id].elems_len;

+ cbss = add_links_data->link[link_id].bss;

+

+ /* should be the same across all BSSes */

+ if (cbss->capability & WLAN_CAPABILITY_PRIVACY)

+ capab |= WLAN_CAPABILITY_PRIVACY;

+

+ size += 2 + sizeof(struct ieee80211_mle_per_sta_profile) +

+ ETH_ALEN;

+

+ /* WMM */

+ size += 9;

+ size += ieee80211_link_common_elems_size(sdata, iftype, cbss,

+ elems_len);

+ }

+

+ skb = alloc_skb(size, GFP_KERNEL);

+ if (!skb)

+ return NULL;

+

+ skb_reserve(skb, local->hw.extra_tx_headroom);

+ mgmt = skb_put_zero(skb, offsetofend(struct ieee80211_mgmt,

+ u.action.u.ml_reconf_req));

+

+ /* Add the MAC header */

+ mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |

+ IEEE80211_STYPE_ACTION);

+ memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN);

+ memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);

+ memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);

+

+ /* Add the action frame fixed fields */

+ mgmt->u.action.category = WLAN_CATEGORY_PROTECTED_EHT;

+ mgmt->u.action.u.ml_reconf_req.action_code =

+ WLAN_PROTECTED_EHT_ACTION_LINK_RECONFIG_REQ;

+

+ /* allocate a dialog token and store it */

+ sdata->u.mgd.reconf.dialog_token = ++sdata->u.mgd.dialog_token_alloc;

+ mgmt->u.action.u.ml_reconf_req.dialog_token =

+ sdata->u.mgd.reconf.dialog_token;

+

+ /* Add the ML reconfiguration element and the common information */

+ skb_put_u8(skb, WLAN_EID_EXTENSION);

+ ml_elem_len = skb_put(skb, 1);

+ skb_put_u8(skb, WLAN_EID_EXT_EHT_MULTI_LINK);

+ ml_elem = skb_put(skb, sizeof(*ml_elem));

+ ml_elem->control =

+ cpu_to_le16(IEEE80211_ML_CONTROL_TYPE_RECONF |

+ IEEE80211_MLC_RECONF_PRES_MLD_MAC_ADDR);

+ common = skb_put(skb, common_size);

+ common->len = common_size + var_common_size;

+ memcpy(common->mld_mac_addr, sdata->vif.addr, ETH_ALEN);

+

+ if (add_links_data) {

+ if (eml_capa &

+ cpu_to_le16((IEEE80211_EML_CAP_EMLSR_SUPP |

+ IEEE80211_EML_CAP_EMLMR_SUPPORT))) {

+ ml_elem->control |=

+ cpu_to_le16(IEEE80211_MLC_RECONF_PRES_EML_CAPA);

+ skb_put_data(skb, &eml_capa, sizeof(eml_capa));

+ }

+

+ ml_elem->control |=

+ cpu_to_le16(IEEE80211_MLC_RECONF_PRES_MLD_CAPA_OP);

+

+ skb_put_data(skb, &mld_capa_ops, sizeof(mld_capa_ops));

+ }

+

+ if (ext_mld_capa_ops) {

+ ml_elem->control |=

+ cpu_to_le16(IEEE80211_MLC_RECONF_PRES_EXT_MLD_CAPA_OP);

+ skb_put_data(skb, &ext_mld_capa_ops, sizeof(ext_mld_capa_ops));

+ }

+

+ if (sdata->u.mgd.flags & IEEE80211_STA_ENABLE_RRM)

+ capab |= WLAN_CAPABILITY_RADIO_MEASURE;

+

+ /* Add the per station profile */

+ for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {

+ u8 *subelem_len = NULL;

+ u16 ctrl;

+ const u8 *addr;

+

+ /* Skip links that are not changing */

+ if (!(removed_links & BIT(link_id)) &&

+ (!add_links_data || !add_links_data->link[link_id].bss))

+ continue;

+

+ ctrl = link_id |

+ IEEE80211_MLE_STA_RECONF_CONTROL_STA_MAC_ADDR_PRESENT;

+

+ if (removed_links & BIT(link_id)) {

+ struct ieee80211_bss_conf *conf =

+ sdata_dereference(sdata->vif.link_conf[link_id],

+ sdata);

+ if (!conf)

+ continue;

+

+ addr = conf->addr;

+ ctrl |= u16_encode_bits(IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE_DEL_LINK,

+ IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE);

+ } else {

+ addr = add_links_data->link[link_id].addr;

+ ctrl |= IEEE80211_MLE_STA_RECONF_CONTROL_COMPLETE_PROFILE |

+ u16_encode_bits(IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE_ADD_LINK,

+ IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE);

+ }

+

+ skb_put_u8(skb, IEEE80211_MLE_SUBELEM_PER_STA_PROFILE);

+ subelem_len = skb_put(skb, 1);

+

+ put_unaligned_le16(ctrl, skb_put(skb, sizeof(ctrl)));

+ skb_put_u8(skb, 1 + ETH_ALEN);

+ skb_put_data(skb, addr, ETH_ALEN);

+

+ if (!(removed_links & BIT(link_id))) {

+ u16 link_present_elems[PRESENT_ELEMS_MAX] = {};

+ size_t extra_used;

+ void *capab_pos;

+ u8 qos_info;

+

+ capab_pos = skb_put(skb, 2);

+

+ extra_used =

+ ieee80211_add_link_elems(sdata, skb, &capab, NULL,

+ add_links_data->link[link_id].elems,

+ add_links_data->link[link_id].elems_len,

+ link_id, NULL,

+ link_present_elems,

+ add_links_data);

+

+ if (add_links_data->link[link_id].elems)

+ skb_put_data(skb,

+ add_links_data->link[link_id].elems +

+ extra_used,

+ add_links_data->link[link_id].elems_len -

+ extra_used);

+ if (sdata->u.mgd.flags & IEEE80211_STA_UAPSD_ENABLED) {

+ qos_info = sdata->u.mgd.uapsd_queues;

+ qos_info |= (sdata->u.mgd.uapsd_max_sp_len <<

+ IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);

+ } else {

+ qos_info = 0;

+ }

+

+ ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);

+ put_unaligned_le16(capab, capab_pos);

+ }

+

+ ieee80211_fragment_element(skb, subelem_len,

+ IEEE80211_MLE_SUBELEM_FRAGMENT);

+ }

+

+ ieee80211_fragment_element(skb, ml_elem_len, WLAN_EID_FRAGMENT);

+

+ info = IEEE80211_SKB_CB(skb);

+ info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;

+

+ return skb;

+}

+

+int ieee80211_mgd_assoc_ml_reconf(struct ieee80211_sub_if_data *sdata,

+ struct cfg80211_ml_reconf_req *req)

+{

+ struct ieee80211_local *local = sdata->local;

+ struct ieee80211_mgd_assoc_data *data = NULL;

+ struct sta_info *sta;

+ struct sk_buff *skb;

+ u16 added_links, new_valid_links;

+ int link_id, err;

+

+ if (!ieee80211_vif_is_mld(&sdata->vif) ||

+ !(sdata->vif.cfg.mld_capa_op &

+ IEEE80211_MLD_CAP_OP_LINK_RECONF_SUPPORT))

+ return -EINVAL;

+

+ /* No support for concurrent ML reconfiguration operation */

+ if (sdata->u.mgd.reconf.added_links ||

+ sdata->u.mgd.reconf.removed_links)

+ return -EBUSY;

+

+ added_links = 0;

+ for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {

+ if (!req->add_links[link_id].bss)

+ continue;

+

+ added_links |= BIT(link_id);

+ }

+

+ sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);

+ if (WARN_ON(!sta))

+ return -ENOLINK;

+

+ /* Adding links to the set of valid link is done only after a successful

+ * ML reconfiguration frame exchange. Here prepare the data for the ML

+ * reconfiguration frame construction and allocate the required

+ * resources

+ */

+ if (added_links) {

+ bool uapsd_supported;

+

+ data = kzalloc(sizeof(*data), GFP_KERNEL);

+ if (!data)

+ return -ENOMEM;

+

+ data->assoc_link_id = -1;

+ data->wmm = true;

+

+ uapsd_supported = true;

+ for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS;

+ link_id++) {

+ struct ieee80211_supported_band *sband;

+ struct cfg80211_bss *link_cbss =

+ req->add_links[link_id].bss;

+ struct ieee80211_bss *bss;

+

+ if (!link_cbss)

+ continue;

+

+ bss = (void *)link_cbss->priv;

+

+ if (!bss->wmm_used) {

+ err = -EINVAL;

+ goto err_free;

+ }

+

+ if (link_cbss->channel->band == NL80211_BAND_S1GHZ) {

+ err = -EINVAL;

+ goto err_free;

+ }

+

+ eth_random_addr(data->link[link_id].addr);

+ data->link[link_id].conn =

+ ieee80211_conn_settings_unlimited;

+ sband =

+ local->hw.wiphy->bands[link_cbss->channel->band];

+

+ ieee80211_determine_our_sta_mode(sdata, sband,

+ NULL, true, link_id,

+ &data->link[link_id].conn);

+

+ data->link[link_id].bss = link_cbss;

+ data->link[link_id].disabled =

+ req->add_links[link_id].disabled;

+ data->link[link_id].elems =

+ (u8 *)req->add_links[link_id].elems;

+ data->link[link_id].elems_len =

+ req->add_links[link_id].elems_len;

+

+ if (!bss->uapsd_supported)

+ uapsd_supported = false;

+

+ if (data->link[link_id].conn.mode <

+ IEEE80211_CONN_MODE_EHT) {

+ err = -EINVAL;

+ goto err_free;

+ }

+

+ err = ieee80211_mgd_get_ap_ht_vht_capa(sdata, data,

+ link_id);

+ if (err) {

+ err = -EINVAL;

+ goto err_free;

+ }

+ }

+

+ /* Require U-APSD support if we enabled it */

+ if (sdata->u.mgd.flags & IEEE80211_STA_UAPSD_ENABLED &&

+ !uapsd_supported) {

+ err = -EINVAL;

+ sdata_info(sdata, "U-APSD on but not available on (all) new links\n");

+ goto err_free;

+ }

+

+ for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS;

+ link_id++) {

+ if (!data->link[link_id].bss)

+ continue;

+

+ /* only used to verify the mode, nothing is allocated */

+ err = ieee80211_prep_channel(sdata, NULL, link_id,

+ data->link[link_id].bss,

+ true,

+ &data->link[link_id].conn,

+ sdata->u.mgd.userspace_selectors);

+ if (err)

+ goto err_free;

+ }

+ }

+

+ /* link removal is done before the ML reconfiguration frame exchange so

+ * that these links will not be used between their removal by the AP MLD

+ * and before the station got the ML reconfiguration response. Based on

+ * Section 35.3.6.4 in Draft P802.11be_D7.0 the AP MLD should accept the

+ * link removal request.

+ */

+ if (req->rem_links) {

+ u16 new_active_links =

+ sdata->vif.active_links & ~req->rem_links;

+

+ new_valid_links = sdata->vif.valid_links & ~req->rem_links;

+

+ /* Should not be left with no valid links to perform the

+ * ML reconfiguration

+ */

+ if (!new_valid_links ||

+ !(new_valid_links & ~sdata->vif.dormant_links)) {

+ sdata_info(sdata, "mlo: reconf: no valid links\n");

+ err = -EINVAL;

+ goto err_free;

+ }

+

+ if (new_active_links != sdata->vif.active_links) {

+ if (!new_active_links)

+ new_active_links =

+ BIT(__ffs(new_valid_links &

+ ~sdata->vif.dormant_links));

+

+ err = ieee80211_set_active_links(&sdata->vif,

+ new_active_links);

+ if (err) {

+ sdata_info(sdata,

+ "mlo: reconf: failed set active links\n");

+ goto err_free;

+ }

+ }

+ }

+

+ /* Build the SKB before the link removal as the construction of the

+ * station info for removed links requires the local address.

+ * Invalidate the removed links, so that the transmission of the ML

+ * reconfiguration request frame would not be done using them, as the AP

+ * is expected to send the ML reconfiguration response frame on the link

+ * on which the request was received.

+ */

+ skb = ieee80211_build_ml_reconf_req(sdata, data, req->rem_links,

+ cpu_to_le16(req->ext_mld_capa_ops));

+ if (!skb) {

+ err = -ENOMEM;

+ goto err_free;

+ }

+

+ if (req->rem_links) {

+ u16 new_dormant_links =

+ sdata->vif.dormant_links & ~req->rem_links;

+

+ err = ieee80211_vif_set_links(sdata, new_valid_links,

+ new_dormant_links);

+ if (err) {

+ sdata_info(sdata,

+ "mlo: reconf: failed set valid links\n");

+ kfree_skb(skb);

+ goto err_free;

+ }

+

+ for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS;

+ link_id++) {

+ if (!(req->rem_links & BIT(link_id)))

+ continue;

+

+ ieee80211_sta_remove_link(sta, link_id);

+ }

+

+ /* notify the driver and upper layers */

+ ieee80211_vif_cfg_change_notify(sdata,

+ BSS_CHANGED_MLD_VALID_LINKS);

+ cfg80211_links_removed(sdata->dev, req->rem_links);

+ }

+

+ sdata_info(sdata, "mlo: reconf: adding=0x%x, removed=0x%x\n",

+ added_links, req->rem_links);

+

+ ieee80211_tx_skb(sdata, skb);

+

+ sdata->u.mgd.reconf.added_links = added_links;

+ sdata->u.mgd.reconf.add_links_data = data;

+ sdata->u.mgd.reconf.removed_links = req->rem_links;

+ wiphy_delayed_work_queue(sdata->local->hw.wiphy,

+ &sdata->u.mgd.reconf.wk,

+ IEEE80211_ASSOC_TIMEOUT_SHORT);

+ return 0;

+

+ err_free:

+ kfree(data);

+ return err;

+}

+

+static bool ieee80211_mgd_epcs_supp(struct ieee80211_sub_if_data *sdata)

+{

+ unsigned long valid_links = sdata->vif.valid_links;

+ u8 link_id;

+

+ lockdep_assert_wiphy(sdata->local->hw.wiphy);

+

+ if (!ieee80211_vif_is_mld(&sdata->vif))

+ return false;

+

+ for_each_set_bit(link_id, &valid_links, IEEE80211_MLD_MAX_NUM_LINKS) {

+ struct ieee80211_bss_conf *bss_conf =

+ sdata_dereference(sdata->vif.link_conf[link_id], sdata);

+

+ if (WARN_ON(!bss_conf) || !bss_conf->epcs_support)

+ return false;

+ }

+

+ return true;

+}

+

+int ieee80211_mgd_set_epcs(struct ieee80211_sub_if_data *sdata, bool enable)

+{

+ struct ieee80211_local *local = sdata->local;

+ struct ieee80211_mgmt *mgmt;

+ struct sk_buff *skb;

+ int frame_len = offsetofend(struct ieee80211_mgmt,

+ u.action.u.epcs) + (enable ? 1 : 0);

+

+ if (!ieee80211_mgd_epcs_supp(sdata))

+ return -EINVAL;

+

+ if (sdata->u.mgd.epcs.enabled == enable &&

+ !sdata->u.mgd.epcs.dialog_token)

+ return 0;

+

+ /* Do not allow enabling EPCS if the AP didn't respond yet.

+ * However, allow disabling EPCS in such a case.

+ */

+ if (sdata->u.mgd.epcs.dialog_token && enable)

+ return -EALREADY;

+

+ skb = dev_alloc_skb(local->hw.extra_tx_headroom + frame_len);

+ if (!skb)

+ return -ENOBUFS;

+

+ skb_reserve(skb, local->hw.extra_tx_headroom);

+ mgmt = skb_put_zero(skb, frame_len);

+ mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |

+ IEEE80211_STYPE_ACTION);

+ memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN);

+ memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);

+ memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);

+

+ mgmt->u.action.category = WLAN_CATEGORY_PROTECTED_EHT;

+ if (enable) {

+ u8 *pos = mgmt->u.action.u.epcs.variable;

+

+ mgmt->u.action.u.epcs.action_code =

+ WLAN_PROTECTED_EHT_ACTION_EPCS_ENABLE_REQ;

+

+ *pos = ++sdata->u.mgd.dialog_token_alloc;

+ sdata->u.mgd.epcs.dialog_token = *pos;

+ } else {

+ mgmt->u.action.u.epcs.action_code =

+ WLAN_PROTECTED_EHT_ACTION_EPCS_ENABLE_TEARDOWN;

+

+ ieee80211_epcs_teardown(sdata);

+ ieee80211_epcs_changed(sdata, false);

+ }

+

+ ieee80211_tx_skb(sdata, skb);

+ return 0;

+}

+

+static void ieee80211_ml_epcs(struct ieee80211_sub_if_data *sdata,

+ struct ieee802_11_elems *elems)

+{

+ const struct element *sub;

+ size_t scratch_len = elems->ml_epcs_len;

+ u8 *scratch __free(kfree) = kzalloc(scratch_len, GFP_KERNEL);

+

+ lockdep_assert_wiphy(sdata->local->hw.wiphy);

+

+ if (!ieee80211_vif_is_mld(&sdata->vif) || !elems->ml_epcs)

+ return;

+

+ if (WARN_ON(!scratch))

+ return;

+

+ /* Directly parse the sub elements as the common information doesn't

+ * hold any useful information.

+ */

+ for_each_mle_subelement(sub, (const u8 *)elems->ml_epcs,

+ elems->ml_epcs_len) {

+ struct ieee80211_link_data *link;

+ struct ieee802_11_elems *link_elems __free(kfree);

+ u8 *pos = (void *)sub->data;

+ u16 control;

+ ssize_t len;

+ u8 link_id;

+

+ if (sub->id != IEEE80211_MLE_SUBELEM_PER_STA_PROFILE)

+ continue;

+

+ if (sub->datalen < sizeof(control))

+ break;

+

+ control = get_unaligned_le16(pos);

+ link_id = control & IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID;

+

+ link = sdata_dereference(sdata->link[link_id], sdata);

+ if (!link)

+ continue;

+

+ len = cfg80211_defragment_element(sub, (u8 *)elems->ml_epcs,

+ elems->ml_epcs_len,

+ scratch, scratch_len,

+ IEEE80211_MLE_SUBELEM_FRAGMENT);

+ if (len < (ssize_t)sizeof(control))

+ continue;

+

+ pos = scratch + sizeof(control);

+ len -= sizeof(control);

+

+ link_elems = ieee802_11_parse_elems(pos, len, false, NULL);

+ if (!link_elems)

+ continue;

+

+ if (ieee80211_sta_wmm_params(sdata->local, link,

+ link_elems->wmm_param,

+ link_elems->wmm_param_len,

+ link_elems->mu_edca_param_set))

+ ieee80211_link_info_change_notify(sdata, link,

+ BSS_CHANGED_QOS);

+ }

+}

+

+void ieee80211_process_epcs_ena_resp(struct ieee80211_sub_if_data *sdata,

+ struct ieee80211_mgmt *mgmt, size_t len)

+{

+ struct ieee802_11_elems *elems __free(kfree) = NULL;

+ size_t ies_len;

+ u16 status_code;

+ u8 *pos, dialog_token;

+

+ if (!ieee80211_mgd_epcs_supp(sdata))

+ return;

+

+ /* Handle dialog token and status code */

+ pos = mgmt->u.action.u.epcs.variable;

+ dialog_token = *pos;

+ status_code = get_unaligned_le16(pos + 1);

+

+ /* An EPCS enable response with dialog token == 0 is an unsolicited

+ * notification from the AP MLD. In such a case, EPCS should already be

+ * enabled and status must be success

+ */

+ if (!dialog_token &&

+ (!sdata->u.mgd.epcs.enabled ||

+ status_code != WLAN_STATUS_SUCCESS))

+ return;

+

+ if (sdata->u.mgd.epcs.dialog_token != dialog_token)

+ return;

+

+ sdata->u.mgd.epcs.dialog_token = 0;

+

+ if (status_code != WLAN_STATUS_SUCCESS)

+ return;

+

+ pos += IEEE80211_EPCS_ENA_RESP_BODY_LEN;

+ ies_len = len - offsetof(struct ieee80211_mgmt,

+ u.action.u.epcs.variable) -

+ IEEE80211_EPCS_ENA_RESP_BODY_LEN;

+

+ elems = ieee802_11_parse_elems(pos, ies_len, true, NULL);

+ if (!elems)

+ return;

+

+ ieee80211_ml_epcs(sdata, elems);

+ ieee80211_epcs_changed(sdata, true);

+}

+

+void ieee80211_process_epcs_teardown(struct ieee80211_sub_if_data *sdata,

+ struct ieee80211_mgmt *mgmt, size_t len)

+{

+ if (!ieee80211_vif_is_mld(&sdata->vif) ||

+ !sdata->u.mgd.epcs.enabled)

+ return;

+

+ ieee80211_epcs_teardown(sdata);

+ ieee80211_epcs_changed(sdata, false);

+}