dump of labs

28 files changed, 16946 insertions, 0 deletions

diff --git a/static-analysis/.gitignore b/static-analysis/.gitignore
new file mode 100644
index 0000000..3b2122a
--- /dev/null
+++ b/static-analysis/.gitignore
@@ -0,0 +1,3 @@
+.*.sw*
+build
+/*.staff.c
diff --git a/static-analysis/COMPILER b/static-analysis/COMPILER
new file mode 100644
index 0000000..788cc34
--- /dev/null
+++ b/static-analysis/COMPILER
@@ -0,0 +1,183 @@
+### Compiler
+The goal of the compiler is to go from lexemes down to the IR accepted by the
+checker you wrote for the prelab. The compiler will compile each function in
+the source C file into a different IR program, separated by the string
+"~~~\n".
+
+For example, we might have:
+
+    $ cat test_inputs/simple_if.c
+    void foo(int *x) {
+        *x = 5;
+        if (x)
+            *x = 6;
+    }
+
+    void bar(int *x) {
+        *x = 5;
+        while (x)
+            x = 6;
+    }
+    $ make build/compiler
+    $ ./build/compiler test_inputs/simple_if.c
+    ~~~
+    3 D 177693 2
+    4 K 5861415 2
+    9 B 177693 6 7 3
+    6 K 0
+    11 D 177693 4
+    12 K 5861415 4
+    13 B 0 8 8 0
+    7 K 0
+    8 K 0
+    1 K 0
+    ~~~
+    3 D 177693 8
+    4 K 5861415 8
+    6 K 0
+    9 B 177693 7 8 9
+    7 K 0
+    11 K 177693 10
+    12 B 0 6 6 0
+    8 K 0
+    1 K 0
+
+Note that ./build/compiler returned one IR block per function, while the
+checker from the prelab only accepts one IR block at a time. The helper script
+helper_scripts/check_file.py will automatically separate these blocks and call
+the prelab checker once for each block. In other words, don't worry about it.
+
+The compilation approach we'll use here is vaguely inspired by
+https://legacy.cs.indiana.edu/~dyb/pubs/ddcg.pdf although _significantly_
+jankier.
+
+One big thing to keep in mind: we're not going to be able to handle all the
+minutiae of the C language, and we're not even really going to try. We're just
+going to try to handle the 90% common case as well as possible in a reasonable
+code budget, then fiddle with it afterwards to reduce false positives.
+
+### Compiler Starter Code Walkthrough
+I'm giving a pretty significant chunk of starter code to get you going. You're
+welcome to start from scratch if you prefer. But if not, read on ...
+
+First, take a look at main.c. It just reads the file provided into a temporary
+buffer, lexes that buffer (you wrote this in part 2a!), and then calls
+"process_program".
+
+Now, open up compiler.c and take a look at process_program. The goal of this
+function is to identify functions in the C source code and compile each one
+individually. To do that, we walk over lexemes until we see a "{". Then, we
+locate the end of that block using the match_body method and call visit_stmt
+on that range of lexemes. visit_stmt does the actual work of compiling the
+function. Then we keep searching for more functions after that one until the
+array of lexemes is emptied.
+
+### Implementing the Compiler
+The two functions you want to work in are:
+
+    - visit_stmt(range, meta): takes a range in the file and compiles the
+      relevant statements to stdout
+    - visit_expr(range, meta): takes a range in the file and compiles the
+      single expression contained in that range to stdout
+
+The struct meta @meta argument is defined in compiler.h. It contains the
+following metadata that is useful to the parser at any point in time:
+
+    - fn_start: the first lexeme in this function
+    - fn_end: one-past-the-end lexeme of this function
+    - continue_to: what label should the IR jump to if the C code sees a
+      "continue"?
+    - break_to: what label should the IR jump to if the C code sees a "break"?
+    - return_to: what label should the IR jump to if the C code sees a
+      "return"?
+    - true_branch: what label should the IR jump to if this expression is
+      true?
+    - false_branch: what label should the IR jump to if this expression is
+      false?
+
+You probably don't need to worry about fn_start or fn_end. The most confusing
+meta fields are true_branch and false_branch; basically, if they are non-zero
+while you're inside visit_expr, they indicate that the program is branching
+based on the value of this expression. Make sure you propagate these properly,
+e.g., through short-circuiting operators like "&&".
+
+Note there are some parts of the code that are nasty/old stuff I don't quite
+remember why I did. They are set aside in blocks that say "NASTY, IGNORE ME"
+--- please do so, at least until you've filled in all the "unimplemented"s.
+
+### Helper Functions
+You should use the helper functions kill, deref, nop_labelled, branch,
+branchrange, and goto_ to output the IR. These functions make sure to output
+the line number as well in a suitable way.
+
+There are some helper functions to help with the parsing:
+
+    - find(lm, rm, str): looks for a lexeme with string @str in the range
+      [lm,rm). Note this skips over the interior of balanced parentheses.
+    - match_body(lm): looks for one-past-the-end of the body of the statement
+      starting at @lm. E.g., match_body([<do>, <{>, ..., <}>, <while>, ...])
+      will return the <}> right before the <while>.
+
+### Tip
+The big big big tip for implementing the compiler is to always first convert
+your statement type to a "goto program" that's halfway between C and our IR.
+for example, a general if/else pattern in C looks like:
+
+    if (cond) then_body; else else_body;
+
+you might write it as a "goto program" like so:
+
+    branch <cond> then_label else_label;
+    then_label:
+    <then_body>
+    goto exit
+    else_label:
+    <else_body>
+    exit_label:
+
+you can then translate "goto programs" pretty much line-by-line into code you
+can stick into the compiler (note you need to construct metas correctly):
+
+    visit_expr(<cond>, {.true = then_label, .false = else_label})
+    nop_labeled(then_label)
+    visit_stmt(<then_body>)
+    goto_(exit)
+    nop_labeled(else_label)
+    visit_stmt(<else_body>)
+    nop_labeled(exit_label)
+
+### Example
+Supposing the function body has lexemes:
+
+    <if> <(> <y> <)> <*> <x> <;>
+
+You'll probably see a callstack roughly like:
+
+    visit_stmt([<if>, ..., <;>], {})
+        body_label = 1, exit_label = 2
+        visit_expr([<y>], {.true_branch=1, .false_branch=2})
+            branchrange([<y>], 1, 2)
+        nop_labelled(1)
+        visit_stmt([<*>, <x>, <;>], {})
+            visit_expr([<*>, <x>], {})
+                deref([<x>])
+                visit_expr([<x>], {})
+        nop_labelled(2)
+
+Notice how it's actually visit_expr that compiles in the branch.
+
+Another example, for short-circuiting operations, if you have something like
+
+    visit_expr([<x>, <&&>, <y>], {})
+        first_true = 1, exit = 2
+        visit_expr([<x>], {.true_branch = 1, .false_branch = 2})
+        nop_labelled(1)
+        visit_expr([<y>], {})
+        nop_labelled(2)
+
+A few notes about these examples:
+
+    - They are not fully generalizable; to handle, say, else blocks you may
+      need extra labels
+    - The labels 1, 2 are just examples here; in practice you can get a unique
+      label using the bump allocator, i.e., just use BUMP++
diff --git a/static-analysis/LEXER b/static-analysis/LEXER
new file mode 100644
index 0000000..2bd4e2b
--- /dev/null
+++ b/static-analysis/LEXER
@@ -0,0 +1,61 @@
+### Lexer
+##### What is a lexer?
+The first step in most compilers is to lex the input file. Lexing basically
+means "chunking up" the input file into logical tokens, rather than individual
+characters. For example, the line:
+
+    if (bar ==foo) continue;
+
+consists of ~30 characters, but logically the compiler should see it as 8
+chunks (tokens, lexemes) like this:
+
+    <if> <(> <bar> <==> <foo> <)> <continue> <;>
+
+Basically, the lexer normalizes the input file, ignoring spaces and collecting
+characters that are logically one into a single lexeme. For our compiler, we'll
+also store a few other things on our lexemes:
+
+    - string: the null-terminated string contents of this lexeme
+    - label: the broad class of lexeme; either LEX_STR_LIT, LEX_NUM_LIT,
+      LEX_OP, or LEX_IDENT.
+    - line_no: the line number in the original file that this lexeme was on
+      (starts at 1)
+    - out_id: set to 0 for now
+    - label_id: set to 0 for now
+
+##### Implementing the lexer
+I've given most of a lexer in lexer.c. Your job is to add rules that lex the
+following types of tokens:
+
+    - [ ] string literals -> not ident or op
+    - [ ] character literals -> not ident or op
+    - [ ] hex literals 0x1234 -> not ident or op
+    - [ ] int literals -> not ident or op
+    - [ ] identifiers (including 'foo', 'if', 'for', ...) -> label ident
+
+Note that the code to insert into the lexeme array is given to you; you just
+need to set the @s pointer and @label value properly.
+
+NOTE: If you're not lexing whitespace (I do it for you, so you shouldn't be)
+then you want to set @s to one past the last character that you want to be part
+of the lexeme.
+
+##### Testing the lexer
+As an initial test, you can:
+
+    $ make build/lexer_tests
+    $ ./build/lexer_tests
+
+which should print a bunch of "Passed!" messages
+
+To go a bit further, I've included a helper script that lets you run your lexer
+against an arbitrary file and see what it lexes to. This lets you compare your
+lexer to mine.
+
+    $ make build/lex_file
+    $ ./build/lex_file test_inputs/mlme.c > mlme.lexed.c
+    $ diff mlme.lexed.c test_inputs/mlme.lexed.staff.c
+
+If you match my lexer output on this test case you're probably good to go
+(*assuming* you've picked proper labels ...). You might even do a better job
+lexing than me :)
diff --git a/static-analysis/Makefile b/static-analysis/Makefile
new file mode 100644
index 0000000..19aabbb
--- /dev/null
+++ b/static-analysis/Makefile
@@ -0,0 +1,25 @@
+# NOTE: We need at least -O2 to get tail call recursion without stack
+# overflows.
+CFLAGS = -g -lm -D_GNU_SOURCE
+CFLAGS += -O3
+CFLAGS += -I.
+# CFLAGS += -fsanitize=address
+
+all: build/compiler build/lexer_tests  build/lex_file
+
+build/compiler: compiler.c lexer.c main.c utils.c
+	mkdir -p $(dir $@)
+	$(CC) $(CFLAGS) $^ -o $@
+
+build/lexer_tests: lexer.c helper_scripts/lexer_tests.c
+	mkdir -p $(dir $@)
+	$(CC) $(CFLAGS) $^ -o $@
+
+build/lex_file: lexer.c helper_scripts/lex_file.c
+	mkdir -p $(dir $@)
+	$(CC) $(CFLAGS) $^ -o $@
+
+clean:
+	rm -rf build
+
+.PHONY: all clean
diff --git a/static-analysis/README b/static-analysis/README
new file mode 100644
index 0000000..6e5b998
--- /dev/null
+++ b/static-analysis/README
@@ -0,0 +1,71 @@
+### Ultimate Lab Goal
+As you've learned in this class, it's hard to write C correctly.  And operating
+systems are huge C projects.  In this lab we're going to implement a simple
+static checker that will help us automatically search for bugs in huge C
+projects. Our checker will find C code that looks like this:
+
+    *x = 5;
+    if (x)
+        return;
+
+This code indicates a bug, because on the first line you dereference $x$ (i.e.,
+requiring that it is non-null) then on the second line you check if $x$ is null
+or not (i.e., asserting a belief that it may be null). One of these beliefs
+must be wrong.
+
+We're going to vaguely be implementing a small part of this:
+https://mlfbrown.com/paper.pdf
+Combined with a little bit of this:
+https://legacy.cs.indiana.edu/~dyb/pubs/ddcg.pdf
+
+Our implementation will be in two parts: first, a checker that runs on a super
+simplified IR (the prelab). Second, a compiler from C to that IR (the main
+lab). I'll provide some helper scripts to hook them up together and
+pretty-print the results.
+
+### Part 1: Prelab
+Do the prelab described in prelab/README
+
+### Part 2a: Lexer
+Do the lexer described in LEXER
+
+### Part 2b: Compiler
+Do the compiler described in COMPILER
+
+### Part 3: Check the Linux Kernel
+If you're pretty confident your compiler & checker work, you can check the
+whole kernel like so:
+
+    $ git clone --depth=1 https://github.com/torvalds/linux.git linux
+    $ ./helper_scripts/check_repo.sh linux
+    ... bugs come out here ...
+
+### Part 4: Checkoff
+You should have:
+
+    - [ ] Prelab that matches my output on the prelab test_inputs
+    - [ ] ./build/lexer_tests passes
+    - [ ] ./build/lex_file test_inputs/mlme.c either matches the staff output
+          or is a better/also reasonable lexing
+    - [ ] Your checker has good SNR so it's easy to find 5--10 bugs in Linux
+    - [ ] Write a C file that causes your checker to have a false positive
+    - [ ] Write a C file that causes your checker to have a false negative
+
+### Part 5: Extensions
+You could ...
+
+    - Fiddle with the compiler to improve the SNR
+    - Implement different checks
+        - E.g., an easy one to adapt this checker to: look for cases where you
+          free(x) on every path before reaching a dereference *x.
+    - Our compiler is super janky; I think you can probably simplify the code
+      and improve robustness of the parser by writing some kind of
+      PEG-with-actions library/DSL
+    - Write a compiler from another language (unsafe rust? c++? go?)
+    - Run it on different codebases (freebsd tends to have a bunch of these
+      bugs)
+    - Compare SNR to just asking ChatGPT
+    - Try reducing false positives by feeding each bug report to ChatGPT and
+      asking it if it's a true bug or not
+    - Pick one or two bug reports that look like true positives & track down
+      Why the existing kernel checkers didn't catch it
diff --git a/static-analysis/compiler.c b/static-analysis/compiler.c
new file mode 100644
index 0000000..492d393
--- /dev/null
+++ b/static-analysis/compiler.c
@@ -0,0 +1,388 @@
+#include "compiler.h"
+
+struct lexeme RET_STATE;
+char *PATH = "[none]";
+
+uint64_t BUMP;
+
+void kill(struct lexrange expr) {
+    printf("%lu K %lu %lu\n", BUMP++, hash_range(expr), expr.lm->line_no);
+}
+void deref(struct lexrange expr) {
+    printf("%lu D %lu %lu\n", BUMP++, hash_range(expr), expr.lm->line_no);
+}
+void nop_labelled(uint64_t label) {
+    printf("%lu K 0\n", label);
+}
+void branch(uint64_t expr, uint64_t label_true, uint64_t label_false, uint64_t line) {
+    // in case we break or continue in something that's not a loop ...
+    if (!label_true || !label_false)
+        return nop_labelled(BUMP++);
+    printf("%lu B %lu %lu %lu %lu\n", BUMP++, expr, label_true, label_false, line);
+}
+void branchrange(struct lexrange expr, uint64_t label_true, uint64_t label_false) {
+    branch(hash_range(expr), label_true, label_false, expr.lm->line_no);
+}
+void goto_(uint64_t label) {
+    branch(0, label, label, 0);
+}
+
+void process_program() {
+    size_t n_fns = 0;
+    for (struct lexeme *l = LEXEMES; l != LEXEMES + N_LEXEMES;) {
+        if (!LEXSTR(l, "{")) {
+            l++;
+        } else {
+            struct meta meta = {0};
+            meta.fn_start = l;
+            meta.fn_end = match_body(l);
+            if (!meta.fn_end) return;
+            printf("~~~\n");
+            BUMP = 1;
+            meta.return_to = BUMP++;
+            visit_stmt(torange(l + 1, meta.fn_end), meta);
+            nop_labelled(meta.return_to);
+            l = meta.fn_end;
+        }
+    }
+}
+
+/********* PARSING **********/
+void visit_stmt(struct lexrange range, struct meta meta) {
+    struct lexeme *lm = range.lm;
+    if (range.rm > meta.fn_end) range.rm = meta.fn_end;
+    // Hit the end of the program!
+    if (!lm || lm >= range.rm) return;
+    if (lm->out_id) return;
+    lm->out_id = BUMP++;
+
+    struct lexeme *end_paren = NULL, *body_end = NULL;
+    if (LEXSTR(lm + 1, "(")) end_paren = find(lm + 1, NULL, ")");
+    if (end_paren) body_end = match_body(end_paren + 1);
+
+    struct meta submeta = meta;
+    if (LEXSTR(lm, "for")) {
+        // given: for (init; cond; upd) body
+        if (!end_paren || !body_end) goto fail;
+        struct lexeme *first_semi = find(lm + 2, NULL, ";");
+        if (!first_semi)    goto fail;
+        struct lexeme *second_semi = find(first_semi + 1, NULL, ";");
+        if (!second_semi) goto fail;
+
+        uint64_t cond = BUMP++, update = BUMP++, body = BUMP++, exit = BUMP++;
+
+        visit_stmt(torange(lm + 2, first_semi + 1), meta);
+
+        nop_labelled(cond);
+        submeta = meta;
+        submeta.true_branch = body;
+        submeta.false_branch = exit;
+        visit_expr(torange(first_semi + 1, second_semi), submeta);
+
+        submeta = meta;
+        submeta.continue_to = update;
+        submeta.break_to = exit;
+        nop_labelled(body);
+        visit_stmt(torange(end_paren + 1, body_end), submeta);
+
+        nop_labelled(update);
+        visit_expr(torange(second_semi + 1, end_paren), meta);
+        goto_(cond);
+        nop_labelled(exit);
+        return visit_stmt(torange(body_end, range.rm), meta);
+    } else if (LEXSTR(lm, "while")) {
+        if (!end_paren || !body_end) goto fail;
+
+        // you'll probably need three labels: cond, body, and exit
+        // the condition expression is [lm+2, end_paren)
+        // the body is [end_paren+1, body_end)
+        assert(!"unimplemented");
+
+        return visit_stmt(torange(body_end, range.rm), meta);
+    } else if (LEXSTR(lm, "if")) {
+        if (!end_paren || !body_end) goto fail;
+
+        // you'll probably need three labels: then, else_, and exit
+        // the condition expression is [lm+2, end_paren)
+        // the body is [end_paren+1, body_end)
+        assert(!"unimplemented");
+
+        if (LEXSTR(body_end, "else")) {
+            struct lexeme *else_end = match_body(body_end + 1);
+
+            // the else body is [body_end + 1, else_end)
+            assert(!"unimplemented");
+
+            // the end of the whole statement is the end of the body
+            body_end = else_end;
+        }
+
+        // in case you need something here ...
+        assert(!"unimplemented");
+
+        return visit_stmt(torange(body_end, range.rm), meta);
+    } else if (LEXSTR(lm, "do")) {
+        if (!(body_end = match_body(lm + 1))) goto fail;
+
+        // you'll probably need cond, body, and exit
+        // the body is [lm + 1, body_end)
+        assert(!"unimplemented");
+
+        end_paren = find(body_end + 1, NULL, ")");
+        // the condition is [body_end, end_paren)
+        assert(!"unimplemented");
+
+        return visit_stmt(torange(end_paren + 1, range.rm), meta);
+    } else if (LEXSTR(lm, "switch")) {
+        /****** NASTY, IGNORE ME ******/
+        if (!end_paren || !body_end) goto fail;
+
+        uint64_t exit = BUMP++, body = BUMP++;
+        submeta = meta;
+        submeta.true_branch = body;
+        submeta.false_branch = body;
+        visit_expr(torange(lm + 2, end_paren), submeta);
+
+        nop_labelled(body);
+        submeta = meta;
+        submeta.break_to = exit;
+
+        int is_case = 0;
+        size_t first_case = BUMP;
+        for (struct lexeme *l = end_paren + 1; l != body_end; l++) {
+            is_case = is_case || LEXSTR(l, "case") || LEXSTR(l, "default");
+            if (is_case && LEXSTR(l, ":")) {
+                BUMP++;
+                is_case = 0;
+            }
+        }
+        size_t n_cases = BUMP - first_case;
+        for (size_t i = 0; i < n_cases; i++)
+                branch(0, first_case + i, BUMP + 1, range.lm->line_no);
+        nop_labelled(BUMP++);
+
+        int i = first_case;
+        for (struct lexeme *l = end_paren + 1; l != body_end; l++) {
+            is_case = is_case || LEXSTR(l, "case") || LEXSTR(l, "default");
+            if (is_case && LEXSTR(l, ":")) {
+                nop_labelled(first_case++);
+                visit_stmt(torange(l + 1, body_end), submeta);
+                is_case = 0;
+            }
+        }
+        nop_labelled(exit);
+        return visit_stmt(torange(body_end, range.rm), meta);
+        /****** END NASTY ******/
+    } else if (LEXSTR(lm, "case") || LEXSTR(lm, "default") || LEXSTR(lm + 1, ":")) {
+        struct lexeme *colon = find(lm + 1, NULL, ":");
+        if (!colon) goto fail;
+        if (!(lm->label_id)) lm->label_id = BUMP++;
+        nop_labelled(lm->label_id);
+        return visit_stmt(torange(colon + 1, range.rm), meta);
+    } else if (LEXSTR(lm, "continue")) {
+        goto_(meta.continue_to);
+        return visit_stmt(torange(lm + 2, range.rm), meta);
+    } else if (LEXSTR(lm, "break")) {
+        assert(!"unimplemented");
+    } else if (LEXSTR(lm, "return")) {
+        assert(!"unimplemented");
+    } else if (LEXSTR(lm, "goto")) {
+        for (struct lexeme *l = meta.fn_start; l != meta.fn_end; l++) {
+            if (LEXSTR(l, (lm + 1)->string) && LEXSTR(l + 1, ":")) {
+                if (!(l->label_id)) l->label_id = BUMP++;
+                goto_(l->label_id);
+                break;
+            }
+        }
+        return visit_stmt(torange(lm + 3, range.rm), meta);
+    } else if (LEXSTR(lm, "{") || LEXSTR(lm, "}")) {
+        return visit_stmt(torange(lm + 1, range.rm), meta);
+    }
+
+    // match foo() { ... }
+    if (end_paren && body_end) {
+        visit_stmt(torange(end_paren + 1, body_end), meta);
+        return visit_stmt(torange(body_end, range.rm), meta);
+    }
+
+    /****** NASTY, IGNORE ME ******/
+    struct lexeme *semi = find(lm, NULL, ";");
+    int saw_star = 0, anything_interesting = LEXSTR(lm, "*");
+    for (struct lexeme *l = lm; l != semi && l != LEXEMES + N_LEXEMES; l++) {
+        saw_star |= LEXSTR(l, "*");
+        if (semi && !LEXSTR(lm, "*") && (LEXSTR(l, ",") || LEXSTR(l, "="))) {
+            struct lexeme *og_l = l;
+            while (1) {
+                l = find(l, semi, "=");
+                if (!l) break;
+                struct lexeme *rm = find(l, semi, ",");
+                if (!rm) rm = semi;
+                visit_expr(torange(l + 1, rm), meta);
+                l = rm;
+            }
+            if (LEXSTR(og_l, "=")) kill(torange(lm, og_l));
+            goto finish;
+        }
+        // Definitely an expression...
+        if (!(l->label == LEX_IDENT || LEXSTR(l, "*") || LEXSTR(l, "[") || LEXSTR(l, "]"))) {
+            anything_interesting = 1;
+            break;
+        }
+    }
+    /****** END NASTY ******/
+    if (!semi) goto fail;
+    if (anything_interesting)
+        // It's a line
+        visit_expr(torange(lm, semi), meta);
+finish:
+    return visit_stmt(torange(semi + 1, range.rm), meta);
+fail:
+    return visit_stmt(torange(lm + 1, range.rm), meta);
+}
+
+void visit_expr(struct lexrange range, struct meta meta) {
+    if (range.rm >= meta.fn_end) range.rm = meta.fn_end;
+    if (range.lm >= range.rm) return;
+    struct lexeme *lm = range.lm, *rm = range.rm;
+    if (lm == rm || !lm || !rm) return;
+    // Handle expression.
+    struct meta og_meta = meta;
+    meta.true_branch = meta.false_branch = 0;
+
+    struct lexeme *found = NULL;
+    if (LEXSTR(lm, "(") && (find(lm, rm, ")") + 1 == rm))
+        return visit_expr(torange(lm + 1, rm - 1), og_meta);
+
+    // Don't parse initializer lists ...
+    if (LEXSTR(lm, "{") && (find(lm, rm, "}") + 1 == rm))
+        return;
+
+    if (found = find(lm, rm, ",")) {
+        visit_expr(torange(lm, found), meta);
+        return visit_expr(torange(found + 1, rm), og_meta);
+    }
+
+    char *assignops[] = {"=","+=","-=","&=","|=","<<=",">>=",NULL};
+    for (char **op = &assignops[0]; *op; op++) {
+        if (!(found = find(lm, rm, *op))) continue;
+        assert(found + 1 != lm);
+        if (found == lm || found + 1 == rm) goto fail;
+        visit_expr(torange(lm, found), meta);
+        visit_expr(torange(found + 1, rm), og_meta);
+        return kill(torange(lm, found));
+    }
+    if (find(lm, rm, "?") || LEXSTR(lm, "sizeof") || LEXSTR(lm, "typeof"))
+        goto opaque;
+
+    // Handle BINOPS
+    struct lexeme *strip = lm;
+    for (; strip != rm && strip->label == LEX_OP; strip++);
+    char *binops[] = {"||","&&","!=","==",">=","<=",">","<",">>",
+                                        "<<","|","&","^","-","+","%","/","*",NULL};
+    struct lexeme *op = NULL;
+    for (char **b = &binops[0]; *b; b++)
+            if (op = find(strip, rm, *b))
+                    break;
+    if (op) {
+        int lhs_null = (lm + 1 == op) && (LEXSTR(lm, "null") || LEXSTR(lm, "0"));
+        int rhs_null = (op + 2 == rm) && (LEXSTR(op + 1, "null") || LEXSTR(op + 1, "0"));
+        assert(op + 1 <= rm);
+        if (LEXSTR(op, "==") && lhs_null) {
+#define NEGATE(l, r) { \
+            meta.true_branch  = og_meta.false_branch; \
+            meta.false_branch = og_meta.true_branch; \
+            return visit_expr(torange(l, r), meta); }
+            NEGATE(op + 1, rm);
+        } else if (LEXSTR(op, "==") && rhs_null) {
+            assert(!"unimplemented");
+        } else if (LEXSTR(op, "!=") && lhs_null) {
+            return visit_expr(torange(op + 1, rm), og_meta);
+        } else if (LEXSTR(op, "!=") && rhs_null) {
+            assert(!"unimplemented");
+        } else if (LEXSTR(op, "&&")) {
+            uint64_t first_true = BUMP++,
+                     either_false = og_meta.false_branch ? og_meta.false_branch : BUMP++;
+            meta.true_branch = first_true;
+            meta.false_branch = either_false;
+            visit_expr(torange(lm, op), meta);
+            nop_labelled(first_true);
+            visit_expr(torange(op + 1, rm), og_meta);
+            if (!og_meta.false_branch)
+                nop_labelled(either_false);
+        } else if (LEXSTR(op, "||")) {
+            assert(!"unimplemented");
+        } else if (lm != op && op != rm) {
+            visit_expr(torange(lm, op), meta);
+            visit_expr(torange(op + 1, rm), meta);
+        }
+        goto opaque;
+    }
+
+    // Handle PREOPS
+    if (strstr(lm->string, "ret")) {
+        goto opaque;
+    } else if (lm->label == LEX_OP) {
+        if (LEXSTR(lm, "!"))
+            NEGATE(lm + 1, rm);
+        if (LEXSTR(lm, "*"))
+            assert(!"unimplemented");
+        if (LEXSTR(lm, "&"))
+            assert(!"unimplemented");
+        else
+            visit_expr(torange(lm + 1, rm), meta);
+        if (LEXSTR(lm, "++") || LEXSTR(lm, "--"))
+            assert(!"unimplemented");
+    } else if (LEXSTR(rm - 1, "++") || LEXSTR(rm - 1, "--")) {
+        assert(lm <= (rm - 1));
+        kill(torange(lm, rm - 1));
+        visit_expr(torange(lm, rm - 1), meta);
+    } else if (LEXSTR(rm - 1, "]")) {
+        struct lexeme *open_bracket = find(rm - 1, lm, "[");
+        if (!open_bracket) goto fail;
+        deref(torange(lm, open_bracket));
+        visit_expr(torange(lm, open_bracket), meta);
+        visit_expr(torange(open_bracket + 1, rm - 1), meta);
+    } else if (lm + 2 <= rm && LEXSTR(rm - 2, ".")) {
+        visit_expr(torange(lm, rm - 2), meta);
+    } else if (lm + 2 <= rm && LEXSTR(rm - 2, "->")) {
+        assert(!"unimplemented");
+    } else if (LEXSTR(rm - 1, ")")) {
+        /****** NASTY, IGNORE ME ******/
+        struct lexeme *arg_start = find(rm - 1, lm, "(");
+        if (!arg_start) goto fail;
+        if (lm+1 != arg_start) goto fail; // ??????
+        arg_start++;
+        struct lexeme *comma = find(arg_start, rm - 1, ",");
+        while (comma) {
+            visit_expr(torange(arg_start, comma), meta);
+            arg_start = comma + 1;
+            comma = find(arg_start, rm - 1, ",");
+        }
+        if (arg_start + 1 != rm - 1)
+            visit_expr(torange(arg_start, rm - 1), meta);
+        // If this is a panic, err, abort, ... then we need to *NOT* fallthrough.
+        char *exits[]
+            = {"panic","exit","err","abort","die","bug_on","oops",
+                "ret","goto","out_of_mem","throw","usage","fatal","quit",
+                "fail","stop",NULL};
+        for (char **e = &exits[0]; *e; e++) {
+            if (!strstr(lm->string, *e)) continue;
+            // dirt: expressions can't actually kill paths, but they can reset the
+            // state (which is effectively the same)
+            goto opaque;
+        }
+        char *exact_exits[] = {"bug",NULL};
+        for (char **e = &exact_exits[0]; *e; e++) {
+            if (!LEXSTR(lm, *e)) continue;
+            // dirt: expressions can't actually kill paths, but they can reset the
+            // state (which is effectively the same)
+            goto opaque;
+        }
+        /****** END NASTY ******/
+    }
+fail:
+opaque:
+    // If we are not branching based on this; just keep going
+    if (!(og_meta.true_branch || og_meta.false_branch)) return;
+    branchrange(range, og_meta.true_branch, og_meta.false_branch);
+}
diff --git a/static-analysis/compiler.h b/static-analysis/compiler.h
new file mode 100644
index 0000000..9205531
--- /dev/null
+++ b/static-analysis/compiler.h
@@ -0,0 +1,74 @@
+#include <string.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <assert.h>
+#include <string.h>
+#include <assert.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <stdint.h>
+
+#define append_field(o, f) *({ \
+  o.f = realloc(o.f, (++o.n_##f) * sizeof(o.f[0])); \
+  o.f + (o.n_##f - 1); \
+})
+
+// Guaranteed to return 0 or 1.
+#define LEXSTR(x, s) (x && x < LEXEMES + N_LEXEMES && !strcmp((x)->string, (s)))
+
+#define prefix(hay, needle) \
+  !strncmp(hay, needle, strlen(needle))
+
+enum lex_label {
+  LEX_NONE, LEX_STR_LIT, LEX_NUM_LIT,
+  LEX_OP, LEX_IDENT
+};
+
+struct lexrange {
+    struct lexeme *lm, *rm;
+};
+#define torange(l, r) (struct lexrange){l,r}
+
+struct lexeme {
+  char *string;
+  enum lex_label label;
+  size_t line_no;
+  uint64_t out_id, label_id;
+};
+
+#define MAX_LEXEMES (1 << 20)
+extern struct lexeme LEXEMES[MAX_LEXEMES];
+extern size_t N_LEXEMES;
+extern char *PATH;
+
+/////// lexer.c
+void lex(char *s);
+
+/////// utils.c
+uint64_t hash_range(struct lexrange range);
+// search in this range for a lexeme with string @str
+// NOTE: does *not* match inside of balanced parens, e.g., (a) should not match
+// a, but (a)a should (the second a).
+struct lexeme *find(struct lexeme *l, struct lexeme *rm, char *str);
+// returns the end of the body for the statement starting at @l.
+// e.g., while (x) { foo(); bar(); } ...
+// will return the first lexeme in the ...s.
+struct lexeme *match_body(struct lexeme *l);
+
+///// nanochex.c
+struct meta {
+    struct lexeme *fn_start, *fn_end;
+    uint64_t continue_to, break_to, true_branch, false_branch, return_to;
+};
+// statically execute the statement starting at lexeme @lm.
+void visit_stmt(struct lexrange range, struct meta meta);
+// statically evaluate the expression in range [@lm, @rm)
+void visit_expr(struct lexrange range, struct meta meta);
+// process an entire program (multiple functions)
+void process_program();
diff --git a/static-analysis/helper_scripts/check_file.py b/static-analysis/helper_scripts/check_file.py
new file mode 100644
index 0000000..06fc9fb
--- /dev/null
+++ b/static-analysis/helper_scripts/check_file.py
@@ -0,0 +1,28 @@
+import sys
+import subprocess
+
+if sys.argv[1].endswith("_table.c"):
+    sys.exit(0)
+
+output = subprocess.check_output(["./build/compiler", sys.argv[1]]).decode("utf-8")
+functions = output.split("~~~\n")
+
+any_error = False
+for function in map(str.strip, functions):
+    if not function: continue
+    try:
+        output = subprocess.check_output(["./prelab/main"], input=function, encoding="utf-8")
+    except subprocess.CalledProcessError:
+        if any_error: continue
+        if len(sys.argv) > 2:
+            open("/tmp/hi.prog", "w").write(function + "\n")
+        print(f"error {sys.argv[1]}")
+        any_error = True
+        continue
+    if output.strip():
+        function = {line.split()[0]: line.split()[-1]
+                    for line in function.split("\n")}
+        for bug in output.strip().split("\n"):
+            deref, check = bug.strip().split(":")
+            deref, check = function[deref], function[check]
+            print(f"{sys.argv[1]}:{deref}:{check}")
diff --git a/static-analysis/helper_scripts/check_repo.sh b/static-analysis/helper_scripts/check_repo.sh
new file mode 100755
index 0000000..ea2d06d
--- /dev/null
+++ b/static-analysis/helper_scripts/check_repo.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+if [ "$#" -ne 1 ]; then
+    echo -e "Usage:   $0 /path/to/repository/to/check"
+    exit 1
+fi
+
+listpath=$(mktemp)
+# find $1 -name '*.c' | shuf | head -n500 > $listpath
+find $1 -name '*.c' > $listpath
+
+resultpath=$(mktemp)
+parallel --progress --eta --bar -a $listpath "python3 helper_scripts/check_file.py" > $resultpath
+
+python3 helper_scripts/collate.py $resultpath
+
+rm $listpath
+rm $resultpath
diff --git a/static-analysis/helper_scripts/collate.py b/static-analysis/helper_scripts/collate.py
new file mode 100644
index 0000000..ac17337
--- /dev/null
+++ b/static-analysis/helper_scripts/collate.py
@@ -0,0 +1,47 @@
+import sys
+
+def main():
+    print(sys.argv)
+    args = sys.argv[1:]
+    errors = [l.strip().split()[-1]
+              for arg in args
+              for l in open(arg, "r").readlines()
+              if l.strip().startswith("error")]
+    for error in errors:
+        print("error", error)
+    warnings = [l.strip().split(':')
+                for arg in args
+                for l in open(arg, "r").readlines()
+                if l.strip() and l.strip()[-1].isnumeric()]
+    warnings = [(checkline[0],) + tuple(map(int, checkline[1:]))
+                for checkline in warnings]
+    warnings = sorted(warnings, key=lambda xyz: (max(xyz[1:]) - min(xyz[1:])))
+    for path, *checklines in reversed(warnings):
+        print(f"{path}:" + ":".join(map(str, checklines)))
+        pprint_area(path, checklines)
+    print("Done with collation.")
+    print(f"{len(warnings)} warnings processed.")
+    checkloc = set(w[-1] for w in warnings)
+    print(f"Out of those, {len(checkloc)} were unique check lines.")
+    derefloc = set(w[1] for w in warnings)
+    print(f"Out of those, {len(derefloc)} were unique deref lines.")
+
+def pprint_area(file, checklines):
+    try:
+        contents = open(file, "r").readlines()
+    except UnicodeDecodeError:
+        return
+    lower, upper = min(checklines), max(checklines)
+    context = 1 if (upper - lower) > 5 else 1
+    for i, line in enumerate(contents):
+        i = i + 1
+        line = line[:-1]
+        if i < lower - context: continue
+        if i > upper + context: continue
+        if i in checklines:
+            print(">>>>>", line)
+        else:
+            print("     ", line)
+
+if __name__ == "__main__":
+    main()
diff --git a/static-analysis/helper_scripts/lex_file.c b/static-analysis/helper_scripts/lex_file.c
new file mode 100644
index 0000000..4ef243d
--- /dev/null
+++ b/static-analysis/helper_scripts/lex_file.c
@@ -0,0 +1,26 @@
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+#include "compiler.h"
+
+int main(int argc, char **argv) {
+    struct stat statbuf;
+    assert(argc > 1);
+    stat(argv[1], &statbuf);
+
+    FILE *fd = fopen(argv[1], "r");
+    assert(fd);
+
+    char *data = calloc(statbuf.st_size + 1, sizeof(char));
+    fread(data, sizeof(char), statbuf.st_size, fd);
+    lex(data);
+
+    size_t line_no = 1;
+    for (struct lexeme *l = LEXEMES; l < (LEXEMES + N_LEXEMES); l++) {
+        for (; l->line_no > line_no; line_no++)
+            printf("\n");
+        printf("%s ", l->string);
+    }
+    printf("\n");
+    return 0;
+}
diff --git a/static-analysis/helper_scripts/lexer_tests.c b/static-analysis/helper_scripts/lexer_tests.c
new file mode 100644
index 0000000..f19d283
--- /dev/null
+++ b/static-analysis/helper_scripts/lexer_tests.c
@@ -0,0 +1,96 @@
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+#include "compiler.h"
+
+void (test_case)(char *string, struct lexeme *lexs, int n_lexs) {
+    printf("Testing '%s'...\n", string);
+
+    N_LEXEMES = 0;
+    lex(string);
+
+    assert(N_LEXEMES == n_lexs);
+    for (size_t i = 0; i < N_LEXEMES; i++) {
+        assert(!strcmp(LEXEMES[i].string, lexs[i].string));
+        assert(LEXEMES[i].label     == lexs[i].label);
+        assert(LEXEMES[i].line_no   == lexs[i].line_no);
+    }
+
+    printf("\tPassed!\n");
+}
+
+#define test_case(str, ...) \
+    (test_case)( \
+            strdup(str), \
+            (struct lexeme[]){__VA_ARGS__}, \
+            sizeof((struct lexeme[]){__VA_ARGS__})/sizeof(struct lexeme))
+
+
+int main() {
+    test_case(
+        "int x = 5;",
+        (struct lexeme){"int",  LEX_IDENT,  1,},
+        (struct lexeme){"x",    LEX_IDENT,  1,},
+        (struct lexeme){"=",    LEX_OP,     1,},
+        (struct lexeme){"5",    LEX_NUM_LIT,1,},
+        (struct lexeme){";",    LEX_OP,     1,},
+    );
+
+    test_case(
+        "int x = /* foo=bar */ 5;",
+        (struct lexeme){"int",  LEX_IDENT,  1,},
+        (struct lexeme){"x",    LEX_IDENT,  1,},
+        (struct lexeme){"=",    LEX_OP,     1,},
+        (struct lexeme){"5",    LEX_NUM_LIT,1,},
+        (struct lexeme){";",    LEX_OP,     1,},
+    );
+
+    test_case(
+        "int x=5;",
+        (struct lexeme){"int",  LEX_IDENT,  1,},
+        (struct lexeme){"x",    LEX_IDENT,  1,},
+        (struct lexeme){"=",    LEX_OP,     1,},
+        (struct lexeme){"5",    LEX_NUM_LIT,1,},
+        (struct lexeme){";",    LEX_OP,     1,},
+    );
+
+    test_case(
+        "int x=5    ;",
+        (struct lexeme){"int",  LEX_IDENT,  1,},
+        (struct lexeme){"x",    LEX_IDENT,  1,},
+        (struct lexeme){"=",    LEX_OP,     1,},
+        (struct lexeme){"5",    LEX_NUM_LIT,1,},
+        (struct lexeme){";",    LEX_OP,     1,},
+    );
+
+    test_case(
+        "x->foo",
+        (struct lexeme){"x",  LEX_IDENT,  1,},
+        (struct lexeme){"->", LEX_OP,     1,},
+        (struct lexeme){"foo",LEX_IDENT,  1,},
+    );
+
+    test_case(
+        "x<<foo",
+        (struct lexeme){"x",  LEX_IDENT,  1,},
+        (struct lexeme){"<<", LEX_OP,     1,},
+        (struct lexeme){"foo",LEX_IDENT,  1,},
+    );
+
+    test_case(
+        "x|=foo",
+        (struct lexeme){"x",  LEX_IDENT,  1,},
+        (struct lexeme){"|=", LEX_OP,     1,},
+        (struct lexeme){"foo",LEX_IDENT,  1,},
+    );
+
+    test_case(
+        "x|=foo// hello\nthere",
+        (struct lexeme){"x",    LEX_IDENT,  1,},
+        (struct lexeme){"|=",   LEX_OP,     1,},
+        (struct lexeme){"foo",  LEX_IDENT,  1,},
+        (struct lexeme){"there",LEX_IDENT,  2,},
+    );
+
+    return 0;
+}
diff --git a/static-analysis/lexer.c b/static-analysis/lexer.c
new file mode 100644
index 0000000..2c64ab7
--- /dev/null
+++ b/static-analysis/lexer.c
@@ -0,0 +1,59 @@
+#include <assert.h>
+#include <string.h>
+#include <ctype.h>
+#include "compiler.h"
+
+struct lexeme LEXEMES[MAX_LEXEMES] = {0};
+size_t N_LEXEMES = 0;
+
+void lex(char *s) {
+    for (char *ptr = s; *ptr; ptr++)
+        *ptr = tolower(*ptr);
+
+    char *LAST_LINE = s;
+    size_t LAST_LINE_NO = 1;
+    for (; *s; s++) {
+        enum lex_label label = LEX_NONE;
+        char *start = s;
+        // TODO: at the very least, also need to lex here: string literals,
+        // character literals, hex literals, int literals, identifiers.
+        // Note in these examples below, the first four are cases where we
+        // throw away some characters (indicated by label = LEX_NONE). In the
+        // final example we lex operation characters like [ and !=.
+        assert(!"unimplemented");
+        if (isspace(*s));
+        else if (prefix(s, "/*")) {
+            for (; *s && !prefix(s, "*/"); s++);
+            if (*s) s++;
+        } else if (prefix(s, "//")) {
+            for (; *s && *s != '\n'; s++);
+        } else if (s[0] == '#') {
+            for (; *s && *s != '\n'; s++)
+                s += (*s == '\\');
+        } else {
+            label = LEX_OP;
+            if (strchr("()[]{}.:?,;", *s))
+                s++;
+            else if (prefix(s, "->"))
+                s += 2;
+            else if (strchr("-+&|", *s) && *s == s[1])
+                s += 2;
+            else if (prefix(s, "<<") || prefix(s, ">>"))
+                s += 2 + (s[2] == '=');
+            else
+                s += 1 + (s[1] == '=');
+        }
+        // NOTE: This shared code builds the lexeme for you & inserts it into
+        // the array of lexemes. Basically, you need to point @s to one-past
+        // the last character you want to be part of the lexeme, and set @label
+        // to whatever label you want it to have.
+        if (label == LEX_NONE) continue;
+        assert(N_LEXEMES < sizeof(LEXEMES) / sizeof(LEXEMES[0]));
+        LEXEMES[N_LEXEMES].string = strndup(start, (size_t)(s - start));
+        LEXEMES[N_LEXEMES].label = label;
+        for (; LAST_LINE != start; LAST_LINE++)
+             LAST_LINE_NO += (*LAST_LINE == '\n');
+        LEXEMES[N_LEXEMES++].line_no = LAST_LINE_NO;
+        s--;
+    }
+}
diff --git a/static-analysis/main.c b/static-analysis/main.c
new file mode 100644
index 0000000..8d3f90e
--- /dev/null
+++ b/static-analysis/main.c
@@ -0,0 +1,24 @@
+////// NOTE: you don't need to modify this file //////
+#include <string.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include "compiler.h"
+
+int main(int argc, char **argv) {
+    PATH = argv[1];
+
+    // Read the entire file
+    struct stat statbuf;
+    stat(PATH, &statbuf);
+
+    FILE *fd = fopen(PATH, "r");
+    char *data = calloc(statbuf.st_size + 1, sizeof(char));
+    fread(data, sizeof(char), statbuf.st_size, fd);
+
+    // Do the lexing
+    lex(data);
+
+    // Then process the lexed program
+    process_program();
+}
diff --git a/static-analysis/prelab/.gitignore b/static-analysis/prelab/.gitignore
new file mode 100644
index 0000000..e1bb0e0
--- /dev/null
+++ b/static-analysis/prelab/.gitignore
@@ -0,0 +1,2 @@
+main
+main.staff.c
diff --git a/static-analysis/prelab/HINTS b/static-analysis/prelab/HINTS
new file mode 100644
index 0000000..960e460
--- /dev/null
+++ b/static-analysis/prelab/HINTS
@@ -0,0 +1,63 @@
+#### visit example
+Take the following IR program:
+
+    1 D 100
+    2 B 100 3 4
+    3 K 100
+    4 B 0 2 2
+
+This corresponds roughly to the C code:
+
+    L1: *x;
+    L2: while (x)
+    L3:    x = rand();
+
+First, notice that this is *not* a bug: there are some paths along which 100/x
+is dereferenced before reaching the branch (namely, 1->2 in the IR and L1->L2
+in the C) and other branches where its value is *not* dereferenced first
+(namely, 1->2->3->4->2 and L1->L2->L3->L2).
+
+The prelab tool only sees the IR. The main() function makes the initial call
+to visit for you, giving it the first instruction and an empty exprmap. For
+brevity, I'll write this as:
+
+    visit(1, {})
+
+From here on out, the operation of visit looks like this:
+
+    visit(1, {})
+    |   1.always_derefed = {}
+    |   visit(2, {100})
+    |   |   2.always_derefed = {100}
+    |   |   visit(3, {100})
+    |   |   |   3.always_derefed = {100}
+    |   |   |   visit(4, {})
+    |   |   |   |   4.always_derefed = {}
+    |   |   |   |   visit(2, {})
+    |   |   |   |   |   2.always_derefed = intersect({100}, {}) = {}
+    |   |   |   |   |   visit(3, {})
+    |   |   |   |   |   |   3.always_derefed = intersect({100}, {}) = {}
+    |   |   |   |   |   |   visit(4, {})
+    |   |   |   |   |   |   |   return bc 4.always_derefed <= {}
+    |   |   |   |   |   |   visit(NULL, {})
+    |   |   |   |   |   |   |   return bc NULL
+    |   |   |   |   |   visit(4, {})
+    |   |   |   |   |   |   return bc 4.always_derefed <= {}
+    |   |   |   |   visit(2, {})
+    |   |   |   |   |   return bc 2.always_derefed <= {}
+    |   |   |   visit(NULL, {100})
+    |   |   |   |   return bc NULL
+    |   |   visit(4, {100})
+    |   |   |   return bc 4.always_derefed <= {100}
+    |   visit(NULL, {100})
+    |   |   return bc NULL
+
+It's important to note a few things:
+1. Each branch in this trace corresponds to a path through the original IR
+   program.
+2. We sometimes reach "NULL", because non-branch instructions have only one
+   place they can go after executing (you could also check for NULL before
+   recursing).
+3. If always_derefed is a subset of the expressions derefed along this path, we
+   know that we're not going to learn anything new along this path that we
+   didn't already learn along another path, so we can immediately return.
diff --git a/static-analysis/prelab/Makefile b/static-analysis/prelab/Makefile
new file mode 100644
index 0000000..4aeaf0d
--- /dev/null
+++ b/static-analysis/prelab/Makefile
@@ -0,0 +1,6 @@
+CFLAGS += -g
+CFLAGS += -O3
+CFLAGS += -Wall
+# CFLAGS += -fsanitize=address
+
+main: main.c
diff --git a/static-analysis/prelab/README b/static-analysis/prelab/README
new file mode 100644
index 0000000..43dc73d
--- /dev/null
+++ b/static-analysis/prelab/README
@@ -0,0 +1,191 @@
+##### Ultimate Lab Goal
+As you've learned in this class, it's hard to write C correctly.  And operating
+systems are huge C projects.  In this lab we're going to implement a simple
+static checker that will help us automatically search for bugs in huge C
+projects. Our checker will find C code that looks like this:
+
+    *x = 5;
+    if (x)
+        return;
+
+This code indicates a bug, because on the first line you dereference $x$ (i.e.,
+requiring that it is non-null) then on the second line you check if $x$ is null
+or not (i.e., asserting a belief that it may be null). One of these beliefs
+must be wrong.
+
+We're going to vaguely be implementing a small part of this:
+https://mlfbrown.com/paper.pdf
+
+##### How to do it?
+Given a function, our game plan is the following:
+
+    - Take every possible path through the function.
+    - During the path, track what expressions *must* be non-null because we've
+      dereferenced them earlier in the path.
+    - At each program point, record what expressions must be non-null along
+      *every* path that reaches that point.
+    - Finally, look at each branch point and report an error if it is branching
+      on an expression that must be non-null along every path that reaches that
+      point.
+
+##### Prelab Setup
+For this prelab, we're going to start by implementing this analysis on a
+simplified intermediate representation (IR) instead of C. Then, for the main
+lab, we'll write a compiler from C to this IR.
+
+A program in our IR has one instruction per line. Everything after the
+instruction on a given line is ignored (think of those as comments or
+metadata).
+
+The IR has three instructions:
+
+    $label B $expression $label_true $label_false [ignored until \n]
+    $label K $expression [ignored until \n]
+    $label D $expression [ignored until \n]
+
+In particular:
+
+    - Every instruction has a "$label" think of this as a pc or line number
+    - "B" means BRANCH, "K" means KILL, and "D" means DEREF
+    - Labels and expressions are both represented as uint64_ts
+    - "$l B $e $t $f" corresponds to "if ($e) goto $t else goto $f"
+    - "$l K $e" corresponds to "$e = rand();"
+    - "$l D $e" corresponds to "*$e;"
+
+The C example above will become (roughly) this IR:
+
+    1 D 100         1
+    2 B 100 3 4     2
+    3 K 0           3
+    4 K 0           3
+
+Here we arbitrarily chose "100" to be the id representing the expression "x",
+and 0 is a dummy expression so that "K 0" always acts like a no-op. Note we're
+using uint64_ts to represent expressions like "x" because uint64_ts are much
+nicer to deal with in C than strings. The compiler that we write for lab will
+use hash("x") as the expression id.
+
+The rightmost number is IGNORED by your code here; it indicates the line number
+in the original program and will only be used by a final wrapper script that
+pretty-prints the results. We will only worry about this during the main lab.
+
+Once again, for now, don't worry about where these programs come from: we'll
+write a compiler from C to this IR during lab. Then scripts will link up the
+output of the IR checker with the original source code to pretty-print the
+resulting bugs.
+
+Internally, an instruction like "2 B 100 3 4" is represented as a struct instr,
+where .label = 2, .opcode = OPCODE_BRANCH, and .args = {100, 3, 4}.
+
+##### Prelab/Lab Part 1
+Your job is to write the program analysis for the simple IR described above.
+Some starter code for parsing the IR is given in main.c. You should be able to
+implement everything in <200loc. The vast majority of the code is just
+implementing the exprmap data structure:
+
+    STRUCT EXPRMAP:
+    - A struct exprmap is a map from uint64_t -> uint64_t. The keys ("exprs")
+      will represent expressions that we know to be non-null, while the values
+      ("deref_labels") will represent the label that those expressions were
+      first dereferenced on.
+    - Exprmaps are usually pretty small, so we implement them as a pair of
+      dynamic arrays
+    - lookup_exprmap, insert_exprmap, remove_exprmap do what they sound like.
+      Note you should always return a fresh exprmap if you change anything;
+      NEVER MODIFY exprmaps IN-PLACE! Note that because you never modify
+      exprmaps in-place, copying exprmaps is super easy: just copy the struct!
+    - intersect_exprmap intersects the keys (exprs); you can take the value
+      (deref_label) from either one.
+    - subset_exprmap returns true iff the keys of "small" are all also keys of
+      "big"
+
+Now, you should be able to implement visit. At a high-level, visit is supposed
+to statically execute a single instruction along a path through the program:
+
+    - the entire overall point of visit is to compute instr->always_derefed for
+      every (reachable) instruction in the program. instr->always_derefed
+      should hold an exprmap of expressions that are known to be non-null along
+      every path to @instr, i.e., expressions that are always dereferenced
+      before reaching @instr.
+    - visit takes the instruction to be executed next (@instr) along with an
+      exprset of expressions that have been dereferenced along this path
+      (@derefed).
+    - it then updates the "always_derefed" exprmap on @instr, which is supposed
+      to represent the expressions that are *always* dereferenced along every
+      path we've seen to this node.
+    - it computes the new @derefed to use for the rest of this path after
+      executing this instruction.
+    - then it recurses on all the possible instructions we could execute next
+      along this path.
+
+The comments should tell you pretty much what to do. Two important things to
+take advantage of to make sure you don't get infinite recursion:
+
+    1. We only care about expressions that are known to be non-null along
+       *EVERY* path to this instruction. So if the last time you visited some
+       instruction you had expressions 1 and 2 non-null, then on the current
+       path to that instruction you have expressions 2 and 3 non-null, you
+       should treat it as if only 2 is non-null.
+    2. The entire behavior of the visit function is determined by (1) the
+       instruction passed in the first argument, and (2) the exprset of
+       non-nulls passed in the second argument. So if the last time you visited
+       a particular instruction you had expressions 1 and 2 non-null, and along
+       this current path you re-visit the instruction again with expressions 1
+       and 2 non-null, you can immediately return (this call is memoized).
+
+Think carefully about in what order to apply hints (1) and (2). Write some
+example programs for yourself that use loops and think about how the
+computation proceeds & when you can terminate the recursion without ignoring
+possible paths.
+
+Some things to keep in mind:
+
+    - We want to minimize the number of false reports. If you think about it,
+      that means you can safely "forget" that things have been dereferenced.
+      This is safe because we only report an error if we always dereference a
+      value before we check it, so if we forget about a dereference we will
+      only ever forget to report an error, not report a fake error.
+    - Because of that, you should feel free to pretty liberally intersect
+      derefed (the set of expressions dereferenced along this path) and
+      instr->always_derefed (the set of expressions that are derefed along
+      every path to this instruction that we've seen so far).
+    - Finally, please remember that visit(instr, derefed) is a *recursive
+      function*: it's supposed to process a single instruction at a time, then
+      recurse on the possible next instructions. This means that you can
+      memoize it: if instr->always_derefed is identical to derefed, that means
+      you've already visited @vist with the same arguments, so you can
+      immediately return without recursing.
+
+If you have trouble with visit, you can take a look at HINTS, which shows a
+trace of visit's execution on a simple IR program.
+
+##### Testing
+There's a super dumb test case in test.prog. You should be able to run:
+
+    $ cat test_inputs/test.prog
+    1 D 123
+    2 B 1 3 3
+    3 B 123 1 4
+    4 D 100
+    5 K 100
+    6 B 100 7 7
+    7 D 100
+    8 B 100 7 7
+    $ cat test_inputs/test.prog | ./main
+    7:8
+    1:3
+
+Every line in the output indicates a bug, i.e., some expression was branched on
+even though it is dereferenced along every path to that branch. The first
+number is the label of the deref instructions, the second is the label of the
+branch instruction. Note that 4:6 is NOT a bug, because the value of 100 was
+overwritten ("killed") at label 5.
+
+I've also posted two files compiled from Linux here:
+
+    $ cat test_inputs/linux1.prog | ./main
+    $ cat test_inputs/linux2.prog | ./main
+    28:35
+
+### Bugs
+make sure to kill all dups or don't insert dups
diff --git a/static-analysis/prelab/main.c b/static-analysis/prelab/main.c
new file mode 100644
index 0000000..b46a77e
--- /dev/null
+++ b/static-analysis/prelab/main.c
@@ -0,0 +1,145 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <search.h>
+#include <stdint.h>
+#include <assert.h>
+#include <string.h>
+
+enum opcode {
+    OPCODE_BRANCH = 'B',
+    OPCODE_KILL = 'K',
+    OPCODE_DEREF = 'D',
+};
+
+struct exprmap {
+    uint64_t *exprs, *deref_labels;
+    size_t n_exprs;
+};
+
+// each of these should be ~5-10loc for a basic implementation. if you want to
+// go crazy, try keeping it sorted & using binary search (only once you have
+// everything working initially!).
+uint64_t lookup_exprmap(const struct exprmap set, uint64_t expr) {
+    // you can return 0 if you don't find anything
+    assert(!"unimplemented");
+}
+
+struct exprmap insert_exprmap(const struct exprmap old, uint64_t expr, uint64_t deref_label) {
+    assert(!"unimplemented");
+}
+
+struct exprmap remove_exprmap(const struct exprmap old, uint64_t expr) {
+    assert(!"unimplemented");
+}
+
+int subset_exprmap(const struct exprmap small, const struct exprmap big) {
+    assert(!"unimplemented");
+}
+
+struct exprmap intersect_exprmaps(const struct exprmap small, const struct exprmap big) {
+    assert(!"unimplemented");
+}
+
+struct instr {
+    uint64_t label;
+    enum opcode opcode;
+    uint64_t args[3];
+    struct instr *nexts[2];
+
+    int visited;
+    struct exprmap always_derefed;
+};
+
+void visit(struct instr *instr, struct exprmap derefed) {
+    // Update instr->visited, instr->always_derefed, derefed, or return as
+    // needed for each of the following cases:
+    // (1) instr is NULL
+    // (2) this is the first path to reach instr
+    // (3) along every prior path to @instr every expression in @derefed has
+    //     been derefed
+    // (4) there are some expressions in instr->always_derefed that are not in
+    //     @derefed along this path
+    // should be about 10loc total; use the data structure operations you
+    // implemented above!
+    assert(!"unimplemented");
+    derefed = instr->always_derefed; // feel free to remove if your sln doesn't need this
+
+    // now actually process the instruction:
+    // (1) if it's a kill, then we no longer know anything about instr->args[0]
+    // (2) if it's a deref, then we should remember that instr->args[0] has
+    //     been derefed for the remainder of this path (at least, until it's
+    //     killed later on)
+    assert(!"unimplemented");
+
+    // now recurse on the possible next-instructions. we visit nexts[1] first
+    // out of superstition (it's more likely to be NULL and we want to do the
+    // most work in the tail recursive call)
+    visit(instr->nexts[1], derefed);
+    visit(instr->nexts[0], derefed);
+}
+
+void check(struct instr *instr) {
+    if (!instr || instr->opcode != OPCODE_BRANCH) return;
+    if (!lookup_exprmap(instr->always_derefed, instr->args[0])) return;
+    printf("%lu:%lu\n", lookup_exprmap(instr->always_derefed, instr->args[0]),
+           instr->label);
+}
+
+int main() {
+    // you don't need to modify any of this; it just parses the input IR, then
+    // calls visit on the first instruction, then calls check on every
+    // instruction.
+    struct instr *head = NULL;
+    size_t n_instructions = 0, max_label = 0;
+    while (!feof(stdin)) {
+        struct instr *new = calloc(1, sizeof(*new));
+        char opcode;
+        if (scanf(" %lu %c", &(new->label), &opcode) != 2) {
+            // if this is failing unexpectedly, and you're on a Mac, maybe just
+            // remove it? still seemed to work for Manya
+            assert(feof(stdin));
+            break;
+        }
+        new->opcode = opcode;
+        int n_args = (new->opcode == OPCODE_BRANCH) ? 3 : 1;
+        for (size_t i = 0; i < n_args; i++)
+            assert(scanf(" %lu", &(new->args[i])) == 1);
+        new->nexts[0] = head;
+        head = new;
+        n_instructions++;
+        if (new->label > max_label) max_label = new->label;
+        while (!feof(stdin) && fgetc(stdin) != '\n') continue;
+    }
+
+    size_t n_labels = max_label + 1;
+    struct instr **label2instr = calloc(n_labels, sizeof(*label2instr));
+
+    for (struct instr *instr = head; instr; instr = instr->nexts[0]) {
+        assert(!label2instr[instr->label]);
+        label2instr[instr->label] = instr;
+    }
+
+    struct instr *new_head = NULL;
+    for (struct instr *instr = head; instr; ) {
+        struct instr *real_next = instr->nexts[0];
+        instr->nexts[0] = new_head;
+        new_head = instr;
+        instr = real_next;
+    }
+    head = new_head;
+
+    for (size_t i = 0; i < n_labels; i++) {
+        struct instr *instr = label2instr[i];
+        if (instr && instr->opcode == OPCODE_BRANCH) {
+            if (!(label2instr[instr->args[1]]) || !(label2instr[instr->args[2]])) {
+                exit(1);
+            }
+            instr->nexts[0] = label2instr[instr->args[1]];
+            instr->nexts[1] = label2instr[instr->args[2]];
+        }
+    }
+
+    visit(head, (struct exprmap){NULL, NULL, 0});
+    for (size_t i = 0; i < n_labels; i++)
+        check(label2instr[i]);
+}
diff --git a/static-analysis/prelab/test_inputs/linux1.prog b/static-analysis/prelab/test_inputs/linux1.prog
new file mode 100644
index 0000000..032ecce
--- /dev/null
+++ b/static-analysis/prelab/test_inputs/linux1.prog
@@ -0,0 +1,40 @@
+3 D 193503915 99
+4 K 1194231000731398559 99
+6 D 193503915 100
+7 K 4387865597241821890 100
+11 K 193486004 105
+13 D 177673 108
+14 K 193504592 108
+19 B 193504592 16 17 109
+16 K 0
+21 B 0 1 1 0
+23 B 0 18 18 0
+17 K 0
+18 K 0
+25 D 177673 113
+26 K 193504592 113
+31 B 193504592 28 29 114
+28 K 0
+33 B 0 1 1 0
+35 B 0 30 30 0
+29 K 0
+30 K 0
+37 D 177673 118
+38 K 193504592 118
+43 B 193504592 40 41 120
+40 K 0
+45 B 0 1 1 0
+47 B 0 42 42 0
+41 K 0
+42 K 0
+49 D 177673 129
+50 K 193504592 129
+55 B 193504592 52 53 130
+52 K 0
+57 B 0 1 1 0
+59 B 0 54 54 0
+53 K 0
+54 K 0
+61 B 0 1 1 0
+63 D 177673 134
+1 K 0
diff --git a/static-analysis/prelab/test_inputs/linux2.prog b/static-analysis/prelab/test_inputs/linux2.prog
new file mode 100644
index 0000000..348e494
--- /dev/null
+++ b/static-analysis/prelab/test_inputs/linux2.prog
@@ -0,0 +1,38 @@
+5 K 6385072256 290
+10 B 15283469052120443381 7 8 291
+7 K 0
+12 B 0 1 1 0
+14 B 0 9 9 0
+8 K 0
+9 K 0
+16 K 249902112288397918 294
+17 K 193503915 294
+22 B 193503915 20 19 295
+19 K 0
+24 B 0 1 1 0
+26 B 0 21 21 0
+20 K 0
+21 K 0
+28 D 193503915 298
+29 K 249902112288397918 298
+30 K 249904109936926005 298
+35 B 193503915 33 32 299
+32 K 0
+37 B 0 1 1 0
+39 B 0 34 34 0
+33 K 0
+34 K 0
+41 D 193503915 302
+42 K 249902112288397918 302
+43 K 13920351217629824699 302
+44 K 13891158689926175282 302
+49 D 193503915 303
+50 B 5115118685804418151 46 47 303
+46 K 0
+52 B 0 1 1 0
+54 D 193503915 304
+55 B 0 48 48 0
+47 K 0
+48 K 0
+59 B 0 1 1 0
+1 K 0
diff --git a/static-analysis/prelab/test_inputs/test.prog b/static-analysis/prelab/test_inputs/test.prog
new file mode 100644
index 0000000..e3330aa
--- /dev/null
+++ b/static-analysis/prelab/test_inputs/test.prog
@@ -0,0 +1,8 @@
+1 D 123
+2 B 1 3 3
+3 B 123 1 4
+4 D 100
+5 K 100
+6 B 100 7 7
+7 D 100
+8 B 100 7 7
diff --git a/static-analysis/test_inputs/from_linux.c b/static-analysis/test_inputs/from_linux.c
new file mode 100644
index 0000000..460c0cd
--- /dev/null
+++ b/static-analysis/test_inputs/from_linux.c
@@ -0,0 +1,26 @@
+foo() {
+	if (foo) {
+		goto close_fds;
+	} else {
+        }
+close_fds:
+        return;
+}
+
+bar() {
+    redirect = (ifp && ifp->flags);
+    if (ifp)
+        in6_ifa_put(ifp);
+}
+
+baz() {
+    goto unlock;
+
+    queue_for_each_hw_ctx(foo)
+    {
+        break;
+    }
+
+unlock:
+    return;
+}
diff --git a/static-analysis/test_inputs/goto.c b/static-analysis/test_inputs/goto.c
new file mode 100644
index 0000000..4bd1579
--- /dev/null
+++ b/static-analysis/test_inputs/goto.c
@@ -0,0 +1,8 @@
+static int foo(bar) {
+        if (bar) goto err;
+	if (baz < 0) {
+err:
+            bad;
+	}
+	return bar;
+}
diff --git a/static-analysis/test_inputs/mlme.c b/static-analysis/test_inputs/mlme.c
new file mode 100644
index 0000000..60792df
--- /dev/null
+++ b/static-analysis/test_inputs/mlme.c
@@ -0,0 +1,7632 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * BSS client mode implementation
+ * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
+ * Copyright 2004, Instant802 Networks, Inc.
+ * Copyright 2005, Devicescape Software, Inc.
+ * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2013-2014  Intel Mobile Communications GmbH
+ * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 - 2023 Intel Corporation
+ */
+
+#include <linux/delay.h>
+#include <linux/fips.h>
+#include <linux/if_ether.h>
+#include <linux/skbuff.h>
+#include <linux/if_arp.h>
+#include <linux/etherdevice.h>
+#include <linux/moduleparam.h>
+#include <linux/rtnetlink.h>
+#include <linux/crc32.h>
+#include <linux/slab.h>
+#include <linux/export.h>
+#include <net/mac80211.h>
+#include <asm/unaligned.h>
+
+#include "ieee80211_i.h"
+#include "driver-ops.h"
+#include "rate.h"
+#include "led.h"
+#include "fils_aead.h"
+
+#define IEEE80211_AUTH_TIMEOUT		(HZ / 5)
+#define IEEE80211_AUTH_TIMEOUT_LONG	(HZ / 2)
+#define IEEE80211_AUTH_TIMEOUT_SHORT	(HZ / 10)
+#define IEEE80211_AUTH_TIMEOUT_SAE	(HZ * 2)
+#define IEEE80211_AUTH_MAX_TRIES	3
+#define IEEE80211_AUTH_WAIT_ASSOC	(HZ * 5)
+#define IEEE80211_AUTH_WAIT_SAE_RETRY	(HZ * 2)
+#define IEEE80211_ASSOC_TIMEOUT		(HZ / 5)
+#define IEEE80211_ASSOC_TIMEOUT_LONG	(HZ / 2)
+#define IEEE80211_ASSOC_TIMEOUT_SHORT	(HZ / 10)
+#define IEEE80211_ASSOC_MAX_TRIES	3
+
+static int max_nullfunc_tries = 2;
+module_param(max_nullfunc_tries, int, 0644);
+MODULE_PARM_DESC(max_nullfunc_tries,
+		 "Maximum nullfunc tx tries before disconnecting (reason 4).");
+
+static int max_probe_tries = 5;
+module_param(max_probe_tries, int, 0644);
+MODULE_PARM_DESC(max_probe_tries,
+		 "Maximum probe tries before disconnecting (reason 4).");
+
+/*
+ * Beacon loss timeout is calculated as N frames times the
+ * advertised beacon interval.  This may need to be somewhat
+ * higher than what hardware might detect to account for
+ * delays in the host processing frames. But since we also
+ * probe on beacon miss before declaring the connection lost
+ * default to what we want.
+ */
+static int beacon_loss_count = 7;
+module_param(beacon_loss_count, int, 0644);
+MODULE_PARM_DESC(beacon_loss_count,
+		 "Number of beacon intervals before we decide beacon was lost.");
+
+/*
+ * Time the connection can be idle before we probe
+ * it to see if we can still talk to the AP.
+ */
+#define IEEE80211_CONNECTION_IDLE_TIME	(30 * HZ)
+/*
+ * Time we wait for a probe response after sending
+ * a probe request because of beacon loss or for
+ * checking the connection still works.
+ */
+static int probe_wait_ms = 500;
+module_param(probe_wait_ms, int, 0644);
+MODULE_PARM_DESC(probe_wait_ms,
+		 "Maximum time(ms) to wait for probe response"
+		 " before disconnecting (reason 4).");
+
+/*
+ * How many Beacon frames need to have been used in average signal strength
+ * before starting to indicate signal change events.
+ */
+#define IEEE80211_SIGNAL_AVE_MIN_COUNT	4
+
+/*
+ * Extract from the given disabled subchannel bitmap (raw format
+ * from the EHT Operation Element) the bits for the subchannel
+ * we're using right now.
+ */
+static u16
+ieee80211_extract_dis_subch_bmap(const struct ieee80211_eht_operation *eht_oper,
+				 struct cfg80211_chan_def *chandef, u16 bitmap)
+{
+	struct ieee80211_eht_operation_info *info = (void *)eht_oper->optional;
+	struct cfg80211_chan_def ap_chandef = *chandef;
+	u32 ap_center_freq, local_center_freq;
+	u32 ap_bw, local_bw;
+	int ap_start_freq, local_start_freq;
+	u16 shift, mask;
+
+	if (!(eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) ||
+	    !(eht_oper->params &
+	      IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT))
+		return 0;
+
+	/* set 160/320 supported to get the full AP definition */
+	ieee80211_chandef_eht_oper(eht_oper, true, true, &ap_chandef);
+	ap_center_freq = ap_chandef.center_freq1;
+	ap_bw = 20 * BIT(u8_get_bits(info->control,
+				     IEEE80211_EHT_OPER_CHAN_WIDTH));
+	ap_start_freq = ap_center_freq - ap_bw / 2;
+	local_center_freq = chandef->center_freq1;
+	local_bw = 20 * BIT(ieee80211_chan_width_to_rx_bw(chandef->width));
+	local_start_freq = local_center_freq - local_bw / 2;
+	shift = (local_start_freq - ap_start_freq) / 20;
+	mask = BIT(local_bw / 20) - 1;
+
+	return (bitmap >> shift) & mask;
+}
+
+/*
+ * Handle the puncturing bitmap, possibly downgrading bandwidth to get a
+ * valid bitmap.
+ */
+static void
+ieee80211_handle_puncturing_bitmap(struct ieee80211_link_data *link,
+				   const struct ieee80211_eht_operation *eht_oper,
+				   u16 bitmap, u64 *changed)
+{
+	struct cfg80211_chan_def *chandef = &link->conf->chandef;
+	u16 extracted;
+	u64 _changed = 0;
+
+	if (!changed)
+		changed = &_changed;
+
+	while (chandef->width > NL80211_CHAN_WIDTH_40) {
+		extracted =
+			ieee80211_extract_dis_subch_bmap(eht_oper, chandef,
+							 bitmap);
+
+		if (cfg80211_valid_disable_subchannel_bitmap(&bitmap,
+							     chandef))
+			break;
+		link->u.mgd.conn_flags |=
+			ieee80211_chandef_downgrade(chandef);
+		*changed |= BSS_CHANGED_BANDWIDTH;
+	}
+
+	if (chandef->width <= NL80211_CHAN_WIDTH_40)
+		extracted = 0;
+
+	if (link->conf->eht_puncturing != extracted) {
+		link->conf->eht_puncturing = extracted;
+		*changed |= BSS_CHANGED_EHT_PUNCTURING;
+	}
+}
+
+/*
+ * We can have multiple work items (and connection probing)
+ * scheduling this timer, but we need to take care to only
+ * reschedule it when it should fire _earlier_ than it was
+ * asked for before, or if it's not pending right now. This
+ * function ensures that. Note that it then is required to
+ * run this function for all timeouts after the first one
+ * has happened -- the work that runs from this timer will
+ * do that.
+ */
+static void run_again(struct ieee80211_sub_if_data *sdata,
+		      unsigned long timeout)
+{
+	sdata_assert_lock(sdata);
+
+	if (!timer_pending(&sdata->u.mgd.timer) ||
+	    time_before(timeout, sdata->u.mgd.timer.expires))
+		mod_timer(&sdata->u.mgd.timer, timeout);
+}
+
+void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
+{
+	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
+		return;
+
+	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
+		return;
+
+	mod_timer(&sdata->u.mgd.bcn_mon_timer,
+		  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
+}
+
+void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
+{
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+	if (unlikely(!ifmgd->associated))
+		return;
+
+	if (ifmgd->probe_send_count)
+		ifmgd->probe_send_count = 0;
+
+	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
+		return;
+
+	mod_timer(&ifmgd->conn_mon_timer,
+		  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
+}
+
+static int ecw2cw(int ecw)
+{
+	return (1 << ecw) - 1;
+}
+
+static ieee80211_conn_flags_t
+ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
+			     struct ieee80211_link_data *link,
+			     ieee80211_conn_flags_t conn_flags,
+			     struct ieee80211_supported_band *sband,
+			     struct ieee80211_channel *channel,
+			     u32 vht_cap_info,
+			     const struct ieee80211_ht_operation *ht_oper,
+			     const struct ieee80211_vht_operation *vht_oper,
+			     const struct ieee80211_he_operation *he_oper,
+			     const struct ieee80211_eht_operation *eht_oper,
+			     const struct ieee80211_s1g_oper_ie *s1g_oper,
+			     struct cfg80211_chan_def *chandef, bool tracking)
+{
+	struct cfg80211_chan_def vht_chandef;
+	struct ieee80211_sta_ht_cap sta_ht_cap;
+	ieee80211_conn_flags_t ret;
+	u32 ht_cfreq;
+
+	memset(chandef, 0, sizeof(struct cfg80211_chan_def));
+	chandef->chan = channel;
+	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
+	chandef->center_freq1 = channel->center_freq;
+	chandef->freq1_offset = channel->freq_offset;
+
+	if (channel->band == NL80211_BAND_6GHZ) {
+		if (!ieee80211_chandef_he_6ghz_oper(sdata, he_oper, eht_oper,
+						    chandef)) {
+			mlme_dbg(sdata,
+				 "bad 6 GHz operation, disabling HT/VHT/HE/EHT\n");
+			ret = IEEE80211_CONN_DISABLE_HT |
+			      IEEE80211_CONN_DISABLE_VHT |
+			      IEEE80211_CONN_DISABLE_HE |
+			      IEEE80211_CONN_DISABLE_EHT;
+		} else {
+			ret = 0;
+		}
+		vht_chandef = *chandef;
+		goto out;
+	} else if (sband->band == NL80211_BAND_S1GHZ) {
+		if (!ieee80211_chandef_s1g_oper(s1g_oper, chandef)) {
+			sdata_info(sdata,
+				   "Missing S1G Operation Element? Trying operating == primary\n");
+			chandef->width = ieee80211_s1g_channel_width(channel);
+		}
+
+		ret = IEEE80211_CONN_DISABLE_HT | IEEE80211_CONN_DISABLE_40MHZ |
+		      IEEE80211_CONN_DISABLE_VHT |
+		      IEEE80211_CONN_DISABLE_80P80MHZ |
+		      IEEE80211_CONN_DISABLE_160MHZ;
+		goto out;
+	}
+
+	memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
+	ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
+
+	if (!ht_oper || !sta_ht_cap.ht_supported) {
+		mlme_dbg(sdata, "HT operation missing / HT not supported\n");
+		ret = IEEE80211_CONN_DISABLE_HT |
+		      IEEE80211_CONN_DISABLE_VHT |
+		      IEEE80211_CONN_DISABLE_HE |
+		      IEEE80211_CONN_DISABLE_EHT;
+		goto out;
+	}
+
+	chandef->width = NL80211_CHAN_WIDTH_20;
+
+	ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
+						  channel->band);
+	/* check that channel matches the right operating channel */
+	if (!tracking && channel->center_freq != ht_cfreq) {
+		/*
+		 * It's possible that some APs are confused here;
+		 * Netgear WNDR3700 sometimes reports 4 higher than
+		 * the actual channel in association responses, but
+		 * since we look at probe response/beacon data here
+		 * it should be OK.
+		 */
+		sdata_info(sdata,
+			   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
+			   channel->center_freq, ht_cfreq,
+			   ht_oper->primary_chan, channel->band);
+		ret = IEEE80211_CONN_DISABLE_HT |
+		      IEEE80211_CONN_DISABLE_VHT |
+		      IEEE80211_CONN_DISABLE_HE |
+		      IEEE80211_CONN_DISABLE_EHT;
+		goto out;
+	}
+
+	/* check 40 MHz support, if we have it */
+	if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
+		ieee80211_chandef_ht_oper(ht_oper, chandef);
+	} else {
+		mlme_dbg(sdata, "40 MHz not supported\n");
+		/* 40 MHz (and 80 MHz) must be supported for VHT */
+		ret = IEEE80211_CONN_DISABLE_VHT;
+		/* also mark 40 MHz disabled */
+		ret |= IEEE80211_CONN_DISABLE_40MHZ;
+		goto out;
+	}
+
+	if (!vht_oper || !sband->vht_cap.vht_supported) {
+		mlme_dbg(sdata, "VHT operation missing / VHT not supported\n");
+		ret = IEEE80211_CONN_DISABLE_VHT;
+		goto out;
+	}
+
+	vht_chandef = *chandef;
+	if (!(conn_flags & IEEE80211_CONN_DISABLE_HE) &&
+	    he_oper &&
+	    (le32_to_cpu(he_oper->he_oper_params) &
+	     IEEE80211_HE_OPERATION_VHT_OPER_INFO)) {
+		struct ieee80211_vht_operation he_oper_vht_cap;
+
+		/*
+		 * Set only first 3 bytes (other 2 aren't used in
+		 * ieee80211_chandef_vht_oper() anyway)
+		 */
+		memcpy(&he_oper_vht_cap, he_oper->optional, 3);
+		he_oper_vht_cap.basic_mcs_set = cpu_to_le16(0);
+
+		if (!ieee80211_chandef_vht_oper(&sdata->local->hw, vht_cap_info,
+						&he_oper_vht_cap, ht_oper,
+						&vht_chandef)) {
+			if (!(conn_flags & IEEE80211_CONN_DISABLE_HE))
+				sdata_info(sdata,
+					   "HE AP VHT information is invalid, disabling HE\n");
+			ret = IEEE80211_CONN_DISABLE_HE | IEEE80211_CONN_DISABLE_EHT;
+			goto out;
+		}
+	} else if (!ieee80211_chandef_vht_oper(&sdata->local->hw,
+					       vht_cap_info,
+					       vht_oper, ht_oper,
+					       &vht_chandef)) {
+		if (!(conn_flags & IEEE80211_CONN_DISABLE_VHT))
+			sdata_info(sdata,
+				   "AP VHT information is invalid, disabling VHT\n");
+		ret = IEEE80211_CONN_DISABLE_VHT;
+		goto out;
+	}
+
+	if (!cfg80211_chandef_valid(&vht_chandef)) {
+		if (!(conn_flags & IEEE80211_CONN_DISABLE_VHT))
+			sdata_info(sdata,
+				   "AP VHT information is invalid, disabling VHT\n");
+		ret = IEEE80211_CONN_DISABLE_VHT;
+		goto out;
+	}
+
+	if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
+		ret = 0;
+		goto out;
+	}
+
+	if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
+		if (!(conn_flags & IEEE80211_CONN_DISABLE_VHT))
+			sdata_info(sdata,
+				   "AP VHT information doesn't match HT, disabling VHT\n");
+		ret = IEEE80211_CONN_DISABLE_VHT;
+		goto out;
+	}
+
+	*chandef = vht_chandef;
+
+	/*
+	 * handle the case that the EHT operation indicates that it holds EHT
+	 * operation information (in case that the channel width differs from
+	 * the channel width reported in HT/VHT/HE).
+	 */
+	if (eht_oper && (eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT)) {
+		struct cfg80211_chan_def eht_chandef = *chandef;
+
+		ieee80211_chandef_eht_oper(eht_oper,
+					   eht_chandef.width ==
+					   NL80211_CHAN_WIDTH_160,
+					   false, &eht_chandef);
+
+		if (!cfg80211_chandef_valid(&eht_chandef)) {
+			if (!(conn_flags & IEEE80211_CONN_DISABLE_EHT))
+				sdata_info(sdata,
+					   "AP EHT information is invalid, disabling EHT\n");
+			ret = IEEE80211_CONN_DISABLE_EHT;
+			goto out;
+		}
+
+		if (!cfg80211_chandef_compatible(chandef, &eht_chandef)) {
+			if (!(conn_flags & IEEE80211_CONN_DISABLE_EHT))
+				sdata_info(sdata,
+					   "AP EHT information is incompatible, disabling EHT\n");
+			ret = IEEE80211_CONN_DISABLE_EHT;
+			goto out;
+		}
+
+		*chandef = eht_chandef;
+	}
+
+	ret = 0;
+
+out:
+	/*
+	 * When tracking the current AP, don't do any further checks if the
+	 * new chandef is identical to the one we're currently using for the
+	 * connection. This keeps us from playing ping-pong with regulatory,
+	 * without it the following can happen (for example):
+	 *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
+	 *  - AP advertises regdom US
+	 *  - CRDA loads regdom US with 80 MHz prohibited (old database)
+	 *  - the code below detects an unsupported channel, downgrades, and
+	 *    we disconnect from the AP in the caller
+	 *  - disconnect causes CRDA to reload world regdomain and the game
+	 *    starts anew.
+	 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
+	 *
+	 * It seems possible that there are still scenarios with CSA or real
+	 * bandwidth changes where a this could happen, but those cases are
+	 * less common and wouldn't completely prevent using the AP.
+	 */
+	if (tracking &&
+	    cfg80211_chandef_identical(chandef, &link->conf->chandef))
+		return ret;
+
+	/* don't print the message below for VHT mismatch if VHT is disabled */
+	if (ret & IEEE80211_CONN_DISABLE_VHT)
+		vht_chandef = *chandef;
+
+	/*
+	 * Ignore the DISABLED flag when we're already connected and only
+	 * tracking the APs beacon for bandwidth changes - otherwise we
+	 * might get disconnected here if we connect to an AP, update our
+	 * regulatory information based on the AP's country IE and the
+	 * information we have is wrong/outdated and disables the channel
+	 * that we're actually using for the connection to the AP.
+	 */
+	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
+					tracking ? 0 :
+						   IEEE80211_CHAN_DISABLED)) {
+		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
+			ret = IEEE80211_CONN_DISABLE_HT |
+			      IEEE80211_CONN_DISABLE_VHT |
+			      IEEE80211_CONN_DISABLE_HE |
+			      IEEE80211_CONN_DISABLE_EHT;
+			break;
+		}
+
+		ret |= ieee80211_chandef_downgrade(chandef);
+	}
+
+	if (!he_oper || !cfg80211_chandef_usable(sdata->wdev.wiphy, chandef,
+						 IEEE80211_CHAN_NO_HE))
+		ret |= IEEE80211_CONN_DISABLE_HE | IEEE80211_CONN_DISABLE_EHT;
+
+	if (!eht_oper || !cfg80211_chandef_usable(sdata->wdev.wiphy, chandef,
+						  IEEE80211_CHAN_NO_EHT))
+		ret |= IEEE80211_CONN_DISABLE_EHT;
+
+	if (chandef->width != vht_chandef.width && !tracking)
+		sdata_info(sdata,
+			   "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
+
+	WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
+	return ret;
+}
+
+static int ieee80211_config_bw(struct ieee80211_link_data *link,
+			       const struct ieee80211_ht_cap *ht_cap,
+			       const struct ieee80211_vht_cap *vht_cap,
+			       const struct ieee80211_ht_operation *ht_oper,
+			       const struct ieee80211_vht_operation *vht_oper,
+			       const struct ieee80211_he_operation *he_oper,
+			       const struct ieee80211_eht_operation *eht_oper,
+			       const struct ieee80211_s1g_oper_ie *s1g_oper,
+			       const u8 *bssid, u64 *changed)
+{
+	struct ieee80211_sub_if_data *sdata = link->sdata;
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	struct ieee80211_channel *chan = link->conf->chandef.chan;
+	struct ieee80211_supported_band *sband =
+		local->hw.wiphy->bands[chan->band];
+	struct cfg80211_chan_def chandef;
+	u16 ht_opmode;
+	ieee80211_conn_flags_t flags;
+	u32 vht_cap_info = 0;
+	int ret;
+
+	/* if HT was/is disabled, don't track any bandwidth changes */
+	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT || !ht_oper)
+		return 0;
+
+	/* don't check VHT if we associated as non-VHT station */
+	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)
+		vht_oper = NULL;
+
+	/* don't check HE if we associated as non-HE station */
+	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE ||
+	    !ieee80211_get_he_iftype_cap(sband,
+					 ieee80211_vif_type_p2p(&sdata->vif))) {
+		he_oper = NULL;
+		eht_oper = NULL;
+	}
+
+	/* don't check EHT if we associated as non-EHT station */
+	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_EHT ||
+	    !ieee80211_get_eht_iftype_cap(sband,
+					 ieee80211_vif_type_p2p(&sdata->vif)))
+		eht_oper = NULL;
+
+	/*
+	 * if bss configuration changed store the new one -
+	 * this may be applicable even if channel is identical
+	 */
+	ht_opmode = le16_to_cpu(ht_oper->operation_mode);
+	if (link->conf->ht_operation_mode != ht_opmode) {
+		*changed |= BSS_CHANGED_HT;
+		link->conf->ht_operation_mode = ht_opmode;
+	}
+
+	if (vht_cap)
+		vht_cap_info = le32_to_cpu(vht_cap->vht_cap_info);
+
+	/* calculate new channel (type) based on HT/VHT/HE operation IEs */
+	flags = ieee80211_determine_chantype(sdata, link,
+					     link->u.mgd.conn_flags,
+					     sband, chan, vht_cap_info,
+					     ht_oper, vht_oper,
+					     he_oper, eht_oper,
+					     s1g_oper, &chandef, true);
+
+	/*
+	 * Downgrade the new channel if we associated with restricted
+	 * capabilities. For example, if we associated as a 20 MHz STA
+	 * to a 40 MHz AP (due to regulatory, capabilities or config
+	 * reasons) then switching to a 40 MHz channel now won't do us
+	 * any good -- we couldn't use it with the AP.
+	 */
+	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_80P80MHZ &&
+	    chandef.width == NL80211_CHAN_WIDTH_80P80)
+		flags |= ieee80211_chandef_downgrade(&chandef);
+	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_160MHZ &&
+	    chandef.width == NL80211_CHAN_WIDTH_160)
+		flags |= ieee80211_chandef_downgrade(&chandef);
+	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_40MHZ &&
+	    chandef.width > NL80211_CHAN_WIDTH_20)
+		flags |= ieee80211_chandef_downgrade(&chandef);
+
+	if (cfg80211_chandef_identical(&chandef, &link->conf->chandef))
+		return 0;
+
+	link_info(link,
+		  "AP %pM changed bandwidth, new config is %d.%03d MHz, width %d (%d.%03d/%d MHz)\n",
+		  link->u.mgd.bssid, chandef.chan->center_freq,
+		  chandef.chan->freq_offset, chandef.width,
+		  chandef.center_freq1, chandef.freq1_offset,
+		  chandef.center_freq2);
+
+	if (flags != (link->u.mgd.conn_flags &
+				(IEEE80211_CONN_DISABLE_HT |
+				 IEEE80211_CONN_DISABLE_VHT |
+				 IEEE80211_CONN_DISABLE_HE |
+				 IEEE80211_CONN_DISABLE_EHT |
+				 IEEE80211_CONN_DISABLE_40MHZ |
+				 IEEE80211_CONN_DISABLE_80P80MHZ |
+				 IEEE80211_CONN_DISABLE_160MHZ |
+				 IEEE80211_CONN_DISABLE_320MHZ)) ||
+	    !cfg80211_chandef_valid(&chandef)) {
+		sdata_info(sdata,
+			   "AP %pM changed caps/bw in a way we can't support (0x%x/0x%x) - disconnect\n",
+			   link->u.mgd.bssid, flags, ifmgd->flags);
+		return -EINVAL;
+	}
+
+	ret = ieee80211_link_change_bandwidth(link, &chandef, changed);
+
+	if (ret) {
+		sdata_info(sdata,
+			   "AP %pM changed bandwidth to incompatible one - disconnect\n",
+			   link->u.mgd.bssid);
+		return ret;
+	}
+
+	return 0;
+}
+
+/* frame sending functions */
+
+static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
+				struct sk_buff *skb, u8 ap_ht_param,
+				struct ieee80211_supported_band *sband,
+				struct ieee80211_channel *channel,
+				enum ieee80211_smps_mode smps,
+				ieee80211_conn_flags_t conn_flags)
+{
+	u8 *pos;
+	u32 flags = channel->flags;
+	u16 cap;
+	struct ieee80211_sta_ht_cap ht_cap;
+
+	BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
+
+	memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
+	ieee80211_apply_htcap_overrides(sdata, &ht_cap);
+
+	/* determine capability flags */
+	cap = ht_cap.cap;
+
+	switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+		if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
+			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+			cap &= ~IEEE80211_HT_CAP_SGI_40;
+		}
+		break;
+	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+		if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
+			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+			cap &= ~IEEE80211_HT_CAP_SGI_40;
+		}
+		break;
+	}
+
+	/*
+	 * If 40 MHz was disabled associate as though we weren't
+	 * capable of 40 MHz -- some broken APs will never fall
+	 * back to trying to transmit in 20 MHz.
+	 */
+	if (conn_flags & IEEE80211_CONN_DISABLE_40MHZ) {
+		cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+		cap &= ~IEEE80211_HT_CAP_SGI_40;
+	}
+
+	/* set SM PS mode properly */
+	cap &= ~IEEE80211_HT_CAP_SM_PS;
+	switch (smps) {
+	case IEEE80211_SMPS_AUTOMATIC:
+	case IEEE80211_SMPS_NUM_MODES:
+		WARN_ON(1);
+		fallthrough;
+	case IEEE80211_SMPS_OFF:
+		cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
+			IEEE80211_HT_CAP_SM_PS_SHIFT;
+		break;
+	case IEEE80211_SMPS_STATIC:
+		cap |= WLAN_HT_CAP_SM_PS_STATIC <<
+			IEEE80211_HT_CAP_SM_PS_SHIFT;
+		break;
+	case IEEE80211_SMPS_DYNAMIC:
+		cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
+			IEEE80211_HT_CAP_SM_PS_SHIFT;
+		break;
+	}
+
+	/* reserve and fill IE */
+	pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
+	ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
+}
+
+/* This function determines vht capability flags for the association
+ * and builds the IE.
+ * Note - the function returns true to own the MU-MIMO capability
+ */
+static bool ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
+				 struct sk_buff *skb,
+				 struct ieee80211_supported_band *sband,
+				 struct ieee80211_vht_cap *ap_vht_cap,
+				 ieee80211_conn_flags_t conn_flags)
+{
+	struct ieee80211_local *local = sdata->local;
+	u8 *pos;
+	u32 cap;
+	struct ieee80211_sta_vht_cap vht_cap;
+	u32 mask, ap_bf_sts, our_bf_sts;
+	bool mu_mimo_owner = false;
+
+	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
+
+	memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
+	ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
+
+	/* determine capability flags */
+	cap = vht_cap.cap;
+
+	if (conn_flags & IEEE80211_CONN_DISABLE_80P80MHZ) {
+		u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
+
+		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
+		if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
+		    bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
+			cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
+	}
+
+	if (conn_flags & IEEE80211_CONN_DISABLE_160MHZ) {
+		cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
+		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
+	}
+
+	/*
+	 * Some APs apparently get confused if our capabilities are better
+	 * than theirs, so restrict what we advertise in the assoc request.
+	 */
+	if (!(ap_vht_cap->vht_cap_info &
+			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
+		cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
+			 IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
+	else if (!(ap_vht_cap->vht_cap_info &
+			cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
+		cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
+
+	/*
+	 * If some other vif is using the MU-MIMO capability we cannot associate
+	 * using MU-MIMO - this will lead to contradictions in the group-id
+	 * mechanism.
+	 * Ownership is defined since association request, in order to avoid
+	 * simultaneous associations with MU-MIMO.
+	 */
+	if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
+		bool disable_mu_mimo = false;
+		struct ieee80211_sub_if_data *other;
+
+		list_for_each_entry_rcu(other, &local->interfaces, list) {
+			if (other->vif.bss_conf.mu_mimo_owner) {
+				disable_mu_mimo = true;
+				break;
+			}
+		}
+		if (disable_mu_mimo)
+			cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
+		else
+			mu_mimo_owner = true;
+	}
+
+	mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
+
+	ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
+	our_bf_sts = cap & mask;
+
+	if (ap_bf_sts < our_bf_sts) {
+		cap &= ~mask;
+		cap |= ap_bf_sts;
+	}
+
+	/* reserve and fill IE */
+	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
+	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
+
+	return mu_mimo_owner;
+}
+
+/* This function determines HE capability flags for the association
+ * and builds the IE.
+ */
+static void ieee80211_add_he_ie(struct ieee80211_sub_if_data *sdata,
+				struct sk_buff *skb,
+				struct ieee80211_supported_band *sband,
+				enum ieee80211_smps_mode smps_mode,
+				ieee80211_conn_flags_t conn_flags)
+{
+	u8 *pos, *pre_he_pos;
+	const struct ieee80211_sta_he_cap *he_cap;
+	u8 he_cap_size;
+
+	he_cap = ieee80211_get_he_iftype_cap(sband,
+					     ieee80211_vif_type_p2p(&sdata->vif));
+	if (WARN_ON(!he_cap))
+		return;
+
+	/* get a max size estimate */
+	he_cap_size =
+		2 + 1 + sizeof(he_cap->he_cap_elem) +
+		ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem) +
+		ieee80211_he_ppe_size(he_cap->ppe_thres[0],
+				      he_cap->he_cap_elem.phy_cap_info);
+	pos = skb_put(skb, he_cap_size);
+	pre_he_pos = pos;
+	pos = ieee80211_ie_build_he_cap(conn_flags,
+					pos, he_cap, pos + he_cap_size);
+	/* trim excess if any */
+	skb_trim(skb, skb->len - (pre_he_pos + he_cap_size - pos));
+
+	ieee80211_ie_build_he_6ghz_cap(sdata, smps_mode, skb);
+}
+
+static void ieee80211_add_eht_ie(struct ieee80211_sub_if_data *sdata,
+				 struct sk_buff *skb,
+				 struct ieee80211_supported_band *sband)
+{
+	u8 *pos;
+	const struct ieee80211_sta_he_cap *he_cap;
+	const struct ieee80211_sta_eht_cap *eht_cap;
+	u8 eht_cap_size;
+
+	he_cap = ieee80211_get_he_iftype_cap(sband,
+					     ieee80211_vif_type_p2p(&sdata->vif));
+	eht_cap = ieee80211_get_eht_iftype_cap(sband,
+					       ieee80211_vif_type_p2p(&sdata->vif));
+
+	/*
+	 * EHT capabilities element is only added if the HE capabilities element
+	 * was added so assume that 'he_cap' is valid and don't check it.
+	 */
+	if (WARN_ON(!he_cap || !eht_cap))
+		return;
+
+	eht_cap_size =
+		2 + 1 + sizeof(eht_cap->eht_cap_elem) +
+		ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
+					   &eht_cap->eht_cap_elem,
+					   false) +
+		ieee80211_eht_ppe_size(eht_cap->eht_ppe_thres[0],
+				       eht_cap->eht_cap_elem.phy_cap_info);
+	pos = skb_put(skb, eht_cap_size);
+	ieee80211_ie_build_eht_cap(pos, he_cap, eht_cap, pos + eht_cap_size,
+				   false);
+}
+
+static void ieee80211_assoc_add_rates(struct sk_buff *skb,
+				      enum nl80211_chan_width width,
+				      struct ieee80211_supported_band *sband,
+				      struct ieee80211_mgd_assoc_data *assoc_data)
+{
+	unsigned int shift = ieee80211_chanwidth_get_shift(width);
+	unsigned int rates_len, supp_rates_len;
+	u32 rates = 0;
+	int i, count;
+	u8 *pos;
+
+	if (assoc_data->supp_rates_len) {
+		/*
+		 * Get all rates supported by the device and the AP as
+		 * some APs don't like getting a superset of their rates
+		 * in the association request (e.g. D-Link DAP 1353 in
+		 * b-only mode)...
+		 */
+		rates_len = ieee80211_parse_bitrates(width, sband,
+						     assoc_data->supp_rates,
+						     assoc_data->supp_rates_len,
+						     &rates);
+	} else {
+		/*
+		 * In case AP not provide any supported rates information
+		 * before association, we send information element(s) with
+		 * all rates that we support.
+		 */
+		rates_len = sband->n_bitrates;
+		for (i = 0; i < sband->n_bitrates; i++)
+			rates |= BIT(i);
+	}
+
+	supp_rates_len = rates_len;
+	if (supp_rates_len > 8)
+		supp_rates_len = 8;
+
+	pos = skb_put(skb, supp_rates_len + 2);
+	*pos++ = WLAN_EID_SUPP_RATES;
+	*pos++ = supp_rates_len;
+
+	count = 0;
+	for (i = 0; i < sband->n_bitrates; i++) {
+		if (BIT(i) & rates) {
+			int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
+						5 * (1 << shift));
+			*pos++ = (u8)rate;
+			if (++count == 8)
+				break;
+		}
+	}
+
+	if (rates_len > count) {
+		pos = skb_put(skb, rates_len - count + 2);
+		*pos++ = WLAN_EID_EXT_SUPP_RATES;
+		*pos++ = rates_len - count;
+
+		for (i++; i < sband->n_bitrates; i++) {
+			if (BIT(i) & rates) {
+				int rate;
+
+				rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
+						    5 * (1 << shift));
+				*pos++ = (u8)rate;
+			}
+		}
+	}
+}
+
+static size_t ieee80211_add_before_ht_elems(struct sk_buff *skb,
+					    const u8 *elems,
+					    size_t elems_len,
+					    size_t offset)
+{
+	size_t noffset;
+
+	static const u8 before_ht[] = {
+		WLAN_EID_SSID,
+		WLAN_EID_SUPP_RATES,
+		WLAN_EID_EXT_SUPP_RATES,
+		WLAN_EID_PWR_CAPABILITY,
+		WLAN_EID_SUPPORTED_CHANNELS,
+		WLAN_EID_RSN,
+		WLAN_EID_QOS_CAPA,
+		WLAN_EID_RRM_ENABLED_CAPABILITIES,
+		WLAN_EID_MOBILITY_DOMAIN,
+		WLAN_EID_FAST_BSS_TRANSITION,	/* reassoc only */
+		WLAN_EID_RIC_DATA,		/* reassoc only */
+		WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
+	};
+	static const u8 after_ric[] = {
+		WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
+		WLAN_EID_HT_CAPABILITY,
+		WLAN_EID_BSS_COEX_2040,
+		/* luckily this is almost always there */
+		WLAN_EID_EXT_CAPABILITY,
+		WLAN_EID_QOS_TRAFFIC_CAPA,
+		WLAN_EID_TIM_BCAST_REQ,
+		WLAN_EID_INTERWORKING,
+		/* 60 GHz (Multi-band, DMG, MMS) can't happen */
+		WLAN_EID_VHT_CAPABILITY,
+		WLAN_EID_OPMODE_NOTIF,
+	};
+
+	if (!elems_len)
+		return offset;
+
+	noffset = ieee80211_ie_split_ric(elems, elems_len,
+					 before_ht,
+					 ARRAY_SIZE(before_ht),
+					 after_ric,
+					 ARRAY_SIZE(after_ric),
+					 offset);
+	skb_put_data(skb, elems + offset, noffset - offset);
+
+	return noffset;
+}
+
+static size_t ieee80211_add_before_vht_elems(struct sk_buff *skb,
+					     const u8 *elems,
+					     size_t elems_len,
+					     size_t offset)
+{
+	static const u8 before_vht[] = {
+		/*
+		 * no need to list the ones split off before HT
+		 * or generated here
+		 */
+		WLAN_EID_BSS_COEX_2040,
+		WLAN_EID_EXT_CAPABILITY,
+		WLAN_EID_QOS_TRAFFIC_CAPA,
+		WLAN_EID_TIM_BCAST_REQ,
+		WLAN_EID_INTERWORKING,
+		/* 60 GHz (Multi-band, DMG, MMS) can't happen */
+	};
+	size_t noffset;
+
+	if (!elems_len)
+		return offset;
+
+	/* RIC already taken care of in ieee80211_add_before_ht_elems() */
+	noffset = ieee80211_ie_split(elems, elems_len,
+				     before_vht, ARRAY_SIZE(before_vht),
+				     offset);
+	skb_put_data(skb, elems + offset, noffset - offset);
+
+	return noffset;
+}
+
+static size_t ieee80211_add_before_he_elems(struct sk_buff *skb,
+					    const u8 *elems,
+					    size_t elems_len,
+					    size_t offset)
+{
+	static const u8 before_he[] = {
+		/*
+		 * no need to list the ones split off before VHT
+		 * or generated here
+		 */
+		WLAN_EID_OPMODE_NOTIF,
+		WLAN_EID_EXTENSION, WLAN_EID_EXT_FUTURE_CHAN_GUIDANCE,
+		/* 11ai elements */
+		WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_SESSION,
+		WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_PUBLIC_KEY,
+		WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_KEY_CONFIRM,
+		WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_HLP_CONTAINER,
+		WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_IP_ADDR_ASSIGN,
+		/* TODO: add 11ah/11aj/11ak elements */
+	};
+	size_t noffset;
+
+	if (!elems_len)
+		return offset;
+
+	/* RIC already taken care of in ieee80211_add_before_ht_elems() */
+	noffset = ieee80211_ie_split(elems, elems_len,
+				     before_he, ARRAY_SIZE(before_he),
+				     offset);
+	skb_put_data(skb, elems + offset, noffset - offset);
+
+	return noffset;
+}
+
+#define PRESENT_ELEMS_MAX	8
+#define PRESENT_ELEM_EXT_OFFS	0x100
+
+static void ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata,
+					struct sk_buff *skb, u16 capab,
+					const struct element *ext_capa,
+					const u16 *present_elems);
+
+static size_t ieee80211_assoc_link_elems(struct ieee80211_sub_if_data *sdata,
+					 struct sk_buff *skb, u16 *capab,
+					 const struct element *ext_capa,
+					 const u8 *extra_elems,
+					 size_t extra_elems_len,
+					 unsigned int link_id,
+					 struct ieee80211_link_data *link,
+					 u16 *present_elems)
+{
+	enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
+	struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
+	struct ieee80211_channel *chan = cbss->channel;
+	const struct ieee80211_sband_iftype_data *iftd;
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_supported_band *sband;
+	enum nl80211_chan_width width = NL80211_CHAN_WIDTH_20;
+	struct ieee80211_chanctx_conf *chanctx_conf;
+	enum ieee80211_smps_mode smps_mode;
+	u16 orig_capab = *capab;
+	size_t offset = 0;
+	int present_elems_len = 0;
+	u8 *pos;
+	int i;
+
+#define ADD_PRESENT_ELEM(id) do {					\
+	/* need a last for termination - we use 0 == SSID */		\
+	if (!WARN_ON(present_elems_len >= PRESENT_ELEMS_MAX - 1))	\
+		present_elems[present_elems_len++] = (id);		\
+} while (0)
+#define ADD_PRESENT_EXT_ELEM(id) ADD_PRESENT_ELEM(PRESENT_ELEM_EXT_OFFS | (id))
+
+	if (link)
+		smps_mode = link->smps_mode;
+	else if (sdata->u.mgd.powersave)
+		smps_mode = IEEE80211_SMPS_DYNAMIC;
+	else
+		smps_mode = IEEE80211_SMPS_OFF;
+
+	if (link) {
+		/*
+		 * 5/10 MHz scenarios are only viable without MLO, in which
+		 * case this pointer should be used ... All of this is a bit
+		 * unclear though, not sure this even works at all.
+		 */
+		rcu_read_lock();
+		chanctx_conf = rcu_dereference(link->conf->chanctx_conf);
+		if (chanctx_conf)
+			width = chanctx_conf->def.width;
+		rcu_read_unlock();
+	}
+
+	sband = local->hw.wiphy->bands[chan->band];
+	iftd = ieee80211_get_sband_iftype_data(sband, iftype);
+
+	if (sband->band == NL80211_BAND_2GHZ) {
+		*capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
+		*capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
+	}
+
+	if ((cbss->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
+	    ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
+		*capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
+
+	if (sband->band != NL80211_BAND_S1GHZ)
+		ieee80211_assoc_add_rates(skb, width, sband, assoc_data);
+
+	if (*capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
+	    *capab & WLAN_CAPABILITY_RADIO_MEASURE) {
+		struct cfg80211_chan_def chandef = {
+			.width = width,
+			.chan = chan,
+		};
+
+		pos = skb_put(skb, 4);
+		*pos++ = WLAN_EID_PWR_CAPABILITY;
+		*pos++ = 2;
+		*pos++ = 0; /* min tx power */
+		 /* max tx power */
+		*pos++ = ieee80211_chandef_max_power(&chandef);
+		ADD_PRESENT_ELEM(WLAN_EID_PWR_CAPABILITY);
+	}
+
+	/*
+	 * Per spec, we shouldn't include the list of channels if we advertise
+	 * support for extended channel switching, but we've always done that;
+	 * (for now?) apply this restriction only on the (new) 6 GHz band.
+	 */
+	if (*capab & WLAN_CAPABILITY_SPECTRUM_MGMT &&
+	    (sband->band != NL80211_BAND_6GHZ ||
+	     !ext_capa || ext_capa->datalen < 1 ||
+	     !(ext_capa->data[0] & WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING))) {
+		/* TODO: get this in reg domain format */
+		pos = skb_put(skb, 2 * sband->n_channels + 2);
+		*pos++ = WLAN_EID_SUPPORTED_CHANNELS;
+		*pos++ = 2 * sband->n_channels;
+		for (i = 0; i < sband->n_channels; i++) {
+			int cf = sband->channels[i].center_freq;
+
+			*pos++ = ieee80211_frequency_to_channel(cf);
+			*pos++ = 1; /* one channel in the subband*/
+		}
+		ADD_PRESENT_ELEM(WLAN_EID_SUPPORTED_CHANNELS);
+	}
+
+	/* if present, add any custom IEs that go before HT */
+	offset = ieee80211_add_before_ht_elems(skb, extra_elems,
+					       extra_elems_len,
+					       offset);
+
+	if (sband->band != NL80211_BAND_6GHZ &&
+	    !(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_HT)) {
+		ieee80211_add_ht_ie(sdata, skb,
+				    assoc_data->link[link_id].ap_ht_param,
+				    sband, chan, smps_mode,
+				    assoc_data->link[link_id].conn_flags);
+		ADD_PRESENT_ELEM(WLAN_EID_HT_CAPABILITY);
+	}
+
+	/* if present, add any custom IEs that go before VHT */
+	offset = ieee80211_add_before_vht_elems(skb, extra_elems,
+						extra_elems_len,
+						offset);
+
+	if (sband->band != NL80211_BAND_6GHZ &&
+	    !(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_VHT)) {
+		bool mu_mimo_owner =
+			ieee80211_add_vht_ie(sdata, skb, sband,
+					     &assoc_data->link[link_id].ap_vht_cap,
+					     assoc_data->link[link_id].conn_flags);
+
+		if (link)
+			link->conf->mu_mimo_owner = mu_mimo_owner;
+		ADD_PRESENT_ELEM(WLAN_EID_VHT_CAPABILITY);
+	}
+
+	/*
+	 * If AP doesn't support HT, mark HE and EHT as disabled.
+	 * If on the 5GHz band, make sure it supports VHT.
+	 */
+	if (assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_HT ||
+	    (sband->band == NL80211_BAND_5GHZ &&
+	     assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_VHT))
+		assoc_data->link[link_id].conn_flags |=
+			IEEE80211_CONN_DISABLE_HE |
+			IEEE80211_CONN_DISABLE_EHT;
+
+	/* if present, add any custom IEs that go before HE */
+	offset = ieee80211_add_before_he_elems(skb, extra_elems,
+					       extra_elems_len,
+					       offset);
+
+	if (!(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_HE)) {
+		ieee80211_add_he_ie(sdata, skb, sband, smps_mode,
+				    assoc_data->link[link_id].conn_flags);
+		ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_HE_CAPABILITY);
+	}
+
+	/*
+	 * careful - need to know about all the present elems before
+	 * calling ieee80211_assoc_add_ml_elem(), so add this one if
+	 * we're going to put it after the ML element
+	 */
+	if (!(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_EHT))
+		ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_EHT_CAPABILITY);
+
+	if (link_id == assoc_data->assoc_link_id)
+		ieee80211_assoc_add_ml_elem(sdata, skb, orig_capab, ext_capa,
+					    present_elems);
+
+	/* crash if somebody gets it wrong */
+	present_elems = NULL;
+
+	if (!(assoc_data->link[link_id].conn_flags & IEEE80211_CONN_DISABLE_EHT))
+		ieee80211_add_eht_ie(sdata, skb, sband);
+
+	if (sband->band == NL80211_BAND_S1GHZ) {
+		ieee80211_add_aid_request_ie(sdata, skb);
+		ieee80211_add_s1g_capab_ie(sdata, &sband->s1g_cap, skb);
+	}
+
+	if (iftd && iftd->vendor_elems.data && iftd->vendor_elems.len)
+		skb_put_data(skb, iftd->vendor_elems.data, iftd->vendor_elems.len);
+
+	if (link)
+		link->u.mgd.conn_flags = assoc_data->link[link_id].conn_flags;
+
+	return offset;
+}
+
+static void ieee80211_add_non_inheritance_elem(struct sk_buff *skb,
+					       const u16 *outer,
+					       const u16 *inner)
+{
+	unsigned int skb_len = skb->len;
+	bool added = false;
+	int i, j;
+	u8 *len, *list_len = NULL;
+
+	skb_put_u8(skb, WLAN_EID_EXTENSION);
+	len = skb_put(skb, 1);
+	skb_put_u8(skb, WLAN_EID_EXT_NON_INHERITANCE);
+
+	for (i = 0; i < PRESENT_ELEMS_MAX && outer[i]; i++) {
+		u16 elem = outer[i];
+		bool have_inner = false;
+		bool at_extension = false;
+
+		/* should at least be sorted in the sense of normal -> ext */
+		WARN_ON(at_extension && elem < PRESENT_ELEM_EXT_OFFS);
+
+		/* switch to extension list */
+		if (!at_extension && elem >= PRESENT_ELEM_EXT_OFFS) {
+			at_extension = true;
+			if (!list_len)
+				skb_put_u8(skb, 0);
+			list_len = NULL;
+		}
+
+		for (j = 0; j < PRESENT_ELEMS_MAX && inner[j]; j++) {
+			if (elem == inner[j]) {
+				have_inner = true;
+				break;
+			}
+		}
+
+		if (have_inner)
+			continue;
+
+		if (!list_len) {
+			list_len = skb_put(skb, 1);
+			*list_len = 0;
+		}
+		*list_len += 1;
+		skb_put_u8(skb, (u8)elem);
+	}
+
+	if (!added)
+		skb_trim(skb, skb_len);
+	else
+		*len = skb->len - skb_len - 2;
+}
+
+static void ieee80211_assoc_add_ml_elem(struct ieee80211_sub_if_data *sdata,
+					struct sk_buff *skb, u16 capab,
+					const struct element *ext_capa,
+					const u16 *outer_present_elems)
+{
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
+	struct ieee80211_multi_link_elem *ml_elem;
+	struct ieee80211_mle_basic_common_info *common;
+	const struct wiphy_iftype_ext_capab *ift_ext_capa;
+	__le16 eml_capa = 0, mld_capa_ops = 0;
+	unsigned int link_id;
+	u8 *ml_elem_len;
+	void *capab_pos;
+
+	if (!sdata->vif.valid_links)
+		return;
+
+	ift_ext_capa = cfg80211_get_iftype_ext_capa(local->hw.wiphy,
+						    ieee80211_vif_type_p2p(&sdata->vif));
+	if (ift_ext_capa) {
+		eml_capa = cpu_to_le16(ift_ext_capa->eml_capabilities);
+		mld_capa_ops = cpu_to_le16(ift_ext_capa->mld_capa_and_ops);
+	}
+
+	skb_put_u8(skb, WLAN_EID_EXTENSION);
+	ml_elem_len = skb_put(skb, 1);
+	skb_put_u8(skb, WLAN_EID_EXT_EHT_MULTI_LINK);
+	ml_elem = skb_put(skb, sizeof(*ml_elem));
+	ml_elem->control =
+		cpu_to_le16(IEEE80211_ML_CONTROL_TYPE_BASIC |
+			    IEEE80211_MLC_BASIC_PRES_MLD_CAPA_OP);
+	common = skb_put(skb, sizeof(*common));
+	common->len = sizeof(*common) +
+		      2;  /* MLD capa/ops */
+	memcpy(common->mld_mac_addr, sdata->vif.addr, ETH_ALEN);
+
+	/* add EML_CAPA only if needed, see Draft P802.11be_D2.1, 35.3.17 */
+	if (eml_capa &
+	    cpu_to_le16((IEEE80211_EML_CAP_EMLSR_SUPP |
+			 IEEE80211_EML_CAP_EMLMR_SUPPORT))) {
+		common->len += 2; /* EML capabilities */
+		ml_elem->control |=
+			cpu_to_le16(IEEE80211_MLC_BASIC_PRES_EML_CAPA);
+		skb_put_data(skb, &eml_capa, sizeof(eml_capa));
+	}
+	/* need indication from userspace to support this */
+	mld_capa_ops &= ~cpu_to_le16(IEEE80211_MLD_CAP_OP_TID_TO_LINK_MAP_NEG_SUPP);
+	skb_put_data(skb, &mld_capa_ops, sizeof(mld_capa_ops));
+
+	for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
+		u16 link_present_elems[PRESENT_ELEMS_MAX] = {};
+		const u8 *extra_elems;
+		size_t extra_elems_len;
+		size_t extra_used;
+		u8 *subelem_len = NULL;
+		__le16 ctrl;
+
+		if (!assoc_data->link[link_id].bss ||
+		    link_id == assoc_data->assoc_link_id)
+			continue;
+
+		extra_elems = assoc_data->link[link_id].elems;
+		extra_elems_len = assoc_data->link[link_id].elems_len;
+
+		skb_put_u8(skb, IEEE80211_MLE_SUBELEM_PER_STA_PROFILE);
+		subelem_len = skb_put(skb, 1);
+
+		ctrl = cpu_to_le16(link_id |
+				   IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE |
+				   IEEE80211_MLE_STA_CONTROL_STA_MAC_ADDR_PRESENT);
+		skb_put_data(skb, &ctrl, sizeof(ctrl));
+		skb_put_u8(skb, 1 + ETH_ALEN); /* STA Info Length */
+		skb_put_data(skb, assoc_data->link[link_id].addr,
+			     ETH_ALEN);
+		/*
+		 * Now add the contents of the (re)association request,
+		 * but the "listen interval" and "current AP address"
+		 * (if applicable) are skipped. So we only have
+		 * the capability field (remember the position and fill
+		 * later), followed by the elements added below by
+		 * calling ieee80211_assoc_link_elems().
+		 */
+		capab_pos = skb_put(skb, 2);
+
+		extra_used = ieee80211_assoc_link_elems(sdata, skb, &capab,
+							ext_capa,
+							extra_elems,
+							extra_elems_len,
+							link_id, NULL,
+							link_present_elems);
+		if (extra_elems)
+			skb_put_data(skb, extra_elems + extra_used,
+				     extra_elems_len - extra_used);
+
+		put_unaligned_le16(capab, capab_pos);
+
+		ieee80211_add_non_inheritance_elem(skb, outer_present_elems,
+						   link_present_elems);
+
+		ieee80211_fragment_element(skb, subelem_len);
+	}
+
+	ieee80211_fragment_element(skb, ml_elem_len);
+}
+
+static int ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
+{
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
+	struct ieee80211_link_data *link;
+	struct sk_buff *skb;
+	struct ieee80211_mgmt *mgmt;
+	u8 *pos, qos_info, *ie_start;
+	size_t offset, noffset;
+	u16 capab = WLAN_CAPABILITY_ESS, link_capab;
+	__le16 listen_int;
+	struct element *ext_capa = NULL;
+	enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
+	struct ieee80211_prep_tx_info info = {};
+	unsigned int link_id, n_links = 0;
+	u16 present_elems[PRESENT_ELEMS_MAX] = {};
+	void *capab_pos;
+	size_t size;
+	int ret;
+
+	/* we know it's writable, cast away the const */
+	if (assoc_data->ie_len)
+		ext_capa = (void *)cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
+						      assoc_data->ie,
+						      assoc_data->ie_len);
+
+	sdata_assert_lock(sdata);
+
+	size = local->hw.extra_tx_headroom +
+	       sizeof(*mgmt) + /* bit too much but doesn't matter */
+	       2 + assoc_data->ssid_len + /* SSID */
+	       assoc_data->ie_len + /* extra IEs */
+	       (assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) +
+	       9; /* WMM */
+
+	for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
+		struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
+		const struct ieee80211_sband_iftype_data *iftd;
+		struct ieee80211_supported_band *sband;
+
+		if (!cbss)
+			continue;
+
+		sband = local->hw.wiphy->bands[cbss->channel->band];
+
+		n_links++;
+		/* add STA profile elements length */
+		size += assoc_data->link[link_id].elems_len;
+		/* and supported rates length */
+		size += 4 + sband->n_bitrates;
+		/* supported channels */
+		size += 2 + 2 * sband->n_channels;
+
+		iftd = ieee80211_get_sband_iftype_data(sband, iftype);
+		if (iftd)
+			size += iftd->vendor_elems.len;
+
+		/* power capability */
+		size += 4;
+
+		/* HT, VHT, HE, EHT */
+		size += 2 + sizeof(struct ieee80211_ht_cap);
+		size += 2 + sizeof(struct ieee80211_vht_cap);
+		size += 2 + 1 + sizeof(struct ieee80211_he_cap_elem) +
+			sizeof(struct ieee80211_he_mcs_nss_supp) +
+			IEEE80211_HE_PPE_THRES_MAX_LEN;
+
+		if (sband->band == NL80211_BAND_6GHZ)
+			size += 2 + 1 + sizeof(struct ieee80211_he_6ghz_capa);
+
+		size += 2 + 1 + sizeof(struct ieee80211_eht_cap_elem) +
+			sizeof(struct ieee80211_eht_mcs_nss_supp) +
+			IEEE80211_EHT_PPE_THRES_MAX_LEN;
+
+		/* non-inheritance element */
+		size += 2 + 2 + PRESENT_ELEMS_MAX;
+
+		/* should be the same across all BSSes */
+		if (cbss->capability & WLAN_CAPABILITY_PRIVACY)
+			capab |= WLAN_CAPABILITY_PRIVACY;
+	}
+
+	if (sdata->vif.valid_links) {
+		/* consider the multi-link element with STA profile */
+		size += sizeof(struct ieee80211_multi_link_elem);
+		/* max common info field in basic multi-link element */
+		size += sizeof(struct ieee80211_mle_basic_common_info) +
+			2 + /* capa & op */
+			2; /* EML capa */
+
+		/*
+		 * The capability elements were already considered above;
+		 * note this over-estimates a bit because there's no
+		 * STA profile for the assoc link.
+		 */
+		size += (n_links - 1) *
+			(1 + 1 + /* subelement ID/length */
+			 2 + /* STA control */
+			 1 + ETH_ALEN + 2 /* STA Info field */);
+	}
+
+	link = sdata_dereference(sdata->link[assoc_data->assoc_link_id], sdata);
+	if (WARN_ON(!link))
+		return -EINVAL;
+
+	if (WARN_ON(!assoc_data->link[assoc_data->assoc_link_id].bss))
+		return -EINVAL;
+
+	skb = alloc_skb(size, GFP_KERNEL);
+	if (!skb)
+		return -ENOMEM;
+
+	skb_reserve(skb, local->hw.extra_tx_headroom);
+
+	if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
+		capab |= WLAN_CAPABILITY_RADIO_MEASURE;
+
+	/* Set MBSSID support for HE AP if needed */
+	if (ieee80211_hw_check(&local->hw, SUPPORTS_ONLY_HE_MULTI_BSSID) &&
+	    !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
+	    ext_capa && ext_capa->datalen >= 3)
+		ext_capa->data[2] |= WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT;
+
+	mgmt = skb_put_zero(skb, 24);
+	memcpy(mgmt->da, sdata->vif.cfg.ap_addr, ETH_ALEN);
+	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
+	memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
+
+	listen_int = cpu_to_le16(assoc_data->s1g ?
+			ieee80211_encode_usf(local->hw.conf.listen_interval) :
+			local->hw.conf.listen_interval);
+	if (!is_zero_ether_addr(assoc_data->prev_ap_addr)) {
+		skb_put(skb, 10);
+		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+						  IEEE80211_STYPE_REASSOC_REQ);
+		capab_pos = &mgmt->u.reassoc_req.capab_info;
+		mgmt->u.reassoc_req.listen_interval = listen_int;
+		memcpy(mgmt->u.reassoc_req.current_ap,
+		       assoc_data->prev_ap_addr, ETH_ALEN);
+		info.subtype = IEEE80211_STYPE_REASSOC_REQ;
+	} else {
+		skb_put(skb, 4);
+		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+						  IEEE80211_STYPE_ASSOC_REQ);
+		capab_pos = &mgmt->u.assoc_req.capab_info;
+		mgmt->u.assoc_req.listen_interval = listen_int;
+		info.subtype = IEEE80211_STYPE_ASSOC_REQ;
+	}
+
+	/* SSID */
+	pos = skb_put(skb, 2 + assoc_data->ssid_len);
+	ie_start = pos;
+	*pos++ = WLAN_EID_SSID;
+	*pos++ = assoc_data->ssid_len;
+	memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);
+
+	/* add the elements for the assoc (main) link */
+	link_capab = capab;
+	offset = ieee80211_assoc_link_elems(sdata, skb, &link_capab,
+					    ext_capa,
+					    assoc_data->ie,
+					    assoc_data->ie_len,
+					    assoc_data->assoc_link_id, link,
+					    present_elems);
+	put_unaligned_le16(link_capab, capab_pos);
+
+	/* if present, add any custom non-vendor IEs */
+	if (assoc_data->ie_len) {
+		noffset = ieee80211_ie_split_vendor(assoc_data->ie,
+						    assoc_data->ie_len,
+						    offset);
+		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
+		offset = noffset;
+	}
+
+	if (assoc_data->wmm) {
+		if (assoc_data->uapsd) {
+			qos_info = ifmgd->uapsd_queues;
+			qos_info |= (ifmgd->uapsd_max_sp_len <<
+				     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
+		} else {
+			qos_info = 0;
+		}
+
+		pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
+	}
+
+	/* add any remaining custom (i.e. vendor specific here) IEs */
+	if (assoc_data->ie_len) {
+		noffset = assoc_data->ie_len;
+		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
+	}
+
+	if (assoc_data->fils_kek_len) {
+		ret = fils_encrypt_assoc_req(skb, assoc_data);
+		if (ret < 0) {
+			dev_kfree_skb(skb);
+			return ret;
+		}
+	}
+
+	pos = skb_tail_pointer(skb);
+	kfree(ifmgd->assoc_req_ies);
+	ifmgd->assoc_req_ies = kmemdup(ie_start, pos - ie_start, GFP_ATOMIC);
+	if (!ifmgd->assoc_req_ies) {
+		dev_kfree_skb(skb);
+		return -ENOMEM;
+	}
+
+	ifmgd->assoc_req_ies_len = pos - ie_start;
+
+	drv_mgd_prepare_tx(local, sdata, &info);
+
+	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
+		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
+						IEEE80211_TX_INTFL_MLME_CONN_TX;
+	ieee80211_tx_skb(sdata, skb);
+
+	return 0;
+}
+
+void ieee80211_send_pspoll(struct ieee80211_local *local,
+			   struct ieee80211_sub_if_data *sdata)
+{
+	struct ieee80211_pspoll *pspoll;
+	struct sk_buff *skb;
+
+	skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
+	if (!skb)
+		return;
+
+	pspoll = (struct ieee80211_pspoll *) skb->data;
+	pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
+
+	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+	ieee80211_tx_skb(sdata, skb);
+}
+
+void ieee80211_send_nullfunc(struct ieee80211_local *local,
+			     struct ieee80211_sub_if_data *sdata,
+			     bool powersave)
+{
+	struct sk_buff *skb;
+	struct ieee80211_hdr_3addr *nullfunc;
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+	skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif, -1,
+				     !ieee80211_hw_check(&local->hw,
+							 DOESNT_SUPPORT_QOS_NDP));
+	if (!skb)
+		return;
+
+	nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
+	if (powersave)
+		nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
+
+	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
+					IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
+
+	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
+		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
+
+	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
+		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
+
+	ieee80211_tx_skb(sdata, skb);
+}
+
+void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
+				   struct ieee80211_sub_if_data *sdata)
+{
+	struct sk_buff *skb;
+	struct ieee80211_hdr *nullfunc;
+	__le16 fc;
+
+	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
+		return;
+
+	skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
+	if (!skb)
+		return;
+
+	skb_reserve(skb, local->hw.extra_tx_headroom);
+
+	nullfunc = skb_put_zero(skb, 30);
+	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
+			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
+	nullfunc->frame_control = fc;
+	memcpy(nullfunc->addr1, sdata->deflink.u.mgd.bssid, ETH_ALEN);
+	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
+	memcpy(nullfunc->addr3, sdata->deflink.u.mgd.bssid, ETH_ALEN);
+	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
+
+	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
+	ieee80211_tx_skb(sdata, skb);
+}
+
+/* spectrum management related things */
+static void ieee80211_chswitch_work(struct work_struct *work)
+{
+	struct ieee80211_link_data *link =
+		container_of(work, struct ieee80211_link_data, u.mgd.chswitch_work);
+	struct ieee80211_sub_if_data *sdata = link->sdata;
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	int ret;
+
+	if (!ieee80211_sdata_running(sdata))
+		return;
+
+	sdata_lock(sdata);
+	mutex_lock(&local->mtx);
+	mutex_lock(&local->chanctx_mtx);
+
+	if (!ifmgd->associated)
+		goto out;
+
+	if (!link->conf->csa_active)
+		goto out;
+
+	/*
+	 * using reservation isn't immediate as it may be deferred until later
+	 * with multi-vif. once reservation is complete it will re-schedule the
+	 * work with no reserved_chanctx so verify chandef to check if it
+	 * completed successfully
+	 */
+
+	if (link->reserved_chanctx) {
+		/*
+		 * with multi-vif csa driver may call ieee80211_csa_finish()
+		 * many times while waiting for other interfaces to use their
+		 * reservations
+		 */
+		if (link->reserved_ready)
+			goto out;
+
+		ret = ieee80211_link_use_reserved_context(link);
+		if (ret) {
+			sdata_info(sdata,
+				   "failed to use reserved channel context, disconnecting (err=%d)\n",
+				   ret);
+			ieee80211_queue_work(&sdata->local->hw,
+					     &ifmgd->csa_connection_drop_work);
+			goto out;
+		}
+
+		goto out;
+	}
+
+	if (!cfg80211_chandef_identical(&link->conf->chandef,
+					&link->csa_chandef)) {
+		sdata_info(sdata,
+			   "failed to finalize channel switch, disconnecting\n");
+		ieee80211_queue_work(&sdata->local->hw,
+				     &ifmgd->csa_connection_drop_work);
+		goto out;
+	}
+
+	link->u.mgd.csa_waiting_bcn = true;
+
+	ieee80211_sta_reset_beacon_monitor(sdata);
+	ieee80211_sta_reset_conn_monitor(sdata);
+
+out:
+	mutex_unlock(&local->chanctx_mtx);
+	mutex_unlock(&local->mtx);
+	sdata_unlock(sdata);
+}
+
+static void ieee80211_chswitch_post_beacon(struct ieee80211_link_data *link)
+{
+	struct ieee80211_sub_if_data *sdata = link->sdata;
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	int ret;
+
+	sdata_assert_lock(sdata);
+
+	WARN_ON(!link->conf->csa_active);
+
+	if (link->csa_block_tx) {
+		ieee80211_wake_vif_queues(local, sdata,
+					  IEEE80211_QUEUE_STOP_REASON_CSA);
+		link->csa_block_tx = false;
+	}
+
+	link->conf->csa_active = false;
+	link->u.mgd.csa_waiting_bcn = false;
+	/*
+	 * If the CSA IE is still present on the beacon after the switch,
+	 * we need to consider it as a new CSA (possibly to self).
+	 */
+	link->u.mgd.beacon_crc_valid = false;
+
+	ret = drv_post_channel_switch(sdata);
+	if (ret) {
+		sdata_info(sdata,
+			   "driver post channel switch failed, disconnecting\n");
+		ieee80211_queue_work(&local->hw,
+				     &ifmgd->csa_connection_drop_work);
+		return;
+	}
+
+	cfg80211_ch_switch_notify(sdata->dev, &link->reserved_chandef, 0, 0);
+}
+
+void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
+{
+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+	if (WARN_ON(sdata->vif.valid_links))
+		success = false;
+
+	trace_api_chswitch_done(sdata, success);
+	if (!success) {
+		sdata_info(sdata,
+			   "driver channel switch failed, disconnecting\n");
+		ieee80211_queue_work(&sdata->local->hw,
+				     &ifmgd->csa_connection_drop_work);
+	} else {
+		ieee80211_queue_work(&sdata->local->hw,
+				     &sdata->deflink.u.mgd.chswitch_work);
+	}
+}
+EXPORT_SYMBOL(ieee80211_chswitch_done);
+
+static void ieee80211_chswitch_timer(struct timer_list *t)
+{
+	struct ieee80211_link_data *link =
+		from_timer(link, t, u.mgd.chswitch_timer);
+
+	ieee80211_queue_work(&link->sdata->local->hw,
+			     &link->u.mgd.chswitch_work);
+}
+
+static void
+ieee80211_sta_abort_chanswitch(struct ieee80211_link_data *link)
+{
+	struct ieee80211_sub_if_data *sdata = link->sdata;
+	struct ieee80211_local *local = sdata->local;
+
+	if (!local->ops->abort_channel_switch)
+		return;
+
+	mutex_lock(&local->mtx);
+
+	mutex_lock(&local->chanctx_mtx);
+	ieee80211_link_unreserve_chanctx(link);
+	mutex_unlock(&local->chanctx_mtx);
+
+	if (link->csa_block_tx)
+		ieee80211_wake_vif_queues(local, sdata,
+					  IEEE80211_QUEUE_STOP_REASON_CSA);
+
+	link->csa_block_tx = false;
+	link->conf->csa_active = false;
+
+	mutex_unlock(&local->mtx);
+
+	drv_abort_channel_switch(sdata);
+}
+
+static void
+ieee80211_sta_process_chanswitch(struct ieee80211_link_data *link,
+				 u64 timestamp, u32 device_timestamp,
+				 struct ieee802_11_elems *elems,
+				 bool beacon)
+{
+	struct ieee80211_sub_if_data *sdata = link->sdata;
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	struct cfg80211_bss *cbss = link->u.mgd.bss;
+	struct ieee80211_chanctx_conf *conf;
+	struct ieee80211_chanctx *chanctx;
+	enum nl80211_band current_band;
+	struct ieee80211_csa_ie csa_ie;
+	struct ieee80211_channel_switch ch_switch;
+	struct ieee80211_bss *bss;
+	int res;
+
+	sdata_assert_lock(sdata);
+
+	if (!cbss)
+		return;
+
+	if (local->scanning)
+		return;
+
+	current_band = cbss->channel->band;
+	bss = (void *)cbss->priv;
+	res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
+					   bss->vht_cap_info,
+					   link->u.mgd.conn_flags,
+					   link->u.mgd.bssid, &csa_ie);
+
+	if (!res) {
+		ch_switch.timestamp = timestamp;
+		ch_switch.device_timestamp = device_timestamp;
+		ch_switch.block_tx = csa_ie.mode;
+		ch_switch.chandef = csa_ie.chandef;
+		ch_switch.count = csa_ie.count;
+		ch_switch.delay = csa_ie.max_switch_time;
+	}
+
+	if (res < 0)
+		goto lock_and_drop_connection;
+
+	if (beacon && link->conf->csa_active &&
+	    !link->u.mgd.csa_waiting_bcn) {
+		if (res)
+			ieee80211_sta_abort_chanswitch(link);
+		else
+			drv_channel_switch_rx_beacon(sdata, &ch_switch);
+		return;
+	} else if (link->conf->csa_active || res) {
+		/* disregard subsequent announcements if already processing */
+		return;
+	}
+
+	if (link->conf->chandef.chan->band !=
+	    csa_ie.chandef.chan->band) {
+		sdata_info(sdata,
+			   "AP %pM switches to different band (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
+			   link->u.mgd.bssid,
+			   csa_ie.chandef.chan->center_freq,
+			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
+			   csa_ie.chandef.center_freq2);
+		goto lock_and_drop_connection;
+	}
+
+	if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
+				     IEEE80211_CHAN_DISABLED)) {
+		sdata_info(sdata,
+			   "AP %pM switches to unsupported channel "
+			   "(%d.%03d MHz, width:%d, CF1/2: %d.%03d/%d MHz), "
+			   "disconnecting\n",
+			   link->u.mgd.bssid,
+			   csa_ie.chandef.chan->center_freq,
+			   csa_ie.chandef.chan->freq_offset,
+			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
+			   csa_ie.chandef.freq1_offset,
+			   csa_ie.chandef.center_freq2);
+		goto lock_and_drop_connection;
+	}
+
+	if (cfg80211_chandef_identical(&csa_ie.chandef,
+				       &link->conf->chandef) &&
+	    (!csa_ie.mode || !beacon)) {
+		if (link->u.mgd.csa_ignored_same_chan)
+			return;
+		sdata_info(sdata,
+			   "AP %pM tries to chanswitch to same channel, ignore\n",
+			   link->u.mgd.bssid);
+		link->u.mgd.csa_ignored_same_chan = true;
+		return;
+	}
+
+	/*
+	 * Drop all TDLS peers - either we disconnect or move to a different
+	 * channel from this point on. There's no telling what our peer will do.
+	 * The TDLS WIDER_BW scenario is also problematic, as peers might now
+	 * have an incompatible wider chandef.
+	 */
+	ieee80211_teardown_tdls_peers(sdata);
+
+	mutex_lock(&local->mtx);
+	mutex_lock(&local->chanctx_mtx);
+	conf = rcu_dereference_protected(link->conf->chanctx_conf,
+					 lockdep_is_held(&local->chanctx_mtx));
+	if (!conf) {
+		sdata_info(sdata,
+			   "no channel context assigned to vif?, disconnecting\n");
+		goto drop_connection;
+	}
+
+	chanctx = container_of(conf, struct ieee80211_chanctx, conf);
+
+	if (local->use_chanctx &&
+	    !ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
+		sdata_info(sdata,
+			   "driver doesn't support chan-switch with channel contexts\n");
+		goto drop_connection;
+	}
+
+	if (drv_pre_channel_switch(sdata, &ch_switch)) {
+		sdata_info(sdata,
+			   "preparing for channel switch failed, disconnecting\n");
+		goto drop_connection;
+	}
+
+	res = ieee80211_link_reserve_chanctx(link, &csa_ie.chandef,
+					     chanctx->mode, false);
+	if (res) {
+		sdata_info(sdata,
+			   "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
+			   res);
+		goto drop_connection;
+	}
+	mutex_unlock(&local->chanctx_mtx);
+
+	link->conf->csa_active = true;
+	link->csa_chandef = csa_ie.chandef;
+	link->csa_block_tx = csa_ie.mode;
+	link->u.mgd.csa_ignored_same_chan = false;
+	link->u.mgd.beacon_crc_valid = false;
+
+	if (link->csa_block_tx)
+		ieee80211_stop_vif_queues(local, sdata,
+					  IEEE80211_QUEUE_STOP_REASON_CSA);
+	mutex_unlock(&local->mtx);
+
+	cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef, 0,
+					  csa_ie.count, csa_ie.mode, 0);
+
+	if (local->ops->channel_switch) {
+		/* use driver's channel switch callback */
+		drv_channel_switch(local, sdata, &ch_switch);
+		return;
+	}
+
+	/* channel switch handled in software */
+	if (csa_ie.count <= 1)
+		ieee80211_queue_work(&local->hw, &link->u.mgd.chswitch_work);
+	else
+		mod_timer(&link->u.mgd.chswitch_timer,
+			  TU_TO_EXP_TIME((csa_ie.count - 1) *
+					 cbss->beacon_interval));
+	return;
+ lock_and_drop_connection:
+	mutex_lock(&local->mtx);
+	mutex_lock(&local->chanctx_mtx);
+ drop_connection:
+	/*
+	 * This is just so that the disconnect flow will know that
+	 * we were trying to switch channel and failed. In case the
+	 * mode is 1 (we are not allowed to Tx), we will know not to
+	 * send a deauthentication frame. Those two fields will be
+	 * reset when the disconnection worker runs.
+	 */
+	link->conf->csa_active = true;
+	link->csa_block_tx = csa_ie.mode;
+
+	ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
+	mutex_unlock(&local->chanctx_mtx);
+	mutex_unlock(&local->mtx);
+}
+
+static bool
+ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
+				 struct ieee80211_channel *channel,
+				 const u8 *country_ie, u8 country_ie_len,
+				 const u8 *pwr_constr_elem,
+				 int *chan_pwr, int *pwr_reduction)
+{
+	struct ieee80211_country_ie_triplet *triplet;
+	int chan = ieee80211_frequency_to_channel(channel->center_freq);
+	int i, chan_increment;
+	bool have_chan_pwr = false;
+
+	/* Invalid IE */
+	if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
+		return false;
+
+	triplet = (void *)(country_ie + 3);
+	country_ie_len -= 3;
+
+	switch (channel->band) {
+	default:
+		WARN_ON_ONCE(1);
+		fallthrough;
+	case NL80211_BAND_2GHZ:
+	case NL80211_BAND_60GHZ:
+	case NL80211_BAND_LC:
+		chan_increment = 1;
+		break;
+	case NL80211_BAND_5GHZ:
+		chan_increment = 4;
+		break;
+	case NL80211_BAND_6GHZ:
+		/*
+		 * In the 6 GHz band, the "maximum transmit power level"
+		 * field in the triplets is reserved, and thus will be
+		 * zero and we shouldn't use it to control TX power.
+		 * The actual TX power will be given in the transmit
+		 * power envelope element instead.
+		 */
+		return false;
+	}
+
+	/* find channel */
+	while (country_ie_len >= 3) {
+		u8 first_channel = triplet->chans.first_channel;
+
+		if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
+			goto next;
+
+		for (i = 0; i < triplet->chans.num_channels; i++) {
+			if (first_channel + i * chan_increment == chan) {
+				have_chan_pwr = true;
+				*chan_pwr = triplet->chans.max_power;
+				break;
+			}
+		}
+		if (have_chan_pwr)
+			break;
+
+ next:
+		triplet++;
+		country_ie_len -= 3;
+	}
+
+	if (have_chan_pwr && pwr_constr_elem)
+		*pwr_reduction = *pwr_constr_elem;
+	else
+		*pwr_reduction = 0;
+
+	return have_chan_pwr;
+}
+
+static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
+				      struct ieee80211_channel *channel,
+				      const u8 *cisco_dtpc_ie,
+				      int *pwr_level)
+{
+	/* From practical testing, the first data byte of the DTPC element
+	 * seems to contain the requested dBm level, and the CLI on Cisco
+	 * APs clearly state the range is -127 to 127 dBm, which indicates
+	 * a signed byte, although it seemingly never actually goes negative.
+	 * The other byte seems to always be zero.
+	 */
+	*pwr_level = (__s8)cisco_dtpc_ie[4];
+}
+
+static u32 ieee80211_handle_pwr_constr(struct ieee80211_link_data *link,
+				       struct ieee80211_channel *channel,
+				       struct ieee80211_mgmt *mgmt,
+				       const u8 *country_ie, u8 country_ie_len,
+				       const u8 *pwr_constr_ie,
+				       const u8 *cisco_dtpc_ie)
+{
+	struct ieee80211_sub_if_data *sdata = link->sdata;
+	bool has_80211h_pwr = false, has_cisco_pwr = false;
+	int chan_pwr = 0, pwr_reduction_80211h = 0;
+	int pwr_level_cisco, pwr_level_80211h;
+	int new_ap_level;
+	__le16 capab = mgmt->u.probe_resp.capab_info;
+
+	if (ieee80211_is_s1g_beacon(mgmt->frame_control))
+		return 0;	/* TODO */
+
+	if (country_ie &&
+	    (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
+	     capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
+		has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
+			sdata, channel, country_ie, country_ie_len,
+			pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
+		pwr_level_80211h =
+			max_t(int, 0, chan_pwr - pwr_reduction_80211h);
+	}
+
+	if (cisco_dtpc_ie) {
+		ieee80211_find_cisco_dtpc(
+			sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
+		has_cisco_pwr = true;
+	}
+
+	if (!has_80211h_pwr && !has_cisco_pwr)
+		return 0;
+
+	/* If we have both 802.11h and Cisco DTPC, apply both limits
+	 * by picking the smallest of the two power levels advertised.
+	 */
+	if (has_80211h_pwr &&
+	    (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
+		new_ap_level = pwr_level_80211h;
+
+		if (link->ap_power_level == new_ap_level)
+			return 0;
+
+		sdata_dbg(sdata,
+			  "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
+			  pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
+			  link->u.mgd.bssid);
+	} else {  /* has_cisco_pwr is always true here. */
+		new_ap_level = pwr_level_cisco;
+
+		if (link->ap_power_level == new_ap_level)
+			return 0;
+
+		sdata_dbg(sdata,
+			  "Limiting TX power to %d dBm as advertised by %pM\n",
+			  pwr_level_cisco, link->u.mgd.bssid);
+	}
+
+	link->ap_power_level = new_ap_level;
+	if (__ieee80211_recalc_txpower(sdata))
+		return BSS_CHANGED_TXPOWER;
+	return 0;
+}
+
+/* powersave */
+static void ieee80211_enable_ps(struct ieee80211_local *local,
+				struct ieee80211_sub_if_data *sdata)
+{
+	struct ieee80211_conf *conf = &local->hw.conf;
+
+	/*
+	 * If we are scanning right now then the parameters will
+	 * take effect when scan finishes.
+	 */
+	if (local->scanning)
+		return;
+
+	if (conf->dynamic_ps_timeout > 0 &&
+	    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
+		mod_timer(&local->dynamic_ps_timer, jiffies +
+			  msecs_to_jiffies(conf->dynamic_ps_timeout));
+	} else {
+		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
+			ieee80211_send_nullfunc(local, sdata, true);
+
+		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
+		    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
+			return;
+
+		conf->flags |= IEEE80211_CONF_PS;
+		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+	}
+}
+
+static void ieee80211_change_ps(struct ieee80211_local *local)
+{
+	struct ieee80211_conf *conf = &local->hw.conf;
+
+	if (local->ps_sdata) {
+		ieee80211_enable_ps(local, local->ps_sdata);
+	} else if (conf->flags & IEEE80211_CONF_PS) {
+		conf->flags &= ~IEEE80211_CONF_PS;
+		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+		del_timer_sync(&local->dynamic_ps_timer);
+		cancel_work_sync(&local->dynamic_ps_enable_work);
+	}
+}
+
+static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
+{
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_if_managed *mgd = &sdata->u.mgd;
+	struct sta_info *sta = NULL;
+	bool authorized = false;
+
+	if (!mgd->powersave)
+		return false;
+
+	if (mgd->broken_ap)
+		return false;
+
+	if (!mgd->associated)
+		return false;
+
+	if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
+		return false;
+
+	if (!(local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO) &&
+	    !sdata->deflink.u.mgd.have_beacon)
+		return false;
+
+	rcu_read_lock();
+	sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
+	if (sta)
+		authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
+	rcu_read_unlock();
+
+	return authorized;
+}
+
+/* need to hold RTNL or interface lock */
+void ieee80211_recalc_ps(struct ieee80211_local *local)
+{
+	struct ieee80211_sub_if_data *sdata, *found = NULL;
+	int count = 0;
+	int timeout;
+
+	if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS) ||
+	    ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
+		local->ps_sdata = NULL;
+		return;
+	}
+
+	list_for_each_entry(sdata, &local->interfaces, list) {
+		if (!ieee80211_sdata_running(sdata))
+			continue;
+		if (sdata->vif.type == NL80211_IFTYPE_AP) {
+			/* If an AP vif is found, then disable PS
+			 * by setting the count to zero thereby setting
+			 * ps_sdata to NULL.
+			 */
+			count = 0;
+			break;
+		}
+		if (sdata->vif.type != NL80211_IFTYPE_STATION)
+			continue;
+		found = sdata;
+		count++;
+	}
+
+	if (count == 1 && ieee80211_powersave_allowed(found)) {
+		u8 dtimper = found->deflink.u.mgd.dtim_period;
+
+		timeout = local->dynamic_ps_forced_timeout;
+		if (timeout < 0)
+			timeout = 100;
+		local->hw.conf.dynamic_ps_timeout = timeout;
+
+		/* If the TIM IE is invalid, pretend the value is 1 */
+		if (!dtimper)
+			dtimper = 1;
+
+		local->hw.conf.ps_dtim_period = dtimper;
+		local->ps_sdata = found;
+	} else {
+		local->ps_sdata = NULL;
+	}
+
+	ieee80211_change_ps(local);
+}
+
+void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
+{
+	bool ps_allowed = ieee80211_powersave_allowed(sdata);
+
+	if (sdata->vif.cfg.ps != ps_allowed) {
+		sdata->vif.cfg.ps = ps_allowed;
+		ieee80211_vif_cfg_change_notify(sdata, BSS_CHANGED_PS);
+	}
+}
+
+void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
+{
+	struct ieee80211_local *local =
+		container_of(work, struct ieee80211_local,
+			     dynamic_ps_disable_work);
+
+	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
+		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+	}
+
+	ieee80211_wake_queues_by_reason(&local->hw,
+					IEEE80211_MAX_QUEUE_MAP,
+					IEEE80211_QUEUE_STOP_REASON_PS,
+					false);
+}
+
+void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
+{
+	struct ieee80211_local *local =
+		container_of(work, struct ieee80211_local,
+			     dynamic_ps_enable_work);
+	struct ieee80211_sub_if_data *sdata = local->ps_sdata;
+	struct ieee80211_if_managed *ifmgd;
+	unsigned long flags;
+	int q;
+
+	/* can only happen when PS was just disabled anyway */
+	if (!sdata)
+		return;
+
+	ifmgd = &sdata->u.mgd;
+
+	if (local->hw.conf.flags & IEEE80211_CONF_PS)
+		return;
+
+	if (local->hw.conf.dynamic_ps_timeout > 0) {
+		/* don't enter PS if TX frames are pending */
+		if (drv_tx_frames_pending(local)) {
+			mod_timer(&local->dynamic_ps_timer, jiffies +
+				  msecs_to_jiffies(
+				  local->hw.conf.dynamic_ps_timeout));
+			return;
+		}
+
+		/*
+		 * transmission can be stopped by others which leads to
+		 * dynamic_ps_timer expiry. Postpone the ps timer if it
+		 * is not the actual idle state.
+		 */
+		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+		for (q = 0; q < local->hw.queues; q++) {
+			if (local->queue_stop_reasons[q]) {
+				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
+						       flags);
+				mod_timer(&local->dynamic_ps_timer, jiffies +
+					  msecs_to_jiffies(
+					  local->hw.conf.dynamic_ps_timeout));
+				return;
+			}
+		}
+		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+	}
+
+	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
+	    !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
+		if (drv_tx_frames_pending(local)) {
+			mod_timer(&local->dynamic_ps_timer, jiffies +
+				  msecs_to_jiffies(
+				  local->hw.conf.dynamic_ps_timeout));
+		} else {
+			ieee80211_send_nullfunc(local, sdata, true);
+			/* Flush to get the tx status of nullfunc frame */
+			ieee80211_flush_queues(local, sdata, false);
+		}
+	}
+
+	if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
+	      ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
+	    (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
+		ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
+		local->hw.conf.flags |= IEEE80211_CONF_PS;
+		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+	}
+}
+
+void ieee80211_dynamic_ps_timer(struct timer_list *t)
+{
+	struct ieee80211_local *local = from_timer(local, t, dynamic_ps_timer);
+
+	ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
+}
+
+void ieee80211_dfs_cac_timer_work(struct work_struct *work)
+{
+	struct delayed_work *delayed_work = to_delayed_work(work);
+	struct ieee80211_link_data *link =
+		container_of(delayed_work, struct ieee80211_link_data,
+			     dfs_cac_timer_work);
+	struct cfg80211_chan_def chandef = link->conf->chandef;
+	struct ieee80211_sub_if_data *sdata = link->sdata;
+
+	mutex_lock(&sdata->local->mtx);
+	if (sdata->wdev.cac_started) {
+		ieee80211_link_release_channel(link);
+		cfg80211_cac_event(sdata->dev, &chandef,
+				   NL80211_RADAR_CAC_FINISHED,
+				   GFP_KERNEL);
+	}
+	mutex_unlock(&sdata->local->mtx);
+}
+
+static bool
+__ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
+{
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	bool ret = false;
+	int ac;
+
+	if (local->hw.queues < IEEE80211_NUM_ACS)
+		return false;
+
+	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+		struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
+		int non_acm_ac;
+		unsigned long now = jiffies;
+
+		if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
+		    tx_tspec->admitted_time &&
+		    time_after(now, tx_tspec->time_slice_start + HZ)) {
+			tx_tspec->consumed_tx_time = 0;
+			tx_tspec->time_slice_start = now;
+
+			if (tx_tspec->downgraded)
+				tx_tspec->action =
+					TX_TSPEC_ACTION_STOP_DOWNGRADE;
+		}
+
+		switch (tx_tspec->action) {
+		case TX_TSPEC_ACTION_STOP_DOWNGRADE:
+			/* take the original parameters */
+			if (drv_conf_tx(local, &sdata->deflink, ac,
+					&sdata->deflink.tx_conf[ac]))
+				link_err(&sdata->deflink,
+					 "failed to set TX queue parameters for queue %d\n",
+					 ac);
+			tx_tspec->action = TX_TSPEC_ACTION_NONE;
+			tx_tspec->downgraded = false;
+			ret = true;
+			break;
+		case TX_TSPEC_ACTION_DOWNGRADE:
+			if (time_after(now, tx_tspec->time_slice_start + HZ)) {
+				tx_tspec->action = TX_TSPEC_ACTION_NONE;
+				ret = true;
+				break;
+			}
+			/* downgrade next lower non-ACM AC */
+			for (non_acm_ac = ac + 1;
+			     non_acm_ac < IEEE80211_NUM_ACS;
+			     non_acm_ac++)
+				if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
+					break;
+			/* Usually the loop will result in using BK even if it
+			 * requires admission control, but such a configuration
+			 * makes no sense and we have to transmit somehow - the
+			 * AC selection does the same thing.
+			 * If we started out trying to downgrade from BK, then
+			 * the extra condition here might be needed.
+			 */
+			if (non_acm_ac >= IEEE80211_NUM_ACS)
+				non_acm_ac = IEEE80211_AC_BK;
+			if (drv_conf_tx(local, &sdata->deflink, ac,
+					&sdata->deflink.tx_conf[non_acm_ac]))
+				link_err(&sdata->deflink,
+					 "failed to set TX queue parameters for queue %d\n",
+					 ac);
+			tx_tspec->action = TX_TSPEC_ACTION_NONE;
+			ret = true;
+			schedule_delayed_work(&ifmgd->tx_tspec_wk,
+				tx_tspec->time_slice_start + HZ - now + 1);
+			break;
+		case TX_TSPEC_ACTION_NONE:
+			/* nothing now */
+			break;
+		}
+	}
+
+	return ret;
+}
+
+void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
+{
+	if (__ieee80211_sta_handle_tspec_ac_params(sdata))
+		ieee80211_link_info_change_notify(sdata, &sdata->deflink,
+						  BSS_CHANGED_QOS);
+}
+
+static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
+{
+	struct ieee80211_sub_if_data *sdata;
+
+	sdata = container_of(work, struct ieee80211_sub_if_data,
+			     u.mgd.tx_tspec_wk.work);
+	ieee80211_sta_handle_tspec_ac_params(sdata);
+}
+
+void ieee80211_mgd_set_link_qos_params(struct ieee80211_link_data *link)
+{
+	struct ieee80211_sub_if_data *sdata = link->sdata;
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	struct ieee80211_tx_queue_params *params = link->tx_conf;
+	u8 ac;
+
+	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+		mlme_dbg(sdata,
+			 "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
+			 ac, params[ac].acm,
+			 params[ac].aifs, params[ac].cw_min, params[ac].cw_max,
+			 params[ac].txop, params[ac].uapsd,
+			 ifmgd->tx_tspec[ac].downgraded);
+		if (!ifmgd->tx_tspec[ac].downgraded &&
+		    drv_conf_tx(local, link, ac, &params[ac]))
+			link_err(link,
+				 "failed to set TX queue parameters for AC %d\n",
+				 ac);
+	}
+}
+
+/* MLME */
+static bool
+ieee80211_sta_wmm_params(struct ieee80211_local *local,
+			 struct ieee80211_link_data *link,
+			 const u8 *wmm_param, size_t wmm_param_len,
+			 const struct ieee80211_mu_edca_param_set *mu_edca)
+{
+	struct ieee80211_sub_if_data *sdata = link->sdata;
+	struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS];
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	size_t left;
+	int count, mu_edca_count, ac;
+	const u8 *pos;
+	u8 uapsd_queues = 0;
+
+	if (!local->ops->conf_tx)
+		return false;
+
+	if (local->hw.queues < IEEE80211_NUM_ACS)
+		return false;
+
+	if (!wmm_param)
+		return false;
+
+	if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
+		return false;
+
+	if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
+		uapsd_queues = ifmgd->uapsd_queues;
+
+	count = wmm_param[6] & 0x0f;
+	/* -1 is the initial value of ifmgd->mu_edca_last_param_set.
+	 * if mu_edca was preset before and now it disappeared tell
+	 * the driver about it.
+	 */
+	mu_edca_count = mu_edca ? mu_edca->mu_qos_info & 0x0f : -1;
+	if (count == link->u.mgd.wmm_last_param_set &&
+	    mu_edca_count == link->u.mgd.mu_edca_last_param_set)
+		return false;
+	link->u.mgd.wmm_last_param_set = count;
+	link->u.mgd.mu_edca_last_param_set = mu_edca_count;
+
+	pos = wmm_param + 8;
+	left = wmm_param_len - 8;
+
+	memset(&params, 0, sizeof(params));
+
+	sdata->wmm_acm = 0;
+	for (; left >= 4; left -= 4, pos += 4) {
+		int aci = (pos[0] >> 5) & 0x03;
+		int acm = (pos[0] >> 4) & 0x01;
+		bool uapsd = false;
+
+		switch (aci) {
+		case 1: /* AC_BK */
+			ac = IEEE80211_AC_BK;
+			if (acm)
+				sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
+			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
+				uapsd = true;
+			params[ac].mu_edca = !!mu_edca;
+			if (mu_edca)
+				params[ac].mu_edca_param_rec = mu_edca->ac_bk;
+			break;
+		case 2: /* AC_VI */
+			ac = IEEE80211_AC_VI;
+			if (acm)
+				sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
+			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
+				uapsd = true;
+			params[ac].mu_edca = !!mu_edca;
+			if (mu_edca)
+				params[ac].mu_edca_param_rec = mu_edca->ac_vi;
+			break;
+		case 3: /* AC_VO */
+			ac = IEEE80211_AC_VO;
+			if (acm)
+				sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
+			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
+				uapsd = true;
+			params[ac].mu_edca = !!mu_edca;
+			if (mu_edca)
+				params[ac].mu_edca_param_rec = mu_edca->ac_vo;
+			break;
+		case 0: /* AC_BE */
+		default:
+			ac = IEEE80211_AC_BE;
+			if (acm)
+				sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
+			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
+				uapsd = true;
+			params[ac].mu_edca = !!mu_edca;
+			if (mu_edca)
+				params[ac].mu_edca_param_rec = mu_edca->ac_be;
+			break;
+		}
+
+		params[ac].aifs = pos[0] & 0x0f;
+
+		if (params[ac].aifs < 2) {
+			sdata_info(sdata,
+				   "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n",
+				   params[ac].aifs, aci);
+			params[ac].aifs = 2;
+		}
+		params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
+		params[ac].cw_min = ecw2cw(pos[1] & 0x0f);
+		params[ac].txop = get_unaligned_le16(pos + 2);
+		params[ac].acm = acm;
+		params[ac].uapsd = uapsd;
+
+		if (params[ac].cw_min == 0 ||
+		    params[ac].cw_min > params[ac].cw_max) {
+			sdata_info(sdata,
+				   "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
+				   params[ac].cw_min, params[ac].cw_max, aci);
+			return false;
+		}
+		ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
+	}
+
+	/* WMM specification requires all 4 ACIs. */
+	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+		if (params[ac].cw_min == 0) {
+			sdata_info(sdata,
+				   "AP has invalid WMM params (missing AC %d), using defaults\n",
+				   ac);
+			return false;
+		}
+	}
+
+	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
+		link->tx_conf[ac] = params[ac];
+
+	ieee80211_mgd_set_link_qos_params(link);
+
+	/* enable WMM or activate new settings */
+	link->conf->qos = true;
+	return true;
+}
+
+static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
+{
+	lockdep_assert_held(&sdata->local->mtx);
+
+	sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
+	ieee80211_run_deferred_scan(sdata->local);
+}
+
+static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
+{
+	mutex_lock(&sdata->local->mtx);
+	__ieee80211_stop_poll(sdata);
+	mutex_unlock(&sdata->local->mtx);
+}
+
+static u32 ieee80211_handle_bss_capability(struct ieee80211_link_data *link,
+					   u16 capab, bool erp_valid, u8 erp)
+{
+	struct ieee80211_bss_conf *bss_conf = link->conf;
+	struct ieee80211_supported_band *sband;
+	u32 changed = 0;
+	bool use_protection;
+	bool use_short_preamble;
+	bool use_short_slot;
+
+	sband = ieee80211_get_link_sband(link);
+	if (!sband)
+		return changed;
+
+	if (erp_valid) {
+		use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
+		use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
+	} else {
+		use_protection = false;
+		use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
+	}
+
+	use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
+	if (sband->band == NL80211_BAND_5GHZ ||
+	    sband->band == NL80211_BAND_6GHZ)
+		use_short_slot = true;
+
+	if (use_protection != bss_conf->use_cts_prot) {
+		bss_conf->use_cts_prot = use_protection;
+		changed |= BSS_CHANGED_ERP_CTS_PROT;
+	}
+
+	if (use_short_preamble != bss_conf->use_short_preamble) {
+		bss_conf->use_short_preamble = use_short_preamble;
+		changed |= BSS_CHANGED_ERP_PREAMBLE;
+	}
+
+	if (use_short_slot != bss_conf->use_short_slot) {
+		bss_conf->use_short_slot = use_short_slot;
+		changed |= BSS_CHANGED_ERP_SLOT;
+	}
+
+	return changed;
+}
+
+static u32 ieee80211_link_set_associated(struct ieee80211_link_data *link,
+					 struct cfg80211_bss *cbss)
+{
+	struct ieee80211_sub_if_data *sdata = link->sdata;
+	struct ieee80211_bss_conf *bss_conf = link->conf;
+	struct ieee80211_bss *bss = (void *)cbss->priv;
+	u32 changed = BSS_CHANGED_QOS;
+
+	/* not really used in MLO */
+	sdata->u.mgd.beacon_timeout =
+		usecs_to_jiffies(ieee80211_tu_to_usec(beacon_loss_count *
+						      bss_conf->beacon_int));
+
+	changed |= ieee80211_handle_bss_capability(link,
+						   bss_conf->assoc_capability,
+						   bss->has_erp_value,
+						   bss->erp_value);
+
+	ieee80211_check_rate_mask(link);
+
+	link->u.mgd.bss = cbss;
+	memcpy(link->u.mgd.bssid, cbss->bssid, ETH_ALEN);
+
+	if (sdata->vif.p2p ||
+	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
+		const struct cfg80211_bss_ies *ies;
+
+		rcu_read_lock();
+		ies = rcu_dereference(cbss->ies);
+		if (ies) {
+			int ret;
+
+			ret = cfg80211_get_p2p_attr(
+					ies->data, ies->len,
+					IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
+					(u8 *) &bss_conf->p2p_noa_attr,
+					sizeof(bss_conf->p2p_noa_attr));
+			if (ret >= 2) {
+				link->u.mgd.p2p_noa_index =
+					bss_conf->p2p_noa_attr.index;
+				changed |= BSS_CHANGED_P2P_PS;
+			}
+		}
+		rcu_read_unlock();
+	}
+
+	if (link->u.mgd.have_beacon) {
+		bss_conf->beacon_rate = bss->beacon_rate;
+		changed |= BSS_CHANGED_BEACON_INFO;
+	} else {
+		bss_conf->beacon_rate = NULL;
+	}
+
+	/* Tell the driver to monitor connection quality (if supported) */
+	if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
+	    bss_conf->cqm_rssi_thold)
+		changed |= BSS_CHANGED_CQM;
+
+	return changed;
+}
+
+static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
+				     struct ieee80211_mgd_assoc_data *assoc_data,
+				     u64 changed[IEEE80211_MLD_MAX_NUM_LINKS])
+{
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
+	u64 vif_changed = BSS_CHANGED_ASSOC;
+	unsigned int link_id;
+
+	sdata->u.mgd.associated = true;
+
+	for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
+		struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
+		struct ieee80211_link_data *link;
+
+		if (!cbss ||
+		    assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS)
+			continue;
+
+		link = sdata_dereference(sdata->link[link_id], sdata);
+		if (WARN_ON(!link))
+			return;
+
+		changed[link_id] |= ieee80211_link_set_associated(link, cbss);
+	}
+
+	/* just to be sure */
+	ieee80211_stop_poll(sdata);
+
+	ieee80211_led_assoc(local, 1);
+
+	vif_cfg->assoc = 1;
+
+	/* Enable ARP filtering */
+	if (vif_cfg->arp_addr_cnt)
+		vif_changed |= BSS_CHANGED_ARP_FILTER;
+
+	if (sdata->vif.valid_links) {
+		for (link_id = 0;
+		     link_id < IEEE80211_MLD_MAX_NUM_LINKS;
+		     link_id++) {
+			struct ieee80211_link_data *link;
+			struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
+
+			if (!cbss ||
+			    assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS)
+				continue;
+
+			link = sdata_dereference(sdata->link[link_id], sdata);
+			if (WARN_ON(!link))
+				return;
+
+			ieee80211_link_info_change_notify(sdata, link,
+							  changed[link_id]);
+
+			ieee80211_recalc_smps(sdata, link);
+		}
+
+		ieee80211_vif_cfg_change_notify(sdata, vif_changed);
+	} else {
+		ieee80211_bss_info_change_notify(sdata,
+						 vif_changed | changed[0]);
+	}
+
+	mutex_lock(&local->iflist_mtx);
+	ieee80211_recalc_ps(local);
+	mutex_unlock(&local->iflist_mtx);
+
+	/* leave this here to not change ordering in non-MLO cases */
+	if (!sdata->vif.valid_links)
+		ieee80211_recalc_smps(sdata, &sdata->deflink);
+	ieee80211_recalc_ps_vif(sdata);
+
+	netif_carrier_on(sdata->dev);
+}
+
+static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
+				   u16 stype, u16 reason, bool tx,
+				   u8 *frame_buf)
+{
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	struct ieee80211_local *local = sdata->local;
+	unsigned int link_id;
+	u32 changed = 0;
+	struct ieee80211_prep_tx_info info = {
+		.subtype = stype,
+	};
+
+	sdata_assert_lock(sdata);
+
+	if (WARN_ON_ONCE(tx && !frame_buf))
+		return;
+
+	if (WARN_ON(!ifmgd->associated))
+		return;
+
+	ieee80211_stop_poll(sdata);
+
+	ifmgd->associated = false;
+
+	/* other links will be destroyed */
+	sdata->deflink.u.mgd.bss = NULL;
+
+	netif_carrier_off(sdata->dev);
+
+	/*
+	 * if we want to get out of ps before disassoc (why?) we have
+	 * to do it before sending disassoc, as otherwise the null-packet
+	 * won't be valid.
+	 */
+	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
+		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+	}
+	local->ps_sdata = NULL;
+
+	/* disable per-vif ps */
+	ieee80211_recalc_ps_vif(sdata);
+
+	/* make sure ongoing transmission finishes */
+	synchronize_net();
+
+	/*
+	 * drop any frame before deauth/disassoc, this can be data or
+	 * management frame. Since we are disconnecting, we should not
+	 * insist sending these frames which can take time and delay
+	 * the disconnection and possible the roaming.
+	 */
+	if (tx)
+		ieee80211_flush_queues(local, sdata, true);
+
+	/* deauthenticate/disassociate now */
+	if (tx || frame_buf) {
+		/*
+		 * In multi channel scenarios guarantee that the virtual
+		 * interface is granted immediate airtime to transmit the
+		 * deauthentication frame by calling mgd_prepare_tx, if the
+		 * driver requested so.
+		 */
+		if (ieee80211_hw_check(&local->hw, DEAUTH_NEED_MGD_TX_PREP) &&
+		    !sdata->deflink.u.mgd.have_beacon) {
+			drv_mgd_prepare_tx(sdata->local, sdata, &info);
+		}
+
+		ieee80211_send_deauth_disassoc(sdata, sdata->vif.cfg.ap_addr,
+					       sdata->vif.cfg.ap_addr, stype,
+					       reason, tx, frame_buf);
+	}
+
+	/* flush out frame - make sure the deauth was actually sent */
+	if (tx)
+		ieee80211_flush_queues(local, sdata, false);
+
+	drv_mgd_complete_tx(sdata->local, sdata, &info);
+
+	/* clear AP addr only after building the needed mgmt frames */
+	eth_zero_addr(sdata->deflink.u.mgd.bssid);
+	eth_zero_addr(sdata->vif.cfg.ap_addr);
+
+	sdata->vif.cfg.ssid_len = 0;
+
+	/* remove AP and TDLS peers */
+	sta_info_flush(sdata);
+
+	/* finally reset all BSS / config parameters */
+	if (!sdata->vif.valid_links)
+		changed |= ieee80211_reset_erp_info(sdata);
+
+	ieee80211_led_assoc(local, 0);
+	changed |= BSS_CHANGED_ASSOC;
+	sdata->vif.cfg.assoc = false;
+
+	sdata->deflink.u.mgd.p2p_noa_index = -1;
+	memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
+	       sizeof(sdata->vif.bss_conf.p2p_noa_attr));
+
+	/* on the next assoc, re-program HT/VHT parameters */
+	memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
+	memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
+	memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
+	memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
+
+	/*
+	 * reset MU-MIMO ownership and group data in default link,
+	 * if used, other links are destroyed
+	 */
+	memset(sdata->vif.bss_conf.mu_group.membership, 0,
+	       sizeof(sdata->vif.bss_conf.mu_group.membership));
+	memset(sdata->vif.bss_conf.mu_group.position, 0,
+	       sizeof(sdata->vif.bss_conf.mu_group.position));
+	if (!sdata->vif.valid_links)
+		changed |= BSS_CHANGED_MU_GROUPS;
+	sdata->vif.bss_conf.mu_mimo_owner = false;
+
+	sdata->deflink.ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
+
+	del_timer_sync(&local->dynamic_ps_timer);
+	cancel_work_sync(&local->dynamic_ps_enable_work);
+
+	/* Disable ARP filtering */
+	if (sdata->vif.cfg.arp_addr_cnt)
+		changed |= BSS_CHANGED_ARP_FILTER;
+
+	sdata->vif.bss_conf.qos = false;
+	if (!sdata->vif.valid_links) {
+		changed |= BSS_CHANGED_QOS;
+		/* The BSSID (not really interesting) and HT changed */
+		changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
+		ieee80211_bss_info_change_notify(sdata, changed);
+	} else {
+		ieee80211_vif_cfg_change_notify(sdata, changed);
+	}
+
+	/* disassociated - set to defaults now */
+	ieee80211_set_wmm_default(&sdata->deflink, false, false);
+
+	del_timer_sync(&sdata->u.mgd.conn_mon_timer);
+	del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
+	del_timer_sync(&sdata->u.mgd.timer);
+	del_timer_sync(&sdata->deflink.u.mgd.chswitch_timer);
+
+	sdata->vif.bss_conf.dtim_period = 0;
+	sdata->vif.bss_conf.beacon_rate = NULL;
+
+	sdata->deflink.u.mgd.have_beacon = false;
+	sdata->deflink.u.mgd.tracking_signal_avg = false;
+	sdata->deflink.u.mgd.disable_wmm_tracking = false;
+
+	ifmgd->flags = 0;
+	sdata->deflink.u.mgd.conn_flags = 0;
+	mutex_lock(&local->mtx);
+
+	for (link_id = 0; link_id < ARRAY_SIZE(sdata->link); link_id++) {
+		struct ieee80211_link_data *link;
+
+		link = sdata_dereference(sdata->link[link_id], sdata);
+		if (!link)
+			continue;
+		ieee80211_link_release_channel(link);
+	}
+
+	sdata->vif.bss_conf.csa_active = false;
+	sdata->deflink.u.mgd.csa_waiting_bcn = false;
+	sdata->deflink.u.mgd.csa_ignored_same_chan = false;
+	if (sdata->deflink.csa_block_tx) {
+		ieee80211_wake_vif_queues(local, sdata,
+					  IEEE80211_QUEUE_STOP_REASON_CSA);
+		sdata->deflink.csa_block_tx = false;
+	}
+	mutex_unlock(&local->mtx);
+
+	/* existing TX TSPEC sessions no longer exist */
+	memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
+	cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);
+
+	sdata->vif.bss_conf.pwr_reduction = 0;
+	sdata->vif.bss_conf.tx_pwr_env_num = 0;
+	memset(sdata->vif.bss_conf.tx_pwr_env, 0,
+	       sizeof(sdata->vif.bss_conf.tx_pwr_env));
+
+	ieee80211_vif_set_links(sdata, 0);
+}
+
+static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
+{
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	struct ieee80211_local *local = sdata->local;
+
+	mutex_lock(&local->mtx);
+	if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
+		goto out;
+
+	__ieee80211_stop_poll(sdata);
+
+	mutex_lock(&local->iflist_mtx);
+	ieee80211_recalc_ps(local);
+	mutex_unlock(&local->iflist_mtx);
+
+	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
+		goto out;
+
+	/*
+	 * We've received a probe response, but are not sure whether
+	 * we have or will be receiving any beacons or data, so let's
+	 * schedule the timers again, just in case.
+	 */
+	ieee80211_sta_reset_beacon_monitor(sdata);
+
+	mod_timer(&ifmgd->conn_mon_timer,
+		  round_jiffies_up(jiffies +
+				   IEEE80211_CONNECTION_IDLE_TIME));
+out:
+	mutex_unlock(&local->mtx);
+}
+
+static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
+					   struct ieee80211_hdr *hdr,
+					   u16 tx_time)
+{
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	u16 tid;
+	int ac;
+	struct ieee80211_sta_tx_tspec *tx_tspec;
+	unsigned long now = jiffies;
+
+	if (!ieee80211_is_data_qos(hdr->frame_control))
+		return;
+
+	tid = ieee80211_get_tid(hdr);
+	ac = ieee80211_ac_from_tid(tid);
+	tx_tspec = &ifmgd->tx_tspec[ac];
+
+	if (likely(!tx_tspec->admitted_time))
+		return;
+
+	if (time_after(now, tx_tspec->time_slice_start + HZ)) {
+		tx_tspec->consumed_tx_time = 0;
+		tx_tspec->time_slice_start = now;
+
+		if (tx_tspec->downgraded) {
+			tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
+			schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
+		}
+	}
+
+	if (tx_tspec->downgraded)
+		return;
+
+	tx_tspec->consumed_tx_time += tx_time;
+
+	if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
+		tx_tspec->downgraded = true;
+		tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
+		schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
+	}
+}
+
+void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
+			     struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
+{
+	ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);
+
+	if (!ieee80211_is_any_nullfunc(hdr->frame_control) ||
+	    !sdata->u.mgd.probe_send_count)
+		return;
+
+	if (ack)
+		sdata->u.mgd.probe_send_count = 0;
+	else
+		sdata->u.mgd.nullfunc_failed = true;
+	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+}
+
+static void ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data *sdata,
+					  const u8 *src, const u8 *dst,
+					  const u8 *ssid, size_t ssid_len,
+					  struct ieee80211_channel *channel)
+{
+	struct sk_buff *skb;
+
+	skb = ieee80211_build_probe_req(sdata, src, dst, (u32)-1, channel,
+					ssid, ssid_len, NULL, 0,
+					IEEE80211_PROBE_FLAG_DIRECTED);
+	if (skb)
+		ieee80211_tx_skb(sdata, skb);
+}
+
+static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
+{
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	u8 *dst = sdata->vif.cfg.ap_addr;
+	u8 unicast_limit = max(1, max_probe_tries - 3);
+	struct sta_info *sta;
+
+	if (WARN_ON(sdata->vif.valid_links))
+		return;
+
+	/*
+	 * Try sending broadcast probe requests for the last three
+	 * probe requests after the first ones failed since some
+	 * buggy APs only support broadcast probe requests.
+	 */
+	if (ifmgd->probe_send_count >= unicast_limit)
+		dst = NULL;
+
+	/*
+	 * When the hardware reports an accurate Tx ACK status, it's
+	 * better to send a nullfunc frame instead of a probe request,
+	 * as it will kick us off the AP quickly if we aren't associated
+	 * anymore. The timeout will be reset if the frame is ACKed by
+	 * the AP.
+	 */
+	ifmgd->probe_send_count++;
+
+	if (dst) {
+		mutex_lock(&sdata->local->sta_mtx);
+		sta = sta_info_get(sdata, dst);
+		if (!WARN_ON(!sta))
+			ieee80211_check_fast_rx(sta);
+		mutex_unlock(&sdata->local->sta_mtx);
+	}
+
+	if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
+		ifmgd->nullfunc_failed = false;
+		ieee80211_send_nullfunc(sdata->local, sdata, false);
+	} else {
+		ieee80211_mlme_send_probe_req(sdata, sdata->vif.addr, dst,
+					      sdata->vif.cfg.ssid,
+					      sdata->vif.cfg.ssid_len,
+					      sdata->deflink.u.mgd.bss->channel);
+	}
+
+	ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
+	run_again(sdata, ifmgd->probe_timeout);
+}
+
+static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
+				   bool beacon)
+{
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	bool already = false;
+
+	if (WARN_ON(sdata->vif.valid_links))
+		return;
+
+	if (!ieee80211_sdata_running(sdata))
+		return;
+
+	sdata_lock(sdata);
+
+	if (!ifmgd->associated)
+		goto out;
+
+	mutex_lock(&sdata->local->mtx);
+
+	if (sdata->local->tmp_channel || sdata->local->scanning) {
+		mutex_unlock(&sdata->local->mtx);
+		goto out;
+	}
+
+	if (sdata->local->suspending) {
+		/* reschedule after resume */
+		mutex_unlock(&sdata->local->mtx);
+		ieee80211_reset_ap_probe(sdata);
+		goto out;
+	}
+
+	if (beacon) {
+		mlme_dbg_ratelimited(sdata,
+				     "detected beacon loss from AP (missed %d beacons) - probing\n",
+				     beacon_loss_count);
+
+		ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
+	}
+
+	/*
+	 * The driver/our work has already reported this event or the
+	 * connection monitoring has kicked in and we have already sent
+	 * a probe request. Or maybe the AP died and the driver keeps
+	 * reporting until we disassociate...
+	 *
+	 * In either case we have to ignore the current call to this
+	 * function (except for setting the correct probe reason bit)
+	 * because otherwise we would reset the timer every time and
+	 * never check whether we received a probe response!
+	 */
+	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
+		already = true;
+
+	ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
+
+	mutex_unlock(&sdata->local->mtx);
+
+	if (already)
+		goto out;
+
+	mutex_lock(&sdata->local->iflist_mtx);
+	ieee80211_recalc_ps(sdata->local);
+	mutex_unlock(&sdata->local->iflist_mtx);
+
+	ifmgd->probe_send_count = 0;
+	ieee80211_mgd_probe_ap_send(sdata);
+ out:
+	sdata_unlock(sdata);
+}
+
+struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
+					  struct ieee80211_vif *vif)
+{
+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	struct cfg80211_bss *cbss;
+	struct sk_buff *skb;
+	const struct element *ssid;
+	int ssid_len;
+
+	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
+		    sdata->vif.valid_links))
+		return NULL;
+
+	sdata_assert_lock(sdata);
+
+	if (ifmgd->associated)
+		cbss = sdata->deflink.u.mgd.bss;
+	else if (ifmgd->auth_data)
+		cbss = ifmgd->auth_data->bss;
+	else if (ifmgd->assoc_data && ifmgd->assoc_data->link[0].bss)
+		cbss = ifmgd->assoc_data->link[0].bss;
+	else
+		return NULL;
+
+	rcu_read_lock();
+	ssid = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID);
+	if (WARN_ONCE(!ssid || ssid->datalen > IEEE80211_MAX_SSID_LEN,
+		      "invalid SSID element (len=%d)",
+		      ssid ? ssid->datalen : -1))
+		ssid_len = 0;
+	else
+		ssid_len = ssid->datalen;
+
+	skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
+					(u32) -1, cbss->channel,
+					ssid->data, ssid_len,
+					NULL, 0, IEEE80211_PROBE_FLAG_DIRECTED);
+	rcu_read_unlock();
+
+	return skb;
+}
+EXPORT_SYMBOL(ieee80211_ap_probereq_get);
+
+static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
+					const u8 *buf, size_t len, bool tx,
+					u16 reason, bool reconnect)
+{
+	struct ieee80211_event event = {
+		.type = MLME_EVENT,
+		.u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
+		.u.mlme.reason = reason,
+	};
+
+	if (tx)
+		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len, reconnect);
+	else
+		cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);
+
+	drv_event_callback(sdata->local, sdata, &event);
+}
+
+static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
+{
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+	bool tx;
+
+	sdata_lock(sdata);
+	if (!ifmgd->associated) {
+		sdata_unlock(sdata);
+		return;
+	}
+
+	/* in MLO assume we have a link where we can TX the frame */
+	tx = sdata->vif.valid_links || !sdata->deflink.csa_block_tx;
+
+	if (!ifmgd->driver_disconnect) {
+		unsigned int link_id;
+
+		/*
+		 * AP is probably out of range (or not reachable for another
+		 * reason) so remove the bss structs for that AP. In the case
+		 * of multi-link, it's not clear that all of them really are
+		 * out of range, but if they weren't the driver likely would
+		 * have switched to just have a single link active?
+		 */
+		for (link_id = 0;
+		     link_id < ARRAY_SIZE(sdata->link);
+		     link_id++) {
+			struct ieee80211_link_data *link;
+
+			link = sdata_dereference(sdata->link[link_id], sdata);
+			if (!link)
+				continue;
+			cfg80211_unlink_bss(local->hw.wiphy, link->u.mgd.bss);
+			link->u.mgd.bss = NULL;
+		}
+	}
+
+	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
+			       ifmgd->driver_disconnect ?
+					WLAN_REASON_DEAUTH_LEAVING :
+					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
+			       tx, frame_buf);
+	mutex_lock(&local->mtx);
+	/* the other links will be destroyed */
+	sdata->vif.bss_conf.csa_active = false;
+	sdata->deflink.u.mgd.csa_waiting_bcn = false;
+	if (sdata->deflink.csa_block_tx) {
+		ieee80211_wake_vif_queues(local, sdata,
+					  IEEE80211_QUEUE_STOP_REASON_CSA);
+		sdata->deflink.csa_block_tx = false;
+	}
+	mutex_unlock(&local->mtx);
+
+	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
+				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
+				    ifmgd->reconnect);
+	ifmgd->reconnect = false;
+
+	sdata_unlock(sdata);
+}
+
+static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
+{
+	struct ieee80211_sub_if_data *sdata =
+		container_of(work, struct ieee80211_sub_if_data,
+			     u.mgd.beacon_connection_loss_work);
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+	if (ifmgd->connection_loss) {
+		sdata_info(sdata, "Connection to AP %pM lost\n",
+			   sdata->vif.cfg.ap_addr);
+		__ieee80211_disconnect(sdata);
+		ifmgd->connection_loss = false;
+	} else if (ifmgd->driver_disconnect) {
+		sdata_info(sdata,
+			   "Driver requested disconnection from AP %pM\n",
+			   sdata->vif.cfg.ap_addr);
+		__ieee80211_disconnect(sdata);
+		ifmgd->driver_disconnect = false;
+	} else {
+		if (ifmgd->associated)
+			sdata->deflink.u.mgd.beacon_loss_count++;
+		ieee80211_mgd_probe_ap(sdata, true);
+	}
+}
+
+static void ieee80211_csa_connection_drop_work(struct work_struct *work)
+{
+	struct ieee80211_sub_if_data *sdata =
+		container_of(work, struct ieee80211_sub_if_data,
+			     u.mgd.csa_connection_drop_work);
+
+	__ieee80211_disconnect(sdata);
+}
+
+void ieee80211_beacon_loss(struct ieee80211_vif *vif)
+{
+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+	struct ieee80211_hw *hw = &sdata->local->hw;
+
+	trace_api_beacon_loss(sdata);
+
+	sdata->u.mgd.connection_loss = false;
+	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
+}
+EXPORT_SYMBOL(ieee80211_beacon_loss);
+
+void ieee80211_connection_loss(struct ieee80211_vif *vif)
+{
+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+	struct ieee80211_hw *hw = &sdata->local->hw;
+
+	trace_api_connection_loss(sdata);
+
+	sdata->u.mgd.connection_loss = true;
+	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
+}
+EXPORT_SYMBOL(ieee80211_connection_loss);
+
+void ieee80211_disconnect(struct ieee80211_vif *vif, bool reconnect)
+{
+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+	struct ieee80211_hw *hw = &sdata->local->hw;
+
+	trace_api_disconnect(sdata, reconnect);
+
+	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
+		return;
+
+	sdata->u.mgd.driver_disconnect = true;
+	sdata->u.mgd.reconnect = reconnect;
+	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
+}
+EXPORT_SYMBOL(ieee80211_disconnect);
+
+static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
+					bool assoc)
+{
+	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
+
+	sdata_assert_lock(sdata);
+
+	if (!assoc) {
+		/*
+		 * we are not authenticated yet, the only timer that could be
+		 * running is the timeout for the authentication response which
+		 * which is not relevant anymore.
+		 */
+		del_timer_sync(&sdata->u.mgd.timer);
+		sta_info_destroy_addr(sdata, auth_data->ap_addr);
+
+		/* other links are destroyed */
+		sdata->deflink.u.mgd.conn_flags = 0;
+		eth_zero_addr(sdata->deflink.u.mgd.bssid);
+		ieee80211_link_info_change_notify(sdata, &sdata->deflink,
+						  BSS_CHANGED_BSSID);
+		sdata->u.mgd.flags = 0;
+
+		mutex_lock(&sdata->local->mtx);
+		ieee80211_link_release_channel(&sdata->deflink);
+		ieee80211_vif_set_links(sdata, 0);
+		mutex_unlock(&sdata->local->mtx);
+	}
+
+	cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
+	kfree(auth_data);
+	sdata->u.mgd.auth_data = NULL;
+}
+
+enum assoc_status {
+	ASSOC_SUCCESS,
+	ASSOC_REJECTED,
+	ASSOC_TIMEOUT,
+	ASSOC_ABANDON,
+};
+
+static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
+					 enum assoc_status status)
+{
+	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
+
+	sdata_assert_lock(sdata);
+
+	if (status != ASSOC_SUCCESS) {
+		/*
+		 * we are not associated yet, the only timer that could be
+		 * running is the timeout for the association response which
+		 * which is not relevant anymore.
+		 */
+		del_timer_sync(&sdata->u.mgd.timer);
+		sta_info_destroy_addr(sdata, assoc_data->ap_addr);
+
+		sdata->deflink.u.mgd.conn_flags = 0;
+		eth_zero_addr(sdata->deflink.u.mgd.bssid);
+		ieee80211_link_info_change_notify(sdata, &sdata->deflink,
+						  BSS_CHANGED_BSSID);
+		sdata->u.mgd.flags = 0;
+		sdata->vif.bss_conf.mu_mimo_owner = false;
+
+		if (status != ASSOC_REJECTED) {
+			struct cfg80211_assoc_failure data = {
+				.timeout = status == ASSOC_TIMEOUT,
+			};
+			int i;
+
+			BUILD_BUG_ON(ARRAY_SIZE(data.bss) !=
+				     ARRAY_SIZE(assoc_data->link));
+
+			for (i = 0; i < ARRAY_SIZE(data.bss); i++)
+				data.bss[i] = assoc_data->link[i].bss;
+
+			if (sdata->vif.valid_links)
+				data.ap_mld_addr = assoc_data->ap_addr;
+
+			cfg80211_assoc_failure(sdata->dev, &data);
+		}
+
+		mutex_lock(&sdata->local->mtx);
+		ieee80211_link_release_channel(&sdata->deflink);
+		ieee80211_vif_set_links(sdata, 0);
+		mutex_unlock(&sdata->local->mtx);
+	}
+
+	kfree(assoc_data);
+	sdata->u.mgd.assoc_data = NULL;
+}
+
+static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
+				     struct ieee80211_mgmt *mgmt, size_t len)
+{
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
+	const struct element *challenge;
+	u8 *pos;
+	u32 tx_flags = 0;
+	struct ieee80211_prep_tx_info info = {
+		.subtype = IEEE80211_STYPE_AUTH,
+	};
+
+	pos = mgmt->u.auth.variable;
+	challenge = cfg80211_find_elem(WLAN_EID_CHALLENGE, pos,
+				       len - (pos - (u8 *)mgmt));
+	if (!challenge)
+		return;
+	auth_data->expected_transaction = 4;
+	drv_mgd_prepare_tx(sdata->local, sdata, &info);
+	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
+		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
+			   IEEE80211_TX_INTFL_MLME_CONN_TX;
+	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
+			    (void *)challenge,
+			    challenge->datalen + sizeof(*challenge),
+			    auth_data->ap_addr, auth_data->ap_addr,
+			    auth_data->key, auth_data->key_len,
+			    auth_data->key_idx, tx_flags);
+}
+
+static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata)
+{
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	const u8 *ap_addr = ifmgd->auth_data->ap_addr;
+	struct sta_info *sta;
+	bool result = true;
+
+	sdata_info(sdata, "authenticated\n");
+	ifmgd->auth_data->done = true;
+	ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
+	ifmgd->auth_data->timeout_started = true;
+	run_again(sdata, ifmgd->auth_data->timeout);
+
+	/* move station state to auth */
+	mutex_lock(&sdata->local->sta_mtx);
+	sta = sta_info_get(sdata, ap_addr);
+	if (!sta) {
+		WARN_ONCE(1, "%s: STA %pM not found", sdata->name, ap_addr);
+		result = false;
+		goto out;
+	}
+	if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
+		sdata_info(sdata, "failed moving %pM to auth\n", ap_addr);
+		result = false;
+		goto out;
+	}
+
+out:
+	mutex_unlock(&sdata->local->sta_mtx);
+	return result;
+}
+
+static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
+				   struct ieee80211_mgmt *mgmt, size_t len)
+{
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	u16 auth_alg, auth_transaction, status_code;
+	struct ieee80211_event event = {
+		.type = MLME_EVENT,
+		.u.mlme.data = AUTH_EVENT,
+	};
+	struct ieee80211_prep_tx_info info = {
+		.subtype = IEEE80211_STYPE_AUTH,
+	};
+
+	sdata_assert_lock(sdata);
+
+	if (len < 24 + 6)
+		return;
+
+	if (!ifmgd->auth_data || ifmgd->auth_data->done)
+		return;
+
+	if (!ether_addr_equal(ifmgd->auth_data->ap_addr, mgmt->bssid))
+		return;
+
+	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
+	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
+	status_code = le16_to_cpu(mgmt->u.auth.status_code);
+
+	if (auth_alg != ifmgd->auth_data->algorithm ||
+	    (auth_alg != WLAN_AUTH_SAE &&
+	     auth_transaction != ifmgd->auth_data->expected_transaction) ||
+	    (auth_alg == WLAN_AUTH_SAE &&
+	     (auth_transaction < ifmgd->auth_data->expected_transaction ||
+	      auth_transaction > 2))) {
+		sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
+			   mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
+			   auth_transaction,
+			   ifmgd->auth_data->expected_transaction);
+		goto notify_driver;
+	}
+
+	if (status_code != WLAN_STATUS_SUCCESS) {
+		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
+
+		if (auth_alg == WLAN_AUTH_SAE &&
+		    (status_code == WLAN_STATUS_ANTI_CLOG_REQUIRED ||
+		     (auth_transaction == 1 &&
+		      (status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
+		       status_code == WLAN_STATUS_SAE_PK)))) {
+			/* waiting for userspace now */
+			ifmgd->auth_data->waiting = true;
+			ifmgd->auth_data->timeout =
+				jiffies + IEEE80211_AUTH_WAIT_SAE_RETRY;
+			ifmgd->auth_data->timeout_started = true;
+			run_again(sdata, ifmgd->auth_data->timeout);
+			goto notify_driver;
+		}
+
+		sdata_info(sdata, "%pM denied authentication (status %d)\n",
+			   mgmt->sa, status_code);
+		ieee80211_destroy_auth_data(sdata, false);
+		event.u.mlme.status = MLME_DENIED;
+		event.u.mlme.reason = status_code;
+		drv_event_callback(sdata->local, sdata, &event);
+		goto notify_driver;
+	}
+
+	switch (ifmgd->auth_data->algorithm) {
+	case WLAN_AUTH_OPEN:
+	case WLAN_AUTH_LEAP:
+	case WLAN_AUTH_FT:
+	case WLAN_AUTH_SAE:
+	case WLAN_AUTH_FILS_SK:
+	case WLAN_AUTH_FILS_SK_PFS:
+	case WLAN_AUTH_FILS_PK:
+		break;
+	case WLAN_AUTH_SHARED_KEY:
+		if (ifmgd->auth_data->expected_transaction != 4) {
+			ieee80211_auth_challenge(sdata, mgmt, len);
+			/* need another frame */
+			return;
+		}
+		break;
+	default:
+		WARN_ONCE(1, "invalid auth alg %d",
+			  ifmgd->auth_data->algorithm);
+		goto notify_driver;
+	}
+
+	event.u.mlme.status = MLME_SUCCESS;
+	info.success = 1;
+	drv_event_callback(sdata->local, sdata, &event);
+	if (ifmgd->auth_data->algorithm != WLAN_AUTH_SAE ||
+	    (auth_transaction == 2 &&
+	     ifmgd->auth_data->expected_transaction == 2)) {
+		if (!ieee80211_mark_sta_auth(sdata))
+			return; /* ignore frame -- wait for timeout */
+	} else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
+		   auth_transaction == 2) {
+		sdata_info(sdata, "SAE peer confirmed\n");
+		ifmgd->auth_data->peer_confirmed = true;
+	}
+
+	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
+notify_driver:
+	drv_mgd_complete_tx(sdata->local, sdata, &info);
+}
+
+#define case_WLAN(type) \
+	case WLAN_REASON_##type: return #type
+
+const char *ieee80211_get_reason_code_string(u16 reason_code)
+{
+	switch (reason_code) {
+	case_WLAN(UNSPECIFIED);
+	case_WLAN(PREV_AUTH_NOT_VALID);
+	case_WLAN(DEAUTH_LEAVING);
+	case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
+	case_WLAN(DISASSOC_AP_BUSY);
+	case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
+	case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
+	case_WLAN(DISASSOC_STA_HAS_LEFT);
+	case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
+	case_WLAN(DISASSOC_BAD_POWER);
+	case_WLAN(DISASSOC_BAD_SUPP_CHAN);
+	case_WLAN(INVALID_IE);
+	case_WLAN(MIC_FAILURE);
+	case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
+	case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
+	case_WLAN(IE_DIFFERENT);
+	case_WLAN(INVALID_GROUP_CIPHER);
+	case_WLAN(INVALID_PAIRWISE_CIPHER);
+	case_WLAN(INVALID_AKMP);
+	case_WLAN(UNSUPP_RSN_VERSION);
+	case_WLAN(INVALID_RSN_IE_CAP);
+	case_WLAN(IEEE8021X_FAILED);
+	case_WLAN(CIPHER_SUITE_REJECTED);
+	case_WLAN(DISASSOC_UNSPECIFIED_QOS);
+	case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
+	case_WLAN(DISASSOC_LOW_ACK);
+	case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
+	case_WLAN(QSTA_LEAVE_QBSS);
+	case_WLAN(QSTA_NOT_USE);
+	case_WLAN(QSTA_REQUIRE_SETUP);
+	case_WLAN(QSTA_TIMEOUT);
+	case_WLAN(QSTA_CIPHER_NOT_SUPP);
+	case_WLAN(MESH_PEER_CANCELED);
+	case_WLAN(MESH_MAX_PEERS);
+	case_WLAN(MESH_CONFIG);
+	case_WLAN(MESH_CLOSE);
+	case_WLAN(MESH_MAX_RETRIES);
+	case_WLAN(MESH_CONFIRM_TIMEOUT);
+	case_WLAN(MESH_INVALID_GTK);
+	case_WLAN(MESH_INCONSISTENT_PARAM);
+	case_WLAN(MESH_INVALID_SECURITY);
+	case_WLAN(MESH_PATH_ERROR);
+	case_WLAN(MESH_PATH_NOFORWARD);
+	case_WLAN(MESH_PATH_DEST_UNREACHABLE);
+	case_WLAN(MAC_EXISTS_IN_MBSS);
+	case_WLAN(MESH_CHAN_REGULATORY);
+	case_WLAN(MESH_CHAN);
+	default: return "<unknown>";
+	}
+}
+
+static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
+				     struct ieee80211_mgmt *mgmt, size_t len)
+{
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
+
+	sdata_assert_lock(sdata);
+
+	if (len < 24 + 2)
+		return;
+
+	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
+		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
+		return;
+	}
+
+	if (ifmgd->associated &&
+	    ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)) {
+		sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
+			   sdata->vif.cfg.ap_addr, reason_code,
+			   ieee80211_get_reason_code_string(reason_code));
+
+		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
+
+		ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
+					    reason_code, false);
+		return;
+	}
+
+	if (ifmgd->assoc_data &&
+	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->ap_addr)) {
+		sdata_info(sdata,
+			   "deauthenticated from %pM while associating (Reason: %u=%s)\n",
+			   ifmgd->assoc_data->ap_addr, reason_code,
+			   ieee80211_get_reason_code_string(reason_code));
+
+		ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
+
+		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
+		return;
+	}
+}
+
+
+static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
+				       struct ieee80211_mgmt *mgmt, size_t len)
+{
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	u16 reason_code;
+
+	sdata_assert_lock(sdata);
+
+	if (len < 24 + 2)
+		return;
+
+	if (!ifmgd->associated ||
+	    !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr))
+		return;
+
+	reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
+
+	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
+		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
+		return;
+	}
+
+	sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
+		   sdata->vif.cfg.ap_addr, reason_code,
+		   ieee80211_get_reason_code_string(reason_code));
+
+	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
+
+	ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code,
+				    false);
+}
+
+static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
+				u8 *supp_rates, unsigned int supp_rates_len,
+				u32 *rates, u32 *basic_rates,
+				bool *have_higher_than_11mbit,
+				int *min_rate, int *min_rate_index,
+				int shift)
+{
+	int i, j;
+
+	for (i = 0; i < supp_rates_len; i++) {
+		int rate = supp_rates[i] & 0x7f;
+		bool is_basic = !!(supp_rates[i] & 0x80);
+
+		if ((rate * 5 * (1 << shift)) > 110)
+			*have_higher_than_11mbit = true;
+
+		/*
+		 * Skip HT, VHT, HE and SAE H2E only BSS membership selectors
+		 * since they're not rates.
+		 *
+		 * Note: Even though the membership selector and the basic
+		 *	 rate flag share the same bit, they are not exactly
+		 *	 the same.
+		 */
+		if (supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY) ||
+		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY) ||
+		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HE_PHY) ||
+		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_SAE_H2E))
+			continue;
+
+		for (j = 0; j < sband->n_bitrates; j++) {
+			struct ieee80211_rate *br;
+			int brate;
+
+			br = &sband->bitrates[j];
+
+			brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
+			if (brate == rate) {
+				*rates |= BIT(j);
+				if (is_basic)
+					*basic_rates |= BIT(j);
+				if ((rate * 5) < *min_rate) {
+					*min_rate = rate * 5;
+					*min_rate_index = j;
+				}
+				break;
+			}
+		}
+	}
+}
+
+static bool ieee80211_twt_req_supported(struct ieee80211_sub_if_data *sdata,
+					struct ieee80211_supported_band *sband,
+					const struct link_sta_info *link_sta,
+					const struct ieee802_11_elems *elems)
+{
+	const struct ieee80211_sta_he_cap *own_he_cap =
+		ieee80211_get_he_iftype_cap(sband,
+					    ieee80211_vif_type_p2p(&sdata->vif));
+
+	if (elems->ext_capab_len < 10)
+		return false;
+
+	if (!(elems->ext_capab[9] & WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT))
+		return false;
+
+	return link_sta->pub->he_cap.he_cap_elem.mac_cap_info[0] &
+		IEEE80211_HE_MAC_CAP0_TWT_RES &&
+		own_he_cap &&
+		(own_he_cap->he_cap_elem.mac_cap_info[0] &
+			IEEE80211_HE_MAC_CAP0_TWT_REQ);
+}
+
+static int ieee80211_recalc_twt_req(struct ieee80211_sub_if_data *sdata,
+				    struct ieee80211_supported_band *sband,
+				    struct ieee80211_link_data *link,
+				    struct link_sta_info *link_sta,
+				    struct ieee802_11_elems *elems)
+{
+	bool twt = ieee80211_twt_req_supported(sdata, sband, link_sta, elems);
+
+	if (link->conf->twt_requester != twt) {
+		link->conf->twt_requester = twt;
+		return BSS_CHANGED_TWT;
+	}
+	return 0;
+}
+
+static bool ieee80211_twt_bcast_support(struct ieee80211_sub_if_data *sdata,
+					struct ieee80211_bss_conf *bss_conf,
+					struct ieee80211_supported_band *sband,
+					struct link_sta_info *link_sta)
+{
+	const struct ieee80211_sta_he_cap *own_he_cap =
+		ieee80211_get_he_iftype_cap(sband,
+					    ieee80211_vif_type_p2p(&sdata->vif));
+
+	return bss_conf->he_support &&
+		(link_sta->pub->he_cap.he_cap_elem.mac_cap_info[2] &
+			IEEE80211_HE_MAC_CAP2_BCAST_TWT) &&
+		own_he_cap &&
+		(own_he_cap->he_cap_elem.mac_cap_info[2] &
+			IEEE80211_HE_MAC_CAP2_BCAST_TWT);
+}
+
+static bool ieee80211_assoc_config_link(struct ieee80211_link_data *link,
+					struct link_sta_info *link_sta,
+					struct cfg80211_bss *cbss,
+					struct ieee80211_mgmt *mgmt,
+					const u8 *elem_start,
+					unsigned int elem_len,
+					u64 *changed)
+{
+	struct ieee80211_sub_if_data *sdata = link->sdata;
+	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
+	struct ieee80211_bss_conf *bss_conf = link->conf;
+	struct ieee80211_local *local = sdata->local;
+	unsigned int link_id = link->link_id;
+	struct ieee80211_elems_parse_params parse_params = {
+		.start = elem_start,
+		.len = elem_len,
+		.link_id = link_id == assoc_data->assoc_link_id ? -1 : link_id,
+		.from_ap = true,
+	};
+	bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
+	bool is_s1g = cbss->channel->band == NL80211_BAND_S1GHZ;
+	const struct cfg80211_bss_ies *bss_ies = NULL;
+	struct ieee80211_supported_band *sband;
+	struct ieee802_11_elems *elems;
+	u16 capab_info;
+	bool ret;
+
+	elems = ieee802_11_parse_elems_full(&parse_params);
+	if (!elems)
+		return false;
+
+	if (link_id == assoc_data->assoc_link_id) {
+		capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
+
+		/*
+		 * we should not get to this flow unless the association was
+		 * successful, so set the status directly to success
+		 */
+		assoc_data->link[link_id].status = WLAN_STATUS_SUCCESS;
+	} else if (!elems->prof) {
+		ret = false;
+		goto out;
+	} else {
+		const u8 *ptr = elems->prof->variable +
+				elems->prof->sta_info_len - 1;
+
+		/*
+		 * During parsing, we validated that these fields exist,
+		 * otherwise elems->prof would have been set to NULL.
+		 */
+		capab_info = get_unaligned_le16(ptr);
+		assoc_data->link[link_id].status = get_unaligned_le16(ptr + 2);
+
+		if (assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) {
+			link_info(link, "association response status code=%u\n",
+				  assoc_data->link[link_id].status);
+			ret = true;
+			goto out;
+		}
+	}
+
+	if (!is_s1g && !elems->supp_rates) {
+		sdata_info(sdata, "no SuppRates element in AssocResp\n");
+		ret = false;
+		goto out;
+	}
+
+	link->u.mgd.tdls_chan_switch_prohibited =
+		elems->ext_capab && elems->ext_capab_len >= 5 &&
+		(elems->ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
+
+	/*
+	 * Some APs are erroneously not including some information in their
+	 * (re)association response frames. Try to recover by using the data
+	 * from the beacon or probe response. This seems to afflict mobile
+	 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
+	 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
+	 */
+	if (!is_6ghz &&
+	    ((assoc_data->wmm && !elems->wmm_param) ||
+	     (!(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT) &&
+	      (!elems->ht_cap_elem || !elems->ht_operation)) ||
+	     (!(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT) &&
+	      (!elems->vht_cap_elem || !elems->vht_operation)))) {
+		const struct cfg80211_bss_ies *ies;
+		struct ieee802_11_elems *bss_elems;
+
+		rcu_read_lock();
+		ies = rcu_dereference(cbss->ies);
+		if (ies)
+			bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
+					  GFP_ATOMIC);
+		rcu_read_unlock();
+		if (!bss_ies) {
+			ret = false;
+			goto out;
+		}
+
+		parse_params.start = bss_ies->data;
+		parse_params.len = bss_ies->len;
+		parse_params.bss = cbss;
+		bss_elems = ieee802_11_parse_elems_full(&parse_params);
+		if (!bss_elems) {
+			ret = false;
+			goto out;
+		}
+
+		if (assoc_data->wmm &&
+		    !elems->wmm_param && bss_elems->wmm_param) {
+			elems->wmm_param = bss_elems->wmm_param;
+			sdata_info(sdata,
+				   "AP bug: WMM param missing from AssocResp\n");
+		}
+
+		/*
+		 * Also check if we requested HT/VHT, otherwise the AP doesn't
+		 * have to include the IEs in the (re)association response.
+		 */
+		if (!elems->ht_cap_elem && bss_elems->ht_cap_elem &&
+		    !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT)) {
+			elems->ht_cap_elem = bss_elems->ht_cap_elem;
+			sdata_info(sdata,
+				   "AP bug: HT capability missing from AssocResp\n");
+		}
+		if (!elems->ht_operation && bss_elems->ht_operation &&
+		    !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT)) {
+			elems->ht_operation = bss_elems->ht_operation;
+			sdata_info(sdata,
+				   "AP bug: HT operation missing from AssocResp\n");
+		}
+		if (!elems->vht_cap_elem && bss_elems->vht_cap_elem &&
+		    !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)) {
+			elems->vht_cap_elem = bss_elems->vht_cap_elem;
+			sdata_info(sdata,
+				   "AP bug: VHT capa missing from AssocResp\n");
+		}
+		if (!elems->vht_operation && bss_elems->vht_operation &&
+		    !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)) {
+			elems->vht_operation = bss_elems->vht_operation;
+			sdata_info(sdata,
+				   "AP bug: VHT operation missing from AssocResp\n");
+		}
+
+		kfree(bss_elems);
+	}
+
+	/*
+	 * We previously checked these in the beacon/probe response, so
+	 * they should be present here. This is just a safety net.
+	 */
+	if (!is_6ghz && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT) &&
+	    (!elems->wmm_param || !elems->ht_cap_elem || !elems->ht_operation)) {
+		sdata_info(sdata,
+			   "HT AP is missing WMM params or HT capability/operation\n");
+		ret = false;
+		goto out;
+	}
+
+	if (!is_6ghz && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT) &&
+	    (!elems->vht_cap_elem || !elems->vht_operation)) {
+		sdata_info(sdata,
+			   "VHT AP is missing VHT capability/operation\n");
+		ret = false;
+		goto out;
+	}
+
+	if (is_6ghz && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
+	    !elems->he_6ghz_capa) {
+		sdata_info(sdata,
+			   "HE 6 GHz AP is missing HE 6 GHz band capability\n");
+		ret = false;
+		goto out;
+	}
+
+	if (WARN_ON(!link->conf->chandef.chan)) {
+		ret = false;
+		goto out;
+	}
+	sband = local->hw.wiphy->bands[link->conf->chandef.chan->band];
+
+	if (!(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
+	    (!elems->he_cap || !elems->he_operation)) {
+		sdata_info(sdata,
+			   "HE AP is missing HE capability/operation\n");
+		ret = false;
+		goto out;
+	}
+
+	/* Set up internal HT/VHT capabilities */
+	if (elems->ht_cap_elem && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT))
+		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
+						  elems->ht_cap_elem,
+						  link_sta);
+
+	if (elems->vht_cap_elem && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT))
+		ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
+						    elems->vht_cap_elem,
+						    link_sta);
+
+	if (elems->he_operation && !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE) &&
+	    elems->he_cap) {
+		ieee80211_he_cap_ie_to_sta_he_cap(sdata, sband,
+						  elems->he_cap,
+						  elems->he_cap_len,
+						  elems->he_6ghz_capa,
+						  link_sta);
+
+		bss_conf->he_support = link_sta->pub->he_cap.has_he;
+		if (elems->rsnx && elems->rsnx_len &&
+		    (elems->rsnx[0] & WLAN_RSNX_CAPA_PROTECTED_TWT) &&
+		    wiphy_ext_feature_isset(local->hw.wiphy,
+					    NL80211_EXT_FEATURE_PROTECTED_TWT))
+			bss_conf->twt_protected = true;
+		else
+			bss_conf->twt_protected = false;
+
+		*changed |= ieee80211_recalc_twt_req(sdata, sband, link,
+						     link_sta, elems);
+
+		if (elems->eht_operation && elems->eht_cap &&
+		    !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_EHT)) {
+			ieee80211_eht_cap_ie_to_sta_eht_cap(sdata, sband,
+							    elems->he_cap,
+							    elems->he_cap_len,
+							    elems->eht_cap,
+							    elems->eht_cap_len,
+							    link_sta);
+
+			bss_conf->eht_support = link_sta->pub->eht_cap.has_eht;
+			*changed |= BSS_CHANGED_EHT_PUNCTURING;
+		} else {
+			bss_conf->eht_support = false;
+		}
+	} else {
+		bss_conf->he_support = false;
+		bss_conf->twt_requester = false;
+		bss_conf->twt_protected = false;
+		bss_conf->eht_support = false;
+	}
+
+	bss_conf->twt_broadcast =
+		ieee80211_twt_bcast_support(sdata, bss_conf, sband, link_sta);
+
+	if (bss_conf->he_support) {
+		bss_conf->he_bss_color.color =
+			le32_get_bits(elems->he_operation->he_oper_params,
+				      IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
+		bss_conf->he_bss_color.partial =
+			le32_get_bits(elems->he_operation->he_oper_params,
+				      IEEE80211_HE_OPERATION_PARTIAL_BSS_COLOR);
+		bss_conf->he_bss_color.enabled =
+			!le32_get_bits(elems->he_operation->he_oper_params,
+				       IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED);
+
+		if (bss_conf->he_bss_color.enabled)
+			*changed |= BSS_CHANGED_HE_BSS_COLOR;
+
+		bss_conf->htc_trig_based_pkt_ext =
+			le32_get_bits(elems->he_operation->he_oper_params,
+				      IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK);
+		bss_conf->frame_time_rts_th =
+			le32_get_bits(elems->he_operation->he_oper_params,
+				      IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
+
+		bss_conf->uora_exists = !!elems->uora_element;
+		if (elems->uora_element)
+			bss_conf->uora_ocw_range = elems->uora_element[0];
+
+		ieee80211_he_op_ie_to_bss_conf(&sdata->vif, elems->he_operation);
+		ieee80211_he_spr_ie_to_bss_conf(&sdata->vif, elems->he_spr);
+		/* TODO: OPEN: what happens if BSS color disable is set? */
+	}
+
+	if (cbss->transmitted_bss) {
+		bss_conf->nontransmitted = true;
+		ether_addr_copy(bss_conf->transmitter_bssid,
+				cbss->transmitted_bss->bssid);
+		bss_conf->bssid_indicator = cbss->max_bssid_indicator;
+		bss_conf->bssid_index = cbss->bssid_index;
+	}
+
+	/*
+	 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
+	 * in their association response, so ignore that data for our own
+	 * configuration. If it changed since the last beacon, we'll get the
+	 * next beacon and update then.
+	 */
+
+	/*
+	 * If an operating mode notification IE is present, override the
+	 * NSS calculation (that would be done in rate_control_rate_init())
+	 * and use the # of streams from that element.
+	 */
+	if (elems->opmode_notif &&
+	    !(*elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
+		u8 nss;
+
+		nss = *elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
+		nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
+		nss += 1;
+		link_sta->pub->rx_nss = nss;
+	}
+
+	/*
+	 * Always handle WMM once after association regardless
+	 * of the first value the AP uses. Setting -1 here has
+	 * that effect because the AP values is an unsigned
+	 * 4-bit value.
+	 */
+	link->u.mgd.wmm_last_param_set = -1;
+	link->u.mgd.mu_edca_last_param_set = -1;
+
+	if (link->u.mgd.disable_wmm_tracking) {
+		ieee80211_set_wmm_default(link, false, false);
+	} else if (!ieee80211_sta_wmm_params(local, link, elems->wmm_param,
+					     elems->wmm_param_len,
+					     elems->mu_edca_param_set)) {
+		/* still enable QoS since we might have HT/VHT */
+		ieee80211_set_wmm_default(link, false, true);
+		/* disable WMM tracking in this case to disable
+		 * tracking WMM parameter changes in the beacon if
+		 * the parameters weren't actually valid. Doing so
+		 * avoids changing parameters very strangely when
+		 * the AP is going back and forth between valid and
+		 * invalid parameters.
+		 */
+		link->u.mgd.disable_wmm_tracking = true;
+	}
+
+	if (elems->max_idle_period_ie) {
+		bss_conf->max_idle_period =
+			le16_to_cpu(elems->max_idle_period_ie->max_idle_period);
+		bss_conf->protected_keep_alive =
+			!!(elems->max_idle_period_ie->idle_options &
+			   WLAN_IDLE_OPTIONS_PROTECTED_KEEP_ALIVE);
+		*changed |= BSS_CHANGED_KEEP_ALIVE;
+	} else {
+		bss_conf->max_idle_period = 0;
+		bss_conf->protected_keep_alive = false;
+	}
+
+	/* set assoc capability (AID was already set earlier),
+	 * ieee80211_set_associated() will tell the driver */
+	bss_conf->assoc_capability = capab_info;
+
+	ret = true;
+out:
+	kfree(elems);
+	kfree(bss_ies);
+	return ret;
+}
+
+static int ieee80211_mgd_setup_link_sta(struct ieee80211_link_data *link,
+					struct sta_info *sta,
+					struct link_sta_info *link_sta,
+					struct cfg80211_bss *cbss)
+{
+	struct ieee80211_sub_if_data *sdata = link->sdata;
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_bss *bss = (void *)cbss->priv;
+	u32 rates = 0, basic_rates = 0;
+	bool have_higher_than_11mbit = false;
+	int min_rate = INT_MAX, min_rate_index = -1;
+	/* this is clearly wrong for MLO but we'll just remove it later */
+	int shift = ieee80211_vif_get_shift(&sdata->vif);
+	struct ieee80211_supported_band *sband;
+
+	memcpy(link_sta->addr, cbss->bssid, ETH_ALEN);
+	memcpy(link_sta->pub->addr, cbss->bssid, ETH_ALEN);
+
+	/* TODO: S1G Basic Rate Set is expressed elsewhere */
+	if (cbss->channel->band == NL80211_BAND_S1GHZ) {
+		ieee80211_s1g_sta_rate_init(sta);
+		return 0;
+	}
+
+	sband = local->hw.wiphy->bands[cbss->channel->band];
+
+	ieee80211_get_rates(sband, bss->supp_rates, bss->supp_rates_len,
+			    &rates, &basic_rates, &have_higher_than_11mbit,
+			    &min_rate, &min_rate_index, shift);
+
+	/*
+	 * This used to be a workaround for basic rates missing
+	 * in the association response frame. Now that we no
+	 * longer use the basic rates from there, it probably
+	 * doesn't happen any more, but keep the workaround so
+	 * in case some *other* APs are buggy in different ways
+	 * we can connect -- with a warning.
+	 * Allow this workaround only in case the AP provided at least
+	 * one rate.
+	 */
+	if (min_rate_index < 0) {
+		link_info(link, "No legacy rates in association response\n");
+		return -EINVAL;
+	} else if (!basic_rates) {
+		link_info(link, "No basic rates, using min rate instead\n");
+		basic_rates = BIT(min_rate_index);
+	}
+
+	if (rates)
+		link_sta->pub->supp_rates[cbss->channel->band] = rates;
+	else
+		link_info(link, "No rates found, keeping mandatory only\n");
+
+	link->conf->basic_rates = basic_rates;
+
+	/* cf. IEEE 802.11 9.2.12 */
+	link->operating_11g_mode = sband->band == NL80211_BAND_2GHZ &&
+				   have_higher_than_11mbit;
+
+	return 0;
+}
+
+static u8 ieee80211_max_rx_chains(struct ieee80211_link_data *link,
+				  struct cfg80211_bss *cbss)
+{
+	struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp;
+	const struct element *ht_cap_elem, *vht_cap_elem;
+	const struct cfg80211_bss_ies *ies;
+	const struct ieee80211_ht_cap *ht_cap;
+	const struct ieee80211_vht_cap *vht_cap;
+	const struct ieee80211_he_cap_elem *he_cap;
+	const struct element *he_cap_elem;
+	u16 mcs_80_map, mcs_160_map;
+	int i, mcs_nss_size;
+	bool support_160;
+	u8 chains = 1;
+
+	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT)
+		return chains;
+
+	ht_cap_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_HT_CAPABILITY);
+	if (ht_cap_elem && ht_cap_elem->datalen >= sizeof(*ht_cap)) {
+		ht_cap = (void *)ht_cap_elem->data;
+		chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
+		/*
+		 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
+		 *	 "Tx Unequal Modulation Supported" fields.
+		 */
+	}
+
+	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_VHT)
+		return chains;
+
+	vht_cap_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_VHT_CAPABILITY);
+	if (vht_cap_elem && vht_cap_elem->datalen >= sizeof(*vht_cap)) {
+		u8 nss;
+		u16 tx_mcs_map;
+
+		vht_cap = (void *)vht_cap_elem->data;
+		tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
+		for (nss = 8; nss > 0; nss--) {
+			if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
+					IEEE80211_VHT_MCS_NOT_SUPPORTED)
+				break;
+		}
+		/* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
+		chains = max(chains, nss);
+	}
+
+	if (link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HE)
+		return chains;
+
+	ies = rcu_dereference(cbss->ies);
+	he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
+					     ies->data, ies->len);
+
+	if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap))
+		return chains;
+
+	/* skip one byte ext_tag_id */
+	he_cap = (void *)(he_cap_elem->data + 1);
+	mcs_nss_size = ieee80211_he_mcs_nss_size(he_cap);
+
+	/* invalid HE IE */
+	if (he_cap_elem->datalen < 1 + mcs_nss_size + sizeof(*he_cap))
+		return chains;
+
+	/* mcs_nss is right after he_cap info */
+	he_mcs_nss_supp = (void *)(he_cap + 1);
+
+	mcs_80_map = le16_to_cpu(he_mcs_nss_supp->tx_mcs_80);
+
+	for (i = 7; i >= 0; i--) {
+		u8 mcs_80 = mcs_80_map >> (2 * i) & 3;
+
+		if (mcs_80 != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
+			chains = max_t(u8, chains, i + 1);
+			break;
+		}
+	}
+
+	support_160 = he_cap->phy_cap_info[0] &
+		      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
+
+	if (!support_160)
+		return chains;
+
+	mcs_160_map = le16_to_cpu(he_mcs_nss_supp->tx_mcs_160);
+	for (i = 7; i >= 0; i--) {
+		u8 mcs_160 = mcs_160_map >> (2 * i) & 3;
+
+		if (mcs_160 != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
+			chains = max_t(u8, chains, i + 1);
+			break;
+		}
+	}
+
+	return chains;
+}
+
+static bool
+ieee80211_verify_peer_he_mcs_support(struct ieee80211_sub_if_data *sdata,
+				     const struct cfg80211_bss_ies *ies,
+				     const struct ieee80211_he_operation *he_op)
+{
+	const struct element *he_cap_elem;
+	const struct ieee80211_he_cap_elem *he_cap;
+	struct ieee80211_he_mcs_nss_supp *he_mcs_nss_supp;
+	u16 mcs_80_map_tx, mcs_80_map_rx;
+	u16 ap_min_req_set;
+	int mcs_nss_size;
+	int nss;
+
+	he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
+					     ies->data, ies->len);
+
+	if (!he_cap_elem)
+		return false;
+
+	/* invalid HE IE */
+	if (he_cap_elem->datalen < 1 + sizeof(*he_cap)) {
+		sdata_info(sdata,
+			   "Invalid HE elem, Disable HE\n");
+		return false;
+	}
+
+	/* skip one byte ext_tag_id */
+	he_cap = (void *)(he_cap_elem->data + 1);
+	mcs_nss_size = ieee80211_he_mcs_nss_size(he_cap);
+
+	/* invalid HE IE */
+	if (he_cap_elem->datalen < 1 + sizeof(*he_cap) + mcs_nss_size) {
+		sdata_info(sdata,
+			   "Invalid HE elem with nss size, Disable HE\n");
+		return false;
+	}
+
+	/* mcs_nss is right after he_cap info */
+	he_mcs_nss_supp = (void *)(he_cap + 1);
+
+	mcs_80_map_tx = le16_to_cpu(he_mcs_nss_supp->tx_mcs_80);
+	mcs_80_map_rx = le16_to_cpu(he_mcs_nss_supp->rx_mcs_80);
+
+	/* P802.11-REVme/D0.3
+	 * 27.1.1 Introduction to the HE PHY
+	 * ...
+	 * An HE STA shall support the following features:
+	 * ...
+	 * Single spatial stream HE-MCSs 0 to 7 (transmit and receive) in all
+	 * supported channel widths for HE SU PPDUs
+	 */
+	if ((mcs_80_map_tx & 0x3) == IEEE80211_HE_MCS_NOT_SUPPORTED ||
+	    (mcs_80_map_rx & 0x3) == IEEE80211_HE_MCS_NOT_SUPPORTED) {
+		sdata_info(sdata,
+			   "Missing mandatory rates for 1 Nss, rx 0x%x, tx 0x%x, disable HE\n",
+			   mcs_80_map_tx, mcs_80_map_rx);
+		return false;
+	}
+
+	if (!he_op)
+		return true;
+
+	ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);
+
+	/*
+	 * Apparently iPhone 13 (at least iOS version 15.3.1) sets this to all
+	 * zeroes, which is nonsense, and completely inconsistent with itself
+	 * (it doesn't have 8 streams). Accept the settings in this case anyway.
+	 */
+	if (!ap_min_req_set)
+		return true;
+
+	/* make sure the AP is consistent with itself
+	 *
+	 * P802.11-REVme/D0.3
+	 * 26.17.1 Basic HE BSS operation
+	 *
+	 * A STA that is operating in an HE BSS shall be able to receive and
+	 * transmit at each of the <HE-MCS, NSS> tuple values indicated by the
+	 * Basic HE-MCS And NSS Set field of the HE Operation parameter of the
+	 * MLME-START.request primitive and shall be able to receive at each of
+	 * the <HE-MCS, NSS> tuple values indicated by the Supported HE-MCS and
+	 * NSS Set field in the HE Capabilities parameter of the MLMESTART.request
+	 * primitive
+	 */
+	for (nss = 8; nss > 0; nss--) {
+		u8 ap_op_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;
+		u8 ap_rx_val;
+		u8 ap_tx_val;
+
+		if (ap_op_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
+			continue;
+
+		ap_rx_val = (mcs_80_map_rx >> (2 * (nss - 1))) & 3;
+		ap_tx_val = (mcs_80_map_tx >> (2 * (nss - 1))) & 3;
+
+		if (ap_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
+		    ap_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
+		    ap_rx_val < ap_op_val || ap_tx_val < ap_op_val) {
+			sdata_info(sdata,
+				   "Invalid rates for %d Nss, rx %d, tx %d oper %d, disable HE\n",
+				   nss, ap_rx_val, ap_rx_val, ap_op_val);
+			return false;
+		}
+	}
+
+	return true;
+}
+
+static bool
+ieee80211_verify_sta_he_mcs_support(struct ieee80211_sub_if_data *sdata,
+				    struct ieee80211_supported_band *sband,
+				    const struct ieee80211_he_operation *he_op)
+{
+	const struct ieee80211_sta_he_cap *sta_he_cap =
+		ieee80211_get_he_iftype_cap(sband,
+					    ieee80211_vif_type_p2p(&sdata->vif));
+	u16 ap_min_req_set;
+	int i;
+
+	if (!sta_he_cap || !he_op)
+		return false;
+
+	ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);
+
+	/*
+	 * Apparently iPhone 13 (at least iOS version 15.3.1) sets this to all
+	 * zeroes, which is nonsense, and completely inconsistent with itself
+	 * (it doesn't have 8 streams). Accept the settings in this case anyway.
+	 */
+	if (!ap_min_req_set)
+		return true;
+
+	/* Need to go over for 80MHz, 160MHz and for 80+80 */
+	for (i = 0; i < 3; i++) {
+		const struct ieee80211_he_mcs_nss_supp *sta_mcs_nss_supp =
+			&sta_he_cap->he_mcs_nss_supp;
+		u16 sta_mcs_map_rx =
+			le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i]);
+		u16 sta_mcs_map_tx =
+			le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i + 1]);
+		u8 nss;
+		bool verified = true;
+
+		/*
+		 * For each band there is a maximum of 8 spatial streams
+		 * possible. Each of the sta_mcs_map_* is a 16-bit struct built
+		 * of 2 bits per NSS (1-8), with the values defined in enum
+		 * ieee80211_he_mcs_support. Need to make sure STA TX and RX
+		 * capabilities aren't less than the AP's minimum requirements
+		 * for this HE BSS per SS.
+		 * It is enough to find one such band that meets the reqs.
+		 */
+		for (nss = 8; nss > 0; nss--) {
+			u8 sta_rx_val = (sta_mcs_map_rx >> (2 * (nss - 1))) & 3;
+			u8 sta_tx_val = (sta_mcs_map_tx >> (2 * (nss - 1))) & 3;
+			u8 ap_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;
+
+			if (ap_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
+				continue;
+
+			/*
+			 * Make sure the HE AP doesn't require MCSs that aren't
+			 * supported by the client as required by spec
+			 *
+			 * P802.11-REVme/D0.3
+			 * 26.17.1 Basic HE BSS operation
+			 *
+			 * An HE STA shall not attempt to join * (MLME-JOIN.request primitive)
+			 * a BSS, unless it supports (i.e., is able to both transmit and
+			 * receive using) all of the <HE-MCS, NSS> tuples in the basic
+			 * HE-MCS and NSS set.
+			 */
+			if (sta_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
+			    sta_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
+			    (ap_val > sta_rx_val) || (ap_val > sta_tx_val)) {
+				verified = false;
+				break;
+			}
+		}
+
+		if (verified)
+			return true;
+	}
+
+	/* If here, STA doesn't meet AP's HE min requirements */
+	return false;
+}
+
+static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
+				  struct ieee80211_link_data *link,
+				  struct cfg80211_bss *cbss,
+				  ieee80211_conn_flags_t *conn_flags)
+{
+	struct ieee80211_local *local = sdata->local;
+	const struct ieee80211_ht_cap *ht_cap = NULL;
+	const struct ieee80211_ht_operation *ht_oper = NULL;
+	const struct ieee80211_vht_operation *vht_oper = NULL;
+	const struct ieee80211_he_operation *he_oper = NULL;
+	const struct ieee80211_eht_operation *eht_oper = NULL;
+	const struct ieee80211_s1g_oper_ie *s1g_oper = NULL;
+	struct ieee80211_supported_band *sband;
+	struct cfg80211_chan_def chandef;
+	bool is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
+	bool is_5ghz = cbss->channel->band == NL80211_BAND_5GHZ;
+	struct ieee80211_bss *bss = (void *)cbss->priv;
+	struct ieee80211_elems_parse_params parse_params = {
+		.bss = cbss,
+		.link_id = -1,
+		.from_ap = true,
+	};
+	struct ieee802_11_elems *elems;
+	const struct cfg80211_bss_ies *ies;
+	int ret;
+	u32 i;
+	bool have_80mhz;
+
+	rcu_read_lock();
+
+	ies = rcu_dereference(cbss->ies);
+	parse_params.start = ies->data;
+	parse_params.len = ies->len;
+	elems = ieee802_11_parse_elems_full(&parse_params);
+	if (!elems) {
+		rcu_read_unlock();
+		return -ENOMEM;
+	}
+
+	sband = local->hw.wiphy->bands[cbss->channel->band];
+
+	*conn_flags &= ~(IEEE80211_CONN_DISABLE_40MHZ |
+			 IEEE80211_CONN_DISABLE_80P80MHZ |
+			 IEEE80211_CONN_DISABLE_160MHZ);
+
+	/* disable HT/VHT/HE if we don't support them */
+	if (!sband->ht_cap.ht_supported && !is_6ghz) {
+		mlme_dbg(sdata, "HT not supported, disabling HT/VHT/HE/EHT\n");
+		*conn_flags |= IEEE80211_CONN_DISABLE_HT;
+		*conn_flags |= IEEE80211_CONN_DISABLE_VHT;
+		*conn_flags |= IEEE80211_CONN_DISABLE_HE;
+		*conn_flags |= IEEE80211_CONN_DISABLE_EHT;
+	}
+
+	if (!sband->vht_cap.vht_supported && is_5ghz) {
+		mlme_dbg(sdata, "VHT not supported, disabling VHT/HE/EHT\n");
+		*conn_flags |= IEEE80211_CONN_DISABLE_VHT;
+		*conn_flags |= IEEE80211_CONN_DISABLE_HE;
+		*conn_flags |= IEEE80211_CONN_DISABLE_EHT;
+	}
+
+	if (!ieee80211_get_he_iftype_cap(sband,
+					 ieee80211_vif_type_p2p(&sdata->vif))) {
+		mlme_dbg(sdata, "HE not supported, disabling HE and EHT\n");
+		*conn_flags |= IEEE80211_CONN_DISABLE_HE;
+		*conn_flags |= IEEE80211_CONN_DISABLE_EHT;
+	}
+
+	if (!ieee80211_get_eht_iftype_cap(sband,
+					  ieee80211_vif_type_p2p(&sdata->vif))) {
+		mlme_dbg(sdata, "EHT not supported, disabling EHT\n");
+		*conn_flags |= IEEE80211_CONN_DISABLE_EHT;
+	}
+
+	if (!(*conn_flags & IEEE80211_CONN_DISABLE_HT) && !is_6ghz) {
+		ht_oper = elems->ht_operation;
+		ht_cap = elems->ht_cap_elem;
+
+		if (!ht_cap) {
+			*conn_flags |= IEEE80211_CONN_DISABLE_HT;
+			ht_oper = NULL;
+		}
+	}
+
+	if (!(*conn_flags & IEEE80211_CONN_DISABLE_VHT) && !is_6ghz) {
+		vht_oper = elems->vht_operation;
+		if (vht_oper && !ht_oper) {
+			vht_oper = NULL;
+			sdata_info(sdata,
+				   "AP advertised VHT without HT, disabling HT/VHT/HE\n");
+			*conn_flags |= IEEE80211_CONN_DISABLE_HT;
+			*conn_flags |= IEEE80211_CONN_DISABLE_VHT;
+			*conn_flags |= IEEE80211_CONN_DISABLE_HE;
+			*conn_flags |= IEEE80211_CONN_DISABLE_EHT;
+		}
+
+		if (!elems->vht_cap_elem) {
+			*conn_flags |= IEEE80211_CONN_DISABLE_VHT;
+			vht_oper = NULL;
+		}
+	}
+
+	if (!(*conn_flags & IEEE80211_CONN_DISABLE_HE)) {
+		he_oper = elems->he_operation;
+
+		if (link && is_6ghz) {
+			struct ieee80211_bss_conf *bss_conf;
+			u8 j = 0;
+
+			bss_conf = link->conf;
+
+			if (elems->pwr_constr_elem)
+				bss_conf->pwr_reduction = *elems->pwr_constr_elem;
+
+			BUILD_BUG_ON(ARRAY_SIZE(bss_conf->tx_pwr_env) !=
+				     ARRAY_SIZE(elems->tx_pwr_env));
+
+			for (i = 0; i < elems->tx_pwr_env_num; i++) {
+				if (elems->tx_pwr_env_len[i] >
+				    sizeof(bss_conf->tx_pwr_env[j]))
+					continue;
+
+				bss_conf->tx_pwr_env_num++;
+				memcpy(&bss_conf->tx_pwr_env[j], elems->tx_pwr_env[i],
+				       elems->tx_pwr_env_len[i]);
+				j++;
+			}
+		}
+
+		if (!ieee80211_verify_peer_he_mcs_support(sdata, ies, he_oper) ||
+		    !ieee80211_verify_sta_he_mcs_support(sdata, sband, he_oper))
+			*conn_flags |= IEEE80211_CONN_DISABLE_HE |
+				       IEEE80211_CONN_DISABLE_EHT;
+	}
+
+	/*
+	 * EHT requires HE to be supported as well. Specifically for 6 GHz
+	 * channels, the operation channel information can only be deduced from
+	 * both the 6 GHz operation information (from the HE operation IE) and
+	 * EHT operation.
+	 */
+	if (!(*conn_flags &
+			(IEEE80211_CONN_DISABLE_HE |
+			 IEEE80211_CONN_DISABLE_EHT)) &&
+	    he_oper) {
+		const struct cfg80211_bss_ies *cbss_ies;
+		const u8 *eht_oper_ie;
+
+		cbss_ies = rcu_dereference(cbss->ies);
+		eht_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_EHT_OPERATION,
+						   cbss_ies->data, cbss_ies->len);
+		if (eht_oper_ie && eht_oper_ie[1] >=
+		    1 + sizeof(struct ieee80211_eht_operation))
+			eht_oper = (void *)(eht_oper_ie + 3);
+		else
+			eht_oper = NULL;
+	}
+
+	/* Allow VHT if at least one channel on the sband supports 80 MHz */
+	have_80mhz = false;
+	for (i = 0; i < sband->n_channels; i++) {
+		if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
+						IEEE80211_CHAN_NO_80MHZ))
+			continue;
+
+		have_80mhz = true;
+		break;
+	}
+
+	if (!have_80mhz) {
+		sdata_info(sdata, "80 MHz not supported, disabling VHT\n");
+		*conn_flags |= IEEE80211_CONN_DISABLE_VHT;
+	}
+
+	if (sband->band == NL80211_BAND_S1GHZ) {
+		s1g_oper = elems->s1g_oper;
+		if (!s1g_oper)
+			sdata_info(sdata,
+				   "AP missing S1G operation element?\n");
+	}
+
+	*conn_flags |=
+		ieee80211_determine_chantype(sdata, link, *conn_flags,
+					     sband,
+					     cbss->channel,
+					     bss->vht_cap_info,
+					     ht_oper, vht_oper,
+					     he_oper, eht_oper,
+					     s1g_oper,
+					     &chandef, false);
+
+	if (link)
+		link->needed_rx_chains =
+			min(ieee80211_max_rx_chains(link, cbss),
+			    local->rx_chains);
+
+	rcu_read_unlock();
+	/* the element data was RCU protected so no longer valid anyway */
+	kfree(elems);
+	elems = NULL;
+
+	if (*conn_flags & IEEE80211_CONN_DISABLE_HE && is_6ghz) {
+		sdata_info(sdata, "Rejecting non-HE 6/7 GHz connection");
+		return -EINVAL;
+	}
+
+	if (!link)
+		return 0;
+
+	/* will change later if needed */
+	link->smps_mode = IEEE80211_SMPS_OFF;
+
+	mutex_lock(&local->mtx);
+	/*
+	 * If this fails (possibly due to channel context sharing
+	 * on incompatible channels, e.g. 80+80 and 160 sharing the
+	 * same control channel) try to use a smaller bandwidth.
+	 */
+	ret = ieee80211_link_use_channel(link, &chandef,
+					 IEEE80211_CHANCTX_SHARED);
+
+	/* don't downgrade for 5 and 10 MHz channels, though. */
+	if (chandef.width == NL80211_CHAN_WIDTH_5 ||
+	    chandef.width == NL80211_CHAN_WIDTH_10)
+		goto out;
+
+	while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
+		*conn_flags |=
+			ieee80211_chandef_downgrade(&chandef);
+		ret = ieee80211_link_use_channel(link, &chandef,
+						 IEEE80211_CHANCTX_SHARED);
+	}
+ out:
+	mutex_unlock(&local->mtx);
+	return ret;
+}
+
+static bool ieee80211_get_dtim(const struct cfg80211_bss_ies *ies,
+			       u8 *dtim_count, u8 *dtim_period)
+{
+	const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len);
+	const u8 *idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, ies->data,
+					 ies->len);
+	const struct ieee80211_tim_ie *tim = NULL;
+	const struct ieee80211_bssid_index *idx;
+	bool valid = tim_ie && tim_ie[1] >= 2;
+
+	if (valid)
+		tim = (void *)(tim_ie + 2);
+
+	if (dtim_count)
+		*dtim_count = valid ? tim->dtim_count : 0;
+
+	if (dtim_period)
+		*dtim_period = valid ? tim->dtim_period : 0;
+
+	/* Check if value is overridden by non-transmitted profile */
+	if (!idx_ie || idx_ie[1] < 3)
+		return valid;
+
+	idx = (void *)(idx_ie + 2);
+
+	if (dtim_count)
+		*dtim_count = idx->dtim_count;
+
+	if (dtim_period)
+		*dtim_period = idx->dtim_period;
+
+	return true;
+}
+
+static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
+				    struct ieee80211_mgmt *mgmt,
+				    struct ieee802_11_elems *elems,
+				    const u8 *elem_start, unsigned int elem_len)
+{
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
+	struct ieee80211_local *local = sdata->local;
+	unsigned int link_id;
+	struct sta_info *sta;
+	u64 changed[IEEE80211_MLD_MAX_NUM_LINKS] = {};
+	u16 valid_links = 0;
+	int err;
+
+	mutex_lock(&sdata->local->sta_mtx);
+	/*
+	 * station info was already allocated and inserted before
+	 * the association and should be available to us
+	 */
+	sta = sta_info_get(sdata, assoc_data->ap_addr);
+	if (WARN_ON(!sta))
+		goto out_err;
+
+	if (sdata->vif.valid_links) {
+		for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
+			if (!assoc_data->link[link_id].bss)
+				continue;
+			valid_links |= BIT(link_id);
+
+			if (link_id != assoc_data->assoc_link_id) {
+				err = ieee80211_sta_allocate_link(sta, link_id);
+				if (err)
+					goto out_err;
+			}
+		}
+
+		ieee80211_vif_set_links(sdata, valid_links);
+	}
+
+	for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
+		struct cfg80211_bss *cbss = assoc_data->link[link_id].bss;
+		struct ieee80211_link_data *link;
+		struct link_sta_info *link_sta;
+
+		if (!cbss)
+			continue;
+
+		link = sdata_dereference(sdata->link[link_id], sdata);
+		if (WARN_ON(!link))
+			goto out_err;
+
+		if (sdata->vif.valid_links)
+			link_info(link,
+				  "local address %pM, AP link address %pM%s\n",
+				  link->conf->addr,
+				  assoc_data->link[link_id].bss->bssid,
+				  link_id == assoc_data->assoc_link_id ?
+					" (assoc)" : "");
+
+		link_sta = rcu_dereference_protected(sta->link[link_id],
+						     lockdep_is_held(&local->sta_mtx));
+		if (WARN_ON(!link_sta))
+			goto out_err;
+
+		if (!link->u.mgd.have_beacon) {
+			const struct cfg80211_bss_ies *ies;
+
+			rcu_read_lock();
+			ies = rcu_dereference(cbss->beacon_ies);
+			if (ies)
+				link->u.mgd.have_beacon = true;
+			else
+				ies = rcu_dereference(cbss->ies);
+			ieee80211_get_dtim(ies,
+					   &link->conf->sync_dtim_count,
+					   &link->u.mgd.dtim_period);
+			link->conf->beacon_int = cbss->beacon_interval;
+			rcu_read_unlock();
+		}
+
+		link->conf->dtim_period = link->u.mgd.dtim_period ?: 1;
+
+		if (link_id != assoc_data->assoc_link_id) {
+			err = ieee80211_prep_channel(sdata, link, cbss,
+						     &link->u.mgd.conn_flags);
+			if (err) {
+				link_info(link, "prep_channel failed\n");
+				goto out_err;
+			}
+		}
+
+		err = ieee80211_mgd_setup_link_sta(link, sta, link_sta,
+						   assoc_data->link[link_id].bss);
+		if (err)
+			goto out_err;
+
+		if (!ieee80211_assoc_config_link(link, link_sta,
+						 assoc_data->link[link_id].bss,
+						 mgmt, elem_start, elem_len,
+						 &changed[link_id]))
+			goto out_err;
+
+		if (assoc_data->link[link_id].status != WLAN_STATUS_SUCCESS) {
+			valid_links &= ~BIT(link_id);
+			ieee80211_sta_remove_link(sta, link_id);
+			continue;
+		}
+
+		if (link_id != assoc_data->assoc_link_id) {
+			err = ieee80211_sta_activate_link(sta, link_id);
+			if (err)
+				goto out_err;
+		}
+	}
+
+	/* links might have changed due to rejected ones, set them again */
+	ieee80211_vif_set_links(sdata, valid_links);
+
+	rate_control_rate_init(sta);
+
+	if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) {
+		set_sta_flag(sta, WLAN_STA_MFP);
+		sta->sta.mfp = true;
+	} else {
+		sta->sta.mfp = false;
+	}
+
+	ieee80211_sta_set_max_amsdu_subframes(sta, elems->ext_capab,
+					      elems->ext_capab_len);
+
+	sta->sta.wme = (elems->wmm_param || elems->s1g_capab) &&
+		       local->hw.queues >= IEEE80211_NUM_ACS;
+
+	err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
+	if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
+		err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
+	if (err) {
+		sdata_info(sdata,
+			   "failed to move station %pM to desired state\n",
+			   sta->sta.addr);
+		WARN_ON(__sta_info_destroy(sta));
+		goto out_err;
+	}
+
+	if (sdata->wdev.use_4addr)
+		drv_sta_set_4addr(local, sdata, &sta->sta, true);
+
+	mutex_unlock(&sdata->local->sta_mtx);
+
+	ieee80211_set_associated(sdata, assoc_data, changed);
+
+	/*
+	 * If we're using 4-addr mode, let the AP know that we're
+	 * doing so, so that it can create the STA VLAN on its side
+	 */
+	if (ifmgd->use_4addr)
+		ieee80211_send_4addr_nullfunc(local, sdata);
+
+	/*
+	 * Start timer to probe the connection to the AP now.
+	 * Also start the timer that will detect beacon loss.
+	 */
+	ieee80211_sta_reset_beacon_monitor(sdata);
+	ieee80211_sta_reset_conn_monitor(sdata);
+
+	return true;
+out_err:
+	eth_zero_addr(sdata->vif.cfg.ap_addr);
+	mutex_unlock(&sdata->local->sta_mtx);
+	return false;
+}
+
+static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
+					 struct ieee80211_mgmt *mgmt,
+					 size_t len)
+{
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
+	u16 capab_info, status_code, aid;
+	struct ieee80211_elems_parse_params parse_params = {
+		.bss = NULL,
+		.link_id = -1,
+		.from_ap = true,
+	};
+	struct ieee802_11_elems *elems;
+	int ac;
+	const u8 *elem_start;
+	unsigned int elem_len;
+	bool reassoc;
+	struct ieee80211_event event = {
+		.type = MLME_EVENT,
+		.u.mlme.data = ASSOC_EVENT,
+	};
+	struct ieee80211_prep_tx_info info = {};
+	struct cfg80211_rx_assoc_resp resp = {
+		.uapsd_queues = -1,
+	};
+	u8 ap_mld_addr[ETH_ALEN] __aligned(2);
+	unsigned int link_id;
+
+	sdata_assert_lock(sdata);
+
+	if (!assoc_data)
+		return;
+
+	if (!ether_addr_equal(assoc_data->ap_addr, mgmt->bssid) ||
+	    !ether_addr_equal(assoc_data->ap_addr, mgmt->sa))
+		return;
+
+	/*
+	 * AssocResp and ReassocResp have identical structure, so process both
+	 * of them in this function.
+	 */
+
+	if (len < 24 + 6)
+		return;
+
+	reassoc = ieee80211_is_reassoc_resp(mgmt->frame_control);
+	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
+	status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
+	if (assoc_data->s1g)
+		elem_start = mgmt->u.s1g_assoc_resp.variable;
+	else
+		elem_start = mgmt->u.assoc_resp.variable;
+
+	/*
+	 * Note: this may not be perfect, AP might misbehave - if
+	 * anyone needs to rely on perfect complete notification
+	 * with the exact right subtype, then we need to track what
+	 * we actually transmitted.
+	 */
+	info.subtype = reassoc ? IEEE80211_STYPE_REASSOC_REQ :
+				 IEEE80211_STYPE_ASSOC_REQ;
+
+	if (assoc_data->fils_kek_len &&
+	    fils_decrypt_assoc_resp(sdata, (u8 *)mgmt, &len, assoc_data) < 0)
+		return;
+
+	elem_len = len - (elem_start - (u8 *)mgmt);
+	parse_params.start = elem_start;
+	parse_params.len = elem_len;
+	elems = ieee802_11_parse_elems_full(&parse_params);
+	if (!elems)
+		goto notify_driver;
+
+	if (elems->aid_resp)
+		aid = le16_to_cpu(elems->aid_resp->aid);
+	else if (assoc_data->s1g)
+		aid = 0; /* TODO */
+	else
+		aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
+
+	/*
+	 * The 5 MSB of the AID field are reserved
+	 * (802.11-2016 9.4.1.8 AID field)
+	 */
+	aid &= 0x7ff;
+
+	sdata_info(sdata,
+		   "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
+		   reassoc ? "Rea" : "A", assoc_data->ap_addr,
+		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
+
+	ifmgd->broken_ap = false;
+
+	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
+	    elems->timeout_int &&
+	    elems->timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
+		u32 tu, ms;
+
+		cfg80211_assoc_comeback(sdata->dev, assoc_data->ap_addr,
+					le32_to_cpu(elems->timeout_int->value));
+
+		tu = le32_to_cpu(elems->timeout_int->value);
+		ms = tu * 1024 / 1000;
+		sdata_info(sdata,
+			   "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
+			   assoc_data->ap_addr, tu, ms);
+		assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
+		assoc_data->timeout_started = true;
+		if (ms > IEEE80211_ASSOC_TIMEOUT)
+			run_again(sdata, assoc_data->timeout);
+		goto notify_driver;
+	}
+
+	if (status_code != WLAN_STATUS_SUCCESS) {
+		sdata_info(sdata, "%pM denied association (code=%d)\n",
+			   assoc_data->ap_addr, status_code);
+		event.u.mlme.status = MLME_DENIED;
+		event.u.mlme.reason = status_code;
+		drv_event_callback(sdata->local, sdata, &event);
+	} else {
+		if (aid == 0 || aid > IEEE80211_MAX_AID) {
+			sdata_info(sdata,
+				   "invalid AID value %d (out of range), turn off PS\n",
+				   aid);
+			aid = 0;
+			ifmgd->broken_ap = true;
+		}
+
+		if (sdata->vif.valid_links) {
+			if (!elems->multi_link) {
+				sdata_info(sdata,
+					   "MLO association with %pM but no multi-link element in response!\n",
+					   assoc_data->ap_addr);
+				goto abandon_assoc;
+			}
+
+			if (le16_get_bits(elems->multi_link->control,
+					  IEEE80211_ML_CONTROL_TYPE) !=
+					IEEE80211_ML_CONTROL_TYPE_BASIC) {
+				sdata_info(sdata,
+					   "bad multi-link element (control=0x%x)\n",
+					   le16_to_cpu(elems->multi_link->control));
+				goto abandon_assoc;
+			} else {
+				struct ieee80211_mle_basic_common_info *common;
+
+				common = (void *)elems->multi_link->variable;
+
+				if (memcmp(assoc_data->ap_addr,
+					   common->mld_mac_addr, ETH_ALEN)) {
+					sdata_info(sdata,
+						   "AP MLD MAC address mismatch: got %pM expected %pM\n",
+						   common->mld_mac_addr,
+						   assoc_data->ap_addr);
+					goto abandon_assoc;
+				}
+			}
+		}
+
+		sdata->vif.cfg.aid = aid;
+
+		if (!ieee80211_assoc_success(sdata, mgmt, elems,
+					     elem_start, elem_len)) {
+			/* oops -- internal error -- send timeout for now */
+			ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
+			goto notify_driver;
+		}
+		event.u.mlme.status = MLME_SUCCESS;
+		drv_event_callback(sdata->local, sdata, &event);
+		sdata_info(sdata, "associated\n");
+
+		info.success = 1;
+	}
+
+	for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS; link_id++) {
+		struct ieee80211_link_data *link;
+
+		link = sdata_dereference(sdata->link[link_id], sdata);
+		if (!link)
+			continue;
+
+		if (!assoc_data->link[link_id].bss)
+			continue;
+
+		resp.links[link_id].bss = assoc_data->link[link_id].bss;
+		resp.links[link_id].addr = link->conf->addr;
+		resp.links[link_id].status = assoc_data->link[link_id].status;
+
+		/* get uapsd queues configuration - same for all links */
+		resp.uapsd_queues = 0;
+		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
+			if (link->tx_conf[ac].uapsd)
+				resp.uapsd_queues |= ieee80211_ac_to_qos_mask[ac];
+	}
+
+	if (sdata->vif.valid_links) {
+		ether_addr_copy(ap_mld_addr, sdata->vif.cfg.ap_addr);
+		resp.ap_mld_addr = ap_mld_addr;
+	}
+
+	ieee80211_destroy_assoc_data(sdata,
+				     status_code == WLAN_STATUS_SUCCESS ?
+					ASSOC_SUCCESS :
+					ASSOC_REJECTED);
+
+	resp.buf = (u8 *)mgmt;
+	resp.len = len;
+	resp.req_ies = ifmgd->assoc_req_ies;
+	resp.req_ies_len = ifmgd->assoc_req_ies_len;
+	cfg80211_rx_assoc_resp(sdata->dev, &resp);
+notify_driver:
+	drv_mgd_complete_tx(sdata->local, sdata, &info);
+	kfree(elems);
+	return;
+abandon_assoc:
+	ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
+	goto notify_driver;
+}
+
+static void ieee80211_rx_bss_info(struct ieee80211_link_data *link,
+				  struct ieee80211_mgmt *mgmt, size_t len,
+				  struct ieee80211_rx_status *rx_status)
+{
+	struct ieee80211_sub_if_data *sdata = link->sdata;
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_bss *bss;
+	struct ieee80211_channel *channel;
+
+	sdata_assert_lock(sdata);
+
+	channel = ieee80211_get_channel_khz(local->hw.wiphy,
+					ieee80211_rx_status_to_khz(rx_status));
+	if (!channel)
+		return;
+
+	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, channel);
+	if (bss) {
+		link->conf->beacon_rate = bss->beacon_rate;
+		ieee80211_rx_bss_put(local, bss);
+	}
+}
+
+
+static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_link_data *link,
+					 struct sk_buff *skb)
+{
+	struct ieee80211_sub_if_data *sdata = link->sdata;
+	struct ieee80211_mgmt *mgmt = (void *)skb->data;
+	struct ieee80211_if_managed *ifmgd;
+	struct ieee80211_rx_status *rx_status = (void *) skb->cb;
+	struct ieee80211_channel *channel;
+	size_t baselen, len = skb->len;
+
+	ifmgd = &sdata->u.mgd;
+
+	sdata_assert_lock(sdata);
+
+	/*
+	 * According to Draft P802.11ax D6.0 clause 26.17.2.3.2:
+	 * "If a 6 GHz AP receives a Probe Request frame  and responds with
+	 * a Probe Response frame [..], the Address 1 field of the Probe
+	 * Response frame shall be set to the broadcast address [..]"
+	 * So, on 6GHz band we should also accept broadcast responses.
+	 */
+	channel = ieee80211_get_channel(sdata->local->hw.wiphy,
+					rx_status->freq);
+	if (!channel)
+		return;
+
+	if (!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
+	    (channel->band != NL80211_BAND_6GHZ ||
+	     !is_broadcast_ether_addr(mgmt->da)))
+		return; /* ignore ProbeResp to foreign address */
+
+	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
+	if (baselen > len)
+		return;
+
+	ieee80211_rx_bss_info(link, mgmt, len, rx_status);
+
+	if (ifmgd->associated &&
+	    ether_addr_equal(mgmt->bssid, link->u.mgd.bssid))
+		ieee80211_reset_ap_probe(sdata);
+}
+
+/*
+ * This is the canonical list of information elements we care about,
+ * the filter code also gives us all changes to the Microsoft OUI
+ * (00:50:F2) vendor IE which is used for WMM which we need to track,
+ * as well as the DTPC IE (part of the Cisco OUI) used for signaling
+ * changes to requested client power.
+ *
+ * We implement beacon filtering in software since that means we can
+ * avoid processing the frame here and in cfg80211, and userspace
+ * will not be able to tell whether the hardware supports it or not.
+ *
+ * XXX: This list needs to be dynamic -- userspace needs to be able to
+ *	add items it requires. It also needs to be able to tell us to
+ *	look out for other vendor IEs.
+ */
+static const u64 care_about_ies =
+	(1ULL << WLAN_EID_COUNTRY) |
+	(1ULL << WLAN_EID_ERP_INFO) |
+	(1ULL << WLAN_EID_CHANNEL_SWITCH) |
+	(1ULL << WLAN_EID_PWR_CONSTRAINT) |
+	(1ULL << WLAN_EID_HT_CAPABILITY) |
+	(1ULL << WLAN_EID_HT_OPERATION) |
+	(1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
+
+static void ieee80211_handle_beacon_sig(struct ieee80211_link_data *link,
+					struct ieee80211_if_managed *ifmgd,
+					struct ieee80211_bss_conf *bss_conf,
+					struct ieee80211_local *local,
+					struct ieee80211_rx_status *rx_status)
+{
+	struct ieee80211_sub_if_data *sdata = link->sdata;
+
+	/* Track average RSSI from the Beacon frames of the current AP */
+
+	if (!link->u.mgd.tracking_signal_avg) {
+		link->u.mgd.tracking_signal_avg = true;
+		ewma_beacon_signal_init(&link->u.mgd.ave_beacon_signal);
+		link->u.mgd.last_cqm_event_signal = 0;
+		link->u.mgd.count_beacon_signal = 1;
+		link->u.mgd.last_ave_beacon_signal = 0;
+	} else {
+		link->u.mgd.count_beacon_signal++;
+	}
+
+	ewma_beacon_signal_add(&link->u.mgd.ave_beacon_signal,
+			       -rx_status->signal);
+
+	if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
+	    link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
+		int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
+		int last_sig = link->u.mgd.last_ave_beacon_signal;
+		struct ieee80211_event event = {
+			.type = RSSI_EVENT,
+		};
+
+		/*
+		 * if signal crosses either of the boundaries, invoke callback
+		 * with appropriate parameters
+		 */
+		if (sig > ifmgd->rssi_max_thold &&
+		    (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
+			link->u.mgd.last_ave_beacon_signal = sig;
+			event.u.rssi.data = RSSI_EVENT_HIGH;
+			drv_event_callback(local, sdata, &event);
+		} else if (sig < ifmgd->rssi_min_thold &&
+			   (last_sig >= ifmgd->rssi_max_thold ||
+			   last_sig == 0)) {
+			link->u.mgd.last_ave_beacon_signal = sig;
+			event.u.rssi.data = RSSI_EVENT_LOW;
+			drv_event_callback(local, sdata, &event);
+		}
+	}
+
+	if (bss_conf->cqm_rssi_thold &&
+	    link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
+	    !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
+		int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
+		int last_event = link->u.mgd.last_cqm_event_signal;
+		int thold = bss_conf->cqm_rssi_thold;
+		int hyst = bss_conf->cqm_rssi_hyst;
+
+		if (sig < thold &&
+		    (last_event == 0 || sig < last_event - hyst)) {
+			link->u.mgd.last_cqm_event_signal = sig;
+			ieee80211_cqm_rssi_notify(
+				&sdata->vif,
+				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
+				sig, GFP_KERNEL);
+		} else if (sig > thold &&
+			   (last_event == 0 || sig > last_event + hyst)) {
+			link->u.mgd.last_cqm_event_signal = sig;
+			ieee80211_cqm_rssi_notify(
+				&sdata->vif,
+				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
+				sig, GFP_KERNEL);
+		}
+	}
+
+	if (bss_conf->cqm_rssi_low &&
+	    link->u.mgd.count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
+		int sig = -ewma_beacon_signal_read(&link->u.mgd.ave_beacon_signal);
+		int last_event = link->u.mgd.last_cqm_event_signal;
+		int low = bss_conf->cqm_rssi_low;
+		int high = bss_conf->cqm_rssi_high;
+
+		if (sig < low &&
+		    (last_event == 0 || last_event >= low)) {
+			link->u.mgd.last_cqm_event_signal = sig;
+			ieee80211_cqm_rssi_notify(
+				&sdata->vif,
+				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
+				sig, GFP_KERNEL);
+		} else if (sig > high &&
+			   (last_event == 0 || last_event <= high)) {
+			link->u.mgd.last_cqm_event_signal = sig;
+			ieee80211_cqm_rssi_notify(
+				&sdata->vif,
+				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
+				sig, GFP_KERNEL);
+		}
+	}
+}
+
+static bool ieee80211_rx_our_beacon(const u8 *tx_bssid,
+				    struct cfg80211_bss *bss)
+{
+	if (ether_addr_equal(tx_bssid, bss->bssid))
+		return true;
+	if (!bss->transmitted_bss)
+		return false;
+	return ether_addr_equal(tx_bssid, bss->transmitted_bss->bssid);
+}
+
+static bool ieee80211_config_puncturing(struct ieee80211_link_data *link,
+					const struct ieee80211_eht_operation *eht_oper,
+					u64 *changed)
+{
+	u16 bitmap = 0, extracted;
+
+	if ((eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) &&
+	    (eht_oper->params &
+	     IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT)) {
+		const struct ieee80211_eht_operation_info *info =
+			(void *)eht_oper->optional;
+		const u8 *disable_subchannel_bitmap = info->optional;
+
+		bitmap = get_unaligned_le16(disable_subchannel_bitmap);
+	}
+
+	extracted = ieee80211_extract_dis_subch_bmap(eht_oper,
+						     &link->conf->chandef,
+						     bitmap);
+
+	/* accept if there are no changes */
+	if (!(*changed & BSS_CHANGED_BANDWIDTH) &&
+	    extracted == link->conf->eht_puncturing)
+		return true;
+
+	if (!cfg80211_valid_disable_subchannel_bitmap(&bitmap,
+						      &link->conf->chandef)) {
+		link_info(link,
+			  "Got an invalid disable subchannel bitmap from AP %pM: bitmap = 0x%x, bw = 0x%x. disconnect\n",
+			  link->u.mgd.bssid,
+			  bitmap,
+			  link->conf->chandef.width);
+		return false;
+	}
+
+	ieee80211_handle_puncturing_bitmap(link, eht_oper, bitmap, changed);
+	return true;
+}
+
+static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link,
+				     struct ieee80211_hdr *hdr, size_t len,
+				     struct ieee80211_rx_status *rx_status)
+{
+	struct ieee80211_sub_if_data *sdata = link->sdata;
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
+	struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
+	struct ieee80211_mgmt *mgmt = (void *) hdr;
+	size_t baselen;
+	struct ieee802_11_elems *elems;
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_chanctx_conf *chanctx_conf;
+	struct ieee80211_supported_band *sband;
+	struct ieee80211_channel *chan;
+	struct link_sta_info *link_sta;
+	struct sta_info *sta;
+	u64 changed = 0;
+	bool erp_valid;
+	u8 erp_value = 0;
+	u32 ncrc = 0;
+	u8 *bssid, *variable = mgmt->u.beacon.variable;
+	u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
+	struct ieee80211_elems_parse_params parse_params = {
+		.link_id = -1,
+		.from_ap = true,
+	};
+
+	sdata_assert_lock(sdata);
+
+	/* Process beacon from the current BSS */
+	bssid = ieee80211_get_bssid(hdr, len, sdata->vif.type);
+	if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
+		struct ieee80211_ext *ext = (void *) mgmt;
+
+		if (ieee80211_is_s1g_short_beacon(ext->frame_control))
+			variable = ext->u.s1g_short_beacon.variable;
+		else
+			variable = ext->u.s1g_beacon.variable;
+	}
+
+	baselen = (u8 *) variable - (u8 *) mgmt;
+	if (baselen > len)
+		return;
+
+	parse_params.start = variable;
+	parse_params.len = len - baselen;
+
+	rcu_read_lock();
+	chanctx_conf = rcu_dereference(link->conf->chanctx_conf);
+	if (!chanctx_conf) {
+		rcu_read_unlock();
+		return;
+	}
+
+	if (ieee80211_rx_status_to_khz(rx_status) !=
+	    ieee80211_channel_to_khz(chanctx_conf->def.chan)) {
+		rcu_read_unlock();
+		return;
+	}
+	chan = chanctx_conf->def.chan;
+	rcu_read_unlock();
+
+	if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
+	    !WARN_ON(sdata->vif.valid_links) &&
+	    ieee80211_rx_our_beacon(bssid, ifmgd->assoc_data->link[0].bss)) {
+		parse_params.bss = ifmgd->assoc_data->link[0].bss;
+		elems = ieee802_11_parse_elems_full(&parse_params);
+		if (!elems)
+			return;
+
+		ieee80211_rx_bss_info(link, mgmt, len, rx_status);
+
+		if (elems->dtim_period)
+			link->u.mgd.dtim_period = elems->dtim_period;
+		link->u.mgd.have_beacon = true;
+		ifmgd->assoc_data->need_beacon = false;
+		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
+			link->conf->sync_tsf =
+				le64_to_cpu(mgmt->u.beacon.timestamp);
+			link->conf->sync_device_ts =
+				rx_status->device_timestamp;
+			link->conf->sync_dtim_count = elems->dtim_count;
+		}
+
+		if (elems->mbssid_config_ie)
+			bss_conf->profile_periodicity =
+				elems->mbssid_config_ie->profile_periodicity;
+		else
+			bss_conf->profile_periodicity = 0;
+
+		if (elems->ext_capab_len >= 11 &&
+		    (elems->ext_capab[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
+			bss_conf->ema_ap = true;
+		else
+			bss_conf->ema_ap = false;
+
+		/* continue assoc process */
+		ifmgd->assoc_data->timeout = jiffies;
+		ifmgd->assoc_data->timeout_started = true;
+		run_again(sdata, ifmgd->assoc_data->timeout);
+		kfree(elems);
+		return;
+	}
+
+	if (!ifmgd->associated ||
+	    !ieee80211_rx_our_beacon(bssid, link->u.mgd.bss))
+		return;
+	bssid = link->u.mgd.bssid;
+
+	if (!(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
+		ieee80211_handle_beacon_sig(link, ifmgd, bss_conf,
+					    local, rx_status);
+
+	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
+		mlme_dbg_ratelimited(sdata,
+				     "cancelling AP probe due to a received beacon\n");
+		ieee80211_reset_ap_probe(sdata);
+	}
+
+	/*
+	 * Push the beacon loss detection into the future since
+	 * we are processing a beacon from the AP just now.
+	 */
+	ieee80211_sta_reset_beacon_monitor(sdata);
+
+	/* TODO: CRC urrently not calculated on S1G Beacon Compatibility
+	 * element (which carries the beacon interval). Don't forget to add a
+	 * bit to care_about_ies[] above if mac80211 is interested in a
+	 * changing S1G element.
+	 */
+	if (!ieee80211_is_s1g_beacon(hdr->frame_control))
+		ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
+	parse_params.bss = link->u.mgd.bss;
+	parse_params.filter = care_about_ies;
+	parse_params.crc = ncrc;
+	elems = ieee802_11_parse_elems_full(&parse_params);
+	if (!elems)
+		return;
+	ncrc = elems->crc;
+
+	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
+	    ieee80211_check_tim(elems->tim, elems->tim_len, vif_cfg->aid)) {
+		if (local->hw.conf.dynamic_ps_timeout > 0) {
+			if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+				local->hw.conf.flags &= ~IEEE80211_CONF_PS;
+				ieee80211_hw_config(local,
+						    IEEE80211_CONF_CHANGE_PS);
+			}
+			ieee80211_send_nullfunc(local, sdata, false);
+		} else if (!local->pspolling && sdata->u.mgd.powersave) {
+			local->pspolling = true;
+
+			/*
+			 * Here is assumed that the driver will be
+			 * able to send ps-poll frame and receive a
+			 * response even though power save mode is
+			 * enabled, but some drivers might require
+			 * to disable power save here. This needs
+			 * to be investigated.
+			 */
+			ieee80211_send_pspoll(local, sdata);
+		}
+	}
+
+	if (sdata->vif.p2p ||
+	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
+		struct ieee80211_p2p_noa_attr noa = {};
+		int ret;
+
+		ret = cfg80211_get_p2p_attr(variable,
+					    len - baselen,
+					    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
+					    (u8 *) &noa, sizeof(noa));
+		if (ret >= 2) {
+			if (link->u.mgd.p2p_noa_index != noa.index) {
+				/* valid noa_attr and index changed */
+				link->u.mgd.p2p_noa_index = noa.index;
+				memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
+				changed |= BSS_CHANGED_P2P_PS;
+				/*
+				 * make sure we update all information, the CRC
+				 * mechanism doesn't look at P2P attributes.
+				 */
+				link->u.mgd.beacon_crc_valid = false;
+			}
+		} else if (link->u.mgd.p2p_noa_index != -1) {
+			/* noa_attr not found and we had valid noa_attr before */
+			link->u.mgd.p2p_noa_index = -1;
+			memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
+			changed |= BSS_CHANGED_P2P_PS;
+			link->u.mgd.beacon_crc_valid = false;
+		}
+	}
+
+	if (link->u.mgd.csa_waiting_bcn)
+		ieee80211_chswitch_post_beacon(link);
+
+	/*
+	 * Update beacon timing and dtim count on every beacon appearance. This
+	 * will allow the driver to use the most updated values. Do it before
+	 * comparing this one with last received beacon.
+	 * IMPORTANT: These parameters would possibly be out of sync by the time
+	 * the driver will use them. The synchronized view is currently
+	 * guaranteed only in certain callbacks.
+	 */
+	if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY) &&
+	    !ieee80211_is_s1g_beacon(hdr->frame_control)) {
+		link->conf->sync_tsf =
+			le64_to_cpu(mgmt->u.beacon.timestamp);
+		link->conf->sync_device_ts =
+			rx_status->device_timestamp;
+		link->conf->sync_dtim_count = elems->dtim_count;
+	}
+
+	if ((ncrc == link->u.mgd.beacon_crc && link->u.mgd.beacon_crc_valid) ||
+	    ieee80211_is_s1g_short_beacon(mgmt->frame_control))
+		goto free;
+	link->u.mgd.beacon_crc = ncrc;
+	link->u.mgd.beacon_crc_valid = true;
+
+	ieee80211_rx_bss_info(link, mgmt, len, rx_status);
+
+	ieee80211_sta_process_chanswitch(link, rx_status->mactime,
+					 rx_status->device_timestamp,
+					 elems, true);
+
+	if (!link->u.mgd.disable_wmm_tracking &&
+	    ieee80211_sta_wmm_params(local, link, elems->wmm_param,
+				     elems->wmm_param_len,
+				     elems->mu_edca_param_set))
+		changed |= BSS_CHANGED_QOS;
+
+	/*
+	 * If we haven't had a beacon before, tell the driver about the
+	 * DTIM period (and beacon timing if desired) now.
+	 */
+	if (!link->u.mgd.have_beacon) {
+		/* a few bogus AP send dtim_period = 0 or no TIM IE */
+		bss_conf->dtim_period = elems->dtim_period ?: 1;
+
+		changed |= BSS_CHANGED_BEACON_INFO;
+		link->u.mgd.have_beacon = true;
+
+		mutex_lock(&local->iflist_mtx);
+		ieee80211_recalc_ps(local);
+		mutex_unlock(&local->iflist_mtx);
+
+		ieee80211_recalc_ps_vif(sdata);
+	}
+
+	if (elems->erp_info) {
+		erp_valid = true;
+		erp_value = elems->erp_info[0];
+	} else {
+		erp_valid = false;
+	}
+
+	if (!ieee80211_is_s1g_beacon(hdr->frame_control))
+		changed |= ieee80211_handle_bss_capability(link,
+				le16_to_cpu(mgmt->u.beacon.capab_info),
+				erp_valid, erp_value);
+
+	mutex_lock(&local->sta_mtx);
+	sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
+	if (WARN_ON(!sta)) {
+		mutex_unlock(&local->sta_mtx);
+		goto free;
+	}
+	link_sta = rcu_dereference_protected(sta->link[link->link_id],
+					     lockdep_is_held(&local->sta_mtx));
+	if (WARN_ON(!link_sta)) {
+		mutex_unlock(&local->sta_mtx);
+		goto free;
+	}
+
+	if (WARN_ON(!link->conf->chandef.chan))
+		goto free;
+
+	sband = local->hw.wiphy->bands[link->conf->chandef.chan->band];
+
+	changed |= ieee80211_recalc_twt_req(sdata, sband, link, link_sta, elems);
+
+	if (ieee80211_config_bw(link, elems->ht_cap_elem,
+				elems->vht_cap_elem, elems->ht_operation,
+				elems->vht_operation, elems->he_operation,
+				elems->eht_operation,
+				elems->s1g_oper, bssid, &changed)) {
+		mutex_unlock(&local->sta_mtx);
+		sdata_info(sdata,
+			   "failed to follow AP %pM bandwidth change, disconnect\n",
+			   bssid);
+		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
+				       WLAN_REASON_DEAUTH_LEAVING,
+				       true, deauth_buf);
+		ieee80211_report_disconnect(sdata, deauth_buf,
+					    sizeof(deauth_buf), true,
+					    WLAN_REASON_DEAUTH_LEAVING,
+					    false);
+		goto free;
+	}
+
+	if (sta && elems->opmode_notif)
+		ieee80211_vht_handle_opmode(sdata, link_sta,
+					    *elems->opmode_notif,
+					    rx_status->band);
+	mutex_unlock(&local->sta_mtx);
+
+	changed |= ieee80211_handle_pwr_constr(link, chan, mgmt,
+					       elems->country_elem,
+					       elems->country_elem_len,
+					       elems->pwr_constr_elem,
+					       elems->cisco_dtpc_elem);
+
+	if (elems->eht_operation &&
+	    !(link->u.mgd.conn_flags & IEEE80211_CONN_DISABLE_EHT)) {
+		if (!ieee80211_config_puncturing(link, elems->eht_operation,
+						 &changed)) {
+			ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
+					       WLAN_REASON_DEAUTH_LEAVING,
+					       true, deauth_buf);
+			ieee80211_report_disconnect(sdata, deauth_buf,
+						    sizeof(deauth_buf), true,
+						    WLAN_REASON_DEAUTH_LEAVING,
+						    false);
+			goto free;
+		}
+	}
+
+	ieee80211_link_info_change_notify(sdata, link, changed);
+free:
+	kfree(elems);
+}
+
+void ieee80211_sta_rx_queued_ext(struct ieee80211_sub_if_data *sdata,
+				 struct sk_buff *skb)
+{
+	struct ieee80211_link_data *link = &sdata->deflink;
+	struct ieee80211_rx_status *rx_status;
+	struct ieee80211_hdr *hdr;
+	u16 fc;
+
+	rx_status = (struct ieee80211_rx_status *) skb->cb;
+	hdr = (struct ieee80211_hdr *) skb->data;
+	fc = le16_to_cpu(hdr->frame_control);
+
+	sdata_lock(sdata);
+	switch (fc & IEEE80211_FCTL_STYPE) {
+	case IEEE80211_STYPE_S1G_BEACON:
+		ieee80211_rx_mgmt_beacon(link, hdr, skb->len, rx_status);
+		break;
+	}
+	sdata_unlock(sdata);
+}
+
+void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
+				  struct sk_buff *skb)
+{
+	struct ieee80211_link_data *link = &sdata->deflink;
+	struct ieee80211_rx_status *rx_status;
+	struct ieee80211_mgmt *mgmt;
+	u16 fc;
+	int ies_len;
+
+	rx_status = (struct ieee80211_rx_status *) skb->cb;
+	mgmt = (struct ieee80211_mgmt *) skb->data;
+	fc = le16_to_cpu(mgmt->frame_control);
+
+	sdata_lock(sdata);
+
+	if (rx_status->link_valid) {
+		link = sdata_dereference(sdata->link[rx_status->link_id],
+					 sdata);
+		if (!link)
+			goto out;
+	}
+
+	switch (fc & IEEE80211_FCTL_STYPE) {
+	case IEEE80211_STYPE_BEACON:
+		ieee80211_rx_mgmt_beacon(link, (void *)mgmt,
+					 skb->len, rx_status);
+		break;
+	case IEEE80211_STYPE_PROBE_RESP:
+		ieee80211_rx_mgmt_probe_resp(link, skb);
+		break;
+	case IEEE80211_STYPE_AUTH:
+		ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
+		break;
+	case IEEE80211_STYPE_DEAUTH:
+		ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
+		break;
+	case IEEE80211_STYPE_DISASSOC:
+		ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
+		break;
+	case IEEE80211_STYPE_ASSOC_RESP:
+	case IEEE80211_STYPE_REASSOC_RESP:
+		ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
+		break;
+	case IEEE80211_STYPE_ACTION:
+		if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
+			struct ieee802_11_elems *elems;
+
+			ies_len = skb->len -
+				  offsetof(struct ieee80211_mgmt,
+					   u.action.u.chan_switch.variable);
+
+			if (ies_len < 0)
+				break;
+
+			/* CSA IE cannot be overridden, no need for BSSID */
+			elems = ieee802_11_parse_elems(
+					mgmt->u.action.u.chan_switch.variable,
+					ies_len, true, NULL);
+
+			if (elems && !elems->parse_error)
+				ieee80211_sta_process_chanswitch(link,
+								 rx_status->mactime,
+								 rx_status->device_timestamp,
+								 elems, false);
+			kfree(elems);
+		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
+			struct ieee802_11_elems *elems;
+
+			ies_len = skb->len -
+				  offsetof(struct ieee80211_mgmt,
+					   u.action.u.ext_chan_switch.variable);
+
+			if (ies_len < 0)
+				break;
+
+			/*
+			 * extended CSA IE can't be overridden, no need for
+			 * BSSID
+			 */
+			elems = ieee802_11_parse_elems(
+					mgmt->u.action.u.ext_chan_switch.variable,
+					ies_len, true, NULL);
+
+			if (elems && !elems->parse_error) {
+				/* for the handling code pretend it was an IE */
+				elems->ext_chansw_ie =
+					&mgmt->u.action.u.ext_chan_switch.data;
+
+				ieee80211_sta_process_chanswitch(link,
+								 rx_status->mactime,
+								 rx_status->device_timestamp,
+								 elems, false);
+			}
+
+			kfree(elems);
+		}
+		break;
+	}
+out:
+	sdata_unlock(sdata);
+}
+
+static void ieee80211_sta_timer(struct timer_list *t)
+{
+	struct ieee80211_sub_if_data *sdata =
+		from_timer(sdata, t, u.mgd.timer);
+
+	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+}
+
+void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
+				   u8 reason, bool tx)
+{
+	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+
+	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
+			       tx, frame_buf);
+
+	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
+				    reason, false);
+}
+
+static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
+{
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
+	u32 tx_flags = 0;
+	u16 trans = 1;
+	u16 status = 0;
+	struct ieee80211_prep_tx_info info = {
+		.subtype = IEEE80211_STYPE_AUTH,
+	};
+
+	sdata_assert_lock(sdata);
+
+	if (WARN_ON_ONCE(!auth_data))
+		return -EINVAL;
+
+	auth_data->tries++;
+
+	if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
+		sdata_info(sdata, "authentication with %pM timed out\n",
+			   auth_data->ap_addr);
+
+		/*
+		 * Most likely AP is not in the range so remove the
+		 * bss struct for that AP.
+		 */
+		cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);
+
+		return -ETIMEDOUT;
+	}
+
+	if (auth_data->algorithm == WLAN_AUTH_SAE)
+		info.duration = jiffies_to_msecs(IEEE80211_AUTH_TIMEOUT_SAE);
+
+	drv_mgd_prepare_tx(local, sdata, &info);
+
+	sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
+		   auth_data->ap_addr, auth_data->tries,
+		   IEEE80211_AUTH_MAX_TRIES);
+
+	auth_data->expected_transaction = 2;
+
+	if (auth_data->algorithm == WLAN_AUTH_SAE) {
+		trans = auth_data->sae_trans;
+		status = auth_data->sae_status;
+		auth_data->expected_transaction = trans;
+	}
+
+	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
+		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
+			   IEEE80211_TX_INTFL_MLME_CONN_TX;
+
+	ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
+			    auth_data->data, auth_data->data_len,
+			    auth_data->ap_addr, auth_data->ap_addr,
+			    NULL, 0, 0, tx_flags);
+
+	if (tx_flags == 0) {
+		if (auth_data->algorithm == WLAN_AUTH_SAE)
+			auth_data->timeout = jiffies +
+				IEEE80211_AUTH_TIMEOUT_SAE;
+		else
+			auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+	} else {
+		auth_data->timeout =
+			round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
+	}
+
+	auth_data->timeout_started = true;
+	run_again(sdata, auth_data->timeout);
+
+	return 0;
+}
+
+static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
+{
+	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
+	struct ieee80211_local *local = sdata->local;
+	int ret;
+
+	sdata_assert_lock(sdata);
+
+	assoc_data->tries++;
+	if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
+		sdata_info(sdata, "association with %pM timed out\n",
+			   assoc_data->ap_addr);
+
+		/*
+		 * Most likely AP is not in the range so remove the
+		 * bss struct for that AP.
+		 */
+		cfg80211_unlink_bss(local->hw.wiphy,
+				    assoc_data->link[assoc_data->assoc_link_id].bss);
+
+		return -ETIMEDOUT;
+	}
+
+	sdata_info(sdata, "associate with %pM (try %d/%d)\n",
+		   assoc_data->ap_addr, assoc_data->tries,
+		   IEEE80211_ASSOC_MAX_TRIES);
+	ret = ieee80211_send_assoc(sdata);
+	if (ret)
+		return ret;
+
+	if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
+		assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
+		assoc_data->timeout_started = true;
+		run_again(sdata, assoc_data->timeout);
+	} else {
+		assoc_data->timeout =
+			round_jiffies_up(jiffies +
+					 IEEE80211_ASSOC_TIMEOUT_LONG);
+		assoc_data->timeout_started = true;
+		run_again(sdata, assoc_data->timeout);
+	}
+
+	return 0;
+}
+
+void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
+				  __le16 fc, bool acked)
+{
+	struct ieee80211_local *local = sdata->local;
+
+	sdata->u.mgd.status_fc = fc;
+	sdata->u.mgd.status_acked = acked;
+	sdata->u.mgd.status_received = true;
+
+	ieee80211_queue_work(&local->hw, &sdata->work);
+}
+
+void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
+{
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+	sdata_lock(sdata);
+
+	if (ifmgd->status_received) {
+		__le16 fc = ifmgd->status_fc;
+		bool status_acked = ifmgd->status_acked;
+
+		ifmgd->status_received = false;
+		if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
+			if (status_acked) {
+				if (ifmgd->auth_data->algorithm ==
+				    WLAN_AUTH_SAE)
+					ifmgd->auth_data->timeout =
+						jiffies +
+						IEEE80211_AUTH_TIMEOUT_SAE;
+				else
+					ifmgd->auth_data->timeout =
+						jiffies +
+						IEEE80211_AUTH_TIMEOUT_SHORT;
+				run_again(sdata, ifmgd->auth_data->timeout);
+			} else {
+				ifmgd->auth_data->timeout = jiffies - 1;
+			}
+			ifmgd->auth_data->timeout_started = true;
+		} else if (ifmgd->assoc_data &&
+			   (ieee80211_is_assoc_req(fc) ||
+			    ieee80211_is_reassoc_req(fc))) {
+			if (status_acked) {
+				ifmgd->assoc_data->timeout =
+					jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
+				run_again(sdata, ifmgd->assoc_data->timeout);
+			} else {
+				ifmgd->assoc_data->timeout = jiffies - 1;
+			}
+			ifmgd->assoc_data->timeout_started = true;
+		}
+	}
+
+	if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
+	    time_after(jiffies, ifmgd->auth_data->timeout)) {
+		if (ifmgd->auth_data->done || ifmgd->auth_data->waiting) {
+			/*
+			 * ok ... we waited for assoc or continuation but
+			 * userspace didn't do it, so kill the auth data
+			 */
+			ieee80211_destroy_auth_data(sdata, false);
+		} else if (ieee80211_auth(sdata)) {
+			u8 ap_addr[ETH_ALEN];
+			struct ieee80211_event event = {
+				.type = MLME_EVENT,
+				.u.mlme.data = AUTH_EVENT,
+				.u.mlme.status = MLME_TIMEOUT,
+			};
+
+			memcpy(ap_addr, ifmgd->auth_data->ap_addr, ETH_ALEN);
+
+			ieee80211_destroy_auth_data(sdata, false);
+
+			cfg80211_auth_timeout(sdata->dev, ap_addr);
+			drv_event_callback(sdata->local, sdata, &event);
+		}
+	} else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
+		run_again(sdata, ifmgd->auth_data->timeout);
+
+	if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
+	    time_after(jiffies, ifmgd->assoc_data->timeout)) {
+		if ((ifmgd->assoc_data->need_beacon &&
+		     !sdata->deflink.u.mgd.have_beacon) ||
+		    ieee80211_do_assoc(sdata)) {
+			struct ieee80211_event event = {
+				.type = MLME_EVENT,
+				.u.mlme.data = ASSOC_EVENT,
+				.u.mlme.status = MLME_TIMEOUT,
+			};
+
+			ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
+			drv_event_callback(sdata->local, sdata, &event);
+		}
+	} else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
+		run_again(sdata, ifmgd->assoc_data->timeout);
+
+	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
+	    ifmgd->associated) {
+		u8 *bssid = sdata->deflink.u.mgd.bssid;
+		int max_tries;
+
+		if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
+			max_tries = max_nullfunc_tries;
+		else
+			max_tries = max_probe_tries;
+
+		/* ACK received for nullfunc probing frame */
+		if (!ifmgd->probe_send_count)
+			ieee80211_reset_ap_probe(sdata);
+		else if (ifmgd->nullfunc_failed) {
+			if (ifmgd->probe_send_count < max_tries) {
+				mlme_dbg(sdata,
+					 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
+					 bssid, ifmgd->probe_send_count,
+					 max_tries);
+				ieee80211_mgd_probe_ap_send(sdata);
+			} else {
+				mlme_dbg(sdata,
+					 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
+					 bssid);
+				ieee80211_sta_connection_lost(sdata,
+					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
+					false);
+			}
+		} else if (time_is_after_jiffies(ifmgd->probe_timeout))
+			run_again(sdata, ifmgd->probe_timeout);
+		else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
+			mlme_dbg(sdata,
+				 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
+				 bssid, probe_wait_ms);
+			ieee80211_sta_connection_lost(sdata,
+				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
+		} else if (ifmgd->probe_send_count < max_tries) {
+			mlme_dbg(sdata,
+				 "No probe response from AP %pM after %dms, try %d/%i\n",
+				 bssid, probe_wait_ms,
+				 ifmgd->probe_send_count, max_tries);
+			ieee80211_mgd_probe_ap_send(sdata);
+		} else {
+			/*
+			 * We actually lost the connection ... or did we?
+			 * Let's make sure!
+			 */
+			mlme_dbg(sdata,
+				 "No probe response from AP %pM after %dms, disconnecting.\n",
+				 bssid, probe_wait_ms);
+
+			ieee80211_sta_connection_lost(sdata,
+				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
+		}
+	}
+
+	sdata_unlock(sdata);
+}
+
+static void ieee80211_sta_bcn_mon_timer(struct timer_list *t)
+{
+	struct ieee80211_sub_if_data *sdata =
+		from_timer(sdata, t, u.mgd.bcn_mon_timer);
+
+	if (WARN_ON(sdata->vif.valid_links))
+		return;
+
+	if (sdata->vif.bss_conf.csa_active &&
+	    !sdata->deflink.u.mgd.csa_waiting_bcn)
+		return;
+
+	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
+		return;
+
+	sdata->u.mgd.connection_loss = false;
+	ieee80211_queue_work(&sdata->local->hw,
+			     &sdata->u.mgd.beacon_connection_loss_work);
+}
+
+static void ieee80211_sta_conn_mon_timer(struct timer_list *t)
+{
+	struct ieee80211_sub_if_data *sdata =
+		from_timer(sdata, t, u.mgd.conn_mon_timer);
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	struct ieee80211_local *local = sdata->local;
+	struct sta_info *sta;
+	unsigned long timeout;
+
+	if (WARN_ON(sdata->vif.valid_links))
+		return;
+
+	if (sdata->vif.bss_conf.csa_active &&
+	    !sdata->deflink.u.mgd.csa_waiting_bcn)
+		return;
+
+	sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
+	if (!sta)
+		return;
+
+	timeout = sta->deflink.status_stats.last_ack;
+	if (time_before(sta->deflink.status_stats.last_ack, sta->deflink.rx_stats.last_rx))
+		timeout = sta->deflink.rx_stats.last_rx;
+	timeout += IEEE80211_CONNECTION_IDLE_TIME;
+
+	/* If timeout is after now, then update timer to fire at
+	 * the later date, but do not actually probe at this time.
+	 */
+	if (time_is_after_jiffies(timeout)) {
+		mod_timer(&ifmgd->conn_mon_timer, round_jiffies_up(timeout));
+		return;
+	}
+
+	ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
+}
+
+static void ieee80211_sta_monitor_work(struct work_struct *work)
+{
+	struct ieee80211_sub_if_data *sdata =
+		container_of(work, struct ieee80211_sub_if_data,
+			     u.mgd.monitor_work);
+
+	ieee80211_mgd_probe_ap(sdata, false);
+}
+
+static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
+{
+	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+		__ieee80211_stop_poll(sdata);
+
+		/* let's probe the connection once */
+		if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
+			ieee80211_queue_work(&sdata->local->hw,
+					     &sdata->u.mgd.monitor_work);
+	}
+}
+
+#ifdef CONFIG_PM
+void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
+{
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+
+	sdata_lock(sdata);
+
+	if (ifmgd->auth_data || ifmgd->assoc_data) {
+		const u8 *ap_addr = ifmgd->auth_data ?
+				ifmgd->auth_data->ap_addr :
+				ifmgd->assoc_data->ap_addr;
+
+		/*
+		 * If we are trying to authenticate / associate while suspending,
+		 * cfg80211 won't know and won't actually abort those attempts,
+		 * thus we need to do that ourselves.
+		 */
+		ieee80211_send_deauth_disassoc(sdata, ap_addr, ap_addr,
+					       IEEE80211_STYPE_DEAUTH,
+					       WLAN_REASON_DEAUTH_LEAVING,
+					       false, frame_buf);
+		if (ifmgd->assoc_data)
+			ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
+		if (ifmgd->auth_data)
+			ieee80211_destroy_auth_data(sdata, false);
+		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
+				      IEEE80211_DEAUTH_FRAME_LEN,
+				      false);
+	}
+
+	/* This is a bit of a hack - we should find a better and more generic
+	 * solution to this. Normally when suspending, cfg80211 will in fact
+	 * deauthenticate. However, it doesn't (and cannot) stop an ongoing
+	 * auth (not so important) or assoc (this is the problem) process.
+	 *
+	 * As a consequence, it can happen that we are in the process of both
+	 * associating and suspending, and receive an association response
+	 * after cfg80211 has checked if it needs to disconnect, but before
+	 * we actually set the flag to drop incoming frames. This will then
+	 * cause the workqueue flush to process the association response in
+	 * the suspend, resulting in a successful association just before it
+	 * tries to remove the interface from the driver, which now though
+	 * has a channel context assigned ... this results in issues.
+	 *
+	 * To work around this (for now) simply deauth here again if we're
+	 * now connected.
+	 */
+	if (ifmgd->associated && !sdata->local->wowlan) {
+		u8 bssid[ETH_ALEN];
+		struct cfg80211_deauth_request req = {
+			.reason_code = WLAN_REASON_DEAUTH_LEAVING,
+			.bssid = bssid,
+		};
+
+		memcpy(bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
+		ieee80211_mgd_deauth(sdata, &req);
+	}
+
+	sdata_unlock(sdata);
+}
+#endif
+
+void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
+{
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+	sdata_lock(sdata);
+	if (!ifmgd->associated) {
+		sdata_unlock(sdata);
+		return;
+	}
+
+	if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
+		sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
+		mlme_dbg(sdata, "driver requested disconnect after resume\n");
+		ieee80211_sta_connection_lost(sdata,
+					      WLAN_REASON_UNSPECIFIED,
+					      true);
+		sdata_unlock(sdata);
+		return;
+	}
+
+	if (sdata->flags & IEEE80211_SDATA_DISCONNECT_HW_RESTART) {
+		sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_HW_RESTART;
+		mlme_dbg(sdata, "driver requested disconnect after hardware restart\n");
+		ieee80211_sta_connection_lost(sdata,
+					      WLAN_REASON_UNSPECIFIED,
+					      true);
+		sdata_unlock(sdata);
+		return;
+	}
+
+	sdata_unlock(sdata);
+}
+
+static void ieee80211_request_smps_mgd_work(struct work_struct *work)
+{
+	struct ieee80211_link_data *link =
+		container_of(work, struct ieee80211_link_data,
+			     u.mgd.request_smps_work);
+
+	sdata_lock(link->sdata);
+	__ieee80211_request_smps_mgd(link->sdata, link,
+				     link->u.mgd.driver_smps_mode);
+	sdata_unlock(link->sdata);
+}
+
+/* interface setup */
+void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
+{
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+	INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
+	INIT_WORK(&ifmgd->beacon_connection_loss_work,
+		  ieee80211_beacon_connection_loss_work);
+	INIT_WORK(&ifmgd->csa_connection_drop_work,
+		  ieee80211_csa_connection_drop_work);
+	INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
+			  ieee80211_tdls_peer_del_work);
+	timer_setup(&ifmgd->timer, ieee80211_sta_timer, 0);
+	timer_setup(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 0);
+	timer_setup(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 0);
+	INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
+			  ieee80211_sta_handle_tspec_ac_params_wk);
+
+	ifmgd->flags = 0;
+	ifmgd->powersave = sdata->wdev.ps;
+	ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
+	ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
+	/* Setup TDLS data */
+	spin_lock_init(&ifmgd->teardown_lock);
+	ifmgd->teardown_skb = NULL;
+	ifmgd->orig_teardown_skb = NULL;
+}
+
+void ieee80211_mgd_setup_link(struct ieee80211_link_data *link)
+{
+	struct ieee80211_sub_if_data *sdata = link->sdata;
+	struct ieee80211_local *local = sdata->local;
+	unsigned int link_id = link->link_id;
+
+	link->u.mgd.p2p_noa_index = -1;
+	link->u.mgd.conn_flags = 0;
+	link->conf->bssid = link->u.mgd.bssid;
+
+	INIT_WORK(&link->u.mgd.request_smps_work,
+		  ieee80211_request_smps_mgd_work);
+	if (local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
+		link->u.mgd.req_smps = IEEE80211_SMPS_AUTOMATIC;
+	else
+		link->u.mgd.req_smps = IEEE80211_SMPS_OFF;
+
+	INIT_WORK(&link->u.mgd.chswitch_work, ieee80211_chswitch_work);
+	timer_setup(&link->u.mgd.chswitch_timer, ieee80211_chswitch_timer, 0);
+
+	if (sdata->u.mgd.assoc_data)
+		ether_addr_copy(link->conf->addr,
+				sdata->u.mgd.assoc_data->link[link_id].addr);
+	else if (!is_valid_ether_addr(link->conf->addr))
+		eth_random_addr(link->conf->addr);
+}
+
+/* scan finished notification */
+void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
+{
+	struct ieee80211_sub_if_data *sdata;
+
+	/* Restart STA timers */
+	rcu_read_lock();
+	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+		if (ieee80211_sdata_running(sdata))
+			ieee80211_restart_sta_timer(sdata);
+	}
+	rcu_read_unlock();
+}
+
+static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
+				     struct cfg80211_bss *cbss, s8 link_id,
+				     const u8 *ap_mld_addr, bool assoc,
+				     bool override)
+{
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	struct ieee80211_bss *bss = (void *)cbss->priv;
+	struct sta_info *new_sta = NULL;
+	struct ieee80211_link_data *link;
+	bool have_sta = false;
+	bool mlo;
+	int err;
+
+	if (link_id >= 0) {
+		mlo = true;
+		if (WARN_ON(!ap_mld_addr))
+			return -EINVAL;
+		err = ieee80211_vif_set_links(sdata, BIT(link_id));
+	} else {
+		if (WARN_ON(ap_mld_addr))
+			return -EINVAL;
+		ap_mld_addr = cbss->bssid;
+		err = ieee80211_vif_set_links(sdata, 0);
+		link_id = 0;
+		mlo = false;
+	}
+
+	if (err)
+		return err;
+
+	link = sdata_dereference(sdata->link[link_id], sdata);
+	if (WARN_ON(!link)) {
+		err = -ENOLINK;
+		goto out_err;
+	}
+
+	if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data)) {
+		err = -EINVAL;
+		goto out_err;
+	}
+
+	/* If a reconfig is happening, bail out */
+	if (local->in_reconfig) {
+		err = -EBUSY;
+		goto out_err;
+	}
+
+	if (assoc) {
+		rcu_read_lock();
+		have_sta = sta_info_get(sdata, ap_mld_addr);
+		rcu_read_unlock();
+	}
+
+	if (!have_sta) {
+		if (mlo)
+			new_sta = sta_info_alloc_with_link(sdata, ap_mld_addr,
+							   link_id, cbss->bssid,
+							   GFP_KERNEL);
+		else
+			new_sta = sta_info_alloc(sdata, ap_mld_addr, GFP_KERNEL);
+
+		if (!new_sta) {
+			err = -ENOMEM;
+			goto out_err;
+		}
+
+		new_sta->sta.mlo = mlo;
+	}
+
+	/*
+	 * Set up the information for the new channel before setting the
+	 * new channel. We can't - completely race-free - change the basic
+	 * rates bitmap and the channel (sband) that it refers to, but if
+	 * we set it up before we at least avoid calling into the driver's
+	 * bss_info_changed() method with invalid information (since we do
+	 * call that from changing the channel - only for IDLE and perhaps
+	 * some others, but ...).
+	 *
+	 * So to avoid that, just set up all the new information before the
+	 * channel, but tell the driver to apply it only afterwards, since
+	 * it might need the new channel for that.
+	 */
+	if (new_sta) {
+		const struct cfg80211_bss_ies *ies;
+		struct link_sta_info *link_sta;
+
+		rcu_read_lock();
+		link_sta = rcu_dereference(new_sta->link[link_id]);
+		if (WARN_ON(!link_sta)) {
+			rcu_read_unlock();
+			sta_info_free(local, new_sta);
+			err = -EINVAL;
+			goto out_err;
+		}
+
+		err = ieee80211_mgd_setup_link_sta(link, new_sta,
+						   link_sta, cbss);
+		if (err) {
+			rcu_read_unlock();
+			sta_info_free(local, new_sta);
+			goto out_err;
+		}
+
+		memcpy(link->u.mgd.bssid, cbss->bssid, ETH_ALEN);
+
+		/* set timing information */
+		link->conf->beacon_int = cbss->beacon_interval;
+		ies = rcu_dereference(cbss->beacon_ies);
+		if (ies) {
+			link->conf->sync_tsf = ies->tsf;
+			link->conf->sync_device_ts =
+				bss->device_ts_beacon;
+
+			ieee80211_get_dtim(ies,
+					   &link->conf->sync_dtim_count,
+					   NULL);
+		} else if (!ieee80211_hw_check(&sdata->local->hw,
+					       TIMING_BEACON_ONLY)) {
+			ies = rcu_dereference(cbss->proberesp_ies);
+			/* must be non-NULL since beacon IEs were NULL */
+			link->conf->sync_tsf = ies->tsf;
+			link->conf->sync_device_ts =
+				bss->device_ts_presp;
+			link->conf->sync_dtim_count = 0;
+		} else {
+			link->conf->sync_tsf = 0;
+			link->conf->sync_device_ts = 0;
+			link->conf->sync_dtim_count = 0;
+		}
+		rcu_read_unlock();
+	}
+
+	if (new_sta || override) {
+		err = ieee80211_prep_channel(sdata, link, cbss,
+					     &link->u.mgd.conn_flags);
+		if (err) {
+			if (new_sta)
+				sta_info_free(local, new_sta);
+			goto out_err;
+		}
+	}
+
+	if (new_sta) {
+		/*
+		 * tell driver about BSSID, basic rates and timing
+		 * this was set up above, before setting the channel
+		 */
+		ieee80211_link_info_change_notify(sdata, link,
+						  BSS_CHANGED_BSSID |
+						  BSS_CHANGED_BASIC_RATES |
+						  BSS_CHANGED_BEACON_INT);
+
+		if (assoc)
+			sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
+
+		err = sta_info_insert(new_sta);
+		new_sta = NULL;
+		if (err) {
+			sdata_info(sdata,
+				   "failed to insert STA entry for the AP (error %d)\n",
+				   err);
+			goto out_err;
+		}
+	} else
+		WARN_ON_ONCE(!ether_addr_equal(link->u.mgd.bssid, cbss->bssid));
+
+	/* Cancel scan to ensure that nothing interferes with connection */
+	if (local->scanning)
+		ieee80211_scan_cancel(local);
+
+	return 0;
+
+out_err:
+	ieee80211_link_release_channel(&sdata->deflink);
+	ieee80211_vif_set_links(sdata, 0);
+	return err;
+}
+
+/* config hooks */
+int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
+		       struct cfg80211_auth_request *req)
+{
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	struct ieee80211_mgd_auth_data *auth_data;
+	u16 auth_alg;
+	int err;
+	bool cont_auth;
+
+	/* prepare auth data structure */
+
+	switch (req->auth_type) {
+	case NL80211_AUTHTYPE_OPEN_SYSTEM:
+		auth_alg = WLAN_AUTH_OPEN;
+		break;
+	case NL80211_AUTHTYPE_SHARED_KEY:
+		if (fips_enabled)
+			return -EOPNOTSUPP;
+		auth_alg = WLAN_AUTH_SHARED_KEY;
+		break;
+	case NL80211_AUTHTYPE_FT:
+		auth_alg = WLAN_AUTH_FT;
+		break;
+	case NL80211_AUTHTYPE_NETWORK_EAP:
+		auth_alg = WLAN_AUTH_LEAP;
+		break;
+	case NL80211_AUTHTYPE_SAE:
+		auth_alg = WLAN_AUTH_SAE;
+		break;
+	case NL80211_AUTHTYPE_FILS_SK:
+		auth_alg = WLAN_AUTH_FILS_SK;
+		break;
+	case NL80211_AUTHTYPE_FILS_SK_PFS:
+		auth_alg = WLAN_AUTH_FILS_SK_PFS;
+		break;
+	case NL80211_AUTHTYPE_FILS_PK:
+		auth_alg = WLAN_AUTH_FILS_PK;
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	if (ifmgd->assoc_data)
+		return -EBUSY;
+
+	auth_data = kzalloc(sizeof(*auth_data) + req->auth_data_len +
+			    req->ie_len, GFP_KERNEL);
+	if (!auth_data)
+		return -ENOMEM;
+
+	memcpy(auth_data->ap_addr,
+	       req->ap_mld_addr ?: req->bss->bssid,
+	       ETH_ALEN);
+	auth_data->bss = req->bss;
+	auth_data->link_id = req->link_id;
+
+	if (req->auth_data_len >= 4) {
+		if (req->auth_type == NL80211_AUTHTYPE_SAE) {
+			__le16 *pos = (__le16 *) req->auth_data;
+
+			auth_data->sae_trans = le16_to_cpu(pos[0]);
+			auth_data->sae_status = le16_to_cpu(pos[1]);
+		}
+		memcpy(auth_data->data, req->auth_data + 4,
+		       req->auth_data_len - 4);
+		auth_data->data_len += req->auth_data_len - 4;
+	}
+
+	/* Check if continuing authentication or trying to authenticate with the
+	 * same BSS that we were in the process of authenticating with and avoid
+	 * removal and re-addition of the STA entry in
+	 * ieee80211_prep_connection().
+	 */
+	cont_auth = ifmgd->auth_data && req->bss == ifmgd->auth_data->bss &&
+		    ifmgd->auth_data->link_id == req->link_id;
+
+	if (req->ie && req->ie_len) {
+		memcpy(&auth_data->data[auth_data->data_len],
+		       req->ie, req->ie_len);
+		auth_data->data_len += req->ie_len;
+	}
+
+	if (req->key && req->key_len) {
+		auth_data->key_len = req->key_len;
+		auth_data->key_idx = req->key_idx;
+		memcpy(auth_data->key, req->key, req->key_len);
+	}
+
+	auth_data->algorithm = auth_alg;
+
+	/* try to authenticate/probe */
+
+	if (ifmgd->auth_data) {
+		if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE) {
+			auth_data->peer_confirmed =
+				ifmgd->auth_data->peer_confirmed;
+		}
+		ieee80211_destroy_auth_data(sdata, cont_auth);
+	}
+
+	/* prep auth_data so we don't go into idle on disassoc */
+	ifmgd->auth_data = auth_data;
+
+	/* If this is continuation of an ongoing SAE authentication exchange
+	 * (i.e., request to send SAE Confirm) and the peer has already
+	 * confirmed, mark authentication completed since we are about to send
+	 * out SAE Confirm.
+	 */
+	if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE &&
+	    auth_data->peer_confirmed && auth_data->sae_trans == 2)
+		ieee80211_mark_sta_auth(sdata);
+
+	if (ifmgd->associated) {
+		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+
+		sdata_info(sdata,
+			   "disconnect from AP %pM for new auth to %pM\n",
+			   sdata->vif.cfg.ap_addr, auth_data->ap_addr);
+		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
+				       WLAN_REASON_UNSPECIFIED,
+				       false, frame_buf);
+
+		ieee80211_report_disconnect(sdata, frame_buf,
+					    sizeof(frame_buf), true,
+					    WLAN_REASON_UNSPECIFIED,
+					    false);
+	}
+
+	sdata_info(sdata, "authenticate with %pM\n", auth_data->ap_addr);
+
+	/* needed for transmitting the auth frame(s) properly */
+	memcpy(sdata->vif.cfg.ap_addr, auth_data->ap_addr, ETH_ALEN);
+
+	err = ieee80211_prep_connection(sdata, req->bss, req->link_id,
+					req->ap_mld_addr, cont_auth, false);
+	if (err)
+		goto err_clear;
+
+	err = ieee80211_auth(sdata);
+	if (err) {
+		sta_info_destroy_addr(sdata, auth_data->ap_addr);
+		goto err_clear;
+	}
+
+	/* hold our own reference */
+	cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
+	return 0;
+
+ err_clear:
+	if (!sdata->vif.valid_links) {
+		eth_zero_addr(sdata->deflink.u.mgd.bssid);
+		ieee80211_link_info_change_notify(sdata, &sdata->deflink,
+						  BSS_CHANGED_BSSID);
+		mutex_lock(&sdata->local->mtx);
+		ieee80211_link_release_channel(&sdata->deflink);
+		mutex_unlock(&sdata->local->mtx);
+	}
+	ifmgd->auth_data = NULL;
+	kfree(auth_data);
+	return err;
+}
+
+static ieee80211_conn_flags_t
+ieee80211_setup_assoc_link(struct ieee80211_sub_if_data *sdata,
+			   struct ieee80211_mgd_assoc_data *assoc_data,
+			   struct cfg80211_assoc_request *req,
+			   ieee80211_conn_flags_t conn_flags,
+			   unsigned int link_id)
+{
+	struct ieee80211_local *local = sdata->local;
+	const struct cfg80211_bss_ies *beacon_ies;
+	struct ieee80211_supported_band *sband;
+	const struct element *ht_elem, *vht_elem;
+	struct ieee80211_link_data *link;
+	struct cfg80211_bss *cbss;
+	struct ieee80211_bss *bss;
+	bool is_5ghz, is_6ghz;
+
+	cbss = assoc_data->link[link_id].bss;
+	if (WARN_ON(!cbss))
+		return 0;
+
+	bss = (void *)cbss->priv;
+
+	sband = local->hw.wiphy->bands[cbss->channel->band];
+	if (WARN_ON(!sband))
+		return 0;
+
+	link = sdata_dereference(sdata->link[link_id], sdata);
+	if (WARN_ON(!link))
+		return 0;
+
+	is_5ghz = cbss->channel->band == NL80211_BAND_5GHZ;
+	is_6ghz = cbss->channel->band == NL80211_BAND_6GHZ;
+
+	/* for MLO connections assume advertising all rates is OK */
+	if (!req->ap_mld_addr) {
+		assoc_data->supp_rates = bss->supp_rates;
+		assoc_data->supp_rates_len = bss->supp_rates_len;
+	}
+
+	/* copy and link elems for the STA profile */
+	if (req->links[link_id].elems_len) {
+		memcpy(assoc_data->ie_pos, req->links[link_id].elems,
+		       req->links[link_id].elems_len);
+		assoc_data->link[link_id].elems = assoc_data->ie_pos;
+		assoc_data->link[link_id].elems_len = req->links[link_id].elems_len;
+		assoc_data->ie_pos += req->links[link_id].elems_len;
+	}
+
+	rcu_read_lock();
+	ht_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_HT_OPERATION);
+	if (ht_elem && ht_elem->datalen >= sizeof(struct ieee80211_ht_operation))
+		assoc_data->link[link_id].ap_ht_param =
+			((struct ieee80211_ht_operation *)(ht_elem->data))->ht_param;
+	else if (!is_6ghz)
+		conn_flags |= IEEE80211_CONN_DISABLE_HT;
+	vht_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_VHT_CAPABILITY);
+	if (vht_elem && vht_elem->datalen >= sizeof(struct ieee80211_vht_cap)) {
+		memcpy(&assoc_data->link[link_id].ap_vht_cap, vht_elem->data,
+		       sizeof(struct ieee80211_vht_cap));
+	} else if (is_5ghz) {
+		link_info(link,
+			  "VHT capa missing/short, disabling VHT/HE/EHT\n");
+		conn_flags |= IEEE80211_CONN_DISABLE_VHT |
+			      IEEE80211_CONN_DISABLE_HE |
+			      IEEE80211_CONN_DISABLE_EHT;
+	}
+	rcu_read_unlock();
+
+	link->u.mgd.beacon_crc_valid = false;
+	link->u.mgd.dtim_period = 0;
+	link->u.mgd.have_beacon = false;
+
+	/* override HT/VHT configuration only if the AP and we support it */
+	if (!(conn_flags & IEEE80211_CONN_DISABLE_HT)) {
+		struct ieee80211_sta_ht_cap sta_ht_cap;
+
+		memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
+		ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
+	}
+
+	link->conf->eht_puncturing = 0;
+
+	rcu_read_lock();
+	beacon_ies = rcu_dereference(cbss->beacon_ies);
+	if (beacon_ies) {
+		const struct ieee80211_eht_operation *eht_oper;
+		const struct element *elem;
+		u8 dtim_count = 0;
+
+		ieee80211_get_dtim(beacon_ies, &dtim_count,
+				   &link->u.mgd.dtim_period);
+
+		sdata->deflink.u.mgd.have_beacon = true;
+
+		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
+			link->conf->sync_tsf = beacon_ies->tsf;
+			link->conf->sync_device_ts = bss->device_ts_beacon;
+			link->conf->sync_dtim_count = dtim_count;
+		}
+
+		elem = cfg80211_find_ext_elem(WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION,
+					      beacon_ies->data, beacon_ies->len);
+		if (elem && elem->datalen >= 3)
+			link->conf->profile_periodicity = elem->data[2];
+		else
+			link->conf->profile_periodicity = 0;
+
+		elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
+					  beacon_ies->data, beacon_ies->len);
+		if (elem && elem->datalen >= 11 &&
+		    (elem->data[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
+			link->conf->ema_ap = true;
+		else
+			link->conf->ema_ap = false;
+
+		elem = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION,
+					      beacon_ies->data, beacon_ies->len);
+		eht_oper = (const void *)(elem->data + 1);
+
+		if (elem &&
+		    ieee80211_eht_oper_size_ok((const void *)(elem->data + 1),
+					       elem->datalen - 1) &&
+		    (eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT) &&
+		    (eht_oper->params & IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT)) {
+			const struct ieee80211_eht_operation_info *info =
+				(void *)eht_oper->optional;
+			const u8 *disable_subchannel_bitmap = info->optional;
+			u16 bitmap;
+
+			bitmap = get_unaligned_le16(disable_subchannel_bitmap);
+			if (cfg80211_valid_disable_subchannel_bitmap(&bitmap,
+								     &link->conf->chandef))
+				ieee80211_handle_puncturing_bitmap(link,
+								   eht_oper,
+								   bitmap,
+								   NULL);
+			else
+				conn_flags |= IEEE80211_CONN_DISABLE_EHT;
+		}
+	}
+	rcu_read_unlock();
+
+	if (bss->corrupt_data) {
+		char *corrupt_type = "data";
+
+		if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
+			if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
+				corrupt_type = "beacon and probe response";
+			else
+				corrupt_type = "beacon";
+		} else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP) {
+			corrupt_type = "probe response";
+		}
+		sdata_info(sdata, "associating to AP %pM with corrupt %s\n",
+			   cbss->bssid, corrupt_type);
+	}
+
+	if (link->u.mgd.req_smps == IEEE80211_SMPS_AUTOMATIC) {
+		if (sdata->u.mgd.powersave)
+			link->smps_mode = IEEE80211_SMPS_DYNAMIC;
+		else
+			link->smps_mode = IEEE80211_SMPS_OFF;
+	} else {
+		link->smps_mode = link->u.mgd.req_smps;
+	}
+
+	return conn_flags;
+}
+
+int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
+			struct cfg80211_assoc_request *req)
+{
+	unsigned int assoc_link_id = req->link_id < 0 ? 0 : req->link_id;
+	struct ieee80211_local *local = sdata->local;
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	struct ieee80211_mgd_assoc_data *assoc_data;
+	const struct element *ssid_elem;
+	struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
+	ieee80211_conn_flags_t conn_flags = 0;
+	struct ieee80211_link_data *link;
+	struct cfg80211_bss *cbss;
+	struct ieee80211_bss *bss;
+	bool override;
+	int i, err;
+	size_t size = sizeof(*assoc_data) + req->ie_len;
+
+	for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++)
+		size += req->links[i].elems_len;
+
+	/* FIXME: no support for 4-addr MLO yet */
+	if (sdata->u.mgd.use_4addr && req->link_id >= 0)
+		return -EOPNOTSUPP;
+
+	assoc_data = kzalloc(size, GFP_KERNEL);
+	if (!assoc_data)
+		return -ENOMEM;
+
+	cbss = req->link_id < 0 ? req->bss : req->links[req->link_id].bss;
+
+	rcu_read_lock();
+	ssid_elem = ieee80211_bss_get_elem(cbss, WLAN_EID_SSID);
+	if (!ssid_elem || ssid_elem->datalen > sizeof(assoc_data->ssid)) {
+		rcu_read_unlock();
+		kfree(assoc_data);
+		return -EINVAL;
+	}
+	memcpy(assoc_data->ssid, ssid_elem->data, ssid_elem->datalen);
+	assoc_data->ssid_len = ssid_elem->datalen;
+	memcpy(vif_cfg->ssid, assoc_data->ssid, assoc_data->ssid_len);
+	vif_cfg->ssid_len = assoc_data->ssid_len;
+	rcu_read_unlock();
+
+	if (req->ap_mld_addr) {
+		for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
+			if (!req->links[i].bss)
+				continue;
+			link = sdata_dereference(sdata->link[i], sdata);
+			if (link)
+				ether_addr_copy(assoc_data->link[i].addr,
+						link->conf->addr);
+			else
+				eth_random_addr(assoc_data->link[i].addr);
+		}
+	} else {
+		memcpy(assoc_data->link[0].addr, sdata->vif.addr, ETH_ALEN);
+	}
+
+	assoc_data->s1g = cbss->channel->band == NL80211_BAND_S1GHZ;
+
+	memcpy(assoc_data->ap_addr,
+	       req->ap_mld_addr ?: req->bss->bssid,
+	       ETH_ALEN);
+
+	if (ifmgd->associated) {
+		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+
+		sdata_info(sdata,
+			   "disconnect from AP %pM for new assoc to %pM\n",
+			   sdata->vif.cfg.ap_addr, assoc_data->ap_addr);
+		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
+				       WLAN_REASON_UNSPECIFIED,
+				       false, frame_buf);
+
+		ieee80211_report_disconnect(sdata, frame_buf,
+					    sizeof(frame_buf), true,
+					    WLAN_REASON_UNSPECIFIED,
+					    false);
+	}
+
+	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
+		err = -EBUSY;
+		goto err_free;
+	}
+
+	if (ifmgd->assoc_data) {
+		err = -EBUSY;
+		goto err_free;
+	}
+
+	if (ifmgd->auth_data) {
+		bool match;
+
+		/* keep sta info, bssid if matching */
+		match = ether_addr_equal(ifmgd->auth_data->ap_addr,
+					 assoc_data->ap_addr) &&
+			ifmgd->auth_data->link_id == req->link_id;
+		ieee80211_destroy_auth_data(sdata, match);
+	}
+
+	/* prepare assoc data */
+
+	bss = (void *)cbss->priv;
+	assoc_data->wmm = bss->wmm_used &&
+			  (local->hw.queues >= IEEE80211_NUM_ACS);
+
+	/*
+	 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
+	 * We still associate in non-HT mode (11a/b/g) if any one of these
+	 * ciphers is configured as pairwise.
+	 * We can set this to true for non-11n hardware, that'll be checked
+	 * separately along with the peer capabilities.
+	 */
+	for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
+		if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
+		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
+		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
+			conn_flags |= IEEE80211_CONN_DISABLE_HT;
+			conn_flags |= IEEE80211_CONN_DISABLE_VHT;
+			conn_flags |= IEEE80211_CONN_DISABLE_HE;
+			conn_flags |= IEEE80211_CONN_DISABLE_EHT;
+			netdev_info(sdata->dev,
+				    "disabling HT/VHT/HE due to WEP/TKIP use\n");
+		}
+	}
+
+	/* also disable HT/VHT/HE/EHT if the AP doesn't use WMM */
+	if (!bss->wmm_used) {
+		conn_flags |= IEEE80211_CONN_DISABLE_HT;
+		conn_flags |= IEEE80211_CONN_DISABLE_VHT;
+		conn_flags |= IEEE80211_CONN_DISABLE_HE;
+		conn_flags |= IEEE80211_CONN_DISABLE_EHT;
+		netdev_info(sdata->dev,
+			    "disabling HT/VHT/HE as WMM/QoS is not supported by the AP\n");
+	}
+
+	if (req->flags & ASSOC_REQ_DISABLE_HT) {
+		mlme_dbg(sdata, "HT disabled by flag, disabling HT/VHT/HE\n");
+		conn_flags |= IEEE80211_CONN_DISABLE_HT;
+		conn_flags |= IEEE80211_CONN_DISABLE_VHT;
+		conn_flags |= IEEE80211_CONN_DISABLE_HE;
+		conn_flags |= IEEE80211_CONN_DISABLE_EHT;
+	}
+
+	if (req->flags & ASSOC_REQ_DISABLE_VHT) {
+		mlme_dbg(sdata, "VHT disabled by flag, disabling VHT\n");
+		conn_flags |= IEEE80211_CONN_DISABLE_VHT;
+	}
+
+	if (req->flags & ASSOC_REQ_DISABLE_HE) {
+		mlme_dbg(sdata, "HE disabled by flag, disabling HE/EHT\n");
+		conn_flags |= IEEE80211_CONN_DISABLE_HE;
+		conn_flags |= IEEE80211_CONN_DISABLE_EHT;
+	}
+
+	if (req->flags & ASSOC_REQ_DISABLE_EHT)
+		conn_flags |= IEEE80211_CONN_DISABLE_EHT;
+
+	memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
+	memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
+	       sizeof(ifmgd->ht_capa_mask));
+
+	memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
+	memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
+	       sizeof(ifmgd->vht_capa_mask));
+
+	memcpy(&ifmgd->s1g_capa, &req->s1g_capa, sizeof(ifmgd->s1g_capa));
+	memcpy(&ifmgd->s1g_capa_mask, &req->s1g_capa_mask,
+	       sizeof(ifmgd->s1g_capa_mask));
+
+	if (req->ie && req->ie_len) {
+		memcpy(assoc_data->ie, req->ie, req->ie_len);
+		assoc_data->ie_len = req->ie_len;
+		assoc_data->ie_pos = assoc_data->ie + assoc_data->ie_len;
+	} else {
+		assoc_data->ie_pos = assoc_data->ie;
+	}
+
+	if (req->fils_kek) {
+		/* should already be checked in cfg80211 - so warn */
+		if (WARN_ON(req->fils_kek_len > FILS_MAX_KEK_LEN)) {
+			err = -EINVAL;
+			goto err_free;
+		}
+		memcpy(assoc_data->fils_kek, req->fils_kek,
+		       req->fils_kek_len);
+		assoc_data->fils_kek_len = req->fils_kek_len;
+	}
+
+	if (req->fils_nonces)
+		memcpy(assoc_data->fils_nonces, req->fils_nonces,
+		       2 * FILS_NONCE_LEN);
+
+	/* default timeout */
+	assoc_data->timeout = jiffies;
+	assoc_data->timeout_started = true;
+
+	assoc_data->assoc_link_id = assoc_link_id;
+
+	if (req->ap_mld_addr) {
+		for (i = 0; i < ARRAY_SIZE(assoc_data->link); i++) {
+			assoc_data->link[i].conn_flags = conn_flags;
+			assoc_data->link[i].bss = req->links[i].bss;
+		}
+
+		/* if there was no authentication, set up the link */
+		err = ieee80211_vif_set_links(sdata, BIT(assoc_link_id));
+		if (err)
+			goto err_clear;
+	} else {
+		assoc_data->link[0].conn_flags = conn_flags;
+		assoc_data->link[0].bss = cbss;
+	}
+
+	link = sdata_dereference(sdata->link[assoc_link_id], sdata);
+	if (WARN_ON(!link)) {
+		err = -EINVAL;
+		goto err_clear;
+	}
+
+	/* keep old conn_flags from ieee80211_prep_channel() from auth */
+	conn_flags |= link->u.mgd.conn_flags;
+	conn_flags |= ieee80211_setup_assoc_link(sdata, assoc_data, req,
+						 conn_flags, assoc_link_id);
+	override = link->u.mgd.conn_flags != conn_flags;
+	link->u.mgd.conn_flags |= conn_flags;
+
+	if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
+		 ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
+	     "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
+		sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
+
+	if (bss->wmm_used && bss->uapsd_supported &&
+	    (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
+		assoc_data->uapsd = true;
+		ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
+	} else {
+		assoc_data->uapsd = false;
+		ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
+	}
+
+	if (req->prev_bssid)
+		memcpy(assoc_data->prev_ap_addr, req->prev_bssid, ETH_ALEN);
+
+	if (req->use_mfp) {
+		ifmgd->mfp = IEEE80211_MFP_REQUIRED;
+		ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
+	} else {
+		ifmgd->mfp = IEEE80211_MFP_DISABLED;
+		ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
+	}
+
+	if (req->flags & ASSOC_REQ_USE_RRM)
+		ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
+	else
+		ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;
+
+	if (req->crypto.control_port)
+		ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
+	else
+		ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
+
+	sdata->control_port_protocol = req->crypto.control_port_ethertype;
+	sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
+	sdata->control_port_over_nl80211 =
+					req->crypto.control_port_over_nl80211;
+	sdata->control_port_no_preauth = req->crypto.control_port_no_preauth;
+
+	/* kick off associate process */
+	ifmgd->assoc_data = assoc_data;
+
+	for (i = 0; i < ARRAY_SIZE(assoc_data->link); i++) {
+		if (!assoc_data->link[i].bss)
+			continue;
+		if (i == assoc_data->assoc_link_id)
+			continue;
+		/* only calculate the flags, hence link == NULL */
+		err = ieee80211_prep_channel(sdata, NULL, assoc_data->link[i].bss,
+					     &assoc_data->link[i].conn_flags);
+		if (err)
+			goto err_clear;
+	}
+
+	/* needed for transmitting the assoc frames properly */
+	memcpy(sdata->vif.cfg.ap_addr, assoc_data->ap_addr, ETH_ALEN);
+
+	err = ieee80211_prep_connection(sdata, cbss, req->link_id,
+					req->ap_mld_addr, true, override);
+	if (err)
+		goto err_clear;
+
+	assoc_data->link[assoc_data->assoc_link_id].conn_flags =
+		link->u.mgd.conn_flags;
+
+	if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC)) {
+		const struct cfg80211_bss_ies *beacon_ies;
+
+		rcu_read_lock();
+		beacon_ies = rcu_dereference(req->bss->beacon_ies);
+
+		if (beacon_ies) {
+			/*
+			 * Wait up to one beacon interval ...
+			 * should this be more if we miss one?
+			 */
+			sdata_info(sdata, "waiting for beacon from %pM\n",
+				   link->u.mgd.bssid);
+			assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
+			assoc_data->timeout_started = true;
+			assoc_data->need_beacon = true;
+		}
+		rcu_read_unlock();
+	}
+
+	run_again(sdata, assoc_data->timeout);
+
+	return 0;
+ err_clear:
+	eth_zero_addr(sdata->deflink.u.mgd.bssid);
+	ieee80211_link_info_change_notify(sdata, &sdata->deflink,
+					  BSS_CHANGED_BSSID);
+	ifmgd->assoc_data = NULL;
+ err_free:
+	kfree(assoc_data);
+	return err;
+}
+
+int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
+			 struct cfg80211_deauth_request *req)
+{
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+	bool tx = !req->local_state_change;
+	struct ieee80211_prep_tx_info info = {
+		.subtype = IEEE80211_STYPE_DEAUTH,
+	};
+
+	if (ifmgd->auth_data &&
+	    ether_addr_equal(ifmgd->auth_data->ap_addr, req->bssid)) {
+		sdata_info(sdata,
+			   "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
+			   req->bssid, req->reason_code,
+			   ieee80211_get_reason_code_string(req->reason_code));
+
+		drv_mgd_prepare_tx(sdata->local, sdata, &info);
+		ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
+					       IEEE80211_STYPE_DEAUTH,
+					       req->reason_code, tx,
+					       frame_buf);
+		ieee80211_destroy_auth_data(sdata, false);
+		ieee80211_report_disconnect(sdata, frame_buf,
+					    sizeof(frame_buf), true,
+					    req->reason_code, false);
+		drv_mgd_complete_tx(sdata->local, sdata, &info);
+		return 0;
+	}
+
+	if (ifmgd->assoc_data &&
+	    ether_addr_equal(ifmgd->assoc_data->ap_addr, req->bssid)) {
+		sdata_info(sdata,
+			   "aborting association with %pM by local choice (Reason: %u=%s)\n",
+			   req->bssid, req->reason_code,
+			   ieee80211_get_reason_code_string(req->reason_code));
+
+		drv_mgd_prepare_tx(sdata->local, sdata, &info);
+		ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
+					       IEEE80211_STYPE_DEAUTH,
+					       req->reason_code, tx,
+					       frame_buf);
+		ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
+		ieee80211_report_disconnect(sdata, frame_buf,
+					    sizeof(frame_buf), true,
+					    req->reason_code, false);
+		return 0;
+	}
+
+	if (ifmgd->associated &&
+	    ether_addr_equal(sdata->vif.cfg.ap_addr, req->bssid)) {
+		sdata_info(sdata,
+			   "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
+			   req->bssid, req->reason_code,
+			   ieee80211_get_reason_code_string(req->reason_code));
+
+		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
+				       req->reason_code, tx, frame_buf);
+		ieee80211_report_disconnect(sdata, frame_buf,
+					    sizeof(frame_buf), true,
+					    req->reason_code, false);
+		drv_mgd_complete_tx(sdata->local, sdata, &info);
+		return 0;
+	}
+
+	return -ENOTCONN;
+}
+
+int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
+			   struct cfg80211_disassoc_request *req)
+{
+	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+
+	if (!sdata->u.mgd.associated ||
+	    memcmp(sdata->vif.cfg.ap_addr, req->ap_addr, ETH_ALEN))
+		return -ENOTCONN;
+
+	sdata_info(sdata,
+		   "disassociating from %pM by local choice (Reason: %u=%s)\n",
+		   req->ap_addr, req->reason_code,
+		   ieee80211_get_reason_code_string(req->reason_code));
+
+	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
+			       req->reason_code, !req->local_state_change,
+			       frame_buf);
+
+	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
+				    req->reason_code, false);
+
+	return 0;
+}
+
+void ieee80211_mgd_stop_link(struct ieee80211_link_data *link)
+{
+	cancel_work_sync(&link->u.mgd.request_smps_work);
+	cancel_work_sync(&link->u.mgd.chswitch_work);
+}
+
+void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
+{
+	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+	/*
+	 * Make sure some work items will not run after this,
+	 * they will not do anything but might not have been
+	 * cancelled when disconnecting.
+	 */
+	cancel_work_sync(&ifmgd->monitor_work);
+	cancel_work_sync(&ifmgd->beacon_connection_loss_work);
+	cancel_work_sync(&ifmgd->csa_connection_drop_work);
+	cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
+
+	sdata_lock(sdata);
+	if (ifmgd->assoc_data)
+		ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
+	if (ifmgd->auth_data)
+		ieee80211_destroy_auth_data(sdata, false);
+	spin_lock_bh(&ifmgd->teardown_lock);
+	if (ifmgd->teardown_skb) {
+		kfree_skb(ifmgd->teardown_skb);
+		ifmgd->teardown_skb = NULL;
+		ifmgd->orig_teardown_skb = NULL;
+	}
+	kfree(ifmgd->assoc_req_ies);
+	ifmgd->assoc_req_ies = NULL;
+	ifmgd->assoc_req_ies_len = 0;
+	spin_unlock_bh(&ifmgd->teardown_lock);
+	del_timer_sync(&ifmgd->timer);
+	sdata_unlock(sdata);
+}
+
+void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
+			       enum nl80211_cqm_rssi_threshold_event rssi_event,
+			       s32 rssi_level,
+			       gfp_t gfp)
+{
+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+
+	trace_api_cqm_rssi_notify(sdata, rssi_event, rssi_level);
+
+	cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, rssi_level, gfp);
+}
+EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
+
+void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
+{
+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+
+	trace_api_cqm_beacon_loss_notify(sdata->local, sdata);
+
+	cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
+}
+EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);
+
+static void _ieee80211_enable_rssi_reports(struct ieee80211_sub_if_data *sdata,
+					    int rssi_min_thold,
+					    int rssi_max_thold)
+{
+	trace_api_enable_rssi_reports(sdata, rssi_min_thold, rssi_max_thold);
+
+	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
+		return;
+
+	/*
+	 * Scale up threshold values before storing it, as the RSSI averaging
+	 * algorithm uses a scaled up value as well. Change this scaling
+	 * factor if the RSSI averaging algorithm changes.
+	 */
+	sdata->u.mgd.rssi_min_thold = rssi_min_thold*16;
+	sdata->u.mgd.rssi_max_thold = rssi_max_thold*16;
+}
+
+void ieee80211_enable_rssi_reports(struct ieee80211_vif *vif,
+				    int rssi_min_thold,
+				    int rssi_max_thold)
+{
+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+
+	WARN_ON(rssi_min_thold == rssi_max_thold ||
+		rssi_min_thold > rssi_max_thold);
+
+	_ieee80211_enable_rssi_reports(sdata, rssi_min_thold,
+				       rssi_max_thold);
+}
+EXPORT_SYMBOL(ieee80211_enable_rssi_reports);
+
+void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif)
+{
+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+
+	_ieee80211_enable_rssi_reports(sdata, 0, 0);
+}
+EXPORT_SYMBOL(ieee80211_disable_rssi_reports);
diff --git a/static-analysis/test_inputs/mlme.lexed.staff.c b/static-analysis/test_inputs/mlme.lexed.staff.c
new file mode 100644
index 0000000..a187e53
--- /dev/null
+++ b/static-analysis/test_inputs/mlme.lexed.staff.c
@@ -0,0 +1,7632 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+static int max_nullfunc_tries = 2 ; 
+module_param ( max_nullfunc_tries , int , 0644 ) ; 
+module_parm_desc ( max_nullfunc_tries , 
+"maximum nullfunc tx tries before disconnecting (reason 4)." ) ; 
+
+static int max_probe_tries = 5 ; 
+module_param ( max_probe_tries , int , 0644 ) ; 
+module_parm_desc ( max_probe_tries , 
+"maximum probe tries before disconnecting (reason 4)." ) ; 
+
+
+
+
+
+
+
+
+
+static int beacon_loss_count = 7 ; 
+module_param ( beacon_loss_count , int , 0644 ) ; 
+module_parm_desc ( beacon_loss_count , 
+"number of beacon intervals before we decide beacon was lost." ) ; 
+
+
+
+
+
+
+
+
+
+
+
+static int probe_wait_ms = 500 ; 
+module_param ( probe_wait_ms , int , 0644 ) ; 
+module_parm_desc ( probe_wait_ms , 
+"maximum time(ms) to wait for probe response" 
+" before disconnecting (reason 4)." ) ; 
+
+
+
+
+
+
+
+
+
+
+
+
+static u16 
+ieee80211_extract_dis_subch_bmap ( const struct ieee80211_eht_operation * eht_oper , 
+struct cfg80211_chan_def * chandef , u16 bitmap ) 
+{ 
+struct ieee80211_eht_operation_info * info = ( void * ) eht_oper -> optional ; 
+struct cfg80211_chan_def ap_chandef = * chandef ; 
+u32 ap_center_freq , local_center_freq ; 
+u32 ap_bw , local_bw ; 
+int ap_start_freq , local_start_freq ; 
+u16 shift , mask ; 
+
+if ( ! ( eht_oper -> params & ieee80211_eht_oper_info_present ) || 
+! ( eht_oper -> params & 
+ieee80211_eht_oper_disabled_subchannel_bitmap_present ) ) 
+return 0 ; 
+
+
+ieee80211_chandef_eht_oper ( eht_oper , true , true , & ap_chandef ) ; 
+ap_center_freq = ap_chandef . center_freq1 ; 
+ap_bw = 20 * bit ( u8_get_bits ( info -> control , 
+ieee80211_eht_oper_chan_width ) ) ; 
+ap_start_freq = ap_center_freq - ap_bw / 2 ; 
+local_center_freq = chandef -> center_freq1 ; 
+local_bw = 20 * bit ( ieee80211_chan_width_to_rx_bw ( chandef -> width ) ) ; 
+local_start_freq = local_center_freq - local_bw / 2 ; 
+shift = ( local_start_freq - ap_start_freq ) / 20 ; 
+mask = bit ( local_bw / 20 ) - 1 ; 
+
+return ( bitmap >> shift ) & mask ; 
+} 
+
+
+
+
+
+static void 
+ieee80211_handle_puncturing_bitmap ( struct ieee80211_link_data * link , 
+const struct ieee80211_eht_operation * eht_oper , 
+u16 bitmap , u64 * changed ) 
+{ 
+struct cfg80211_chan_def * chandef = & link -> conf -> chandef ; 
+u16 extracted ; 
+u64 _changed = 0 ; 
+
+if ( ! changed ) 
+changed = & _changed ; 
+
+while ( chandef -> width > nl80211_chan_width_40 ) { 
+extracted = 
+ieee80211_extract_dis_subch_bmap ( eht_oper , chandef , 
+bitmap ) ; 
+
+if ( cfg80211_valid_disable_subchannel_bitmap ( & bitmap , 
+chandef ) ) 
+break ; 
+link -> u . mgd . conn_flags |= 
+ieee80211_chandef_downgrade ( chandef ) ; 
+* changed |= bss_changed_bandwidth ; 
+} 
+
+if ( chandef -> width <= nl80211_chan_width_40 ) 
+extracted = 0 ; 
+
+if ( link -> conf -> eht_puncturing != extracted ) { 
+link -> conf -> eht_puncturing = extracted ; 
+* changed |= bss_changed_eht_puncturing ; 
+} 
+} 
+
+
+
+
+
+
+
+
+
+
+
+static void run_again ( struct ieee80211_sub_if_data * sdata , 
+unsigned long timeout ) 
+{ 
+sdata_assert_lock ( sdata ) ; 
+
+if ( ! timer_pending ( & sdata -> u . mgd . timer ) || 
+time_before ( timeout , sdata -> u . mgd . timer . expires ) ) 
+mod_timer ( & sdata -> u . mgd . timer , timeout ) ; 
+} 
+
+void ieee80211_sta_reset_beacon_monitor ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+if ( sdata -> vif . driver_flags & ieee80211_vif_beacon_filter ) 
+return ; 
+
+if ( ieee80211_hw_check ( & sdata -> local -> hw , connection_monitor ) ) 
+return ; 
+
+mod_timer ( & sdata -> u . mgd . bcn_mon_timer , 
+round_jiffies_up ( jiffies + sdata -> u . mgd . beacon_timeout ) ) ; 
+} 
+
+void ieee80211_sta_reset_conn_monitor ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+
+if ( unlikely ( ! ifmgd -> associated ) ) 
+return ; 
+
+if ( ifmgd -> probe_send_count ) 
+ifmgd -> probe_send_count = 0 ; 
+
+if ( ieee80211_hw_check ( & sdata -> local -> hw , connection_monitor ) ) 
+return ; 
+
+mod_timer ( & ifmgd -> conn_mon_timer , 
+round_jiffies_up ( jiffies + ieee80211_connection_idle_time ) ) ; 
+} 
+
+static int ecw2cw ( int ecw ) 
+{ 
+return ( 1 << ecw ) - 1 ; 
+} 
+
+static ieee80211_conn_flags_t 
+ieee80211_determine_chantype ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_link_data * link , 
+ieee80211_conn_flags_t conn_flags , 
+struct ieee80211_supported_band * sband , 
+struct ieee80211_channel * channel , 
+u32 vht_cap_info , 
+const struct ieee80211_ht_operation * ht_oper , 
+const struct ieee80211_vht_operation * vht_oper , 
+const struct ieee80211_he_operation * he_oper , 
+const struct ieee80211_eht_operation * eht_oper , 
+const struct ieee80211_s1g_oper_ie * s1g_oper , 
+struct cfg80211_chan_def * chandef , bool tracking ) 
+{ 
+struct cfg80211_chan_def vht_chandef ; 
+struct ieee80211_sta_ht_cap sta_ht_cap ; 
+ieee80211_conn_flags_t ret ; 
+u32 ht_cfreq ; 
+
+memset ( chandef , 0 , sizeof ( struct cfg80211_chan_def ) ) ; 
+chandef -> chan = channel ; 
+chandef -> width = nl80211_chan_width_20_noht ; 
+chandef -> center_freq1 = channel -> center_freq ; 
+chandef -> freq1_offset = channel -> freq_offset ; 
+
+if ( channel -> band == nl80211_band_6ghz ) { 
+if ( ! ieee80211_chandef_he_6ghz_oper ( sdata , he_oper , eht_oper , 
+chandef ) ) { 
+mlme_dbg ( sdata , 
+"bad 6 ghz operation, disabling ht/vht/he/eht\n" ) ; 
+ret = ieee80211_conn_disable_ht | 
+ieee80211_conn_disable_vht | 
+ieee80211_conn_disable_he | 
+ieee80211_conn_disable_eht ; 
+} else { 
+ret = 0 ; 
+} 
+vht_chandef = * chandef ; 
+goto out ; 
+} else if ( sband -> band == nl80211_band_s1ghz ) { 
+if ( ! ieee80211_chandef_s1g_oper ( s1g_oper , chandef ) ) { 
+sdata_info ( sdata , 
+"missing s1g operation element? trying operating == primary\n" ) ; 
+chandef -> width = ieee80211_s1g_channel_width ( channel ) ; 
+} 
+
+ret = ieee80211_conn_disable_ht | ieee80211_conn_disable_40mhz | 
+ieee80211_conn_disable_vht | 
+ieee80211_conn_disable_80p80mhz | 
+ieee80211_conn_disable_160mhz ; 
+goto out ; 
+} 
+
+memcpy ( & sta_ht_cap , & sband -> ht_cap , sizeof ( sta_ht_cap ) ) ; 
+ieee80211_apply_htcap_overrides ( sdata , & sta_ht_cap ) ; 
+
+if ( ! ht_oper || ! sta_ht_cap . ht_supported ) { 
+mlme_dbg ( sdata , "ht operation missing / ht not supported\n" ) ; 
+ret = ieee80211_conn_disable_ht | 
+ieee80211_conn_disable_vht | 
+ieee80211_conn_disable_he | 
+ieee80211_conn_disable_eht ; 
+goto out ; 
+} 
+
+chandef -> width = nl80211_chan_width_20 ; 
+
+ht_cfreq = ieee80211_channel_to_frequency ( ht_oper -> primary_chan , 
+channel -> band ) ; 
+
+if ( ! tracking && channel -> center_freq != ht_cfreq ) { 
+
+
+
+
+
+
+
+sdata_info ( sdata , 
+"wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - disabling ht\n" , 
+channel -> center_freq , ht_cfreq , 
+ht_oper -> primary_chan , channel -> band ) ; 
+ret = ieee80211_conn_disable_ht | 
+ieee80211_conn_disable_vht | 
+ieee80211_conn_disable_he | 
+ieee80211_conn_disable_eht ; 
+goto out ; 
+} 
+
+
+if ( sta_ht_cap . cap & ieee80211_ht_cap_sup_width_20_40 ) { 
+ieee80211_chandef_ht_oper ( ht_oper , chandef ) ; 
+} else { 
+mlme_dbg ( sdata , "40 mhz not supported\n" ) ; 
+
+ret = ieee80211_conn_disable_vht ; 
+
+ret |= ieee80211_conn_disable_40mhz ; 
+goto out ; 
+} 
+
+if ( ! vht_oper || ! sband -> vht_cap . vht_supported ) { 
+mlme_dbg ( sdata , "vht operation missing / vht not supported\n" ) ; 
+ret = ieee80211_conn_disable_vht ; 
+goto out ; 
+} 
+
+vht_chandef = * chandef ; 
+if ( ! ( conn_flags & ieee80211_conn_disable_he ) && 
+he_oper && 
+( le32_to_cpu ( he_oper -> he_oper_params ) & 
+ieee80211_he_operation_vht_oper_info ) ) { 
+struct ieee80211_vht_operation he_oper_vht_cap ; 
+
+
+
+
+
+memcpy ( & he_oper_vht_cap , he_oper -> optional , 3 ) ; 
+he_oper_vht_cap . basic_mcs_set = cpu_to_le16 ( 0 ) ; 
+
+if ( ! ieee80211_chandef_vht_oper ( & sdata -> local -> hw , vht_cap_info , 
+& he_oper_vht_cap , ht_oper , 
+& vht_chandef ) ) { 
+if ( ! ( conn_flags & ieee80211_conn_disable_he ) ) 
+sdata_info ( sdata , 
+"he ap vht information is invalid, disabling he\n" ) ; 
+ret = ieee80211_conn_disable_he | ieee80211_conn_disable_eht ; 
+goto out ; 
+} 
+} else if ( ! ieee80211_chandef_vht_oper ( & sdata -> local -> hw , 
+vht_cap_info , 
+vht_oper , ht_oper , 
+& vht_chandef ) ) { 
+if ( ! ( conn_flags & ieee80211_conn_disable_vht ) ) 
+sdata_info ( sdata , 
+"ap vht information is invalid, disabling vht\n" ) ; 
+ret = ieee80211_conn_disable_vht ; 
+goto out ; 
+} 
+
+if ( ! cfg80211_chandef_valid ( & vht_chandef ) ) { 
+if ( ! ( conn_flags & ieee80211_conn_disable_vht ) ) 
+sdata_info ( sdata , 
+"ap vht information is invalid, disabling vht\n" ) ; 
+ret = ieee80211_conn_disable_vht ; 
+goto out ; 
+} 
+
+if ( cfg80211_chandef_identical ( chandef , & vht_chandef ) ) { 
+ret = 0 ; 
+goto out ; 
+} 
+
+if ( ! cfg80211_chandef_compatible ( chandef , & vht_chandef ) ) { 
+if ( ! ( conn_flags & ieee80211_conn_disable_vht ) ) 
+sdata_info ( sdata , 
+"ap vht information doesn't match ht, disabling vht\n" ) ; 
+ret = ieee80211_conn_disable_vht ; 
+goto out ; 
+} 
+
+* chandef = vht_chandef ; 
+
+
+
+
+
+
+if ( eht_oper && ( eht_oper -> params & ieee80211_eht_oper_info_present ) ) { 
+struct cfg80211_chan_def eht_chandef = * chandef ; 
+
+ieee80211_chandef_eht_oper ( eht_oper , 
+eht_chandef . width == 
+nl80211_chan_width_160 , 
+false , & eht_chandef ) ; 
+
+if ( ! cfg80211_chandef_valid ( & eht_chandef ) ) { 
+if ( ! ( conn_flags & ieee80211_conn_disable_eht ) ) 
+sdata_info ( sdata , 
+"ap eht information is invalid, disabling eht\n" ) ; 
+ret = ieee80211_conn_disable_eht ; 
+goto out ; 
+} 
+
+if ( ! cfg80211_chandef_compatible ( chandef , & eht_chandef ) ) { 
+if ( ! ( conn_flags & ieee80211_conn_disable_eht ) ) 
+sdata_info ( sdata , 
+"ap eht information is incompatible, disabling eht\n" ) ; 
+ret = ieee80211_conn_disable_eht ; 
+goto out ; 
+} 
+
+* chandef = eht_chandef ; 
+} 
+
+ret = 0 ; 
+
+out : 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+if ( tracking && 
+cfg80211_chandef_identical ( chandef , & link -> conf -> chandef ) ) 
+return ret ; 
+
+
+if ( ret & ieee80211_conn_disable_vht ) 
+vht_chandef = * chandef ; 
+
+
+
+
+
+
+
+
+
+while ( ! cfg80211_chandef_usable ( sdata -> local -> hw . wiphy , chandef , 
+tracking ? 0 : 
+ieee80211_chan_disabled ) ) { 
+if ( warn_on ( chandef -> width == nl80211_chan_width_20_noht ) ) { 
+ret = ieee80211_conn_disable_ht | 
+ieee80211_conn_disable_vht | 
+ieee80211_conn_disable_he | 
+ieee80211_conn_disable_eht ; 
+break ; 
+} 
+
+ret |= ieee80211_chandef_downgrade ( chandef ) ; 
+} 
+
+if ( ! he_oper || ! cfg80211_chandef_usable ( sdata -> wdev . wiphy , chandef , 
+ieee80211_chan_no_he ) ) 
+ret |= ieee80211_conn_disable_he | ieee80211_conn_disable_eht ; 
+
+if ( ! eht_oper || ! cfg80211_chandef_usable ( sdata -> wdev . wiphy , chandef , 
+ieee80211_chan_no_eht ) ) 
+ret |= ieee80211_conn_disable_eht ; 
+
+if ( chandef -> width != vht_chandef . width && ! tracking ) 
+sdata_info ( sdata , 
+"capabilities/regulatory prevented using ap ht/vht configuration, downgraded\n" ) ; 
+
+warn_on_once ( ! cfg80211_chandef_valid ( chandef ) ) ; 
+return ret ; 
+} 
+
+static int ieee80211_config_bw ( struct ieee80211_link_data * link , 
+const struct ieee80211_ht_cap * ht_cap , 
+const struct ieee80211_vht_cap * vht_cap , 
+const struct ieee80211_ht_operation * ht_oper , 
+const struct ieee80211_vht_operation * vht_oper , 
+const struct ieee80211_he_operation * he_oper , 
+const struct ieee80211_eht_operation * eht_oper , 
+const struct ieee80211_s1g_oper_ie * s1g_oper , 
+const u8 * bssid , u64 * changed ) 
+{ 
+struct ieee80211_sub_if_data * sdata = link -> sdata ; 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+struct ieee80211_channel * chan = link -> conf -> chandef . chan ; 
+struct ieee80211_supported_band * sband = 
+local -> hw . wiphy -> bands [ chan -> band ] ; 
+struct cfg80211_chan_def chandef ; 
+u16 ht_opmode ; 
+ieee80211_conn_flags_t flags ; 
+u32 vht_cap_info = 0 ; 
+int ret ; 
+
+
+if ( link -> u . mgd . conn_flags & ieee80211_conn_disable_ht || ! ht_oper ) 
+return 0 ; 
+
+
+if ( link -> u . mgd . conn_flags & ieee80211_conn_disable_vht ) 
+vht_oper = null ; 
+
+
+if ( link -> u . mgd . conn_flags & ieee80211_conn_disable_he || 
+! ieee80211_get_he_iftype_cap ( sband , 
+ieee80211_vif_type_p2p ( & sdata -> vif ) ) ) { 
+he_oper = null ; 
+eht_oper = null ; 
+} 
+
+
+if ( link -> u . mgd . conn_flags & ieee80211_conn_disable_eht || 
+! ieee80211_get_eht_iftype_cap ( sband , 
+ieee80211_vif_type_p2p ( & sdata -> vif ) ) ) 
+eht_oper = null ; 
+
+
+
+
+
+ht_opmode = le16_to_cpu ( ht_oper -> operation_mode ) ; 
+if ( link -> conf -> ht_operation_mode != ht_opmode ) { 
+* changed |= bss_changed_ht ; 
+link -> conf -> ht_operation_mode = ht_opmode ; 
+} 
+
+if ( vht_cap ) 
+vht_cap_info = le32_to_cpu ( vht_cap -> vht_cap_info ) ; 
+
+
+flags = ieee80211_determine_chantype ( sdata , link , 
+link -> u . mgd . conn_flags , 
+sband , chan , vht_cap_info , 
+ht_oper , vht_oper , 
+he_oper , eht_oper , 
+s1g_oper , & chandef , true ) ; 
+
+
+
+
+
+
+
+
+if ( link -> u . mgd . conn_flags & ieee80211_conn_disable_80p80mhz && 
+chandef . width == nl80211_chan_width_80p80 ) 
+flags |= ieee80211_chandef_downgrade ( & chandef ) ; 
+if ( link -> u . mgd . conn_flags & ieee80211_conn_disable_160mhz && 
+chandef . width == nl80211_chan_width_160 ) 
+flags |= ieee80211_chandef_downgrade ( & chandef ) ; 
+if ( link -> u . mgd . conn_flags & ieee80211_conn_disable_40mhz && 
+chandef . width > nl80211_chan_width_20 ) 
+flags |= ieee80211_chandef_downgrade ( & chandef ) ; 
+
+if ( cfg80211_chandef_identical ( & chandef , & link -> conf -> chandef ) ) 
+return 0 ; 
+
+link_info ( link , 
+"ap %pm changed bandwidth, new config is %d.%03d mhz, width %d (%d.%03d/%d mhz)\n" , 
+link -> u . mgd . bssid , chandef . chan -> center_freq , 
+chandef . chan -> freq_offset , chandef . width , 
+chandef . center_freq1 , chandef . freq1_offset , 
+chandef . center_freq2 ) ; 
+
+if ( flags != ( link -> u . mgd . conn_flags & 
+( ieee80211_conn_disable_ht | 
+ieee80211_conn_disable_vht | 
+ieee80211_conn_disable_he | 
+ieee80211_conn_disable_eht | 
+ieee80211_conn_disable_40mhz | 
+ieee80211_conn_disable_80p80mhz | 
+ieee80211_conn_disable_160mhz | 
+ieee80211_conn_disable_320mhz ) ) || 
+! cfg80211_chandef_valid ( & chandef ) ) { 
+sdata_info ( sdata , 
+"ap %pm changed caps/bw in a way we can't support (0x%x/0x%x) - disconnect\n" , 
+link -> u . mgd . bssid , flags , ifmgd -> flags ) ; 
+return - einval ; 
+} 
+
+ret = ieee80211_link_change_bandwidth ( link , & chandef , changed ) ; 
+
+if ( ret ) { 
+sdata_info ( sdata , 
+"ap %pm changed bandwidth to incompatible one - disconnect\n" , 
+link -> u . mgd . bssid ) ; 
+return ret ; 
+} 
+
+return 0 ; 
+} 
+
+
+
+static void ieee80211_add_ht_ie ( struct ieee80211_sub_if_data * sdata , 
+struct sk_buff * skb , u8 ap_ht_param , 
+struct ieee80211_supported_band * sband , 
+struct ieee80211_channel * channel , 
+enum ieee80211_smps_mode smps , 
+ieee80211_conn_flags_t conn_flags ) 
+{ 
+u8 * pos ; 
+u32 flags = channel -> flags ; 
+u16 cap ; 
+struct ieee80211_sta_ht_cap ht_cap ; 
+
+build_bug_on ( sizeof ( ht_cap ) != sizeof ( sband -> ht_cap ) ) ; 
+
+memcpy ( & ht_cap , & sband -> ht_cap , sizeof ( ht_cap ) ) ; 
+ieee80211_apply_htcap_overrides ( sdata , & ht_cap ) ; 
+
+
+cap = ht_cap . cap ; 
+
+switch ( ap_ht_param & ieee80211_ht_param_cha_sec_offset ) { 
+case ieee80211_ht_param_cha_sec_above : 
+if ( flags & ieee80211_chan_no_ht40plus ) { 
+cap &= ~ ieee80211_ht_cap_sup_width_20_40 ; 
+cap &= ~ ieee80211_ht_cap_sgi_40 ; 
+} 
+break ; 
+case ieee80211_ht_param_cha_sec_below : 
+if ( flags & ieee80211_chan_no_ht40minus ) { 
+cap &= ~ ieee80211_ht_cap_sup_width_20_40 ; 
+cap &= ~ ieee80211_ht_cap_sgi_40 ; 
+} 
+break ; 
+} 
+
+
+
+
+
+
+if ( conn_flags & ieee80211_conn_disable_40mhz ) { 
+cap &= ~ ieee80211_ht_cap_sup_width_20_40 ; 
+cap &= ~ ieee80211_ht_cap_sgi_40 ; 
+} 
+
+
+cap &= ~ ieee80211_ht_cap_sm_ps ; 
+switch ( smps ) { 
+case ieee80211_smps_automatic : 
+case ieee80211_smps_num_modes : 
+warn_on ( 1 ) ; 
+fallthrough ; 
+case ieee80211_smps_off : 
+cap |= wlan_ht_cap_sm_ps_disabled << 
+ieee80211_ht_cap_sm_ps_shift ; 
+break ; 
+case ieee80211_smps_static : 
+cap |= wlan_ht_cap_sm_ps_static << 
+ieee80211_ht_cap_sm_ps_shift ; 
+break ; 
+case ieee80211_smps_dynamic : 
+cap |= wlan_ht_cap_sm_ps_dynamic << 
+ieee80211_ht_cap_sm_ps_shift ; 
+break ; 
+} 
+
+
+pos = skb_put ( skb , sizeof ( struct ieee80211_ht_cap ) + 2 ) ; 
+ieee80211_ie_build_ht_cap ( pos , & ht_cap , cap ) ; 
+} 
+
+
+
+
+
+static bool ieee80211_add_vht_ie ( struct ieee80211_sub_if_data * sdata , 
+struct sk_buff * skb , 
+struct ieee80211_supported_band * sband , 
+struct ieee80211_vht_cap * ap_vht_cap , 
+ieee80211_conn_flags_t conn_flags ) 
+{ 
+struct ieee80211_local * local = sdata -> local ; 
+u8 * pos ; 
+u32 cap ; 
+struct ieee80211_sta_vht_cap vht_cap ; 
+u32 mask , ap_bf_sts , our_bf_sts ; 
+bool mu_mimo_owner = false ; 
+
+build_bug_on ( sizeof ( vht_cap ) != sizeof ( sband -> vht_cap ) ) ; 
+
+memcpy ( & vht_cap , & sband -> vht_cap , sizeof ( vht_cap ) ) ; 
+ieee80211_apply_vhtcap_overrides ( sdata , & vht_cap ) ; 
+
+
+cap = vht_cap . cap ; 
+
+if ( conn_flags & ieee80211_conn_disable_80p80mhz ) { 
+u32 bw = cap & ieee80211_vht_cap_supp_chan_width_mask ; 
+
+cap &= ~ ieee80211_vht_cap_supp_chan_width_mask ; 
+if ( bw == ieee80211_vht_cap_supp_chan_width_160mhz || 
+bw == ieee80211_vht_cap_supp_chan_width_160_80plus80mhz ) 
+cap |= ieee80211_vht_cap_supp_chan_width_160mhz ; 
+} 
+
+if ( conn_flags & ieee80211_conn_disable_160mhz ) { 
+cap &= ~ ieee80211_vht_cap_short_gi_160 ; 
+cap &= ~ ieee80211_vht_cap_supp_chan_width_mask ; 
+} 
+
+
+
+
+
+if ( ! ( ap_vht_cap -> vht_cap_info & 
+cpu_to_le32 ( ieee80211_vht_cap_su_beamformer_capable ) ) ) 
+cap &= ~ ( ieee80211_vht_cap_su_beamformee_capable | 
+ieee80211_vht_cap_mu_beamformee_capable ) ; 
+else if ( ! ( ap_vht_cap -> vht_cap_info & 
+cpu_to_le32 ( ieee80211_vht_cap_mu_beamformer_capable ) ) ) 
+cap &= ~ ieee80211_vht_cap_mu_beamformee_capable ; 
+
+
+
+
+
+
+
+
+if ( cap & ieee80211_vht_cap_mu_beamformee_capable ) { 
+bool disable_mu_mimo = false ; 
+struct ieee80211_sub_if_data * other ; 
+
+list_for_each_entry_rcu ( other , & local -> interfaces , list ) { 
+if ( other -> vif . bss_conf . mu_mimo_owner ) { 
+disable_mu_mimo = true ; 
+break ; 
+} 
+} 
+if ( disable_mu_mimo ) 
+cap &= ~ ieee80211_vht_cap_mu_beamformee_capable ; 
+else 
+mu_mimo_owner = true ; 
+} 
+
+mask = ieee80211_vht_cap_beamformee_sts_mask ; 
+
+ap_bf_sts = le32_to_cpu ( ap_vht_cap -> vht_cap_info ) & mask ; 
+our_bf_sts = cap & mask ; 
+
+if ( ap_bf_sts < our_bf_sts ) { 
+cap &= ~ mask ; 
+cap |= ap_bf_sts ; 
+} 
+
+
+pos = skb_put ( skb , sizeof ( struct ieee80211_vht_cap ) + 2 ) ; 
+ieee80211_ie_build_vht_cap ( pos , & vht_cap , cap ) ; 
+
+return mu_mimo_owner ; 
+} 
+
+
+
+
+static void ieee80211_add_he_ie ( struct ieee80211_sub_if_data * sdata , 
+struct sk_buff * skb , 
+struct ieee80211_supported_band * sband , 
+enum ieee80211_smps_mode smps_mode , 
+ieee80211_conn_flags_t conn_flags ) 
+{ 
+u8 * pos , * pre_he_pos ; 
+const struct ieee80211_sta_he_cap * he_cap ; 
+u8 he_cap_size ; 
+
+he_cap = ieee80211_get_he_iftype_cap ( sband , 
+ieee80211_vif_type_p2p ( & sdata -> vif ) ) ; 
+if ( warn_on ( ! he_cap ) ) 
+return ; 
+
+
+he_cap_size = 
+2 + 1 + sizeof ( he_cap -> he_cap_elem ) + 
+ieee80211_he_mcs_nss_size ( & he_cap -> he_cap_elem ) + 
+ieee80211_he_ppe_size ( he_cap -> ppe_thres [ 0 ] , 
+he_cap -> he_cap_elem . phy_cap_info ) ; 
+pos = skb_put ( skb , he_cap_size ) ; 
+pre_he_pos = pos ; 
+pos = ieee80211_ie_build_he_cap ( conn_flags , 
+pos , he_cap , pos + he_cap_size ) ; 
+
+skb_trim ( skb , skb -> len - ( pre_he_pos + he_cap_size - pos ) ) ; 
+
+ieee80211_ie_build_he_6ghz_cap ( sdata , smps_mode , skb ) ; 
+} 
+
+static void ieee80211_add_eht_ie ( struct ieee80211_sub_if_data * sdata , 
+struct sk_buff * skb , 
+struct ieee80211_supported_band * sband ) 
+{ 
+u8 * pos ; 
+const struct ieee80211_sta_he_cap * he_cap ; 
+const struct ieee80211_sta_eht_cap * eht_cap ; 
+u8 eht_cap_size ; 
+
+he_cap = ieee80211_get_he_iftype_cap ( sband , 
+ieee80211_vif_type_p2p ( & sdata -> vif ) ) ; 
+eht_cap = ieee80211_get_eht_iftype_cap ( sband , 
+ieee80211_vif_type_p2p ( & sdata -> vif ) ) ; 
+
+
+
+
+
+if ( warn_on ( ! he_cap || ! eht_cap ) ) 
+return ; 
+
+eht_cap_size = 
+2 + 1 + sizeof ( eht_cap -> eht_cap_elem ) + 
+ieee80211_eht_mcs_nss_size ( & he_cap -> he_cap_elem , 
+& eht_cap -> eht_cap_elem , 
+false ) + 
+ieee80211_eht_ppe_size ( eht_cap -> eht_ppe_thres [ 0 ] , 
+eht_cap -> eht_cap_elem . phy_cap_info ) ; 
+pos = skb_put ( skb , eht_cap_size ) ; 
+ieee80211_ie_build_eht_cap ( pos , he_cap , eht_cap , pos + eht_cap_size , 
+false ) ; 
+} 
+
+static void ieee80211_assoc_add_rates ( struct sk_buff * skb , 
+enum nl80211_chan_width width , 
+struct ieee80211_supported_band * sband , 
+struct ieee80211_mgd_assoc_data * assoc_data ) 
+{ 
+unsigned int shift = ieee80211_chanwidth_get_shift ( width ) ; 
+unsigned int rates_len , supp_rates_len ; 
+u32 rates = 0 ; 
+int i , count ; 
+u8 * pos ; 
+
+if ( assoc_data -> supp_rates_len ) { 
+
+
+
+
+
+
+rates_len = ieee80211_parse_bitrates ( width , sband , 
+assoc_data -> supp_rates , 
+assoc_data -> supp_rates_len , 
+& rates ) ; 
+} else { 
+
+
+
+
+
+rates_len = sband -> n_bitrates ; 
+for ( i = 0 ; i < sband -> n_bitrates ; i ++ ) 
+rates |= bit ( i ) ; 
+} 
+
+supp_rates_len = rates_len ; 
+if ( supp_rates_len > 8 ) 
+supp_rates_len = 8 ; 
+
+pos = skb_put ( skb , supp_rates_len + 2 ) ; 
+* pos ++ = wlan_eid_supp_rates ; 
+* pos ++ = supp_rates_len ; 
+
+count = 0 ; 
+for ( i = 0 ; i < sband -> n_bitrates ; i ++ ) { 
+if ( bit ( i ) & rates ) { 
+int rate = div_round_up ( sband -> bitrates [ i ] . bitrate , 
+5 * ( 1 << shift ) ) ; 
+* pos ++ = ( u8 ) rate ; 
+if ( ++ count == 8 ) 
+break ; 
+} 
+} 
+
+if ( rates_len > count ) { 
+pos = skb_put ( skb , rates_len - count + 2 ) ; 
+* pos ++ = wlan_eid_ext_supp_rates ; 
+* pos ++ = rates_len - count ; 
+
+for ( i ++ ; i < sband -> n_bitrates ; i ++ ) { 
+if ( bit ( i ) & rates ) { 
+int rate ; 
+
+rate = div_round_up ( sband -> bitrates [ i ] . bitrate , 
+5 * ( 1 << shift ) ) ; 
+* pos ++ = ( u8 ) rate ; 
+} 
+} 
+} 
+} 
+
+static size_t ieee80211_add_before_ht_elems ( struct sk_buff * skb , 
+const u8 * elems , 
+size_t elems_len , 
+size_t offset ) 
+{ 
+size_t noffset ; 
+
+static const u8 before_ht [ ] = { 
+wlan_eid_ssid , 
+wlan_eid_supp_rates , 
+wlan_eid_ext_supp_rates , 
+wlan_eid_pwr_capability , 
+wlan_eid_supported_channels , 
+wlan_eid_rsn , 
+wlan_eid_qos_capa , 
+wlan_eid_rrm_enabled_capabilities , 
+wlan_eid_mobility_domain , 
+wlan_eid_fast_bss_transition , 
+wlan_eid_ric_data , 
+wlan_eid_supported_regulatory_classes , 
+} ; 
+static const u8 after_ric [ ] = { 
+wlan_eid_supported_regulatory_classes , 
+wlan_eid_ht_capability , 
+wlan_eid_bss_coex_2040 , 
+
+wlan_eid_ext_capability , 
+wlan_eid_qos_traffic_capa , 
+wlan_eid_tim_bcast_req , 
+wlan_eid_interworking , 
+
+wlan_eid_vht_capability , 
+wlan_eid_opmode_notif , 
+} ; 
+
+if ( ! elems_len ) 
+return offset ; 
+
+noffset = ieee80211_ie_split_ric ( elems , elems_len , 
+before_ht , 
+array_size ( before_ht ) , 
+after_ric , 
+array_size ( after_ric ) , 
+offset ) ; 
+skb_put_data ( skb , elems + offset , noffset - offset ) ; 
+
+return noffset ; 
+} 
+
+static size_t ieee80211_add_before_vht_elems ( struct sk_buff * skb , 
+const u8 * elems , 
+size_t elems_len , 
+size_t offset ) 
+{ 
+static const u8 before_vht [ ] = { 
+
+
+
+
+wlan_eid_bss_coex_2040 , 
+wlan_eid_ext_capability , 
+wlan_eid_qos_traffic_capa , 
+wlan_eid_tim_bcast_req , 
+wlan_eid_interworking , 
+
+} ; 
+size_t noffset ; 
+
+if ( ! elems_len ) 
+return offset ; 
+
+
+noffset = ieee80211_ie_split ( elems , elems_len , 
+before_vht , array_size ( before_vht ) , 
+offset ) ; 
+skb_put_data ( skb , elems + offset , noffset - offset ) ; 
+
+return noffset ; 
+} 
+
+static size_t ieee80211_add_before_he_elems ( struct sk_buff * skb , 
+const u8 * elems , 
+size_t elems_len , 
+size_t offset ) 
+{ 
+static const u8 before_he [ ] = { 
+
+
+
+
+wlan_eid_opmode_notif , 
+wlan_eid_extension , wlan_eid_ext_future_chan_guidance , 
+
+wlan_eid_extension , wlan_eid_ext_fils_session , 
+wlan_eid_extension , wlan_eid_ext_fils_public_key , 
+wlan_eid_extension , wlan_eid_ext_fils_key_confirm , 
+wlan_eid_extension , wlan_eid_ext_fils_hlp_container , 
+wlan_eid_extension , wlan_eid_ext_fils_ip_addr_assign , 
+
+} ; 
+size_t noffset ; 
+
+if ( ! elems_len ) 
+return offset ; 
+
+
+noffset = ieee80211_ie_split ( elems , elems_len , 
+before_he , array_size ( before_he ) , 
+offset ) ; 
+skb_put_data ( skb , elems + offset , noffset - offset ) ; 
+
+return noffset ; 
+} 
+
+
+
+
+static void ieee80211_assoc_add_ml_elem ( struct ieee80211_sub_if_data * sdata , 
+struct sk_buff * skb , u16 capab , 
+const struct element * ext_capa , 
+const u16 * present_elems ) ; 
+
+static size_t ieee80211_assoc_link_elems ( struct ieee80211_sub_if_data * sdata , 
+struct sk_buff * skb , u16 * capab , 
+const struct element * ext_capa , 
+const u8 * extra_elems , 
+size_t extra_elems_len , 
+unsigned int link_id , 
+struct ieee80211_link_data * link , 
+u16 * present_elems ) 
+{ 
+enum nl80211_iftype iftype = ieee80211_vif_type_p2p ( & sdata -> vif ) ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+struct ieee80211_mgd_assoc_data * assoc_data = ifmgd -> assoc_data ; 
+struct cfg80211_bss * cbss = assoc_data -> link [ link_id ] . bss ; 
+struct ieee80211_channel * chan = cbss -> channel ; 
+const struct ieee80211_sband_iftype_data * iftd ; 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_supported_band * sband ; 
+enum nl80211_chan_width width = nl80211_chan_width_20 ; 
+struct ieee80211_chanctx_conf * chanctx_conf ; 
+enum ieee80211_smps_mode smps_mode ; 
+u16 orig_capab = * capab ; 
+size_t offset = 0 ; 
+int present_elems_len = 0 ; 
+u8 * pos ; 
+int i ; 
+
+
+
+
+
+
+
+
+if ( link ) 
+smps_mode = link -> smps_mode ; 
+else if ( sdata -> u . mgd . powersave ) 
+smps_mode = ieee80211_smps_dynamic ; 
+else 
+smps_mode = ieee80211_smps_off ; 
+
+if ( link ) { 
+
+
+
+
+
+rcu_read_lock ( ) ; 
+chanctx_conf = rcu_dereference ( link -> conf -> chanctx_conf ) ; 
+if ( chanctx_conf ) 
+width = chanctx_conf -> def . width ; 
+rcu_read_unlock ( ) ; 
+} 
+
+sband = local -> hw . wiphy -> bands [ chan -> band ] ; 
+iftd = ieee80211_get_sband_iftype_data ( sband , iftype ) ; 
+
+if ( sband -> band == nl80211_band_2ghz ) { 
+* capab |= wlan_capability_short_slot_time ; 
+* capab |= wlan_capability_short_preamble ; 
+} 
+
+if ( ( cbss -> capability & wlan_capability_spectrum_mgmt ) && 
+ieee80211_hw_check ( & local -> hw , spectrum_mgmt ) ) 
+* capab |= wlan_capability_spectrum_mgmt ; 
+
+if ( sband -> band != nl80211_band_s1ghz ) 
+ieee80211_assoc_add_rates ( skb , width , sband , assoc_data ) ; 
+
+if ( * capab & wlan_capability_spectrum_mgmt || 
+* capab & wlan_capability_radio_measure ) { 
+struct cfg80211_chan_def chandef = { 
+. width = width , 
+. chan = chan , 
+} ; 
+
+pos = skb_put ( skb , 4 ) ; 
+* pos ++ = wlan_eid_pwr_capability ; 
+* pos ++ = 2 ; 
+* pos ++ = 0 ; 
+
+* pos ++ = ieee80211_chandef_max_power ( & chandef ) ; 
+add_present_elem ( wlan_eid_pwr_capability ) ; 
+} 
+
+
+
+
+
+
+if ( * capab & wlan_capability_spectrum_mgmt && 
+( sband -> band != nl80211_band_6ghz || 
+! ext_capa || ext_capa -> datalen < 1 || 
+! ( ext_capa -> data [ 0 ] & wlan_ext_capa1_ext_channel_switching ) ) ) { 
+
+pos = skb_put ( skb , 2 * sband -> n_channels + 2 ) ; 
+* pos ++ = wlan_eid_supported_channels ; 
+* pos ++ = 2 * sband -> n_channels ; 
+for ( i = 0 ; i < sband -> n_channels ; i ++ ) { 
+int cf = sband -> channels [ i ] . center_freq ; 
+
+* pos ++ = ieee80211_frequency_to_channel ( cf ) ; 
+* pos ++ = 1 ; 
+} 
+add_present_elem ( wlan_eid_supported_channels ) ; 
+} 
+
+
+offset = ieee80211_add_before_ht_elems ( skb , extra_elems , 
+extra_elems_len , 
+offset ) ; 
+
+if ( sband -> band != nl80211_band_6ghz && 
+! ( assoc_data -> link [ link_id ] . conn_flags & ieee80211_conn_disable_ht ) ) { 
+ieee80211_add_ht_ie ( sdata , skb , 
+assoc_data -> link [ link_id ] . ap_ht_param , 
+sband , chan , smps_mode , 
+assoc_data -> link [ link_id ] . conn_flags ) ; 
+add_present_elem ( wlan_eid_ht_capability ) ; 
+} 
+
+
+offset = ieee80211_add_before_vht_elems ( skb , extra_elems , 
+extra_elems_len , 
+offset ) ; 
+
+if ( sband -> band != nl80211_band_6ghz && 
+! ( assoc_data -> link [ link_id ] . conn_flags & ieee80211_conn_disable_vht ) ) { 
+bool mu_mimo_owner = 
+ieee80211_add_vht_ie ( sdata , skb , sband , 
+& assoc_data -> link [ link_id ] . ap_vht_cap , 
+assoc_data -> link [ link_id ] . conn_flags ) ; 
+
+if ( link ) 
+link -> conf -> mu_mimo_owner = mu_mimo_owner ; 
+add_present_elem ( wlan_eid_vht_capability ) ; 
+} 
+
+
+
+
+
+if ( assoc_data -> link [ link_id ] . conn_flags & ieee80211_conn_disable_ht || 
+( sband -> band == nl80211_band_5ghz && 
+assoc_data -> link [ link_id ] . conn_flags & ieee80211_conn_disable_vht ) ) 
+assoc_data -> link [ link_id ] . conn_flags |= 
+ieee80211_conn_disable_he | 
+ieee80211_conn_disable_eht ; 
+
+
+offset = ieee80211_add_before_he_elems ( skb , extra_elems , 
+extra_elems_len , 
+offset ) ; 
+
+if ( ! ( assoc_data -> link [ link_id ] . conn_flags & ieee80211_conn_disable_he ) ) { 
+ieee80211_add_he_ie ( sdata , skb , sband , smps_mode , 
+assoc_data -> link [ link_id ] . conn_flags ) ; 
+add_present_ext_elem ( wlan_eid_ext_he_capability ) ; 
+} 
+
+
+
+
+
+
+if ( ! ( assoc_data -> link [ link_id ] . conn_flags & ieee80211_conn_disable_eht ) ) 
+add_present_ext_elem ( wlan_eid_ext_eht_capability ) ; 
+
+if ( link_id == assoc_data -> assoc_link_id ) 
+ieee80211_assoc_add_ml_elem ( sdata , skb , orig_capab , ext_capa , 
+present_elems ) ; 
+
+
+present_elems = null ; 
+
+if ( ! ( assoc_data -> link [ link_id ] . conn_flags & ieee80211_conn_disable_eht ) ) 
+ieee80211_add_eht_ie ( sdata , skb , sband ) ; 
+
+if ( sband -> band == nl80211_band_s1ghz ) { 
+ieee80211_add_aid_request_ie ( sdata , skb ) ; 
+ieee80211_add_s1g_capab_ie ( sdata , & sband -> s1g_cap , skb ) ; 
+} 
+
+if ( iftd && iftd -> vendor_elems . data && iftd -> vendor_elems . len ) 
+skb_put_data ( skb , iftd -> vendor_elems . data , iftd -> vendor_elems . len ) ; 
+
+if ( link ) 
+link -> u . mgd . conn_flags = assoc_data -> link [ link_id ] . conn_flags ; 
+
+return offset ; 
+} 
+
+static void ieee80211_add_non_inheritance_elem ( struct sk_buff * skb , 
+const u16 * outer , 
+const u16 * inner ) 
+{ 
+unsigned int skb_len = skb -> len ; 
+bool added = false ; 
+int i , j ; 
+u8 * len , * list_len = null ; 
+
+skb_put_u8 ( skb , wlan_eid_extension ) ; 
+len = skb_put ( skb , 1 ) ; 
+skb_put_u8 ( skb , wlan_eid_ext_non_inheritance ) ; 
+
+for ( i = 0 ; i < present_elems_max && outer [ i ] ; i ++ ) { 
+u16 elem = outer [ i ] ; 
+bool have_inner = false ; 
+bool at_extension = false ; 
+
+
+warn_on ( at_extension && elem < present_elem_ext_offs ) ; 
+
+
+if ( ! at_extension && elem >= present_elem_ext_offs ) { 
+at_extension = true ; 
+if ( ! list_len ) 
+skb_put_u8 ( skb , 0 ) ; 
+list_len = null ; 
+} 
+
+for ( j = 0 ; j < present_elems_max && inner [ j ] ; j ++ ) { 
+if ( elem == inner [ j ] ) { 
+have_inner = true ; 
+break ; 
+} 
+} 
+
+if ( have_inner ) 
+continue ; 
+
+if ( ! list_len ) { 
+list_len = skb_put ( skb , 1 ) ; 
+* list_len = 0 ; 
+} 
+* list_len += 1 ; 
+skb_put_u8 ( skb , ( u8 ) elem ) ; 
+} 
+
+if ( ! added ) 
+skb_trim ( skb , skb_len ) ; 
+else 
+* len = skb -> len - skb_len - 2 ; 
+} 
+
+static void ieee80211_assoc_add_ml_elem ( struct ieee80211_sub_if_data * sdata , 
+struct sk_buff * skb , u16 capab , 
+const struct element * ext_capa , 
+const u16 * outer_present_elems ) 
+{ 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+struct ieee80211_mgd_assoc_data * assoc_data = ifmgd -> assoc_data ; 
+struct ieee80211_multi_link_elem * ml_elem ; 
+struct ieee80211_mle_basic_common_info * common ; 
+const struct wiphy_iftype_ext_capab * ift_ext_capa ; 
+__le16 eml_capa = 0 , mld_capa_ops = 0 ; 
+unsigned int link_id ; 
+u8 * ml_elem_len ; 
+void * capab_pos ; 
+
+if ( ! sdata -> vif . valid_links ) 
+return ; 
+
+ift_ext_capa = cfg80211_get_iftype_ext_capa ( local -> hw . wiphy , 
+ieee80211_vif_type_p2p ( & sdata -> vif ) ) ; 
+if ( ift_ext_capa ) { 
+eml_capa = cpu_to_le16 ( ift_ext_capa -> eml_capabilities ) ; 
+mld_capa_ops = cpu_to_le16 ( ift_ext_capa -> mld_capa_and_ops ) ; 
+} 
+
+skb_put_u8 ( skb , wlan_eid_extension ) ; 
+ml_elem_len = skb_put ( skb , 1 ) ; 
+skb_put_u8 ( skb , wlan_eid_ext_eht_multi_link ) ; 
+ml_elem = skb_put ( skb , sizeof ( * ml_elem ) ) ; 
+ml_elem -> control = 
+cpu_to_le16 ( ieee80211_ml_control_type_basic | 
+ieee80211_mlc_basic_pres_mld_capa_op ) ; 
+common = skb_put ( skb , sizeof ( * common ) ) ; 
+common -> len = sizeof ( * common ) + 
+2 ; 
+memcpy ( common -> mld_mac_addr , sdata -> vif . addr , eth_alen ) ; 
+
+
+if ( eml_capa & 
+cpu_to_le16 ( ( ieee80211_eml_cap_emlsr_supp | 
+ieee80211_eml_cap_emlmr_support ) ) ) { 
+common -> len += 2 ; 
+ml_elem -> control |= 
+cpu_to_le16 ( ieee80211_mlc_basic_pres_eml_capa ) ; 
+skb_put_data ( skb , & eml_capa , sizeof ( eml_capa ) ) ; 
+} 
+
+mld_capa_ops &= ~ cpu_to_le16 ( ieee80211_mld_cap_op_tid_to_link_map_neg_supp ) ; 
+skb_put_data ( skb , & mld_capa_ops , sizeof ( mld_capa_ops ) ) ; 
+
+for ( link_id = 0 ; link_id < ieee80211_mld_max_num_links ; link_id ++ ) { 
+u16 link_present_elems [ present_elems_max ] = { } ; 
+const u8 * extra_elems ; 
+size_t extra_elems_len ; 
+size_t extra_used ; 
+u8 * subelem_len = null ; 
+__le16 ctrl ; 
+
+if ( ! assoc_data -> link [ link_id ] . bss || 
+link_id == assoc_data -> assoc_link_id ) 
+continue ; 
+
+extra_elems = assoc_data -> link [ link_id ] . elems ; 
+extra_elems_len = assoc_data -> link [ link_id ] . elems_len ; 
+
+skb_put_u8 ( skb , ieee80211_mle_subelem_per_sta_profile ) ; 
+subelem_len = skb_put ( skb , 1 ) ; 
+
+ctrl = cpu_to_le16 ( link_id | 
+ieee80211_mle_sta_control_complete_profile | 
+ieee80211_mle_sta_control_sta_mac_addr_present ) ; 
+skb_put_data ( skb , & ctrl , sizeof ( ctrl ) ) ; 
+skb_put_u8 ( skb , 1 + eth_alen ) ; 
+skb_put_data ( skb , assoc_data -> link [ link_id ] . addr , 
+eth_alen ) ; 
+
+
+
+
+
+
+
+
+capab_pos = skb_put ( skb , 2 ) ; 
+
+extra_used = ieee80211_assoc_link_elems ( sdata , skb , & capab , 
+ext_capa , 
+extra_elems , 
+extra_elems_len , 
+link_id , null , 
+link_present_elems ) ; 
+if ( extra_elems ) 
+skb_put_data ( skb , extra_elems + extra_used , 
+extra_elems_len - extra_used ) ; 
+
+put_unaligned_le16 ( capab , capab_pos ) ; 
+
+ieee80211_add_non_inheritance_elem ( skb , outer_present_elems , 
+link_present_elems ) ; 
+
+ieee80211_fragment_element ( skb , subelem_len ) ; 
+} 
+
+ieee80211_fragment_element ( skb , ml_elem_len ) ; 
+} 
+
+static int ieee80211_send_assoc ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+struct ieee80211_mgd_assoc_data * assoc_data = ifmgd -> assoc_data ; 
+struct ieee80211_link_data * link ; 
+struct sk_buff * skb ; 
+struct ieee80211_mgmt * mgmt ; 
+u8 * pos , qos_info , * ie_start ; 
+size_t offset , noffset ; 
+u16 capab = wlan_capability_ess , link_capab ; 
+__le16 listen_int ; 
+struct element * ext_capa = null ; 
+enum nl80211_iftype iftype = ieee80211_vif_type_p2p ( & sdata -> vif ) ; 
+struct ieee80211_prep_tx_info info = { } ; 
+unsigned int link_id , n_links = 0 ; 
+u16 present_elems [ present_elems_max ] = { } ; 
+void * capab_pos ; 
+size_t size ; 
+int ret ; 
+
+
+if ( assoc_data -> ie_len ) 
+ext_capa = ( void * ) cfg80211_find_elem ( wlan_eid_ext_capability , 
+assoc_data -> ie , 
+assoc_data -> ie_len ) ; 
+
+sdata_assert_lock ( sdata ) ; 
+
+size = local -> hw . extra_tx_headroom + 
+sizeof ( * mgmt ) + 
+2 + assoc_data -> ssid_len + 
+assoc_data -> ie_len + 
+( assoc_data -> fils_kek_len ? 16 : 0 ) + 
+9 ; 
+
+for ( link_id = 0 ; link_id < ieee80211_mld_max_num_links ; link_id ++ ) { 
+struct cfg80211_bss * cbss = assoc_data -> link [ link_id ] . bss ; 
+const struct ieee80211_sband_iftype_data * iftd ; 
+struct ieee80211_supported_band * sband ; 
+
+if ( ! cbss ) 
+continue ; 
+
+sband = local -> hw . wiphy -> bands [ cbss -> channel -> band ] ; 
+
+n_links ++ ; 
+
+size += assoc_data -> link [ link_id ] . elems_len ; 
+
+size += 4 + sband -> n_bitrates ; 
+
+size += 2 + 2 * sband -> n_channels ; 
+
+iftd = ieee80211_get_sband_iftype_data ( sband , iftype ) ; 
+if ( iftd ) 
+size += iftd -> vendor_elems . len ; 
+
+
+size += 4 ; 
+
+
+size += 2 + sizeof ( struct ieee80211_ht_cap ) ; 
+size += 2 + sizeof ( struct ieee80211_vht_cap ) ; 
+size += 2 + 1 + sizeof ( struct ieee80211_he_cap_elem ) + 
+sizeof ( struct ieee80211_he_mcs_nss_supp ) + 
+ieee80211_he_ppe_thres_max_len ; 
+
+if ( sband -> band == nl80211_band_6ghz ) 
+size += 2 + 1 + sizeof ( struct ieee80211_he_6ghz_capa ) ; 
+
+size += 2 + 1 + sizeof ( struct ieee80211_eht_cap_elem ) + 
+sizeof ( struct ieee80211_eht_mcs_nss_supp ) + 
+ieee80211_eht_ppe_thres_max_len ; 
+
+
+size += 2 + 2 + present_elems_max ; 
+
+
+if ( cbss -> capability & wlan_capability_privacy ) 
+capab |= wlan_capability_privacy ; 
+} 
+
+if ( sdata -> vif . valid_links ) { 
+
+size += sizeof ( struct ieee80211_multi_link_elem ) ; 
+
+size += sizeof ( struct ieee80211_mle_basic_common_info ) + 
+2 + 
+2 ; 
+
+
+
+
+
+
+size += ( n_links - 1 ) * 
+( 1 + 1 + 
+2 + 
+1 + eth_alen + 2 ) ; 
+} 
+
+link = sdata_dereference ( sdata -> link [ assoc_data -> assoc_link_id ] , sdata ) ; 
+if ( warn_on ( ! link ) ) 
+return - einval ; 
+
+if ( warn_on ( ! assoc_data -> link [ assoc_data -> assoc_link_id ] . bss ) ) 
+return - einval ; 
+
+skb = alloc_skb ( size , gfp_kernel ) ; 
+if ( ! skb ) 
+return - enomem ; 
+
+skb_reserve ( skb , local -> hw . extra_tx_headroom ) ; 
+
+if ( ifmgd -> flags & ieee80211_sta_enable_rrm ) 
+capab |= wlan_capability_radio_measure ; 
+
+
+if ( ieee80211_hw_check ( & local -> hw , supports_only_he_multi_bssid ) && 
+! ( link -> u . mgd . conn_flags & ieee80211_conn_disable_he ) && 
+ext_capa && ext_capa -> datalen >= 3 ) 
+ext_capa -> data [ 2 ] |= wlan_ext_capa3_multi_bssid_support ; 
+
+mgmt = skb_put_zero ( skb , 24 ) ; 
+memcpy ( mgmt -> da , sdata -> vif . cfg . ap_addr , eth_alen ) ; 
+memcpy ( mgmt -> sa , sdata -> vif . addr , eth_alen ) ; 
+memcpy ( mgmt -> bssid , sdata -> vif . cfg . ap_addr , eth_alen ) ; 
+
+listen_int = cpu_to_le16 ( assoc_data -> s1g ? 
+ieee80211_encode_usf ( local -> hw . conf . listen_interval ) : 
+local -> hw . conf . listen_interval ) ; 
+if ( ! is_zero_ether_addr ( assoc_data -> prev_ap_addr ) ) { 
+skb_put ( skb , 10 ) ; 
+mgmt -> frame_control = cpu_to_le16 ( ieee80211_ftype_mgmt | 
+ieee80211_stype_reassoc_req ) ; 
+capab_pos = & mgmt -> u . reassoc_req . capab_info ; 
+mgmt -> u . reassoc_req . listen_interval = listen_int ; 
+memcpy ( mgmt -> u . reassoc_req . current_ap , 
+assoc_data -> prev_ap_addr , eth_alen ) ; 
+info . subtype = ieee80211_stype_reassoc_req ; 
+} else { 
+skb_put ( skb , 4 ) ; 
+mgmt -> frame_control = cpu_to_le16 ( ieee80211_ftype_mgmt | 
+ieee80211_stype_assoc_req ) ; 
+capab_pos = & mgmt -> u . assoc_req . capab_info ; 
+mgmt -> u . assoc_req . listen_interval = listen_int ; 
+info . subtype = ieee80211_stype_assoc_req ; 
+} 
+
+
+pos = skb_put ( skb , 2 + assoc_data -> ssid_len ) ; 
+ie_start = pos ; 
+* pos ++ = wlan_eid_ssid ; 
+* pos ++ = assoc_data -> ssid_len ; 
+memcpy ( pos , assoc_data -> ssid , assoc_data -> ssid_len ) ; 
+
+
+link_capab = capab ; 
+offset = ieee80211_assoc_link_elems ( sdata , skb , & link_capab , 
+ext_capa , 
+assoc_data -> ie , 
+assoc_data -> ie_len , 
+assoc_data -> assoc_link_id , link , 
+present_elems ) ; 
+put_unaligned_le16 ( link_capab , capab_pos ) ; 
+
+
+if ( assoc_data -> ie_len ) { 
+noffset = ieee80211_ie_split_vendor ( assoc_data -> ie , 
+assoc_data -> ie_len , 
+offset ) ; 
+skb_put_data ( skb , assoc_data -> ie + offset , noffset - offset ) ; 
+offset = noffset ; 
+} 
+
+if ( assoc_data -> wmm ) { 
+if ( assoc_data -> uapsd ) { 
+qos_info = ifmgd -> uapsd_queues ; 
+qos_info |= ( ifmgd -> uapsd_max_sp_len << 
+ieee80211_wmm_ie_sta_qosinfo_sp_shift ) ; 
+} else { 
+qos_info = 0 ; 
+} 
+
+pos = ieee80211_add_wmm_info_ie ( skb_put ( skb , 9 ) , qos_info ) ; 
+} 
+
+
+if ( assoc_data -> ie_len ) { 
+noffset = assoc_data -> ie_len ; 
+skb_put_data ( skb , assoc_data -> ie + offset , noffset - offset ) ; 
+} 
+
+if ( assoc_data -> fils_kek_len ) { 
+ret = fils_encrypt_assoc_req ( skb , assoc_data ) ; 
+if ( ret < 0 ) { 
+dev_kfree_skb ( skb ) ; 
+return ret ; 
+} 
+} 
+
+pos = skb_tail_pointer ( skb ) ; 
+kfree ( ifmgd -> assoc_req_ies ) ; 
+ifmgd -> assoc_req_ies = kmemdup ( ie_start , pos - ie_start , gfp_atomic ) ; 
+if ( ! ifmgd -> assoc_req_ies ) { 
+dev_kfree_skb ( skb ) ; 
+return - enomem ; 
+} 
+
+ifmgd -> assoc_req_ies_len = pos - ie_start ; 
+
+drv_mgd_prepare_tx ( local , sdata , & info ) ; 
+
+ieee80211_skb_cb ( skb ) -> flags |= ieee80211_tx_intfl_dont_encrypt ; 
+if ( ieee80211_hw_check ( & local -> hw , reports_tx_ack_status ) ) 
+ieee80211_skb_cb ( skb ) -> flags |= ieee80211_tx_ctl_req_tx_status | 
+ieee80211_tx_intfl_mlme_conn_tx ; 
+ieee80211_tx_skb ( sdata , skb ) ; 
+
+return 0 ; 
+} 
+
+void ieee80211_send_pspoll ( struct ieee80211_local * local , 
+struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct ieee80211_pspoll * pspoll ; 
+struct sk_buff * skb ; 
+
+skb = ieee80211_pspoll_get ( & local -> hw , & sdata -> vif ) ; 
+if ( ! skb ) 
+return ; 
+
+pspoll = ( struct ieee80211_pspoll * ) skb -> data ; 
+pspoll -> frame_control |= cpu_to_le16 ( ieee80211_fctl_pm ) ; 
+
+ieee80211_skb_cb ( skb ) -> flags |= ieee80211_tx_intfl_dont_encrypt ; 
+ieee80211_tx_skb ( sdata , skb ) ; 
+} 
+
+void ieee80211_send_nullfunc ( struct ieee80211_local * local , 
+struct ieee80211_sub_if_data * sdata , 
+bool powersave ) 
+{ 
+struct sk_buff * skb ; 
+struct ieee80211_hdr_3addr * nullfunc ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+
+skb = ieee80211_nullfunc_get ( & local -> hw , & sdata -> vif , - 1 , 
+! ieee80211_hw_check ( & local -> hw , 
+doesnt_support_qos_ndp ) ) ; 
+if ( ! skb ) 
+return ; 
+
+nullfunc = ( struct ieee80211_hdr_3addr * ) skb -> data ; 
+if ( powersave ) 
+nullfunc -> frame_control |= cpu_to_le16 ( ieee80211_fctl_pm ) ; 
+
+ieee80211_skb_cb ( skb ) -> flags |= ieee80211_tx_intfl_dont_encrypt | 
+ieee80211_tx_intfl_offchan_tx_ok ; 
+
+if ( ieee80211_hw_check ( & local -> hw , reports_tx_ack_status ) ) 
+ieee80211_skb_cb ( skb ) -> flags |= ieee80211_tx_ctl_req_tx_status ; 
+
+if ( ifmgd -> flags & ieee80211_sta_connection_poll ) 
+ieee80211_skb_cb ( skb ) -> flags |= ieee80211_tx_ctl_use_minrate ; 
+
+ieee80211_tx_skb ( sdata , skb ) ; 
+} 
+
+void ieee80211_send_4addr_nullfunc ( struct ieee80211_local * local , 
+struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct sk_buff * skb ; 
+struct ieee80211_hdr * nullfunc ; 
+__le16 fc ; 
+
+if ( warn_on ( sdata -> vif . type != nl80211_iftype_station ) ) 
+return ; 
+
+skb = dev_alloc_skb ( local -> hw . extra_tx_headroom + 30 ) ; 
+if ( ! skb ) 
+return ; 
+
+skb_reserve ( skb , local -> hw . extra_tx_headroom ) ; 
+
+nullfunc = skb_put_zero ( skb , 30 ) ; 
+fc = cpu_to_le16 ( ieee80211_ftype_data | ieee80211_stype_nullfunc | 
+ieee80211_fctl_fromds | ieee80211_fctl_tods ) ; 
+nullfunc -> frame_control = fc ; 
+memcpy ( nullfunc -> addr1 , sdata -> deflink . u . mgd . bssid , eth_alen ) ; 
+memcpy ( nullfunc -> addr2 , sdata -> vif . addr , eth_alen ) ; 
+memcpy ( nullfunc -> addr3 , sdata -> deflink . u . mgd . bssid , eth_alen ) ; 
+memcpy ( nullfunc -> addr4 , sdata -> vif . addr , eth_alen ) ; 
+
+ieee80211_skb_cb ( skb ) -> flags |= ieee80211_tx_intfl_dont_encrypt ; 
+ieee80211_skb_cb ( skb ) -> flags |= ieee80211_tx_ctl_use_minrate ; 
+ieee80211_tx_skb ( sdata , skb ) ; 
+} 
+
+
+static void ieee80211_chswitch_work ( struct work_struct * work ) 
+{ 
+struct ieee80211_link_data * link = 
+container_of ( work , struct ieee80211_link_data , u . mgd . chswitch_work ) ; 
+struct ieee80211_sub_if_data * sdata = link -> sdata ; 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+int ret ; 
+
+if ( ! ieee80211_sdata_running ( sdata ) ) 
+return ; 
+
+sdata_lock ( sdata ) ; 
+mutex_lock ( & local -> mtx ) ; 
+mutex_lock ( & local -> chanctx_mtx ) ; 
+
+if ( ! ifmgd -> associated ) 
+goto out ; 
+
+if ( ! link -> conf -> csa_active ) 
+goto out ; 
+
+
+
+
+
+
+
+
+if ( link -> reserved_chanctx ) { 
+
+
+
+
+
+if ( link -> reserved_ready ) 
+goto out ; 
+
+ret = ieee80211_link_use_reserved_context ( link ) ; 
+if ( ret ) { 
+sdata_info ( sdata , 
+"failed to use reserved channel context, disconnecting (err=%d)\n" , 
+ret ) ; 
+ieee80211_queue_work ( & sdata -> local -> hw , 
+& ifmgd -> csa_connection_drop_work ) ; 
+goto out ; 
+} 
+
+goto out ; 
+} 
+
+if ( ! cfg80211_chandef_identical ( & link -> conf -> chandef , 
+& link -> csa_chandef ) ) { 
+sdata_info ( sdata , 
+"failed to finalize channel switch, disconnecting\n" ) ; 
+ieee80211_queue_work ( & sdata -> local -> hw , 
+& ifmgd -> csa_connection_drop_work ) ; 
+goto out ; 
+} 
+
+link -> u . mgd . csa_waiting_bcn = true ; 
+
+ieee80211_sta_reset_beacon_monitor ( sdata ) ; 
+ieee80211_sta_reset_conn_monitor ( sdata ) ; 
+
+out : 
+mutex_unlock ( & local -> chanctx_mtx ) ; 
+mutex_unlock ( & local -> mtx ) ; 
+sdata_unlock ( sdata ) ; 
+} 
+
+static void ieee80211_chswitch_post_beacon ( struct ieee80211_link_data * link ) 
+{ 
+struct ieee80211_sub_if_data * sdata = link -> sdata ; 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+int ret ; 
+
+sdata_assert_lock ( sdata ) ; 
+
+warn_on ( ! link -> conf -> csa_active ) ; 
+
+if ( link -> csa_block_tx ) { 
+ieee80211_wake_vif_queues ( local , sdata , 
+ieee80211_queue_stop_reason_csa ) ; 
+link -> csa_block_tx = false ; 
+} 
+
+link -> conf -> csa_active = false ; 
+link -> u . mgd . csa_waiting_bcn = false ; 
+
+
+
+
+link -> u . mgd . beacon_crc_valid = false ; 
+
+ret = drv_post_channel_switch ( sdata ) ; 
+if ( ret ) { 
+sdata_info ( sdata , 
+"driver post channel switch failed, disconnecting\n" ) ; 
+ieee80211_queue_work ( & local -> hw , 
+& ifmgd -> csa_connection_drop_work ) ; 
+return ; 
+} 
+
+cfg80211_ch_switch_notify ( sdata -> dev , & link -> reserved_chandef , 0 , 0 ) ; 
+} 
+
+void ieee80211_chswitch_done ( struct ieee80211_vif * vif , bool success ) 
+{ 
+struct ieee80211_sub_if_data * sdata = vif_to_sdata ( vif ) ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+
+if ( warn_on ( sdata -> vif . valid_links ) ) 
+success = false ; 
+
+trace_api_chswitch_done ( sdata , success ) ; 
+if ( ! success ) { 
+sdata_info ( sdata , 
+"driver channel switch failed, disconnecting\n" ) ; 
+ieee80211_queue_work ( & sdata -> local -> hw , 
+& ifmgd -> csa_connection_drop_work ) ; 
+} else { 
+ieee80211_queue_work ( & sdata -> local -> hw , 
+& sdata -> deflink . u . mgd . chswitch_work ) ; 
+} 
+} 
+export_symbol ( ieee80211_chswitch_done ) ; 
+
+static void ieee80211_chswitch_timer ( struct timer_list * t ) 
+{ 
+struct ieee80211_link_data * link = 
+from_timer ( link , t , u . mgd . chswitch_timer ) ; 
+
+ieee80211_queue_work ( & link -> sdata -> local -> hw , 
+& link -> u . mgd . chswitch_work ) ; 
+} 
+
+static void 
+ieee80211_sta_abort_chanswitch ( struct ieee80211_link_data * link ) 
+{ 
+struct ieee80211_sub_if_data * sdata = link -> sdata ; 
+struct ieee80211_local * local = sdata -> local ; 
+
+if ( ! local -> ops -> abort_channel_switch ) 
+return ; 
+
+mutex_lock ( & local -> mtx ) ; 
+
+mutex_lock ( & local -> chanctx_mtx ) ; 
+ieee80211_link_unreserve_chanctx ( link ) ; 
+mutex_unlock ( & local -> chanctx_mtx ) ; 
+
+if ( link -> csa_block_tx ) 
+ieee80211_wake_vif_queues ( local , sdata , 
+ieee80211_queue_stop_reason_csa ) ; 
+
+link -> csa_block_tx = false ; 
+link -> conf -> csa_active = false ; 
+
+mutex_unlock ( & local -> mtx ) ; 
+
+drv_abort_channel_switch ( sdata ) ; 
+} 
+
+static void 
+ieee80211_sta_process_chanswitch ( struct ieee80211_link_data * link , 
+u64 timestamp , u32 device_timestamp , 
+struct ieee802_11_elems * elems , 
+bool beacon ) 
+{ 
+struct ieee80211_sub_if_data * sdata = link -> sdata ; 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+struct cfg80211_bss * cbss = link -> u . mgd . bss ; 
+struct ieee80211_chanctx_conf * conf ; 
+struct ieee80211_chanctx * chanctx ; 
+enum nl80211_band current_band ; 
+struct ieee80211_csa_ie csa_ie ; 
+struct ieee80211_channel_switch ch_switch ; 
+struct ieee80211_bss * bss ; 
+int res ; 
+
+sdata_assert_lock ( sdata ) ; 
+
+if ( ! cbss ) 
+return ; 
+
+if ( local -> scanning ) 
+return ; 
+
+current_band = cbss -> channel -> band ; 
+bss = ( void * ) cbss -> priv ; 
+res = ieee80211_parse_ch_switch_ie ( sdata , elems , current_band , 
+bss -> vht_cap_info , 
+link -> u . mgd . conn_flags , 
+link -> u . mgd . bssid , & csa_ie ) ; 
+
+if ( ! res ) { 
+ch_switch . timestamp = timestamp ; 
+ch_switch . device_timestamp = device_timestamp ; 
+ch_switch . block_tx = csa_ie . mode ; 
+ch_switch . chandef = csa_ie . chandef ; 
+ch_switch . count = csa_ie . count ; 
+ch_switch . delay = csa_ie . max_switch_time ; 
+} 
+
+if ( res < 0 ) 
+goto lock_and_drop_connection ; 
+
+if ( beacon && link -> conf -> csa_active && 
+! link -> u . mgd . csa_waiting_bcn ) { 
+if ( res ) 
+ieee80211_sta_abort_chanswitch ( link ) ; 
+else 
+drv_channel_switch_rx_beacon ( sdata , & ch_switch ) ; 
+return ; 
+} else if ( link -> conf -> csa_active || res ) { 
+
+return ; 
+} 
+
+if ( link -> conf -> chandef . chan -> band != 
+csa_ie . chandef . chan -> band ) { 
+sdata_info ( sdata , 
+"ap %pm switches to different band (%d mhz, width:%d, cf1/2: %d/%d mhz), disconnecting\n" , 
+link -> u . mgd . bssid , 
+csa_ie . chandef . chan -> center_freq , 
+csa_ie . chandef . width , csa_ie . chandef . center_freq1 , 
+csa_ie . chandef . center_freq2 ) ; 
+goto lock_and_drop_connection ; 
+} 
+
+if ( ! cfg80211_chandef_usable ( local -> hw . wiphy , & csa_ie . chandef , 
+ieee80211_chan_disabled ) ) { 
+sdata_info ( sdata , 
+"ap %pm switches to unsupported channel " 
+"(%d.%03d mhz, width:%d, cf1/2: %d.%03d/%d mhz), " 
+"disconnecting\n" , 
+link -> u . mgd . bssid , 
+csa_ie . chandef . chan -> center_freq , 
+csa_ie . chandef . chan -> freq_offset , 
+csa_ie . chandef . width , csa_ie . chandef . center_freq1 , 
+csa_ie . chandef . freq1_offset , 
+csa_ie . chandef . center_freq2 ) ; 
+goto lock_and_drop_connection ; 
+} 
+
+if ( cfg80211_chandef_identical ( & csa_ie . chandef , 
+& link -> conf -> chandef ) && 
+( ! csa_ie . mode || ! beacon ) ) { 
+if ( link -> u . mgd . csa_ignored_same_chan ) 
+return ; 
+sdata_info ( sdata , 
+"ap %pm tries to chanswitch to same channel, ignore\n" , 
+link -> u . mgd . bssid ) ; 
+link -> u . mgd . csa_ignored_same_chan = true ; 
+return ; 
+} 
+
+
+
+
+
+
+
+ieee80211_teardown_tdls_peers ( sdata ) ; 
+
+mutex_lock ( & local -> mtx ) ; 
+mutex_lock ( & local -> chanctx_mtx ) ; 
+conf = rcu_dereference_protected ( link -> conf -> chanctx_conf , 
+lockdep_is_held ( & local -> chanctx_mtx ) ) ; 
+if ( ! conf ) { 
+sdata_info ( sdata , 
+"no channel context assigned to vif?, disconnecting\n" ) ; 
+goto drop_connection ; 
+} 
+
+chanctx = container_of ( conf , struct ieee80211_chanctx , conf ) ; 
+
+if ( local -> use_chanctx && 
+! ieee80211_hw_check ( & local -> hw , chanctx_sta_csa ) ) { 
+sdata_info ( sdata , 
+"driver doesn't support chan-switch with channel contexts\n" ) ; 
+goto drop_connection ; 
+} 
+
+if ( drv_pre_channel_switch ( sdata , & ch_switch ) ) { 
+sdata_info ( sdata , 
+"preparing for channel switch failed, disconnecting\n" ) ; 
+goto drop_connection ; 
+} 
+
+res = ieee80211_link_reserve_chanctx ( link , & csa_ie . chandef , 
+chanctx -> mode , false ) ; 
+if ( res ) { 
+sdata_info ( sdata , 
+"failed to reserve channel context for channel switch, disconnecting (err=%d)\n" , 
+res ) ; 
+goto drop_connection ; 
+} 
+mutex_unlock ( & local -> chanctx_mtx ) ; 
+
+link -> conf -> csa_active = true ; 
+link -> csa_chandef = csa_ie . chandef ; 
+link -> csa_block_tx = csa_ie . mode ; 
+link -> u . mgd . csa_ignored_same_chan = false ; 
+link -> u . mgd . beacon_crc_valid = false ; 
+
+if ( link -> csa_block_tx ) 
+ieee80211_stop_vif_queues ( local , sdata , 
+ieee80211_queue_stop_reason_csa ) ; 
+mutex_unlock ( & local -> mtx ) ; 
+
+cfg80211_ch_switch_started_notify ( sdata -> dev , & csa_ie . chandef , 0 , 
+csa_ie . count , csa_ie . mode , 0 ) ; 
+
+if ( local -> ops -> channel_switch ) { 
+
+drv_channel_switch ( local , sdata , & ch_switch ) ; 
+return ; 
+} 
+
+
+if ( csa_ie . count <= 1 ) 
+ieee80211_queue_work ( & local -> hw , & link -> u . mgd . chswitch_work ) ; 
+else 
+mod_timer ( & link -> u . mgd . chswitch_timer , 
+tu_to_exp_time ( ( csa_ie . count - 1 ) * 
+cbss -> beacon_interval ) ) ; 
+return ; 
+lock_and_drop_connection : 
+mutex_lock ( & local -> mtx ) ; 
+mutex_lock ( & local -> chanctx_mtx ) ; 
+drop_connection : 
+
+
+
+
+
+
+
+link -> conf -> csa_active = true ; 
+link -> csa_block_tx = csa_ie . mode ; 
+
+ieee80211_queue_work ( & local -> hw , & ifmgd -> csa_connection_drop_work ) ; 
+mutex_unlock ( & local -> chanctx_mtx ) ; 
+mutex_unlock ( & local -> mtx ) ; 
+} 
+
+static bool 
+ieee80211_find_80211h_pwr_constr ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_channel * channel , 
+const u8 * country_ie , u8 country_ie_len , 
+const u8 * pwr_constr_elem , 
+int * chan_pwr , int * pwr_reduction ) 
+{ 
+struct ieee80211_country_ie_triplet * triplet ; 
+int chan = ieee80211_frequency_to_channel ( channel -> center_freq ) ; 
+int i , chan_increment ; 
+bool have_chan_pwr = false ; 
+
+
+if ( country_ie_len % 2 || country_ie_len < ieee80211_country_ie_min_len ) 
+return false ; 
+
+triplet = ( void * ) ( country_ie + 3 ) ; 
+country_ie_len -= 3 ; 
+
+switch ( channel -> band ) { 
+default : 
+warn_on_once ( 1 ) ; 
+fallthrough ; 
+case nl80211_band_2ghz : 
+case nl80211_band_60ghz : 
+case nl80211_band_lc : 
+chan_increment = 1 ; 
+break ; 
+case nl80211_band_5ghz : 
+chan_increment = 4 ; 
+break ; 
+case nl80211_band_6ghz : 
+
+
+
+
+
+
+
+return false ; 
+} 
+
+
+while ( country_ie_len >= 3 ) { 
+u8 first_channel = triplet -> chans . first_channel ; 
+
+if ( first_channel >= ieee80211_country_extension_id ) 
+goto next ; 
+
+for ( i = 0 ; i < triplet -> chans . num_channels ; i ++ ) { 
+if ( first_channel + i * chan_increment == chan ) { 
+have_chan_pwr = true ; 
+* chan_pwr = triplet -> chans . max_power ; 
+break ; 
+} 
+} 
+if ( have_chan_pwr ) 
+break ; 
+
+next : 
+triplet ++ ; 
+country_ie_len -= 3 ; 
+} 
+
+if ( have_chan_pwr && pwr_constr_elem ) 
+* pwr_reduction = * pwr_constr_elem ; 
+else 
+* pwr_reduction = 0 ; 
+
+return have_chan_pwr ; 
+} 
+
+static void ieee80211_find_cisco_dtpc ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_channel * channel , 
+const u8 * cisco_dtpc_ie , 
+int * pwr_level ) 
+{ 
+
+
+
+
+
+
+* pwr_level = ( __s8 ) cisco_dtpc_ie [ 4 ] ; 
+} 
+
+static u32 ieee80211_handle_pwr_constr ( struct ieee80211_link_data * link , 
+struct ieee80211_channel * channel , 
+struct ieee80211_mgmt * mgmt , 
+const u8 * country_ie , u8 country_ie_len , 
+const u8 * pwr_constr_ie , 
+const u8 * cisco_dtpc_ie ) 
+{ 
+struct ieee80211_sub_if_data * sdata = link -> sdata ; 
+bool has_80211h_pwr = false , has_cisco_pwr = false ; 
+int chan_pwr = 0 , pwr_reduction_80211h = 0 ; 
+int pwr_level_cisco , pwr_level_80211h ; 
+int new_ap_level ; 
+__le16 capab = mgmt -> u . probe_resp . capab_info ; 
+
+if ( ieee80211_is_s1g_beacon ( mgmt -> frame_control ) ) 
+return 0 ; 
+
+if ( country_ie && 
+( capab & cpu_to_le16 ( wlan_capability_spectrum_mgmt ) || 
+capab & cpu_to_le16 ( wlan_capability_radio_measure ) ) ) { 
+has_80211h_pwr = ieee80211_find_80211h_pwr_constr ( 
+sdata , channel , country_ie , country_ie_len , 
+pwr_constr_ie , & chan_pwr , & pwr_reduction_80211h ) ; 
+pwr_level_80211h = 
+max_t ( int , 0 , chan_pwr - pwr_reduction_80211h ) ; 
+} 
+
+if ( cisco_dtpc_ie ) { 
+ieee80211_find_cisco_dtpc ( 
+sdata , channel , cisco_dtpc_ie , & pwr_level_cisco ) ; 
+has_cisco_pwr = true ; 
+} 
+
+if ( ! has_80211h_pwr && ! has_cisco_pwr ) 
+return 0 ; 
+
+
+
+
+if ( has_80211h_pwr && 
+( ! has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco ) ) { 
+new_ap_level = pwr_level_80211h ; 
+
+if ( link -> ap_power_level == new_ap_level ) 
+return 0 ; 
+
+sdata_dbg ( sdata , 
+"limiting tx power to %d (%d - %d) dbm as advertised by %pm\n" , 
+pwr_level_80211h , chan_pwr , pwr_reduction_80211h , 
+link -> u . mgd . bssid ) ; 
+} else { 
+new_ap_level = pwr_level_cisco ; 
+
+if ( link -> ap_power_level == new_ap_level ) 
+return 0 ; 
+
+sdata_dbg ( sdata , 
+"limiting tx power to %d dbm as advertised by %pm\n" , 
+pwr_level_cisco , link -> u . mgd . bssid ) ; 
+} 
+
+link -> ap_power_level = new_ap_level ; 
+if ( __ieee80211_recalc_txpower ( sdata ) ) 
+return bss_changed_txpower ; 
+return 0 ; 
+} 
+
+
+static void ieee80211_enable_ps ( struct ieee80211_local * local , 
+struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct ieee80211_conf * conf = & local -> hw . conf ; 
+
+
+
+
+
+if ( local -> scanning ) 
+return ; 
+
+if ( conf -> dynamic_ps_timeout > 0 && 
+! ieee80211_hw_check ( & local -> hw , supports_dynamic_ps ) ) { 
+mod_timer ( & local -> dynamic_ps_timer , jiffies + 
+msecs_to_jiffies ( conf -> dynamic_ps_timeout ) ) ; 
+} else { 
+if ( ieee80211_hw_check ( & local -> hw , ps_nullfunc_stack ) ) 
+ieee80211_send_nullfunc ( local , sdata , true ) ; 
+
+if ( ieee80211_hw_check ( & local -> hw , ps_nullfunc_stack ) && 
+ieee80211_hw_check ( & local -> hw , reports_tx_ack_status ) ) 
+return ; 
+
+conf -> flags |= ieee80211_conf_ps ; 
+ieee80211_hw_config ( local , ieee80211_conf_change_ps ) ; 
+} 
+} 
+
+static void ieee80211_change_ps ( struct ieee80211_local * local ) 
+{ 
+struct ieee80211_conf * conf = & local -> hw . conf ; 
+
+if ( local -> ps_sdata ) { 
+ieee80211_enable_ps ( local , local -> ps_sdata ) ; 
+} else if ( conf -> flags & ieee80211_conf_ps ) { 
+conf -> flags &= ~ ieee80211_conf_ps ; 
+ieee80211_hw_config ( local , ieee80211_conf_change_ps ) ; 
+del_timer_sync ( & local -> dynamic_ps_timer ) ; 
+cancel_work_sync ( & local -> dynamic_ps_enable_work ) ; 
+} 
+} 
+
+static bool ieee80211_powersave_allowed ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_if_managed * mgd = & sdata -> u . mgd ; 
+struct sta_info * sta = null ; 
+bool authorized = false ; 
+
+if ( ! mgd -> powersave ) 
+return false ; 
+
+if ( mgd -> broken_ap ) 
+return false ; 
+
+if ( ! mgd -> associated ) 
+return false ; 
+
+if ( mgd -> flags & ieee80211_sta_connection_poll ) 
+return false ; 
+
+if ( ! ( local -> hw . wiphy -> flags & wiphy_flag_supports_mlo ) && 
+! sdata -> deflink . u . mgd . have_beacon ) 
+return false ; 
+
+rcu_read_lock ( ) ; 
+sta = sta_info_get ( sdata , sdata -> vif . cfg . ap_addr ) ; 
+if ( sta ) 
+authorized = test_sta_flag ( sta , wlan_sta_authorized ) ; 
+rcu_read_unlock ( ) ; 
+
+return authorized ; 
+} 
+
+
+void ieee80211_recalc_ps ( struct ieee80211_local * local ) 
+{ 
+struct ieee80211_sub_if_data * sdata , * found = null ; 
+int count = 0 ; 
+int timeout ; 
+
+if ( ! ieee80211_hw_check ( & local -> hw , supports_ps ) || 
+ieee80211_hw_check ( & local -> hw , supports_dynamic_ps ) ) { 
+local -> ps_sdata = null ; 
+return ; 
+} 
+
+list_for_each_entry ( sdata , & local -> interfaces , list ) { 
+if ( ! ieee80211_sdata_running ( sdata ) ) 
+continue ; 
+if ( sdata -> vif . type == nl80211_iftype_ap ) { 
+
+
+
+
+count = 0 ; 
+break ; 
+} 
+if ( sdata -> vif . type != nl80211_iftype_station ) 
+continue ; 
+found = sdata ; 
+count ++ ; 
+} 
+
+if ( count == 1 && ieee80211_powersave_allowed ( found ) ) { 
+u8 dtimper = found -> deflink . u . mgd . dtim_period ; 
+
+timeout = local -> dynamic_ps_forced_timeout ; 
+if ( timeout < 0 ) 
+timeout = 100 ; 
+local -> hw . conf . dynamic_ps_timeout = timeout ; 
+
+
+if ( ! dtimper ) 
+dtimper = 1 ; 
+
+local -> hw . conf . ps_dtim_period = dtimper ; 
+local -> ps_sdata = found ; 
+} else { 
+local -> ps_sdata = null ; 
+} 
+
+ieee80211_change_ps ( local ) ; 
+} 
+
+void ieee80211_recalc_ps_vif ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+bool ps_allowed = ieee80211_powersave_allowed ( sdata ) ; 
+
+if ( sdata -> vif . cfg . ps != ps_allowed ) { 
+sdata -> vif . cfg . ps = ps_allowed ; 
+ieee80211_vif_cfg_change_notify ( sdata , bss_changed_ps ) ; 
+} 
+} 
+
+void ieee80211_dynamic_ps_disable_work ( struct work_struct * work ) 
+{ 
+struct ieee80211_local * local = 
+container_of ( work , struct ieee80211_local , 
+dynamic_ps_disable_work ) ; 
+
+if ( local -> hw . conf . flags & ieee80211_conf_ps ) { 
+local -> hw . conf . flags &= ~ ieee80211_conf_ps ; 
+ieee80211_hw_config ( local , ieee80211_conf_change_ps ) ; 
+} 
+
+ieee80211_wake_queues_by_reason ( & local -> hw , 
+ieee80211_max_queue_map , 
+ieee80211_queue_stop_reason_ps , 
+false ) ; 
+} 
+
+void ieee80211_dynamic_ps_enable_work ( struct work_struct * work ) 
+{ 
+struct ieee80211_local * local = 
+container_of ( work , struct ieee80211_local , 
+dynamic_ps_enable_work ) ; 
+struct ieee80211_sub_if_data * sdata = local -> ps_sdata ; 
+struct ieee80211_if_managed * ifmgd ; 
+unsigned long flags ; 
+int q ; 
+
+
+if ( ! sdata ) 
+return ; 
+
+ifmgd = & sdata -> u . mgd ; 
+
+if ( local -> hw . conf . flags & ieee80211_conf_ps ) 
+return ; 
+
+if ( local -> hw . conf . dynamic_ps_timeout > 0 ) { 
+
+if ( drv_tx_frames_pending ( local ) ) { 
+mod_timer ( & local -> dynamic_ps_timer , jiffies + 
+msecs_to_jiffies ( 
+local -> hw . conf . dynamic_ps_timeout ) ) ; 
+return ; 
+} 
+
+
+
+
+
+
+spin_lock_irqsave ( & local -> queue_stop_reason_lock , flags ) ; 
+for ( q = 0 ; q < local -> hw . queues ; q ++ ) { 
+if ( local -> queue_stop_reasons [ q ] ) { 
+spin_unlock_irqrestore ( & local -> queue_stop_reason_lock , 
+flags ) ; 
+mod_timer ( & local -> dynamic_ps_timer , jiffies + 
+msecs_to_jiffies ( 
+local -> hw . conf . dynamic_ps_timeout ) ) ; 
+return ; 
+} 
+} 
+spin_unlock_irqrestore ( & local -> queue_stop_reason_lock , flags ) ; 
+} 
+
+if ( ieee80211_hw_check ( & local -> hw , ps_nullfunc_stack ) && 
+! ( ifmgd -> flags & ieee80211_sta_nullfunc_acked ) ) { 
+if ( drv_tx_frames_pending ( local ) ) { 
+mod_timer ( & local -> dynamic_ps_timer , jiffies + 
+msecs_to_jiffies ( 
+local -> hw . conf . dynamic_ps_timeout ) ) ; 
+} else { 
+ieee80211_send_nullfunc ( local , sdata , true ) ; 
+
+ieee80211_flush_queues ( local , sdata , false ) ; 
+} 
+} 
+
+if ( ! ( ieee80211_hw_check ( & local -> hw , reports_tx_ack_status ) && 
+ieee80211_hw_check ( & local -> hw , ps_nullfunc_stack ) ) || 
+( ifmgd -> flags & ieee80211_sta_nullfunc_acked ) ) { 
+ifmgd -> flags &= ~ ieee80211_sta_nullfunc_acked ; 
+local -> hw . conf . flags |= ieee80211_conf_ps ; 
+ieee80211_hw_config ( local , ieee80211_conf_change_ps ) ; 
+} 
+} 
+
+void ieee80211_dynamic_ps_timer ( struct timer_list * t ) 
+{ 
+struct ieee80211_local * local = from_timer ( local , t , dynamic_ps_timer ) ; 
+
+ieee80211_queue_work ( & local -> hw , & local -> dynamic_ps_enable_work ) ; 
+} 
+
+void ieee80211_dfs_cac_timer_work ( struct work_struct * work ) 
+{ 
+struct delayed_work * delayed_work = to_delayed_work ( work ) ; 
+struct ieee80211_link_data * link = 
+container_of ( delayed_work , struct ieee80211_link_data , 
+dfs_cac_timer_work ) ; 
+struct cfg80211_chan_def chandef = link -> conf -> chandef ; 
+struct ieee80211_sub_if_data * sdata = link -> sdata ; 
+
+mutex_lock ( & sdata -> local -> mtx ) ; 
+if ( sdata -> wdev . cac_started ) { 
+ieee80211_link_release_channel ( link ) ; 
+cfg80211_cac_event ( sdata -> dev , & chandef , 
+nl80211_radar_cac_finished , 
+gfp_kernel ) ; 
+} 
+mutex_unlock ( & sdata -> local -> mtx ) ; 
+} 
+
+static bool 
+__ieee80211_sta_handle_tspec_ac_params ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+bool ret = false ; 
+int ac ; 
+
+if ( local -> hw . queues < ieee80211_num_acs ) 
+return false ; 
+
+for ( ac = 0 ; ac < ieee80211_num_acs ; ac ++ ) { 
+struct ieee80211_sta_tx_tspec * tx_tspec = & ifmgd -> tx_tspec [ ac ] ; 
+int non_acm_ac ; 
+unsigned long now = jiffies ; 
+
+if ( tx_tspec -> action == tx_tspec_action_none && 
+tx_tspec -> admitted_time && 
+time_after ( now , tx_tspec -> time_slice_start + hz ) ) { 
+tx_tspec -> consumed_tx_time = 0 ; 
+tx_tspec -> time_slice_start = now ; 
+
+if ( tx_tspec -> downgraded ) 
+tx_tspec -> action = 
+tx_tspec_action_stop_downgrade ; 
+} 
+
+switch ( tx_tspec -> action ) { 
+case tx_tspec_action_stop_downgrade : 
+
+if ( drv_conf_tx ( local , & sdata -> deflink , ac , 
+& sdata -> deflink . tx_conf [ ac ] ) ) 
+link_err ( & sdata -> deflink , 
+"failed to set tx queue parameters for queue %d\n" , 
+ac ) ; 
+tx_tspec -> action = tx_tspec_action_none ; 
+tx_tspec -> downgraded = false ; 
+ret = true ; 
+break ; 
+case tx_tspec_action_downgrade : 
+if ( time_after ( now , tx_tspec -> time_slice_start + hz ) ) { 
+tx_tspec -> action = tx_tspec_action_none ; 
+ret = true ; 
+break ; 
+} 
+
+for ( non_acm_ac = ac + 1 ; 
+non_acm_ac < ieee80211_num_acs ; 
+non_acm_ac ++ ) 
+if ( ! ( sdata -> wmm_acm & bit ( 7 - 2 * non_acm_ac ) ) ) 
+break ; 
+
+
+
+
+
+
+
+if ( non_acm_ac >= ieee80211_num_acs ) 
+non_acm_ac = ieee80211_ac_bk ; 
+if ( drv_conf_tx ( local , & sdata -> deflink , ac , 
+& sdata -> deflink . tx_conf [ non_acm_ac ] ) ) 
+link_err ( & sdata -> deflink , 
+"failed to set tx queue parameters for queue %d\n" , 
+ac ) ; 
+tx_tspec -> action = tx_tspec_action_none ; 
+ret = true ; 
+schedule_delayed_work ( & ifmgd -> tx_tspec_wk , 
+tx_tspec -> time_slice_start + hz - now + 1 ) ; 
+break ; 
+case tx_tspec_action_none : 
+
+break ; 
+} 
+} 
+
+return ret ; 
+} 
+
+void ieee80211_sta_handle_tspec_ac_params ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+if ( __ieee80211_sta_handle_tspec_ac_params ( sdata ) ) 
+ieee80211_link_info_change_notify ( sdata , & sdata -> deflink , 
+bss_changed_qos ) ; 
+} 
+
+static void ieee80211_sta_handle_tspec_ac_params_wk ( struct work_struct * work ) 
+{ 
+struct ieee80211_sub_if_data * sdata ; 
+
+sdata = container_of ( work , struct ieee80211_sub_if_data , 
+u . mgd . tx_tspec_wk . work ) ; 
+ieee80211_sta_handle_tspec_ac_params ( sdata ) ; 
+} 
+
+void ieee80211_mgd_set_link_qos_params ( struct ieee80211_link_data * link ) 
+{ 
+struct ieee80211_sub_if_data * sdata = link -> sdata ; 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+struct ieee80211_tx_queue_params * params = link -> tx_conf ; 
+u8 ac ; 
+
+for ( ac = 0 ; ac < ieee80211_num_acs ; ac ++ ) { 
+mlme_dbg ( sdata , 
+"wmm ac=%d acm=%d aifs=%d cwmin=%d cwmax=%d txop=%d uapsd=%d, downgraded=%d\n" , 
+ac , params [ ac ] . acm , 
+params [ ac ] . aifs , params [ ac ] . cw_min , params [ ac ] . cw_max , 
+params [ ac ] . txop , params [ ac ] . uapsd , 
+ifmgd -> tx_tspec [ ac ] . downgraded ) ; 
+if ( ! ifmgd -> tx_tspec [ ac ] . downgraded && 
+drv_conf_tx ( local , link , ac , & params [ ac ] ) ) 
+link_err ( link , 
+"failed to set tx queue parameters for ac %d\n" , 
+ac ) ; 
+} 
+} 
+
+
+static bool 
+ieee80211_sta_wmm_params ( struct ieee80211_local * local , 
+struct ieee80211_link_data * link , 
+const u8 * wmm_param , size_t wmm_param_len , 
+const struct ieee80211_mu_edca_param_set * mu_edca ) 
+{ 
+struct ieee80211_sub_if_data * sdata = link -> sdata ; 
+struct ieee80211_tx_queue_params params [ ieee80211_num_acs ] ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+size_t left ; 
+int count , mu_edca_count , ac ; 
+const u8 * pos ; 
+u8 uapsd_queues = 0 ; 
+
+if ( ! local -> ops -> conf_tx ) 
+return false ; 
+
+if ( local -> hw . queues < ieee80211_num_acs ) 
+return false ; 
+
+if ( ! wmm_param ) 
+return false ; 
+
+if ( wmm_param_len < 8 || wmm_param [ 5 ] != 1 ) 
+return false ; 
+
+if ( ifmgd -> flags & ieee80211_sta_uapsd_enabled ) 
+uapsd_queues = ifmgd -> uapsd_queues ; 
+
+count = wmm_param [ 6 ] & 0x0f ; 
+
+
+
+
+mu_edca_count = mu_edca ? mu_edca -> mu_qos_info & 0x0f : - 1 ; 
+if ( count == link -> u . mgd . wmm_last_param_set && 
+mu_edca_count == link -> u . mgd . mu_edca_last_param_set ) 
+return false ; 
+link -> u . mgd . wmm_last_param_set = count ; 
+link -> u . mgd . mu_edca_last_param_set = mu_edca_count ; 
+
+pos = wmm_param + 8 ; 
+left = wmm_param_len - 8 ; 
+
+memset ( & params , 0 , sizeof ( params ) ) ; 
+
+sdata -> wmm_acm = 0 ; 
+for ( ; left >= 4 ; left -= 4 , pos += 4 ) { 
+int aci = ( pos [ 0 ] >> 5 ) & 0x03 ; 
+int acm = ( pos [ 0 ] >> 4 ) & 0x01 ; 
+bool uapsd = false ; 
+
+switch ( aci ) { 
+case 1 : 
+ac = ieee80211_ac_bk ; 
+if ( acm ) 
+sdata -> wmm_acm |= bit ( 1 ) | bit ( 2 ) ; 
+if ( uapsd_queues & ieee80211_wmm_ie_sta_qosinfo_ac_bk ) 
+uapsd = true ; 
+params [ ac ] . mu_edca = ! ! mu_edca ; 
+if ( mu_edca ) 
+params [ ac ] . mu_edca_param_rec = mu_edca -> ac_bk ; 
+break ; 
+case 2 : 
+ac = ieee80211_ac_vi ; 
+if ( acm ) 
+sdata -> wmm_acm |= bit ( 4 ) | bit ( 5 ) ; 
+if ( uapsd_queues & ieee80211_wmm_ie_sta_qosinfo_ac_vi ) 
+uapsd = true ; 
+params [ ac ] . mu_edca = ! ! mu_edca ; 
+if ( mu_edca ) 
+params [ ac ] . mu_edca_param_rec = mu_edca -> ac_vi ; 
+break ; 
+case 3 : 
+ac = ieee80211_ac_vo ; 
+if ( acm ) 
+sdata -> wmm_acm |= bit ( 6 ) | bit ( 7 ) ; 
+if ( uapsd_queues & ieee80211_wmm_ie_sta_qosinfo_ac_vo ) 
+uapsd = true ; 
+params [ ac ] . mu_edca = ! ! mu_edca ; 
+if ( mu_edca ) 
+params [ ac ] . mu_edca_param_rec = mu_edca -> ac_vo ; 
+break ; 
+case 0 : 
+default : 
+ac = ieee80211_ac_be ; 
+if ( acm ) 
+sdata -> wmm_acm |= bit ( 0 ) | bit ( 3 ) ; 
+if ( uapsd_queues & ieee80211_wmm_ie_sta_qosinfo_ac_be ) 
+uapsd = true ; 
+params [ ac ] . mu_edca = ! ! mu_edca ; 
+if ( mu_edca ) 
+params [ ac ] . mu_edca_param_rec = mu_edca -> ac_be ; 
+break ; 
+} 
+
+params [ ac ] . aifs = pos [ 0 ] & 0x0f ; 
+
+if ( params [ ac ] . aifs < 2 ) { 
+sdata_info ( sdata , 
+"ap has invalid wmm params (aifsn=%d for aci %d), will use 2\n" , 
+params [ ac ] . aifs , aci ) ; 
+params [ ac ] . aifs = 2 ; 
+} 
+params [ ac ] . cw_max = ecw2cw ( ( pos [ 1 ] & 0xf0 ) >> 4 ) ; 
+params [ ac ] . cw_min = ecw2cw ( pos [ 1 ] & 0x0f ) ; 
+params [ ac ] . txop = get_unaligned_le16 ( pos + 2 ) ; 
+params [ ac ] . acm = acm ; 
+params [ ac ] . uapsd = uapsd ; 
+
+if ( params [ ac ] . cw_min == 0 || 
+params [ ac ] . cw_min > params [ ac ] . cw_max ) { 
+sdata_info ( sdata , 
+"ap has invalid wmm params (cwmin/max=%d/%d for aci %d), using defaults\n" , 
+params [ ac ] . cw_min , params [ ac ] . cw_max , aci ) ; 
+return false ; 
+} 
+ieee80211_regulatory_limit_wmm_params ( sdata , & params [ ac ] , ac ) ; 
+} 
+
+
+for ( ac = 0 ; ac < ieee80211_num_acs ; ac ++ ) { 
+if ( params [ ac ] . cw_min == 0 ) { 
+sdata_info ( sdata , 
+"ap has invalid wmm params (missing ac %d), using defaults\n" , 
+ac ) ; 
+return false ; 
+} 
+} 
+
+for ( ac = 0 ; ac < ieee80211_num_acs ; ac ++ ) 
+link -> tx_conf [ ac ] = params [ ac ] ; 
+
+ieee80211_mgd_set_link_qos_params ( link ) ; 
+
+
+link -> conf -> qos = true ; 
+return true ; 
+} 
+
+static void __ieee80211_stop_poll ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+lockdep_assert_held ( & sdata -> local -> mtx ) ; 
+
+sdata -> u . mgd . flags &= ~ ieee80211_sta_connection_poll ; 
+ieee80211_run_deferred_scan ( sdata -> local ) ; 
+} 
+
+static void ieee80211_stop_poll ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+mutex_lock ( & sdata -> local -> mtx ) ; 
+__ieee80211_stop_poll ( sdata ) ; 
+mutex_unlock ( & sdata -> local -> mtx ) ; 
+} 
+
+static u32 ieee80211_handle_bss_capability ( struct ieee80211_link_data * link , 
+u16 capab , bool erp_valid , u8 erp ) 
+{ 
+struct ieee80211_bss_conf * bss_conf = link -> conf ; 
+struct ieee80211_supported_band * sband ; 
+u32 changed = 0 ; 
+bool use_protection ; 
+bool use_short_preamble ; 
+bool use_short_slot ; 
+
+sband = ieee80211_get_link_sband ( link ) ; 
+if ( ! sband ) 
+return changed ; 
+
+if ( erp_valid ) { 
+use_protection = ( erp & wlan_erp_use_protection ) != 0 ; 
+use_short_preamble = ( erp & wlan_erp_barker_preamble ) == 0 ; 
+} else { 
+use_protection = false ; 
+use_short_preamble = ! ! ( capab & wlan_capability_short_preamble ) ; 
+} 
+
+use_short_slot = ! ! ( capab & wlan_capability_short_slot_time ) ; 
+if ( sband -> band == nl80211_band_5ghz || 
+sband -> band == nl80211_band_6ghz ) 
+use_short_slot = true ; 
+
+if ( use_protection != bss_conf -> use_cts_prot ) { 
+bss_conf -> use_cts_prot = use_protection ; 
+changed |= bss_changed_erp_cts_prot ; 
+} 
+
+if ( use_short_preamble != bss_conf -> use_short_preamble ) { 
+bss_conf -> use_short_preamble = use_short_preamble ; 
+changed |= bss_changed_erp_preamble ; 
+} 
+
+if ( use_short_slot != bss_conf -> use_short_slot ) { 
+bss_conf -> use_short_slot = use_short_slot ; 
+changed |= bss_changed_erp_slot ; 
+} 
+
+return changed ; 
+} 
+
+static u32 ieee80211_link_set_associated ( struct ieee80211_link_data * link , 
+struct cfg80211_bss * cbss ) 
+{ 
+struct ieee80211_sub_if_data * sdata = link -> sdata ; 
+struct ieee80211_bss_conf * bss_conf = link -> conf ; 
+struct ieee80211_bss * bss = ( void * ) cbss -> priv ; 
+u32 changed = bss_changed_qos ; 
+
+
+sdata -> u . mgd . beacon_timeout = 
+usecs_to_jiffies ( ieee80211_tu_to_usec ( beacon_loss_count * 
+bss_conf -> beacon_int ) ) ; 
+
+changed |= ieee80211_handle_bss_capability ( link , 
+bss_conf -> assoc_capability , 
+bss -> has_erp_value , 
+bss -> erp_value ) ; 
+
+ieee80211_check_rate_mask ( link ) ; 
+
+link -> u . mgd . bss = cbss ; 
+memcpy ( link -> u . mgd . bssid , cbss -> bssid , eth_alen ) ; 
+
+if ( sdata -> vif . p2p || 
+sdata -> vif . driver_flags & ieee80211_vif_get_noa_update ) { 
+const struct cfg80211_bss_ies * ies ; 
+
+rcu_read_lock ( ) ; 
+ies = rcu_dereference ( cbss -> ies ) ; 
+if ( ies ) { 
+int ret ; 
+
+ret = cfg80211_get_p2p_attr ( 
+ies -> data , ies -> len , 
+ieee80211_p2p_attr_absence_notice , 
+( u8 * ) & bss_conf -> p2p_noa_attr , 
+sizeof ( bss_conf -> p2p_noa_attr ) ) ; 
+if ( ret >= 2 ) { 
+link -> u . mgd . p2p_noa_index = 
+bss_conf -> p2p_noa_attr . index ; 
+changed |= bss_changed_p2p_ps ; 
+} 
+} 
+rcu_read_unlock ( ) ; 
+} 
+
+if ( link -> u . mgd . have_beacon ) { 
+bss_conf -> beacon_rate = bss -> beacon_rate ; 
+changed |= bss_changed_beacon_info ; 
+} else { 
+bss_conf -> beacon_rate = null ; 
+} 
+
+
+if ( sdata -> vif . driver_flags & ieee80211_vif_supports_cqm_rssi && 
+bss_conf -> cqm_rssi_thold ) 
+changed |= bss_changed_cqm ; 
+
+return changed ; 
+} 
+
+static void ieee80211_set_associated ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_mgd_assoc_data * assoc_data , 
+u64 changed [ ieee80211_mld_max_num_links ] ) 
+{ 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_vif_cfg * vif_cfg = & sdata -> vif . cfg ; 
+u64 vif_changed = bss_changed_assoc ; 
+unsigned int link_id ; 
+
+sdata -> u . mgd . associated = true ; 
+
+for ( link_id = 0 ; link_id < ieee80211_mld_max_num_links ; link_id ++ ) { 
+struct cfg80211_bss * cbss = assoc_data -> link [ link_id ] . bss ; 
+struct ieee80211_link_data * link ; 
+
+if ( ! cbss || 
+assoc_data -> link [ link_id ] . status != wlan_status_success ) 
+continue ; 
+
+link = sdata_dereference ( sdata -> link [ link_id ] , sdata ) ; 
+if ( warn_on ( ! link ) ) 
+return ; 
+
+changed [ link_id ] |= ieee80211_link_set_associated ( link , cbss ) ; 
+} 
+
+
+ieee80211_stop_poll ( sdata ) ; 
+
+ieee80211_led_assoc ( local , 1 ) ; 
+
+vif_cfg -> assoc = 1 ; 
+
+
+if ( vif_cfg -> arp_addr_cnt ) 
+vif_changed |= bss_changed_arp_filter ; 
+
+if ( sdata -> vif . valid_links ) { 
+for ( link_id = 0 ; 
+link_id < ieee80211_mld_max_num_links ; 
+link_id ++ ) { 
+struct ieee80211_link_data * link ; 
+struct cfg80211_bss * cbss = assoc_data -> link [ link_id ] . bss ; 
+
+if ( ! cbss || 
+assoc_data -> link [ link_id ] . status != wlan_status_success ) 
+continue ; 
+
+link = sdata_dereference ( sdata -> link [ link_id ] , sdata ) ; 
+if ( warn_on ( ! link ) ) 
+return ; 
+
+ieee80211_link_info_change_notify ( sdata , link , 
+changed [ link_id ] ) ; 
+
+ieee80211_recalc_smps ( sdata , link ) ; 
+} 
+
+ieee80211_vif_cfg_change_notify ( sdata , vif_changed ) ; 
+} else { 
+ieee80211_bss_info_change_notify ( sdata , 
+vif_changed | changed [ 0 ] ) ; 
+} 
+
+mutex_lock ( & local -> iflist_mtx ) ; 
+ieee80211_recalc_ps ( local ) ; 
+mutex_unlock ( & local -> iflist_mtx ) ; 
+
+
+if ( ! sdata -> vif . valid_links ) 
+ieee80211_recalc_smps ( sdata , & sdata -> deflink ) ; 
+ieee80211_recalc_ps_vif ( sdata ) ; 
+
+netif_carrier_on ( sdata -> dev ) ; 
+} 
+
+static void ieee80211_set_disassoc ( struct ieee80211_sub_if_data * sdata , 
+u16 stype , u16 reason , bool tx , 
+u8 * frame_buf ) 
+{ 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+struct ieee80211_local * local = sdata -> local ; 
+unsigned int link_id ; 
+u32 changed = 0 ; 
+struct ieee80211_prep_tx_info info = { 
+. subtype = stype , 
+} ; 
+
+sdata_assert_lock ( sdata ) ; 
+
+if ( warn_on_once ( tx && ! frame_buf ) ) 
+return ; 
+
+if ( warn_on ( ! ifmgd -> associated ) ) 
+return ; 
+
+ieee80211_stop_poll ( sdata ) ; 
+
+ifmgd -> associated = false ; 
+
+
+sdata -> deflink . u . mgd . bss = null ; 
+
+netif_carrier_off ( sdata -> dev ) ; 
+
+
+
+
+
+
+if ( local -> hw . conf . flags & ieee80211_conf_ps ) { 
+local -> hw . conf . flags &= ~ ieee80211_conf_ps ; 
+ieee80211_hw_config ( local , ieee80211_conf_change_ps ) ; 
+} 
+local -> ps_sdata = null ; 
+
+
+ieee80211_recalc_ps_vif ( sdata ) ; 
+
+
+synchronize_net ( ) ; 
+
+
+
+
+
+
+
+if ( tx ) 
+ieee80211_flush_queues ( local , sdata , true ) ; 
+
+
+if ( tx || frame_buf ) { 
+
+
+
+
+
+
+if ( ieee80211_hw_check ( & local -> hw , deauth_need_mgd_tx_prep ) && 
+! sdata -> deflink . u . mgd . have_beacon ) { 
+drv_mgd_prepare_tx ( sdata -> local , sdata , & info ) ; 
+} 
+
+ieee80211_send_deauth_disassoc ( sdata , sdata -> vif . cfg . ap_addr , 
+sdata -> vif . cfg . ap_addr , stype , 
+reason , tx , frame_buf ) ; 
+} 
+
+
+if ( tx ) 
+ieee80211_flush_queues ( local , sdata , false ) ; 
+
+drv_mgd_complete_tx ( sdata -> local , sdata , & info ) ; 
+
+
+eth_zero_addr ( sdata -> deflink . u . mgd . bssid ) ; 
+eth_zero_addr ( sdata -> vif . cfg . ap_addr ) ; 
+
+sdata -> vif . cfg . ssid_len = 0 ; 
+
+
+sta_info_flush ( sdata ) ; 
+
+
+if ( ! sdata -> vif . valid_links ) 
+changed |= ieee80211_reset_erp_info ( sdata ) ; 
+
+ieee80211_led_assoc ( local , 0 ) ; 
+changed |= bss_changed_assoc ; 
+sdata -> vif . cfg . assoc = false ; 
+
+sdata -> deflink . u . mgd . p2p_noa_index = - 1 ; 
+memset ( & sdata -> vif . bss_conf . p2p_noa_attr , 0 , 
+sizeof ( sdata -> vif . bss_conf . p2p_noa_attr ) ) ; 
+
+
+memset ( & ifmgd -> ht_capa , 0 , sizeof ( ifmgd -> ht_capa ) ) ; 
+memset ( & ifmgd -> ht_capa_mask , 0 , sizeof ( ifmgd -> ht_capa_mask ) ) ; 
+memset ( & ifmgd -> vht_capa , 0 , sizeof ( ifmgd -> vht_capa ) ) ; 
+memset ( & ifmgd -> vht_capa_mask , 0 , sizeof ( ifmgd -> vht_capa_mask ) ) ; 
+
+
+
+
+
+memset ( sdata -> vif . bss_conf . mu_group . membership , 0 , 
+sizeof ( sdata -> vif . bss_conf . mu_group . membership ) ) ; 
+memset ( sdata -> vif . bss_conf . mu_group . position , 0 , 
+sizeof ( sdata -> vif . bss_conf . mu_group . position ) ) ; 
+if ( ! sdata -> vif . valid_links ) 
+changed |= bss_changed_mu_groups ; 
+sdata -> vif . bss_conf . mu_mimo_owner = false ; 
+
+sdata -> deflink . ap_power_level = ieee80211_unset_power_level ; 
+
+del_timer_sync ( & local -> dynamic_ps_timer ) ; 
+cancel_work_sync ( & local -> dynamic_ps_enable_work ) ; 
+
+
+if ( sdata -> vif . cfg . arp_addr_cnt ) 
+changed |= bss_changed_arp_filter ; 
+
+sdata -> vif . bss_conf . qos = false ; 
+if ( ! sdata -> vif . valid_links ) { 
+changed |= bss_changed_qos ; 
+
+changed |= bss_changed_bssid | bss_changed_ht ; 
+ieee80211_bss_info_change_notify ( sdata , changed ) ; 
+} else { 
+ieee80211_vif_cfg_change_notify ( sdata , changed ) ; 
+} 
+
+
+ieee80211_set_wmm_default ( & sdata -> deflink , false , false ) ; 
+
+del_timer_sync ( & sdata -> u . mgd . conn_mon_timer ) ; 
+del_timer_sync ( & sdata -> u . mgd . bcn_mon_timer ) ; 
+del_timer_sync ( & sdata -> u . mgd . timer ) ; 
+del_timer_sync ( & sdata -> deflink . u . mgd . chswitch_timer ) ; 
+
+sdata -> vif . bss_conf . dtim_period = 0 ; 
+sdata -> vif . bss_conf . beacon_rate = null ; 
+
+sdata -> deflink . u . mgd . have_beacon = false ; 
+sdata -> deflink . u . mgd . tracking_signal_avg = false ; 
+sdata -> deflink . u . mgd . disable_wmm_tracking = false ; 
+
+ifmgd -> flags = 0 ; 
+sdata -> deflink . u . mgd . conn_flags = 0 ; 
+mutex_lock ( & local -> mtx ) ; 
+
+for ( link_id = 0 ; link_id < array_size ( sdata -> link ) ; link_id ++ ) { 
+struct ieee80211_link_data * link ; 
+
+link = sdata_dereference ( sdata -> link [ link_id ] , sdata ) ; 
+if ( ! link ) 
+continue ; 
+ieee80211_link_release_channel ( link ) ; 
+} 
+
+sdata -> vif . bss_conf . csa_active = false ; 
+sdata -> deflink . u . mgd . csa_waiting_bcn = false ; 
+sdata -> deflink . u . mgd . csa_ignored_same_chan = false ; 
+if ( sdata -> deflink . csa_block_tx ) { 
+ieee80211_wake_vif_queues ( local , sdata , 
+ieee80211_queue_stop_reason_csa ) ; 
+sdata -> deflink . csa_block_tx = false ; 
+} 
+mutex_unlock ( & local -> mtx ) ; 
+
+
+memset ( ifmgd -> tx_tspec , 0 , sizeof ( ifmgd -> tx_tspec ) ) ; 
+cancel_delayed_work_sync ( & ifmgd -> tx_tspec_wk ) ; 
+
+sdata -> vif . bss_conf . pwr_reduction = 0 ; 
+sdata -> vif . bss_conf . tx_pwr_env_num = 0 ; 
+memset ( sdata -> vif . bss_conf . tx_pwr_env , 0 , 
+sizeof ( sdata -> vif . bss_conf . tx_pwr_env ) ) ; 
+
+ieee80211_vif_set_links ( sdata , 0 ) ; 
+} 
+
+static void ieee80211_reset_ap_probe ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+struct ieee80211_local * local = sdata -> local ; 
+
+mutex_lock ( & local -> mtx ) ; 
+if ( ! ( ifmgd -> flags & ieee80211_sta_connection_poll ) ) 
+goto out ; 
+
+__ieee80211_stop_poll ( sdata ) ; 
+
+mutex_lock ( & local -> iflist_mtx ) ; 
+ieee80211_recalc_ps ( local ) ; 
+mutex_unlock ( & local -> iflist_mtx ) ; 
+
+if ( ieee80211_hw_check ( & sdata -> local -> hw , connection_monitor ) ) 
+goto out ; 
+
+
+
+
+
+
+ieee80211_sta_reset_beacon_monitor ( sdata ) ; 
+
+mod_timer ( & ifmgd -> conn_mon_timer , 
+round_jiffies_up ( jiffies + 
+ieee80211_connection_idle_time ) ) ; 
+out : 
+mutex_unlock ( & local -> mtx ) ; 
+} 
+
+static void ieee80211_sta_tx_wmm_ac_notify ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_hdr * hdr , 
+u16 tx_time ) 
+{ 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+u16 tid ; 
+int ac ; 
+struct ieee80211_sta_tx_tspec * tx_tspec ; 
+unsigned long now = jiffies ; 
+
+if ( ! ieee80211_is_data_qos ( hdr -> frame_control ) ) 
+return ; 
+
+tid = ieee80211_get_tid ( hdr ) ; 
+ac = ieee80211_ac_from_tid ( tid ) ; 
+tx_tspec = & ifmgd -> tx_tspec [ ac ] ; 
+
+if ( likely ( ! tx_tspec -> admitted_time ) ) 
+return ; 
+
+if ( time_after ( now , tx_tspec -> time_slice_start + hz ) ) { 
+tx_tspec -> consumed_tx_time = 0 ; 
+tx_tspec -> time_slice_start = now ; 
+
+if ( tx_tspec -> downgraded ) { 
+tx_tspec -> action = tx_tspec_action_stop_downgrade ; 
+schedule_delayed_work ( & ifmgd -> tx_tspec_wk , 0 ) ; 
+} 
+} 
+
+if ( tx_tspec -> downgraded ) 
+return ; 
+
+tx_tspec -> consumed_tx_time += tx_time ; 
+
+if ( tx_tspec -> consumed_tx_time >= tx_tspec -> admitted_time ) { 
+tx_tspec -> downgraded = true ; 
+tx_tspec -> action = tx_tspec_action_downgrade ; 
+schedule_delayed_work ( & ifmgd -> tx_tspec_wk , 0 ) ; 
+} 
+} 
+
+void ieee80211_sta_tx_notify ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_hdr * hdr , bool ack , u16 tx_time ) 
+{ 
+ieee80211_sta_tx_wmm_ac_notify ( sdata , hdr , tx_time ) ; 
+
+if ( ! ieee80211_is_any_nullfunc ( hdr -> frame_control ) || 
+! sdata -> u . mgd . probe_send_count ) 
+return ; 
+
+if ( ack ) 
+sdata -> u . mgd . probe_send_count = 0 ; 
+else 
+sdata -> u . mgd . nullfunc_failed = true ; 
+ieee80211_queue_work ( & sdata -> local -> hw , & sdata -> work ) ; 
+} 
+
+static void ieee80211_mlme_send_probe_req ( struct ieee80211_sub_if_data * sdata , 
+const u8 * src , const u8 * dst , 
+const u8 * ssid , size_t ssid_len , 
+struct ieee80211_channel * channel ) 
+{ 
+struct sk_buff * skb ; 
+
+skb = ieee80211_build_probe_req ( sdata , src , dst , ( u32 ) - 1 , channel , 
+ssid , ssid_len , null , 0 , 
+ieee80211_probe_flag_directed ) ; 
+if ( skb ) 
+ieee80211_tx_skb ( sdata , skb ) ; 
+} 
+
+static void ieee80211_mgd_probe_ap_send ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+u8 * dst = sdata -> vif . cfg . ap_addr ; 
+u8 unicast_limit = max ( 1 , max_probe_tries - 3 ) ; 
+struct sta_info * sta ; 
+
+if ( warn_on ( sdata -> vif . valid_links ) ) 
+return ; 
+
+
+
+
+
+
+if ( ifmgd -> probe_send_count >= unicast_limit ) 
+dst = null ; 
+
+
+
+
+
+
+
+
+ifmgd -> probe_send_count ++ ; 
+
+if ( dst ) { 
+mutex_lock ( & sdata -> local -> sta_mtx ) ; 
+sta = sta_info_get ( sdata , dst ) ; 
+if ( ! warn_on ( ! sta ) ) 
+ieee80211_check_fast_rx ( sta ) ; 
+mutex_unlock ( & sdata -> local -> sta_mtx ) ; 
+} 
+
+if ( ieee80211_hw_check ( & sdata -> local -> hw , reports_tx_ack_status ) ) { 
+ifmgd -> nullfunc_failed = false ; 
+ieee80211_send_nullfunc ( sdata -> local , sdata , false ) ; 
+} else { 
+ieee80211_mlme_send_probe_req ( sdata , sdata -> vif . addr , dst , 
+sdata -> vif . cfg . ssid , 
+sdata -> vif . cfg . ssid_len , 
+sdata -> deflink . u . mgd . bss -> channel ) ; 
+} 
+
+ifmgd -> probe_timeout = jiffies + msecs_to_jiffies ( probe_wait_ms ) ; 
+run_again ( sdata , ifmgd -> probe_timeout ) ; 
+} 
+
+static void ieee80211_mgd_probe_ap ( struct ieee80211_sub_if_data * sdata , 
+bool beacon ) 
+{ 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+bool already = false ; 
+
+if ( warn_on ( sdata -> vif . valid_links ) ) 
+return ; 
+
+if ( ! ieee80211_sdata_running ( sdata ) ) 
+return ; 
+
+sdata_lock ( sdata ) ; 
+
+if ( ! ifmgd -> associated ) 
+goto out ; 
+
+mutex_lock ( & sdata -> local -> mtx ) ; 
+
+if ( sdata -> local -> tmp_channel || sdata -> local -> scanning ) { 
+mutex_unlock ( & sdata -> local -> mtx ) ; 
+goto out ; 
+} 
+
+if ( sdata -> local -> suspending ) { 
+
+mutex_unlock ( & sdata -> local -> mtx ) ; 
+ieee80211_reset_ap_probe ( sdata ) ; 
+goto out ; 
+} 
+
+if ( beacon ) { 
+mlme_dbg_ratelimited ( sdata , 
+"detected beacon loss from ap (missed %d beacons) - probing\n" , 
+beacon_loss_count ) ; 
+
+ieee80211_cqm_beacon_loss_notify ( & sdata -> vif , gfp_kernel ) ; 
+} 
+
+
+
+
+
+
+
+
+
+
+
+
+if ( ifmgd -> flags & ieee80211_sta_connection_poll ) 
+already = true ; 
+
+ifmgd -> flags |= ieee80211_sta_connection_poll ; 
+
+mutex_unlock ( & sdata -> local -> mtx ) ; 
+
+if ( already ) 
+goto out ; 
+
+mutex_lock ( & sdata -> local -> iflist_mtx ) ; 
+ieee80211_recalc_ps ( sdata -> local ) ; 
+mutex_unlock ( & sdata -> local -> iflist_mtx ) ; 
+
+ifmgd -> probe_send_count = 0 ; 
+ieee80211_mgd_probe_ap_send ( sdata ) ; 
+out : 
+sdata_unlock ( sdata ) ; 
+} 
+
+struct sk_buff * ieee80211_ap_probereq_get ( struct ieee80211_hw * hw , 
+struct ieee80211_vif * vif ) 
+{ 
+struct ieee80211_sub_if_data * sdata = vif_to_sdata ( vif ) ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+struct cfg80211_bss * cbss ; 
+struct sk_buff * skb ; 
+const struct element * ssid ; 
+int ssid_len ; 
+
+if ( warn_on ( sdata -> vif . type != nl80211_iftype_station || 
+sdata -> vif . valid_links ) ) 
+return null ; 
+
+sdata_assert_lock ( sdata ) ; 
+
+if ( ifmgd -> associated ) 
+cbss = sdata -> deflink . u . mgd . bss ; 
+else if ( ifmgd -> auth_data ) 
+cbss = ifmgd -> auth_data -> bss ; 
+else if ( ifmgd -> assoc_data && ifmgd -> assoc_data -> link [ 0 ] . bss ) 
+cbss = ifmgd -> assoc_data -> link [ 0 ] . bss ; 
+else 
+return null ; 
+
+rcu_read_lock ( ) ; 
+ssid = ieee80211_bss_get_elem ( cbss , wlan_eid_ssid ) ; 
+if ( warn_once ( ! ssid || ssid -> datalen > ieee80211_max_ssid_len , 
+"invalid ssid element (len=%d)" , 
+ssid ? ssid -> datalen : - 1 ) ) 
+ssid_len = 0 ; 
+else 
+ssid_len = ssid -> datalen ; 
+
+skb = ieee80211_build_probe_req ( sdata , sdata -> vif . addr , cbss -> bssid , 
+( u32 ) - 1 , cbss -> channel , 
+ssid -> data , ssid_len , 
+null , 0 , ieee80211_probe_flag_directed ) ; 
+rcu_read_unlock ( ) ; 
+
+return skb ; 
+} 
+export_symbol ( ieee80211_ap_probereq_get ) ; 
+
+static void ieee80211_report_disconnect ( struct ieee80211_sub_if_data * sdata , 
+const u8 * buf , size_t len , bool tx , 
+u16 reason , bool reconnect ) 
+{ 
+struct ieee80211_event event = { 
+. type = mlme_event , 
+. u . mlme . data = tx ? deauth_tx_event : deauth_rx_event , 
+. u . mlme . reason = reason , 
+} ; 
+
+if ( tx ) 
+cfg80211_tx_mlme_mgmt ( sdata -> dev , buf , len , reconnect ) ; 
+else 
+cfg80211_rx_mlme_mgmt ( sdata -> dev , buf , len ) ; 
+
+drv_event_callback ( sdata -> local , sdata , & event ) ; 
+} 
+
+static void __ieee80211_disconnect ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+u8 frame_buf [ ieee80211_deauth_frame_len ] ; 
+bool tx ; 
+
+sdata_lock ( sdata ) ; 
+if ( ! ifmgd -> associated ) { 
+sdata_unlock ( sdata ) ; 
+return ; 
+} 
+
+
+tx = sdata -> vif . valid_links || ! sdata -> deflink . csa_block_tx ; 
+
+if ( ! ifmgd -> driver_disconnect ) { 
+unsigned int link_id ; 
+
+
+
+
+
+
+
+
+for ( link_id = 0 ; 
+link_id < array_size ( sdata -> link ) ; 
+link_id ++ ) { 
+struct ieee80211_link_data * link ; 
+
+link = sdata_dereference ( sdata -> link [ link_id ] , sdata ) ; 
+if ( ! link ) 
+continue ; 
+cfg80211_unlink_bss ( local -> hw . wiphy , link -> u . mgd . bss ) ; 
+link -> u . mgd . bss = null ; 
+} 
+} 
+
+ieee80211_set_disassoc ( sdata , ieee80211_stype_deauth , 
+ifmgd -> driver_disconnect ? 
+wlan_reason_deauth_leaving : 
+wlan_reason_disassoc_due_to_inactivity , 
+tx , frame_buf ) ; 
+mutex_lock ( & local -> mtx ) ; 
+
+sdata -> vif . bss_conf . csa_active = false ; 
+sdata -> deflink . u . mgd . csa_waiting_bcn = false ; 
+if ( sdata -> deflink . csa_block_tx ) { 
+ieee80211_wake_vif_queues ( local , sdata , 
+ieee80211_queue_stop_reason_csa ) ; 
+sdata -> deflink . csa_block_tx = false ; 
+} 
+mutex_unlock ( & local -> mtx ) ; 
+
+ieee80211_report_disconnect ( sdata , frame_buf , sizeof ( frame_buf ) , tx , 
+wlan_reason_disassoc_due_to_inactivity , 
+ifmgd -> reconnect ) ; 
+ifmgd -> reconnect = false ; 
+
+sdata_unlock ( sdata ) ; 
+} 
+
+static void ieee80211_beacon_connection_loss_work ( struct work_struct * work ) 
+{ 
+struct ieee80211_sub_if_data * sdata = 
+container_of ( work , struct ieee80211_sub_if_data , 
+u . mgd . beacon_connection_loss_work ) ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+
+if ( ifmgd -> connection_loss ) { 
+sdata_info ( sdata , "connection to ap %pm lost\n" , 
+sdata -> vif . cfg . ap_addr ) ; 
+__ieee80211_disconnect ( sdata ) ; 
+ifmgd -> connection_loss = false ; 
+} else if ( ifmgd -> driver_disconnect ) { 
+sdata_info ( sdata , 
+"driver requested disconnection from ap %pm\n" , 
+sdata -> vif . cfg . ap_addr ) ; 
+__ieee80211_disconnect ( sdata ) ; 
+ifmgd -> driver_disconnect = false ; 
+} else { 
+if ( ifmgd -> associated ) 
+sdata -> deflink . u . mgd . beacon_loss_count ++ ; 
+ieee80211_mgd_probe_ap ( sdata , true ) ; 
+} 
+} 
+
+static void ieee80211_csa_connection_drop_work ( struct work_struct * work ) 
+{ 
+struct ieee80211_sub_if_data * sdata = 
+container_of ( work , struct ieee80211_sub_if_data , 
+u . mgd . csa_connection_drop_work ) ; 
+
+__ieee80211_disconnect ( sdata ) ; 
+} 
+
+void ieee80211_beacon_loss ( struct ieee80211_vif * vif ) 
+{ 
+struct ieee80211_sub_if_data * sdata = vif_to_sdata ( vif ) ; 
+struct ieee80211_hw * hw = & sdata -> local -> hw ; 
+
+trace_api_beacon_loss ( sdata ) ; 
+
+sdata -> u . mgd . connection_loss = false ; 
+ieee80211_queue_work ( hw , & sdata -> u . mgd . beacon_connection_loss_work ) ; 
+} 
+export_symbol ( ieee80211_beacon_loss ) ; 
+
+void ieee80211_connection_loss ( struct ieee80211_vif * vif ) 
+{ 
+struct ieee80211_sub_if_data * sdata = vif_to_sdata ( vif ) ; 
+struct ieee80211_hw * hw = & sdata -> local -> hw ; 
+
+trace_api_connection_loss ( sdata ) ; 
+
+sdata -> u . mgd . connection_loss = true ; 
+ieee80211_queue_work ( hw , & sdata -> u . mgd . beacon_connection_loss_work ) ; 
+} 
+export_symbol ( ieee80211_connection_loss ) ; 
+
+void ieee80211_disconnect ( struct ieee80211_vif * vif , bool reconnect ) 
+{ 
+struct ieee80211_sub_if_data * sdata = vif_to_sdata ( vif ) ; 
+struct ieee80211_hw * hw = & sdata -> local -> hw ; 
+
+trace_api_disconnect ( sdata , reconnect ) ; 
+
+if ( warn_on ( sdata -> vif . type != nl80211_iftype_station ) ) 
+return ; 
+
+sdata -> u . mgd . driver_disconnect = true ; 
+sdata -> u . mgd . reconnect = reconnect ; 
+ieee80211_queue_work ( hw , & sdata -> u . mgd . beacon_connection_loss_work ) ; 
+} 
+export_symbol ( ieee80211_disconnect ) ; 
+
+static void ieee80211_destroy_auth_data ( struct ieee80211_sub_if_data * sdata , 
+bool assoc ) 
+{ 
+struct ieee80211_mgd_auth_data * auth_data = sdata -> u . mgd . auth_data ; 
+
+sdata_assert_lock ( sdata ) ; 
+
+if ( ! assoc ) { 
+
+
+
+
+
+del_timer_sync ( & sdata -> u . mgd . timer ) ; 
+sta_info_destroy_addr ( sdata , auth_data -> ap_addr ) ; 
+
+
+sdata -> deflink . u . mgd . conn_flags = 0 ; 
+eth_zero_addr ( sdata -> deflink . u . mgd . bssid ) ; 
+ieee80211_link_info_change_notify ( sdata , & sdata -> deflink , 
+bss_changed_bssid ) ; 
+sdata -> u . mgd . flags = 0 ; 
+
+mutex_lock ( & sdata -> local -> mtx ) ; 
+ieee80211_link_release_channel ( & sdata -> deflink ) ; 
+ieee80211_vif_set_links ( sdata , 0 ) ; 
+mutex_unlock ( & sdata -> local -> mtx ) ; 
+} 
+
+cfg80211_put_bss ( sdata -> local -> hw . wiphy , auth_data -> bss ) ; 
+kfree ( auth_data ) ; 
+sdata -> u . mgd . auth_data = null ; 
+} 
+
+enum assoc_status { 
+assoc_success , 
+assoc_rejected , 
+assoc_timeout , 
+assoc_abandon , 
+} ; 
+
+static void ieee80211_destroy_assoc_data ( struct ieee80211_sub_if_data * sdata , 
+enum assoc_status status ) 
+{ 
+struct ieee80211_mgd_assoc_data * assoc_data = sdata -> u . mgd . assoc_data ; 
+
+sdata_assert_lock ( sdata ) ; 
+
+if ( status != assoc_success ) { 
+
+
+
+
+
+del_timer_sync ( & sdata -> u . mgd . timer ) ; 
+sta_info_destroy_addr ( sdata , assoc_data -> ap_addr ) ; 
+
+sdata -> deflink . u . mgd . conn_flags = 0 ; 
+eth_zero_addr ( sdata -> deflink . u . mgd . bssid ) ; 
+ieee80211_link_info_change_notify ( sdata , & sdata -> deflink , 
+bss_changed_bssid ) ; 
+sdata -> u . mgd . flags = 0 ; 
+sdata -> vif . bss_conf . mu_mimo_owner = false ; 
+
+if ( status != assoc_rejected ) { 
+struct cfg80211_assoc_failure data = { 
+. timeout = status == assoc_timeout , 
+} ; 
+int i ; 
+
+build_bug_on ( array_size ( data . bss ) != 
+array_size ( assoc_data -> link ) ) ; 
+
+for ( i = 0 ; i < array_size ( data . bss ) ; i ++ ) 
+data . bss [ i ] = assoc_data -> link [ i ] . bss ; 
+
+if ( sdata -> vif . valid_links ) 
+data . ap_mld_addr = assoc_data -> ap_addr ; 
+
+cfg80211_assoc_failure ( sdata -> dev , & data ) ; 
+} 
+
+mutex_lock ( & sdata -> local -> mtx ) ; 
+ieee80211_link_release_channel ( & sdata -> deflink ) ; 
+ieee80211_vif_set_links ( sdata , 0 ) ; 
+mutex_unlock ( & sdata -> local -> mtx ) ; 
+} 
+
+kfree ( assoc_data ) ; 
+sdata -> u . mgd . assoc_data = null ; 
+} 
+
+static void ieee80211_auth_challenge ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_mgmt * mgmt , size_t len ) 
+{ 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_mgd_auth_data * auth_data = sdata -> u . mgd . auth_data ; 
+const struct element * challenge ; 
+u8 * pos ; 
+u32 tx_flags = 0 ; 
+struct ieee80211_prep_tx_info info = { 
+. subtype = ieee80211_stype_auth , 
+} ; 
+
+pos = mgmt -> u . auth . variable ; 
+challenge = cfg80211_find_elem ( wlan_eid_challenge , pos , 
+len - ( pos - ( u8 * ) mgmt ) ) ; 
+if ( ! challenge ) 
+return ; 
+auth_data -> expected_transaction = 4 ; 
+drv_mgd_prepare_tx ( sdata -> local , sdata , & info ) ; 
+if ( ieee80211_hw_check ( & local -> hw , reports_tx_ack_status ) ) 
+tx_flags = ieee80211_tx_ctl_req_tx_status | 
+ieee80211_tx_intfl_mlme_conn_tx ; 
+ieee80211_send_auth ( sdata , 3 , auth_data -> algorithm , 0 , 
+( void * ) challenge , 
+challenge -> datalen + sizeof ( * challenge ) , 
+auth_data -> ap_addr , auth_data -> ap_addr , 
+auth_data -> key , auth_data -> key_len , 
+auth_data -> key_idx , tx_flags ) ; 
+} 
+
+static bool ieee80211_mark_sta_auth ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+const u8 * ap_addr = ifmgd -> auth_data -> ap_addr ; 
+struct sta_info * sta ; 
+bool result = true ; 
+
+sdata_info ( sdata , "authenticated\n" ) ; 
+ifmgd -> auth_data -> done = true ; 
+ifmgd -> auth_data -> timeout = jiffies + ieee80211_auth_wait_assoc ; 
+ifmgd -> auth_data -> timeout_started = true ; 
+run_again ( sdata , ifmgd -> auth_data -> timeout ) ; 
+
+
+mutex_lock ( & sdata -> local -> sta_mtx ) ; 
+sta = sta_info_get ( sdata , ap_addr ) ; 
+if ( ! sta ) { 
+warn_once ( 1 , "%s: sta %pm not found" , sdata -> name , ap_addr ) ; 
+result = false ; 
+goto out ; 
+} 
+if ( sta_info_move_state ( sta , ieee80211_sta_auth ) ) { 
+sdata_info ( sdata , "failed moving %pm to auth\n" , ap_addr ) ; 
+result = false ; 
+goto out ; 
+} 
+
+out : 
+mutex_unlock ( & sdata -> local -> sta_mtx ) ; 
+return result ; 
+} 
+
+static void ieee80211_rx_mgmt_auth ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_mgmt * mgmt , size_t len ) 
+{ 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+u16 auth_alg , auth_transaction , status_code ; 
+struct ieee80211_event event = { 
+. type = mlme_event , 
+. u . mlme . data = auth_event , 
+} ; 
+struct ieee80211_prep_tx_info info = { 
+. subtype = ieee80211_stype_auth , 
+} ; 
+
+sdata_assert_lock ( sdata ) ; 
+
+if ( len < 24 + 6 ) 
+return ; 
+
+if ( ! ifmgd -> auth_data || ifmgd -> auth_data -> done ) 
+return ; 
+
+if ( ! ether_addr_equal ( ifmgd -> auth_data -> ap_addr , mgmt -> bssid ) ) 
+return ; 
+
+auth_alg = le16_to_cpu ( mgmt -> u . auth . auth_alg ) ; 
+auth_transaction = le16_to_cpu ( mgmt -> u . auth . auth_transaction ) ; 
+status_code = le16_to_cpu ( mgmt -> u . auth . status_code ) ; 
+
+if ( auth_alg != ifmgd -> auth_data -> algorithm || 
+( auth_alg != wlan_auth_sae && 
+auth_transaction != ifmgd -> auth_data -> expected_transaction ) || 
+( auth_alg == wlan_auth_sae && 
+( auth_transaction < ifmgd -> auth_data -> expected_transaction || 
+auth_transaction > 2 ) ) ) { 
+sdata_info ( sdata , "%pm unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n" , 
+mgmt -> sa , auth_alg , ifmgd -> auth_data -> algorithm , 
+auth_transaction , 
+ifmgd -> auth_data -> expected_transaction ) ; 
+goto notify_driver ; 
+} 
+
+if ( status_code != wlan_status_success ) { 
+cfg80211_rx_mlme_mgmt ( sdata -> dev , ( u8 * ) mgmt , len ) ; 
+
+if ( auth_alg == wlan_auth_sae && 
+( status_code == wlan_status_anti_clog_required || 
+( auth_transaction == 1 && 
+( status_code == wlan_status_sae_hash_to_element || 
+status_code == wlan_status_sae_pk ) ) ) ) { 
+
+ifmgd -> auth_data -> waiting = true ; 
+ifmgd -> auth_data -> timeout = 
+jiffies + ieee80211_auth_wait_sae_retry ; 
+ifmgd -> auth_data -> timeout_started = true ; 
+run_again ( sdata , ifmgd -> auth_data -> timeout ) ; 
+goto notify_driver ; 
+} 
+
+sdata_info ( sdata , "%pm denied authentication (status %d)\n" , 
+mgmt -> sa , status_code ) ; 
+ieee80211_destroy_auth_data ( sdata , false ) ; 
+event . u . mlme . status = mlme_denied ; 
+event . u . mlme . reason = status_code ; 
+drv_event_callback ( sdata -> local , sdata , & event ) ; 
+goto notify_driver ; 
+} 
+
+switch ( ifmgd -> auth_data -> algorithm ) { 
+case wlan_auth_open : 
+case wlan_auth_leap : 
+case wlan_auth_ft : 
+case wlan_auth_sae : 
+case wlan_auth_fils_sk : 
+case wlan_auth_fils_sk_pfs : 
+case wlan_auth_fils_pk : 
+break ; 
+case wlan_auth_shared_key : 
+if ( ifmgd -> auth_data -> expected_transaction != 4 ) { 
+ieee80211_auth_challenge ( sdata , mgmt , len ) ; 
+
+return ; 
+} 
+break ; 
+default : 
+warn_once ( 1 , "invalid auth alg %d" , 
+ifmgd -> auth_data -> algorithm ) ; 
+goto notify_driver ; 
+} 
+
+event . u . mlme . status = mlme_success ; 
+info . success = 1 ; 
+drv_event_callback ( sdata -> local , sdata , & event ) ; 
+if ( ifmgd -> auth_data -> algorithm != wlan_auth_sae || 
+( auth_transaction == 2 && 
+ifmgd -> auth_data -> expected_transaction == 2 ) ) { 
+if ( ! ieee80211_mark_sta_auth ( sdata ) ) 
+return ; 
+} else if ( ifmgd -> auth_data -> algorithm == wlan_auth_sae && 
+auth_transaction == 2 ) { 
+sdata_info ( sdata , "sae peer confirmed\n" ) ; 
+ifmgd -> auth_data -> peer_confirmed = true ; 
+} 
+
+cfg80211_rx_mlme_mgmt ( sdata -> dev , ( u8 * ) mgmt , len ) ; 
+notify_driver : 
+drv_mgd_complete_tx ( sdata -> local , sdata , & info ) ; 
+} 
+
+
+
+
+const char * ieee80211_get_reason_code_string ( u16 reason_code ) 
+{ 
+switch ( reason_code ) { 
+case_wlan ( unspecified ) ; 
+case_wlan ( prev_auth_not_valid ) ; 
+case_wlan ( deauth_leaving ) ; 
+case_wlan ( disassoc_due_to_inactivity ) ; 
+case_wlan ( disassoc_ap_busy ) ; 
+case_wlan ( class2_frame_from_nonauth_sta ) ; 
+case_wlan ( class3_frame_from_nonassoc_sta ) ; 
+case_wlan ( disassoc_sta_has_left ) ; 
+case_wlan ( sta_req_assoc_without_auth ) ; 
+case_wlan ( disassoc_bad_power ) ; 
+case_wlan ( disassoc_bad_supp_chan ) ; 
+case_wlan ( invalid_ie ) ; 
+case_wlan ( mic_failure ) ; 
+case_wlan ( 4 way_handshake_timeout ) ; 
+case_wlan ( group_key_handshake_timeout ) ; 
+case_wlan ( ie_different ) ; 
+case_wlan ( invalid_group_cipher ) ; 
+case_wlan ( invalid_pairwise_cipher ) ; 
+case_wlan ( invalid_akmp ) ; 
+case_wlan ( unsupp_rsn_version ) ; 
+case_wlan ( invalid_rsn_ie_cap ) ; 
+case_wlan ( ieee8021x_failed ) ; 
+case_wlan ( cipher_suite_rejected ) ; 
+case_wlan ( disassoc_unspecified_qos ) ; 
+case_wlan ( disassoc_qap_no_bandwidth ) ; 
+case_wlan ( disassoc_low_ack ) ; 
+case_wlan ( disassoc_qap_exceed_txop ) ; 
+case_wlan ( qsta_leave_qbss ) ; 
+case_wlan ( qsta_not_use ) ; 
+case_wlan ( qsta_require_setup ) ; 
+case_wlan ( qsta_timeout ) ; 
+case_wlan ( qsta_cipher_not_supp ) ; 
+case_wlan ( mesh_peer_canceled ) ; 
+case_wlan ( mesh_max_peers ) ; 
+case_wlan ( mesh_config ) ; 
+case_wlan ( mesh_close ) ; 
+case_wlan ( mesh_max_retries ) ; 
+case_wlan ( mesh_confirm_timeout ) ; 
+case_wlan ( mesh_invalid_gtk ) ; 
+case_wlan ( mesh_inconsistent_param ) ; 
+case_wlan ( mesh_invalid_security ) ; 
+case_wlan ( mesh_path_error ) ; 
+case_wlan ( mesh_path_noforward ) ; 
+case_wlan ( mesh_path_dest_unreachable ) ; 
+case_wlan ( mac_exists_in_mbss ) ; 
+case_wlan ( mesh_chan_regulatory ) ; 
+case_wlan ( mesh_chan ) ; 
+default : return "<unknown>" ; 
+} 
+} 
+
+static void ieee80211_rx_mgmt_deauth ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_mgmt * mgmt , size_t len ) 
+{ 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+u16 reason_code = le16_to_cpu ( mgmt -> u . deauth . reason_code ) ; 
+
+sdata_assert_lock ( sdata ) ; 
+
+if ( len < 24 + 2 ) 
+return ; 
+
+if ( ! ether_addr_equal ( mgmt -> bssid , mgmt -> sa ) ) { 
+ieee80211_tdls_handle_disconnect ( sdata , mgmt -> sa , reason_code ) ; 
+return ; 
+} 
+
+if ( ifmgd -> associated && 
+ether_addr_equal ( mgmt -> bssid , sdata -> vif . cfg . ap_addr ) ) { 
+sdata_info ( sdata , "deauthenticated from %pm (reason: %u=%s)\n" , 
+sdata -> vif . cfg . ap_addr , reason_code , 
+ieee80211_get_reason_code_string ( reason_code ) ) ; 
+
+ieee80211_set_disassoc ( sdata , 0 , 0 , false , null ) ; 
+
+ieee80211_report_disconnect ( sdata , ( u8 * ) mgmt , len , false , 
+reason_code , false ) ; 
+return ; 
+} 
+
+if ( ifmgd -> assoc_data && 
+ether_addr_equal ( mgmt -> bssid , ifmgd -> assoc_data -> ap_addr ) ) { 
+sdata_info ( sdata , 
+"deauthenticated from %pm while associating (reason: %u=%s)\n" , 
+ifmgd -> assoc_data -> ap_addr , reason_code , 
+ieee80211_get_reason_code_string ( reason_code ) ) ; 
+
+ieee80211_destroy_assoc_data ( sdata , assoc_abandon ) ; 
+
+cfg80211_rx_mlme_mgmt ( sdata -> dev , ( u8 * ) mgmt , len ) ; 
+return ; 
+} 
+} 
+
+
+static void ieee80211_rx_mgmt_disassoc ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_mgmt * mgmt , size_t len ) 
+{ 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+u16 reason_code ; 
+
+sdata_assert_lock ( sdata ) ; 
+
+if ( len < 24 + 2 ) 
+return ; 
+
+if ( ! ifmgd -> associated || 
+! ether_addr_equal ( mgmt -> bssid , sdata -> vif . cfg . ap_addr ) ) 
+return ; 
+
+reason_code = le16_to_cpu ( mgmt -> u . disassoc . reason_code ) ; 
+
+if ( ! ether_addr_equal ( mgmt -> bssid , mgmt -> sa ) ) { 
+ieee80211_tdls_handle_disconnect ( sdata , mgmt -> sa , reason_code ) ; 
+return ; 
+} 
+
+sdata_info ( sdata , "disassociated from %pm (reason: %u=%s)\n" , 
+sdata -> vif . cfg . ap_addr , reason_code , 
+ieee80211_get_reason_code_string ( reason_code ) ) ; 
+
+ieee80211_set_disassoc ( sdata , 0 , 0 , false , null ) ; 
+
+ieee80211_report_disconnect ( sdata , ( u8 * ) mgmt , len , false , reason_code , 
+false ) ; 
+} 
+
+static void ieee80211_get_rates ( struct ieee80211_supported_band * sband , 
+u8 * supp_rates , unsigned int supp_rates_len , 
+u32 * rates , u32 * basic_rates , 
+bool * have_higher_than_11mbit , 
+int * min_rate , int * min_rate_index , 
+int shift ) 
+{ 
+int i , j ; 
+
+for ( i = 0 ; i < supp_rates_len ; i ++ ) { 
+int rate = supp_rates [ i ] & 0x7f ; 
+bool is_basic = ! ! ( supp_rates [ i ] & 0x80 ) ; 
+
+if ( ( rate * 5 * ( 1 << shift ) ) > 110 ) 
+* have_higher_than_11mbit = true ; 
+
+
+
+
+
+
+
+
+
+if ( supp_rates [ i ] == ( 0x80 | bss_membership_selector_ht_phy ) || 
+supp_rates [ i ] == ( 0x80 | bss_membership_selector_vht_phy ) || 
+supp_rates [ i ] == ( 0x80 | bss_membership_selector_he_phy ) || 
+supp_rates [ i ] == ( 0x80 | bss_membership_selector_sae_h2e ) ) 
+continue ; 
+
+for ( j = 0 ; j < sband -> n_bitrates ; j ++ ) { 
+struct ieee80211_rate * br ; 
+int brate ; 
+
+br = & sband -> bitrates [ j ] ; 
+
+brate = div_round_up ( br -> bitrate , ( 1 << shift ) * 5 ) ; 
+if ( brate == rate ) { 
+* rates |= bit ( j ) ; 
+if ( is_basic ) 
+* basic_rates |= bit ( j ) ; 
+if ( ( rate * 5 ) < * min_rate ) { 
+* min_rate = rate * 5 ; 
+* min_rate_index = j ; 
+} 
+break ; 
+} 
+} 
+} 
+} 
+
+static bool ieee80211_twt_req_supported ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_supported_band * sband , 
+const struct link_sta_info * link_sta , 
+const struct ieee802_11_elems * elems ) 
+{ 
+const struct ieee80211_sta_he_cap * own_he_cap = 
+ieee80211_get_he_iftype_cap ( sband , 
+ieee80211_vif_type_p2p ( & sdata -> vif ) ) ; 
+
+if ( elems -> ext_capab_len < 10 ) 
+return false ; 
+
+if ( ! ( elems -> ext_capab [ 9 ] & wlan_ext_capa10_twt_responder_support ) ) 
+return false ; 
+
+return link_sta -> pub -> he_cap . he_cap_elem . mac_cap_info [ 0 ] & 
+ieee80211_he_mac_cap0_twt_res && 
+own_he_cap && 
+( own_he_cap -> he_cap_elem . mac_cap_info [ 0 ] & 
+ieee80211_he_mac_cap0_twt_req ) ; 
+} 
+
+static int ieee80211_recalc_twt_req ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_supported_band * sband , 
+struct ieee80211_link_data * link , 
+struct link_sta_info * link_sta , 
+struct ieee802_11_elems * elems ) 
+{ 
+bool twt = ieee80211_twt_req_supported ( sdata , sband , link_sta , elems ) ; 
+
+if ( link -> conf -> twt_requester != twt ) { 
+link -> conf -> twt_requester = twt ; 
+return bss_changed_twt ; 
+} 
+return 0 ; 
+} 
+
+static bool ieee80211_twt_bcast_support ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_bss_conf * bss_conf , 
+struct ieee80211_supported_band * sband , 
+struct link_sta_info * link_sta ) 
+{ 
+const struct ieee80211_sta_he_cap * own_he_cap = 
+ieee80211_get_he_iftype_cap ( sband , 
+ieee80211_vif_type_p2p ( & sdata -> vif ) ) ; 
+
+return bss_conf -> he_support && 
+( link_sta -> pub -> he_cap . he_cap_elem . mac_cap_info [ 2 ] & 
+ieee80211_he_mac_cap2_bcast_twt ) && 
+own_he_cap && 
+( own_he_cap -> he_cap_elem . mac_cap_info [ 2 ] & 
+ieee80211_he_mac_cap2_bcast_twt ) ; 
+} 
+
+static bool ieee80211_assoc_config_link ( struct ieee80211_link_data * link , 
+struct link_sta_info * link_sta , 
+struct cfg80211_bss * cbss , 
+struct ieee80211_mgmt * mgmt , 
+const u8 * elem_start , 
+unsigned int elem_len , 
+u64 * changed ) 
+{ 
+struct ieee80211_sub_if_data * sdata = link -> sdata ; 
+struct ieee80211_mgd_assoc_data * assoc_data = sdata -> u . mgd . assoc_data ; 
+struct ieee80211_bss_conf * bss_conf = link -> conf ; 
+struct ieee80211_local * local = sdata -> local ; 
+unsigned int link_id = link -> link_id ; 
+struct ieee80211_elems_parse_params parse_params = { 
+. start = elem_start , 
+. len = elem_len , 
+. link_id = link_id == assoc_data -> assoc_link_id ? - 1 : link_id , 
+. from_ap = true , 
+} ; 
+bool is_6ghz = cbss -> channel -> band == nl80211_band_6ghz ; 
+bool is_s1g = cbss -> channel -> band == nl80211_band_s1ghz ; 
+const struct cfg80211_bss_ies * bss_ies = null ; 
+struct ieee80211_supported_band * sband ; 
+struct ieee802_11_elems * elems ; 
+u16 capab_info ; 
+bool ret ; 
+
+elems = ieee802_11_parse_elems_full ( & parse_params ) ; 
+if ( ! elems ) 
+return false ; 
+
+if ( link_id == assoc_data -> assoc_link_id ) { 
+capab_info = le16_to_cpu ( mgmt -> u . assoc_resp . capab_info ) ; 
+
+
+
+
+
+assoc_data -> link [ link_id ] . status = wlan_status_success ; 
+} else if ( ! elems -> prof ) { 
+ret = false ; 
+goto out ; 
+} else { 
+const u8 * ptr = elems -> prof -> variable + 
+elems -> prof -> sta_info_len - 1 ; 
+
+
+
+
+
+capab_info = get_unaligned_le16 ( ptr ) ; 
+assoc_data -> link [ link_id ] . status = get_unaligned_le16 ( ptr + 2 ) ; 
+
+if ( assoc_data -> link [ link_id ] . status != wlan_status_success ) { 
+link_info ( link , "association response status code=%u\n" , 
+assoc_data -> link [ link_id ] . status ) ; 
+ret = true ; 
+goto out ; 
+} 
+} 
+
+if ( ! is_s1g && ! elems -> supp_rates ) { 
+sdata_info ( sdata , "no supprates element in assocresp\n" ) ; 
+ret = false ; 
+goto out ; 
+} 
+
+link -> u . mgd . tdls_chan_switch_prohibited = 
+elems -> ext_capab && elems -> ext_capab_len >= 5 && 
+( elems -> ext_capab [ 4 ] & wlan_ext_capa5_tdls_ch_sw_prohibited ) ; 
+
+
+
+
+
+
+
+
+if ( ! is_6ghz && 
+( ( assoc_data -> wmm && ! elems -> wmm_param ) || 
+( ! ( link -> u . mgd . conn_flags & ieee80211_conn_disable_ht ) && 
+( ! elems -> ht_cap_elem || ! elems -> ht_operation ) ) || 
+( ! ( link -> u . mgd . conn_flags & ieee80211_conn_disable_vht ) && 
+( ! elems -> vht_cap_elem || ! elems -> vht_operation ) ) ) ) { 
+const struct cfg80211_bss_ies * ies ; 
+struct ieee802_11_elems * bss_elems ; 
+
+rcu_read_lock ( ) ; 
+ies = rcu_dereference ( cbss -> ies ) ; 
+if ( ies ) 
+bss_ies = kmemdup ( ies , sizeof ( * ies ) + ies -> len , 
+gfp_atomic ) ; 
+rcu_read_unlock ( ) ; 
+if ( ! bss_ies ) { 
+ret = false ; 
+goto out ; 
+} 
+
+parse_params . start = bss_ies -> data ; 
+parse_params . len = bss_ies -> len ; 
+parse_params . bss = cbss ; 
+bss_elems = ieee802_11_parse_elems_full ( & parse_params ) ; 
+if ( ! bss_elems ) { 
+ret = false ; 
+goto out ; 
+} 
+
+if ( assoc_data -> wmm && 
+! elems -> wmm_param && bss_elems -> wmm_param ) { 
+elems -> wmm_param = bss_elems -> wmm_param ; 
+sdata_info ( sdata , 
+"ap bug: wmm param missing from assocresp\n" ) ; 
+} 
+
+
+
+
+
+if ( ! elems -> ht_cap_elem && bss_elems -> ht_cap_elem && 
+! ( link -> u . mgd . conn_flags & ieee80211_conn_disable_ht ) ) { 
+elems -> ht_cap_elem = bss_elems -> ht_cap_elem ; 
+sdata_info ( sdata , 
+"ap bug: ht capability missing from assocresp\n" ) ; 
+} 
+if ( ! elems -> ht_operation && bss_elems -> ht_operation && 
+! ( link -> u . mgd . conn_flags & ieee80211_conn_disable_ht ) ) { 
+elems -> ht_operation = bss_elems -> ht_operation ; 
+sdata_info ( sdata , 
+"ap bug: ht operation missing from assocresp\n" ) ; 
+} 
+if ( ! elems -> vht_cap_elem && bss_elems -> vht_cap_elem && 
+! ( link -> u . mgd . conn_flags & ieee80211_conn_disable_vht ) ) { 
+elems -> vht_cap_elem = bss_elems -> vht_cap_elem ; 
+sdata_info ( sdata , 
+"ap bug: vht capa missing from assocresp\n" ) ; 
+} 
+if ( ! elems -> vht_operation && bss_elems -> vht_operation && 
+! ( link -> u . mgd . conn_flags & ieee80211_conn_disable_vht ) ) { 
+elems -> vht_operation = bss_elems -> vht_operation ; 
+sdata_info ( sdata , 
+"ap bug: vht operation missing from assocresp\n" ) ; 
+} 
+
+kfree ( bss_elems ) ; 
+} 
+
+
+
+
+
+if ( ! is_6ghz && ! ( link -> u . mgd . conn_flags & ieee80211_conn_disable_ht ) && 
+( ! elems -> wmm_param || ! elems -> ht_cap_elem || ! elems -> ht_operation ) ) { 
+sdata_info ( sdata , 
+"ht ap is missing wmm params or ht capability/operation\n" ) ; 
+ret = false ; 
+goto out ; 
+} 
+
+if ( ! is_6ghz && ! ( link -> u . mgd . conn_flags & ieee80211_conn_disable_vht ) && 
+( ! elems -> vht_cap_elem || ! elems -> vht_operation ) ) { 
+sdata_info ( sdata , 
+"vht ap is missing vht capability/operation\n" ) ; 
+ret = false ; 
+goto out ; 
+} 
+
+if ( is_6ghz && ! ( link -> u . mgd . conn_flags & ieee80211_conn_disable_he ) && 
+! elems -> he_6ghz_capa ) { 
+sdata_info ( sdata , 
+"he 6 ghz ap is missing he 6 ghz band capability\n" ) ; 
+ret = false ; 
+goto out ; 
+} 
+
+if ( warn_on ( ! link -> conf -> chandef . chan ) ) { 
+ret = false ; 
+goto out ; 
+} 
+sband = local -> hw . wiphy -> bands [ link -> conf -> chandef . chan -> band ] ; 
+
+if ( ! ( link -> u . mgd . conn_flags & ieee80211_conn_disable_he ) && 
+( ! elems -> he_cap || ! elems -> he_operation ) ) { 
+sdata_info ( sdata , 
+"he ap is missing he capability/operation\n" ) ; 
+ret = false ; 
+goto out ; 
+} 
+
+
+if ( elems -> ht_cap_elem && ! ( link -> u . mgd . conn_flags & ieee80211_conn_disable_ht ) ) 
+ieee80211_ht_cap_ie_to_sta_ht_cap ( sdata , sband , 
+elems -> ht_cap_elem , 
+link_sta ) ; 
+
+if ( elems -> vht_cap_elem && ! ( link -> u . mgd . conn_flags & ieee80211_conn_disable_vht ) ) 
+ieee80211_vht_cap_ie_to_sta_vht_cap ( sdata , sband , 
+elems -> vht_cap_elem , 
+link_sta ) ; 
+
+if ( elems -> he_operation && ! ( link -> u . mgd . conn_flags & ieee80211_conn_disable_he ) && 
+elems -> he_cap ) { 
+ieee80211_he_cap_ie_to_sta_he_cap ( sdata , sband , 
+elems -> he_cap , 
+elems -> he_cap_len , 
+elems -> he_6ghz_capa , 
+link_sta ) ; 
+
+bss_conf -> he_support = link_sta -> pub -> he_cap . has_he ; 
+if ( elems -> rsnx && elems -> rsnx_len && 
+( elems -> rsnx [ 0 ] & wlan_rsnx_capa_protected_twt ) && 
+wiphy_ext_feature_isset ( local -> hw . wiphy , 
+nl80211_ext_feature_protected_twt ) ) 
+bss_conf -> twt_protected = true ; 
+else 
+bss_conf -> twt_protected = false ; 
+
+* changed |= ieee80211_recalc_twt_req ( sdata , sband , link , 
+link_sta , elems ) ; 
+
+if ( elems -> eht_operation && elems -> eht_cap && 
+! ( link -> u . mgd . conn_flags & ieee80211_conn_disable_eht ) ) { 
+ieee80211_eht_cap_ie_to_sta_eht_cap ( sdata , sband , 
+elems -> he_cap , 
+elems -> he_cap_len , 
+elems -> eht_cap , 
+elems -> eht_cap_len , 
+link_sta ) ; 
+
+bss_conf -> eht_support = link_sta -> pub -> eht_cap . has_eht ; 
+* changed |= bss_changed_eht_puncturing ; 
+} else { 
+bss_conf -> eht_support = false ; 
+} 
+} else { 
+bss_conf -> he_support = false ; 
+bss_conf -> twt_requester = false ; 
+bss_conf -> twt_protected = false ; 
+bss_conf -> eht_support = false ; 
+} 
+
+bss_conf -> twt_broadcast = 
+ieee80211_twt_bcast_support ( sdata , bss_conf , sband , link_sta ) ; 
+
+if ( bss_conf -> he_support ) { 
+bss_conf -> he_bss_color . color = 
+le32_get_bits ( elems -> he_operation -> he_oper_params , 
+ieee80211_he_operation_bss_color_mask ) ; 
+bss_conf -> he_bss_color . partial = 
+le32_get_bits ( elems -> he_operation -> he_oper_params , 
+ieee80211_he_operation_partial_bss_color ) ; 
+bss_conf -> he_bss_color . enabled = 
+! le32_get_bits ( elems -> he_operation -> he_oper_params , 
+ieee80211_he_operation_bss_color_disabled ) ; 
+
+if ( bss_conf -> he_bss_color . enabled ) 
+* changed |= bss_changed_he_bss_color ; 
+
+bss_conf -> htc_trig_based_pkt_ext = 
+le32_get_bits ( elems -> he_operation -> he_oper_params , 
+ieee80211_he_operation_dflt_pe_duration_mask ) ; 
+bss_conf -> frame_time_rts_th = 
+le32_get_bits ( elems -> he_operation -> he_oper_params , 
+ieee80211_he_operation_rts_threshold_mask ) ; 
+
+bss_conf -> uora_exists = ! ! elems -> uora_element ; 
+if ( elems -> uora_element ) 
+bss_conf -> uora_ocw_range = elems -> uora_element [ 0 ] ; 
+
+ieee80211_he_op_ie_to_bss_conf ( & sdata -> vif , elems -> he_operation ) ; 
+ieee80211_he_spr_ie_to_bss_conf ( & sdata -> vif , elems -> he_spr ) ; 
+
+} 
+
+if ( cbss -> transmitted_bss ) { 
+bss_conf -> nontransmitted = true ; 
+ether_addr_copy ( bss_conf -> transmitter_bssid , 
+cbss -> transmitted_bss -> bssid ) ; 
+bss_conf -> bssid_indicator = cbss -> max_bssid_indicator ; 
+bss_conf -> bssid_index = cbss -> bssid_index ; 
+} 
+
+
+
+
+
+
+
+
+
+
+
+
+
+if ( elems -> opmode_notif && 
+! ( * elems -> opmode_notif & ieee80211_opmode_notif_rx_nss_type_bf ) ) { 
+u8 nss ; 
+
+nss = * elems -> opmode_notif & ieee80211_opmode_notif_rx_nss_mask ; 
+nss >>= ieee80211_opmode_notif_rx_nss_shift ; 
+nss += 1 ; 
+link_sta -> pub -> rx_nss = nss ; 
+} 
+
+
+
+
+
+
+
+link -> u . mgd . wmm_last_param_set = - 1 ; 
+link -> u . mgd . mu_edca_last_param_set = - 1 ; 
+
+if ( link -> u . mgd . disable_wmm_tracking ) { 
+ieee80211_set_wmm_default ( link , false , false ) ; 
+} else if ( ! ieee80211_sta_wmm_params ( local , link , elems -> wmm_param , 
+elems -> wmm_param_len , 
+elems -> mu_edca_param_set ) ) { 
+
+ieee80211_set_wmm_default ( link , false , true ) ; 
+
+
+
+
+
+
+
+link -> u . mgd . disable_wmm_tracking = true ; 
+} 
+
+if ( elems -> max_idle_period_ie ) { 
+bss_conf -> max_idle_period = 
+le16_to_cpu ( elems -> max_idle_period_ie -> max_idle_period ) ; 
+bss_conf -> protected_keep_alive = 
+! ! ( elems -> max_idle_period_ie -> idle_options & 
+wlan_idle_options_protected_keep_alive ) ; 
+* changed |= bss_changed_keep_alive ; 
+} else { 
+bss_conf -> max_idle_period = 0 ; 
+bss_conf -> protected_keep_alive = false ; 
+} 
+
+
+
+bss_conf -> assoc_capability = capab_info ; 
+
+ret = true ; 
+out : 
+kfree ( elems ) ; 
+kfree ( bss_ies ) ; 
+return ret ; 
+} 
+
+static int ieee80211_mgd_setup_link_sta ( struct ieee80211_link_data * link , 
+struct sta_info * sta , 
+struct link_sta_info * link_sta , 
+struct cfg80211_bss * cbss ) 
+{ 
+struct ieee80211_sub_if_data * sdata = link -> sdata ; 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_bss * bss = ( void * ) cbss -> priv ; 
+u32 rates = 0 , basic_rates = 0 ; 
+bool have_higher_than_11mbit = false ; 
+int min_rate = int_max , min_rate_index = - 1 ; 
+
+int shift = ieee80211_vif_get_shift ( & sdata -> vif ) ; 
+struct ieee80211_supported_band * sband ; 
+
+memcpy ( link_sta -> addr , cbss -> bssid , eth_alen ) ; 
+memcpy ( link_sta -> pub -> addr , cbss -> bssid , eth_alen ) ; 
+
+
+if ( cbss -> channel -> band == nl80211_band_s1ghz ) { 
+ieee80211_s1g_sta_rate_init ( sta ) ; 
+return 0 ; 
+} 
+
+sband = local -> hw . wiphy -> bands [ cbss -> channel -> band ] ; 
+
+ieee80211_get_rates ( sband , bss -> supp_rates , bss -> supp_rates_len , 
+& rates , & basic_rates , & have_higher_than_11mbit , 
+& min_rate , & min_rate_index , shift ) ; 
+
+
+
+
+
+
+
+
+
+
+
+if ( min_rate_index < 0 ) { 
+link_info ( link , "no legacy rates in association response\n" ) ; 
+return - einval ; 
+} else if ( ! basic_rates ) { 
+link_info ( link , "no basic rates, using min rate instead\n" ) ; 
+basic_rates = bit ( min_rate_index ) ; 
+} 
+
+if ( rates ) 
+link_sta -> pub -> supp_rates [ cbss -> channel -> band ] = rates ; 
+else 
+link_info ( link , "no rates found, keeping mandatory only\n" ) ; 
+
+link -> conf -> basic_rates = basic_rates ; 
+
+
+link -> operating_11g_mode = sband -> band == nl80211_band_2ghz && 
+have_higher_than_11mbit ; 
+
+return 0 ; 
+} 
+
+static u8 ieee80211_max_rx_chains ( struct ieee80211_link_data * link , 
+struct cfg80211_bss * cbss ) 
+{ 
+struct ieee80211_he_mcs_nss_supp * he_mcs_nss_supp ; 
+const struct element * ht_cap_elem , * vht_cap_elem ; 
+const struct cfg80211_bss_ies * ies ; 
+const struct ieee80211_ht_cap * ht_cap ; 
+const struct ieee80211_vht_cap * vht_cap ; 
+const struct ieee80211_he_cap_elem * he_cap ; 
+const struct element * he_cap_elem ; 
+u16 mcs_80_map , mcs_160_map ; 
+int i , mcs_nss_size ; 
+bool support_160 ; 
+u8 chains = 1 ; 
+
+if ( link -> u . mgd . conn_flags & ieee80211_conn_disable_ht ) 
+return chains ; 
+
+ht_cap_elem = ieee80211_bss_get_elem ( cbss , wlan_eid_ht_capability ) ; 
+if ( ht_cap_elem && ht_cap_elem -> datalen >= sizeof ( * ht_cap ) ) { 
+ht_cap = ( void * ) ht_cap_elem -> data ; 
+chains = ieee80211_mcs_to_chains ( & ht_cap -> mcs ) ; 
+
+
+
+
+} 
+
+if ( link -> u . mgd . conn_flags & ieee80211_conn_disable_vht ) 
+return chains ; 
+
+vht_cap_elem = ieee80211_bss_get_elem ( cbss , wlan_eid_vht_capability ) ; 
+if ( vht_cap_elem && vht_cap_elem -> datalen >= sizeof ( * vht_cap ) ) { 
+u8 nss ; 
+u16 tx_mcs_map ; 
+
+vht_cap = ( void * ) vht_cap_elem -> data ; 
+tx_mcs_map = le16_to_cpu ( vht_cap -> supp_mcs . tx_mcs_map ) ; 
+for ( nss = 8 ; nss > 0 ; nss -- ) { 
+if ( ( ( tx_mcs_map >> ( 2 * ( nss - 1 ) ) ) & 3 ) != 
+ieee80211_vht_mcs_not_supported ) 
+break ; 
+} 
+
+chains = max ( chains , nss ) ; 
+} 
+
+if ( link -> u . mgd . conn_flags & ieee80211_conn_disable_he ) 
+return chains ; 
+
+ies = rcu_dereference ( cbss -> ies ) ; 
+he_cap_elem = cfg80211_find_ext_elem ( wlan_eid_ext_he_capability , 
+ies -> data , ies -> len ) ; 
+
+if ( ! he_cap_elem || he_cap_elem -> datalen < sizeof ( * he_cap ) ) 
+return chains ; 
+
+
+he_cap = ( void * ) ( he_cap_elem -> data + 1 ) ; 
+mcs_nss_size = ieee80211_he_mcs_nss_size ( he_cap ) ; 
+
+
+if ( he_cap_elem -> datalen < 1 + mcs_nss_size + sizeof ( * he_cap ) ) 
+return chains ; 
+
+
+he_mcs_nss_supp = ( void * ) ( he_cap + 1 ) ; 
+
+mcs_80_map = le16_to_cpu ( he_mcs_nss_supp -> tx_mcs_80 ) ; 
+
+for ( i = 7 ; i >= 0 ; i -- ) { 
+u8 mcs_80 = mcs_80_map >> ( 2 * i ) & 3 ; 
+
+if ( mcs_80 != ieee80211_vht_mcs_not_supported ) { 
+chains = max_t ( u8 , chains , i + 1 ) ; 
+break ; 
+} 
+} 
+
+support_160 = he_cap -> phy_cap_info [ 0 ] & 
+ieee80211_he_phy_cap0_channel_width_set_160mhz_in_5g ; 
+
+if ( ! support_160 ) 
+return chains ; 
+
+mcs_160_map = le16_to_cpu ( he_mcs_nss_supp -> tx_mcs_160 ) ; 
+for ( i = 7 ; i >= 0 ; i -- ) { 
+u8 mcs_160 = mcs_160_map >> ( 2 * i ) & 3 ; 
+
+if ( mcs_160 != ieee80211_vht_mcs_not_supported ) { 
+chains = max_t ( u8 , chains , i + 1 ) ; 
+break ; 
+} 
+} 
+
+return chains ; 
+} 
+
+static bool 
+ieee80211_verify_peer_he_mcs_support ( struct ieee80211_sub_if_data * sdata , 
+const struct cfg80211_bss_ies * ies , 
+const struct ieee80211_he_operation * he_op ) 
+{ 
+const struct element * he_cap_elem ; 
+const struct ieee80211_he_cap_elem * he_cap ; 
+struct ieee80211_he_mcs_nss_supp * he_mcs_nss_supp ; 
+u16 mcs_80_map_tx , mcs_80_map_rx ; 
+u16 ap_min_req_set ; 
+int mcs_nss_size ; 
+int nss ; 
+
+he_cap_elem = cfg80211_find_ext_elem ( wlan_eid_ext_he_capability , 
+ies -> data , ies -> len ) ; 
+
+if ( ! he_cap_elem ) 
+return false ; 
+
+
+if ( he_cap_elem -> datalen < 1 + sizeof ( * he_cap ) ) { 
+sdata_info ( sdata , 
+"invalid he elem, disable he\n" ) ; 
+return false ; 
+} 
+
+
+he_cap = ( void * ) ( he_cap_elem -> data + 1 ) ; 
+mcs_nss_size = ieee80211_he_mcs_nss_size ( he_cap ) ; 
+
+
+if ( he_cap_elem -> datalen < 1 + sizeof ( * he_cap ) + mcs_nss_size ) { 
+sdata_info ( sdata , 
+"invalid he elem with nss size, disable he\n" ) ; 
+return false ; 
+} 
+
+
+he_mcs_nss_supp = ( void * ) ( he_cap + 1 ) ; 
+
+mcs_80_map_tx = le16_to_cpu ( he_mcs_nss_supp -> tx_mcs_80 ) ; 
+mcs_80_map_rx = le16_to_cpu ( he_mcs_nss_supp -> rx_mcs_80 ) ; 
+
+
+
+
+
+
+
+
+
+if ( ( mcs_80_map_tx & 0x3 ) == ieee80211_he_mcs_not_supported || 
+( mcs_80_map_rx & 0x3 ) == ieee80211_he_mcs_not_supported ) { 
+sdata_info ( sdata , 
+"missing mandatory rates for 1 nss, rx 0x%x, tx 0x%x, disable he\n" , 
+mcs_80_map_tx , mcs_80_map_rx ) ; 
+return false ; 
+} 
+
+if ( ! he_op ) 
+return true ; 
+
+ap_min_req_set = le16_to_cpu ( he_op -> he_mcs_nss_set ) ; 
+
+
+
+
+
+
+if ( ! ap_min_req_set ) 
+return true ; 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+for ( nss = 8 ; nss > 0 ; nss -- ) { 
+u8 ap_op_val = ( ap_min_req_set >> ( 2 * ( nss - 1 ) ) ) & 3 ; 
+u8 ap_rx_val ; 
+u8 ap_tx_val ; 
+
+if ( ap_op_val == ieee80211_he_mcs_not_supported ) 
+continue ; 
+
+ap_rx_val = ( mcs_80_map_rx >> ( 2 * ( nss - 1 ) ) ) & 3 ; 
+ap_tx_val = ( mcs_80_map_tx >> ( 2 * ( nss - 1 ) ) ) & 3 ; 
+
+if ( ap_rx_val == ieee80211_he_mcs_not_supported || 
+ap_tx_val == ieee80211_he_mcs_not_supported || 
+ap_rx_val < ap_op_val || ap_tx_val < ap_op_val ) { 
+sdata_info ( sdata , 
+"invalid rates for %d nss, rx %d, tx %d oper %d, disable he\n" , 
+nss , ap_rx_val , ap_rx_val , ap_op_val ) ; 
+return false ; 
+} 
+} 
+
+return true ; 
+} 
+
+static bool 
+ieee80211_verify_sta_he_mcs_support ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_supported_band * sband , 
+const struct ieee80211_he_operation * he_op ) 
+{ 
+const struct ieee80211_sta_he_cap * sta_he_cap = 
+ieee80211_get_he_iftype_cap ( sband , 
+ieee80211_vif_type_p2p ( & sdata -> vif ) ) ; 
+u16 ap_min_req_set ; 
+int i ; 
+
+if ( ! sta_he_cap || ! he_op ) 
+return false ; 
+
+ap_min_req_set = le16_to_cpu ( he_op -> he_mcs_nss_set ) ; 
+
+
+
+
+
+
+if ( ! ap_min_req_set ) 
+return true ; 
+
+
+for ( i = 0 ; i < 3 ; i ++ ) { 
+const struct ieee80211_he_mcs_nss_supp * sta_mcs_nss_supp = 
+& sta_he_cap -> he_mcs_nss_supp ; 
+u16 sta_mcs_map_rx = 
+le16_to_cpu ( ( ( __le16 * ) sta_mcs_nss_supp ) [ 2 * i ] ) ; 
+u16 sta_mcs_map_tx = 
+le16_to_cpu ( ( ( __le16 * ) sta_mcs_nss_supp ) [ 2 * i + 1 ] ) ; 
+u8 nss ; 
+bool verified = true ; 
+
+
+
+
+
+
+
+
+
+
+for ( nss = 8 ; nss > 0 ; nss -- ) { 
+u8 sta_rx_val = ( sta_mcs_map_rx >> ( 2 * ( nss - 1 ) ) ) & 3 ; 
+u8 sta_tx_val = ( sta_mcs_map_tx >> ( 2 * ( nss - 1 ) ) ) & 3 ; 
+u8 ap_val = ( ap_min_req_set >> ( 2 * ( nss - 1 ) ) ) & 3 ; 
+
+if ( ap_val == ieee80211_he_mcs_not_supported ) 
+continue ; 
+
+
+
+
+
+
+
+
+
+
+
+
+
+if ( sta_rx_val == ieee80211_he_mcs_not_supported || 
+sta_tx_val == ieee80211_he_mcs_not_supported || 
+( ap_val > sta_rx_val ) || ( ap_val > sta_tx_val ) ) { 
+verified = false ; 
+break ; 
+} 
+} 
+
+if ( verified ) 
+return true ; 
+} 
+
+
+return false ; 
+} 
+
+static int ieee80211_prep_channel ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_link_data * link , 
+struct cfg80211_bss * cbss , 
+ieee80211_conn_flags_t * conn_flags ) 
+{ 
+struct ieee80211_local * local = sdata -> local ; 
+const struct ieee80211_ht_cap * ht_cap = null ; 
+const struct ieee80211_ht_operation * ht_oper = null ; 
+const struct ieee80211_vht_operation * vht_oper = null ; 
+const struct ieee80211_he_operation * he_oper = null ; 
+const struct ieee80211_eht_operation * eht_oper = null ; 
+const struct ieee80211_s1g_oper_ie * s1g_oper = null ; 
+struct ieee80211_supported_band * sband ; 
+struct cfg80211_chan_def chandef ; 
+bool is_6ghz = cbss -> channel -> band == nl80211_band_6ghz ; 
+bool is_5ghz = cbss -> channel -> band == nl80211_band_5ghz ; 
+struct ieee80211_bss * bss = ( void * ) cbss -> priv ; 
+struct ieee80211_elems_parse_params parse_params = { 
+. bss = cbss , 
+. link_id = - 1 , 
+. from_ap = true , 
+} ; 
+struct ieee802_11_elems * elems ; 
+const struct cfg80211_bss_ies * ies ; 
+int ret ; 
+u32 i ; 
+bool have_80mhz ; 
+
+rcu_read_lock ( ) ; 
+
+ies = rcu_dereference ( cbss -> ies ) ; 
+parse_params . start = ies -> data ; 
+parse_params . len = ies -> len ; 
+elems = ieee802_11_parse_elems_full ( & parse_params ) ; 
+if ( ! elems ) { 
+rcu_read_unlock ( ) ; 
+return - enomem ; 
+} 
+
+sband = local -> hw . wiphy -> bands [ cbss -> channel -> band ] ; 
+
+* conn_flags &= ~ ( ieee80211_conn_disable_40mhz | 
+ieee80211_conn_disable_80p80mhz | 
+ieee80211_conn_disable_160mhz ) ; 
+
+
+if ( ! sband -> ht_cap . ht_supported && ! is_6ghz ) { 
+mlme_dbg ( sdata , "ht not supported, disabling ht/vht/he/eht\n" ) ; 
+* conn_flags |= ieee80211_conn_disable_ht ; 
+* conn_flags |= ieee80211_conn_disable_vht ; 
+* conn_flags |= ieee80211_conn_disable_he ; 
+* conn_flags |= ieee80211_conn_disable_eht ; 
+} 
+
+if ( ! sband -> vht_cap . vht_supported && is_5ghz ) { 
+mlme_dbg ( sdata , "vht not supported, disabling vht/he/eht\n" ) ; 
+* conn_flags |= ieee80211_conn_disable_vht ; 
+* conn_flags |= ieee80211_conn_disable_he ; 
+* conn_flags |= ieee80211_conn_disable_eht ; 
+} 
+
+if ( ! ieee80211_get_he_iftype_cap ( sband , 
+ieee80211_vif_type_p2p ( & sdata -> vif ) ) ) { 
+mlme_dbg ( sdata , "he not supported, disabling he and eht\n" ) ; 
+* conn_flags |= ieee80211_conn_disable_he ; 
+* conn_flags |= ieee80211_conn_disable_eht ; 
+} 
+
+if ( ! ieee80211_get_eht_iftype_cap ( sband , 
+ieee80211_vif_type_p2p ( & sdata -> vif ) ) ) { 
+mlme_dbg ( sdata , "eht not supported, disabling eht\n" ) ; 
+* conn_flags |= ieee80211_conn_disable_eht ; 
+} 
+
+if ( ! ( * conn_flags & ieee80211_conn_disable_ht ) && ! is_6ghz ) { 
+ht_oper = elems -> ht_operation ; 
+ht_cap = elems -> ht_cap_elem ; 
+
+if ( ! ht_cap ) { 
+* conn_flags |= ieee80211_conn_disable_ht ; 
+ht_oper = null ; 
+} 
+} 
+
+if ( ! ( * conn_flags & ieee80211_conn_disable_vht ) && ! is_6ghz ) { 
+vht_oper = elems -> vht_operation ; 
+if ( vht_oper && ! ht_oper ) { 
+vht_oper = null ; 
+sdata_info ( sdata , 
+"ap advertised vht without ht, disabling ht/vht/he\n" ) ; 
+* conn_flags |= ieee80211_conn_disable_ht ; 
+* conn_flags |= ieee80211_conn_disable_vht ; 
+* conn_flags |= ieee80211_conn_disable_he ; 
+* conn_flags |= ieee80211_conn_disable_eht ; 
+} 
+
+if ( ! elems -> vht_cap_elem ) { 
+* conn_flags |= ieee80211_conn_disable_vht ; 
+vht_oper = null ; 
+} 
+} 
+
+if ( ! ( * conn_flags & ieee80211_conn_disable_he ) ) { 
+he_oper = elems -> he_operation ; 
+
+if ( link && is_6ghz ) { 
+struct ieee80211_bss_conf * bss_conf ; 
+u8 j = 0 ; 
+
+bss_conf = link -> conf ; 
+
+if ( elems -> pwr_constr_elem ) 
+bss_conf -> pwr_reduction = * elems -> pwr_constr_elem ; 
+
+build_bug_on ( array_size ( bss_conf -> tx_pwr_env ) != 
+array_size ( elems -> tx_pwr_env ) ) ; 
+
+for ( i = 0 ; i < elems -> tx_pwr_env_num ; i ++ ) { 
+if ( elems -> tx_pwr_env_len [ i ] > 
+sizeof ( bss_conf -> tx_pwr_env [ j ] ) ) 
+continue ; 
+
+bss_conf -> tx_pwr_env_num ++ ; 
+memcpy ( & bss_conf -> tx_pwr_env [ j ] , elems -> tx_pwr_env [ i ] , 
+elems -> tx_pwr_env_len [ i ] ) ; 
+j ++ ; 
+} 
+} 
+
+if ( ! ieee80211_verify_peer_he_mcs_support ( sdata , ies , he_oper ) || 
+! ieee80211_verify_sta_he_mcs_support ( sdata , sband , he_oper ) ) 
+* conn_flags |= ieee80211_conn_disable_he | 
+ieee80211_conn_disable_eht ; 
+} 
+
+
+
+
+
+
+
+if ( ! ( * conn_flags & 
+( ieee80211_conn_disable_he | 
+ieee80211_conn_disable_eht ) ) && 
+he_oper ) { 
+const struct cfg80211_bss_ies * cbss_ies ; 
+const u8 * eht_oper_ie ; 
+
+cbss_ies = rcu_dereference ( cbss -> ies ) ; 
+eht_oper_ie = cfg80211_find_ext_ie ( wlan_eid_ext_eht_operation , 
+cbss_ies -> data , cbss_ies -> len ) ; 
+if ( eht_oper_ie && eht_oper_ie [ 1 ] >= 
+1 + sizeof ( struct ieee80211_eht_operation ) ) 
+eht_oper = ( void * ) ( eht_oper_ie + 3 ) ; 
+else 
+eht_oper = null ; 
+} 
+
+
+have_80mhz = false ; 
+for ( i = 0 ; i < sband -> n_channels ; i ++ ) { 
+if ( sband -> channels [ i ] . flags & ( ieee80211_chan_disabled | 
+ieee80211_chan_no_80mhz ) ) 
+continue ; 
+
+have_80mhz = true ; 
+break ; 
+} 
+
+if ( ! have_80mhz ) { 
+sdata_info ( sdata , "80 mhz not supported, disabling vht\n" ) ; 
+* conn_flags |= ieee80211_conn_disable_vht ; 
+} 
+
+if ( sband -> band == nl80211_band_s1ghz ) { 
+s1g_oper = elems -> s1g_oper ; 
+if ( ! s1g_oper ) 
+sdata_info ( sdata , 
+"ap missing s1g operation element?\n" ) ; 
+} 
+
+* conn_flags |= 
+ieee80211_determine_chantype ( sdata , link , * conn_flags , 
+sband , 
+cbss -> channel , 
+bss -> vht_cap_info , 
+ht_oper , vht_oper , 
+he_oper , eht_oper , 
+s1g_oper , 
+& chandef , false ) ; 
+
+if ( link ) 
+link -> needed_rx_chains = 
+min ( ieee80211_max_rx_chains ( link , cbss ) , 
+local -> rx_chains ) ; 
+
+rcu_read_unlock ( ) ; 
+
+kfree ( elems ) ; 
+elems = null ; 
+
+if ( * conn_flags & ieee80211_conn_disable_he && is_6ghz ) { 
+sdata_info ( sdata , "rejecting non-he 6/7 ghz connection" ) ; 
+return - einval ; 
+} 
+
+if ( ! link ) 
+return 0 ; 
+
+
+link -> smps_mode = ieee80211_smps_off ; 
+
+mutex_lock ( & local -> mtx ) ; 
+
+
+
+
+
+ret = ieee80211_link_use_channel ( link , & chandef , 
+ieee80211_chanctx_shared ) ; 
+
+
+if ( chandef . width == nl80211_chan_width_5 || 
+chandef . width == nl80211_chan_width_10 ) 
+goto out ; 
+
+while ( ret && chandef . width != nl80211_chan_width_20_noht ) { 
+* conn_flags |= 
+ieee80211_chandef_downgrade ( & chandef ) ; 
+ret = ieee80211_link_use_channel ( link , & chandef , 
+ieee80211_chanctx_shared ) ; 
+} 
+out : 
+mutex_unlock ( & local -> mtx ) ; 
+return ret ; 
+} 
+
+static bool ieee80211_get_dtim ( const struct cfg80211_bss_ies * ies , 
+u8 * dtim_count , u8 * dtim_period ) 
+{ 
+const u8 * tim_ie = cfg80211_find_ie ( wlan_eid_tim , ies -> data , ies -> len ) ; 
+const u8 * idx_ie = cfg80211_find_ie ( wlan_eid_multi_bssid_idx , ies -> data , 
+ies -> len ) ; 
+const struct ieee80211_tim_ie * tim = null ; 
+const struct ieee80211_bssid_index * idx ; 
+bool valid = tim_ie && tim_ie [ 1 ] >= 2 ; 
+
+if ( valid ) 
+tim = ( void * ) ( tim_ie + 2 ) ; 
+
+if ( dtim_count ) 
+* dtim_count = valid ? tim -> dtim_count : 0 ; 
+
+if ( dtim_period ) 
+* dtim_period = valid ? tim -> dtim_period : 0 ; 
+
+
+if ( ! idx_ie || idx_ie [ 1 ] < 3 ) 
+return valid ; 
+
+idx = ( void * ) ( idx_ie + 2 ) ; 
+
+if ( dtim_count ) 
+* dtim_count = idx -> dtim_count ; 
+
+if ( dtim_period ) 
+* dtim_period = idx -> dtim_period ; 
+
+return true ; 
+} 
+
+static bool ieee80211_assoc_success ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_mgmt * mgmt , 
+struct ieee802_11_elems * elems , 
+const u8 * elem_start , unsigned int elem_len ) 
+{ 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+struct ieee80211_mgd_assoc_data * assoc_data = ifmgd -> assoc_data ; 
+struct ieee80211_local * local = sdata -> local ; 
+unsigned int link_id ; 
+struct sta_info * sta ; 
+u64 changed [ ieee80211_mld_max_num_links ] = { } ; 
+u16 valid_links = 0 ; 
+int err ; 
+
+mutex_lock ( & sdata -> local -> sta_mtx ) ; 
+
+
+
+
+sta = sta_info_get ( sdata , assoc_data -> ap_addr ) ; 
+if ( warn_on ( ! sta ) ) 
+goto out_err ; 
+
+if ( sdata -> vif . valid_links ) { 
+for ( link_id = 0 ; link_id < ieee80211_mld_max_num_links ; link_id ++ ) { 
+if ( ! assoc_data -> link [ link_id ] . bss ) 
+continue ; 
+valid_links |= bit ( link_id ) ; 
+
+if ( link_id != assoc_data -> assoc_link_id ) { 
+err = ieee80211_sta_allocate_link ( sta , link_id ) ; 
+if ( err ) 
+goto out_err ; 
+} 
+} 
+
+ieee80211_vif_set_links ( sdata , valid_links ) ; 
+} 
+
+for ( link_id = 0 ; link_id < ieee80211_mld_max_num_links ; link_id ++ ) { 
+struct cfg80211_bss * cbss = assoc_data -> link [ link_id ] . bss ; 
+struct ieee80211_link_data * link ; 
+struct link_sta_info * link_sta ; 
+
+if ( ! cbss ) 
+continue ; 
+
+link = sdata_dereference ( sdata -> link [ link_id ] , sdata ) ; 
+if ( warn_on ( ! link ) ) 
+goto out_err ; 
+
+if ( sdata -> vif . valid_links ) 
+link_info ( link , 
+"local address %pm, ap link address %pm%s\n" , 
+link -> conf -> addr , 
+assoc_data -> link [ link_id ] . bss -> bssid , 
+link_id == assoc_data -> assoc_link_id ? 
+" (assoc)" : "" ) ; 
+
+link_sta = rcu_dereference_protected ( sta -> link [ link_id ] , 
+lockdep_is_held ( & local -> sta_mtx ) ) ; 
+if ( warn_on ( ! link_sta ) ) 
+goto out_err ; 
+
+if ( ! link -> u . mgd . have_beacon ) { 
+const struct cfg80211_bss_ies * ies ; 
+
+rcu_read_lock ( ) ; 
+ies = rcu_dereference ( cbss -> beacon_ies ) ; 
+if ( ies ) 
+link -> u . mgd . have_beacon = true ; 
+else 
+ies = rcu_dereference ( cbss -> ies ) ; 
+ieee80211_get_dtim ( ies , 
+& link -> conf -> sync_dtim_count , 
+& link -> u . mgd . dtim_period ) ; 
+link -> conf -> beacon_int = cbss -> beacon_interval ; 
+rcu_read_unlock ( ) ; 
+} 
+
+link -> conf -> dtim_period = link -> u . mgd . dtim_period ? : 1 ; 
+
+if ( link_id != assoc_data -> assoc_link_id ) { 
+err = ieee80211_prep_channel ( sdata , link , cbss , 
+& link -> u . mgd . conn_flags ) ; 
+if ( err ) { 
+link_info ( link , "prep_channel failed\n" ) ; 
+goto out_err ; 
+} 
+} 
+
+err = ieee80211_mgd_setup_link_sta ( link , sta , link_sta , 
+assoc_data -> link [ link_id ] . bss ) ; 
+if ( err ) 
+goto out_err ; 
+
+if ( ! ieee80211_assoc_config_link ( link , link_sta , 
+assoc_data -> link [ link_id ] . bss , 
+mgmt , elem_start , elem_len , 
+& changed [ link_id ] ) ) 
+goto out_err ; 
+
+if ( assoc_data -> link [ link_id ] . status != wlan_status_success ) { 
+valid_links &= ~ bit ( link_id ) ; 
+ieee80211_sta_remove_link ( sta , link_id ) ; 
+continue ; 
+} 
+
+if ( link_id != assoc_data -> assoc_link_id ) { 
+err = ieee80211_sta_activate_link ( sta , link_id ) ; 
+if ( err ) 
+goto out_err ; 
+} 
+} 
+
+
+ieee80211_vif_set_links ( sdata , valid_links ) ; 
+
+rate_control_rate_init ( sta ) ; 
+
+if ( ifmgd -> flags & ieee80211_sta_mfp_enabled ) { 
+set_sta_flag ( sta , wlan_sta_mfp ) ; 
+sta -> sta . mfp = true ; 
+} else { 
+sta -> sta . mfp = false ; 
+} 
+
+ieee80211_sta_set_max_amsdu_subframes ( sta , elems -> ext_capab , 
+elems -> ext_capab_len ) ; 
+
+sta -> sta . wme = ( elems -> wmm_param || elems -> s1g_capab ) && 
+local -> hw . queues >= ieee80211_num_acs ; 
+
+err = sta_info_move_state ( sta , ieee80211_sta_assoc ) ; 
+if ( ! err && ! ( ifmgd -> flags & ieee80211_sta_control_port ) ) 
+err = sta_info_move_state ( sta , ieee80211_sta_authorized ) ; 
+if ( err ) { 
+sdata_info ( sdata , 
+"failed to move station %pm to desired state\n" , 
+sta -> sta . addr ) ; 
+warn_on ( __sta_info_destroy ( sta ) ) ; 
+goto out_err ; 
+} 
+
+if ( sdata -> wdev . use_4addr ) 
+drv_sta_set_4addr ( local , sdata , & sta -> sta , true ) ; 
+
+mutex_unlock ( & sdata -> local -> sta_mtx ) ; 
+
+ieee80211_set_associated ( sdata , assoc_data , changed ) ; 
+
+
+
+
+
+if ( ifmgd -> use_4addr ) 
+ieee80211_send_4addr_nullfunc ( local , sdata ) ; 
+
+
+
+
+
+ieee80211_sta_reset_beacon_monitor ( sdata ) ; 
+ieee80211_sta_reset_conn_monitor ( sdata ) ; 
+
+return true ; 
+out_err : 
+eth_zero_addr ( sdata -> vif . cfg . ap_addr ) ; 
+mutex_unlock ( & sdata -> local -> sta_mtx ) ; 
+return false ; 
+} 
+
+static void ieee80211_rx_mgmt_assoc_resp ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_mgmt * mgmt , 
+size_t len ) 
+{ 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+struct ieee80211_mgd_assoc_data * assoc_data = ifmgd -> assoc_data ; 
+u16 capab_info , status_code , aid ; 
+struct ieee80211_elems_parse_params parse_params = { 
+. bss = null , 
+. link_id = - 1 , 
+. from_ap = true , 
+} ; 
+struct ieee802_11_elems * elems ; 
+int ac ; 
+const u8 * elem_start ; 
+unsigned int elem_len ; 
+bool reassoc ; 
+struct ieee80211_event event = { 
+. type = mlme_event , 
+. u . mlme . data = assoc_event , 
+} ; 
+struct ieee80211_prep_tx_info info = { } ; 
+struct cfg80211_rx_assoc_resp resp = { 
+. uapsd_queues = - 1 , 
+} ; 
+u8 ap_mld_addr [ eth_alen ] __aligned ( 2 ) ; 
+unsigned int link_id ; 
+
+sdata_assert_lock ( sdata ) ; 
+
+if ( ! assoc_data ) 
+return ; 
+
+if ( ! ether_addr_equal ( assoc_data -> ap_addr , mgmt -> bssid ) || 
+! ether_addr_equal ( assoc_data -> ap_addr , mgmt -> sa ) ) 
+return ; 
+
+
+
+
+
+
+if ( len < 24 + 6 ) 
+return ; 
+
+reassoc = ieee80211_is_reassoc_resp ( mgmt -> frame_control ) ; 
+capab_info = le16_to_cpu ( mgmt -> u . assoc_resp . capab_info ) ; 
+status_code = le16_to_cpu ( mgmt -> u . assoc_resp . status_code ) ; 
+if ( assoc_data -> s1g ) 
+elem_start = mgmt -> u . s1g_assoc_resp . variable ; 
+else 
+elem_start = mgmt -> u . assoc_resp . variable ; 
+
+
+
+
+
+
+
+info . subtype = reassoc ? ieee80211_stype_reassoc_req : 
+ieee80211_stype_assoc_req ; 
+
+if ( assoc_data -> fils_kek_len && 
+fils_decrypt_assoc_resp ( sdata , ( u8 * ) mgmt , & len , assoc_data ) < 0 ) 
+return ; 
+
+elem_len = len - ( elem_start - ( u8 * ) mgmt ) ; 
+parse_params . start = elem_start ; 
+parse_params . len = elem_len ; 
+elems = ieee802_11_parse_elems_full ( & parse_params ) ; 
+if ( ! elems ) 
+goto notify_driver ; 
+
+if ( elems -> aid_resp ) 
+aid = le16_to_cpu ( elems -> aid_resp -> aid ) ; 
+else if ( assoc_data -> s1g ) 
+aid = 0 ; 
+else 
+aid = le16_to_cpu ( mgmt -> u . assoc_resp . aid ) ; 
+
+
+
+
+
+aid &= 0x7ff ; 
+
+sdata_info ( sdata , 
+"rx %sssocresp from %pm (capab=0x%x status=%d aid=%d)\n" , 
+reassoc ? "rea" : "a" , assoc_data -> ap_addr , 
+capab_info , status_code , ( u16 ) ( aid & ~ ( bit ( 15 ) | bit ( 14 ) ) ) ) ; 
+
+ifmgd -> broken_ap = false ; 
+
+if ( status_code == wlan_status_assoc_rejected_temporarily && 
+elems -> timeout_int && 
+elems -> timeout_int -> type == wlan_timeout_assoc_comeback ) { 
+u32 tu , ms ; 
+
+cfg80211_assoc_comeback ( sdata -> dev , assoc_data -> ap_addr , 
+le32_to_cpu ( elems -> timeout_int -> value ) ) ; 
+
+tu = le32_to_cpu ( elems -> timeout_int -> value ) ; 
+ms = tu * 1024 / 1000 ; 
+sdata_info ( sdata , 
+"%pm rejected association temporarily; comeback duration %u tu (%u ms)\n" , 
+assoc_data -> ap_addr , tu , ms ) ; 
+assoc_data -> timeout = jiffies + msecs_to_jiffies ( ms ) ; 
+assoc_data -> timeout_started = true ; 
+if ( ms > ieee80211_assoc_timeout ) 
+run_again ( sdata , assoc_data -> timeout ) ; 
+goto notify_driver ; 
+} 
+
+if ( status_code != wlan_status_success ) { 
+sdata_info ( sdata , "%pm denied association (code=%d)\n" , 
+assoc_data -> ap_addr , status_code ) ; 
+event . u . mlme . status = mlme_denied ; 
+event . u . mlme . reason = status_code ; 
+drv_event_callback ( sdata -> local , sdata , & event ) ; 
+} else { 
+if ( aid == 0 || aid > ieee80211_max_aid ) { 
+sdata_info ( sdata , 
+"invalid aid value %d (out of range), turn off ps\n" , 
+aid ) ; 
+aid = 0 ; 
+ifmgd -> broken_ap = true ; 
+} 
+
+if ( sdata -> vif . valid_links ) { 
+if ( ! elems -> multi_link ) { 
+sdata_info ( sdata , 
+"mlo association with %pm but no multi-link element in response!\n" , 
+assoc_data -> ap_addr ) ; 
+goto abandon_assoc ; 
+} 
+
+if ( le16_get_bits ( elems -> multi_link -> control , 
+ieee80211_ml_control_type ) != 
+ieee80211_ml_control_type_basic ) { 
+sdata_info ( sdata , 
+"bad multi-link element (control=0x%x)\n" , 
+le16_to_cpu ( elems -> multi_link -> control ) ) ; 
+goto abandon_assoc ; 
+} else { 
+struct ieee80211_mle_basic_common_info * common ; 
+
+common = ( void * ) elems -> multi_link -> variable ; 
+
+if ( memcmp ( assoc_data -> ap_addr , 
+common -> mld_mac_addr , eth_alen ) ) { 
+sdata_info ( sdata , 
+"ap mld mac address mismatch: got %pm expected %pm\n" , 
+common -> mld_mac_addr , 
+assoc_data -> ap_addr ) ; 
+goto abandon_assoc ; 
+} 
+} 
+} 
+
+sdata -> vif . cfg . aid = aid ; 
+
+if ( ! ieee80211_assoc_success ( sdata , mgmt , elems , 
+elem_start , elem_len ) ) { 
+
+ieee80211_destroy_assoc_data ( sdata , assoc_timeout ) ; 
+goto notify_driver ; 
+} 
+event . u . mlme . status = mlme_success ; 
+drv_event_callback ( sdata -> local , sdata , & event ) ; 
+sdata_info ( sdata , "associated\n" ) ; 
+
+info . success = 1 ; 
+} 
+
+for ( link_id = 0 ; link_id < ieee80211_mld_max_num_links ; link_id ++ ) { 
+struct ieee80211_link_data * link ; 
+
+link = sdata_dereference ( sdata -> link [ link_id ] , sdata ) ; 
+if ( ! link ) 
+continue ; 
+
+if ( ! assoc_data -> link [ link_id ] . bss ) 
+continue ; 
+
+resp . links [ link_id ] . bss = assoc_data -> link [ link_id ] . bss ; 
+resp . links [ link_id ] . addr = link -> conf -> addr ; 
+resp . links [ link_id ] . status = assoc_data -> link [ link_id ] . status ; 
+
+
+resp . uapsd_queues = 0 ; 
+for ( ac = 0 ; ac < ieee80211_num_acs ; ac ++ ) 
+if ( link -> tx_conf [ ac ] . uapsd ) 
+resp . uapsd_queues |= ieee80211_ac_to_qos_mask [ ac ] ; 
+} 
+
+if ( sdata -> vif . valid_links ) { 
+ether_addr_copy ( ap_mld_addr , sdata -> vif . cfg . ap_addr ) ; 
+resp . ap_mld_addr = ap_mld_addr ; 
+} 
+
+ieee80211_destroy_assoc_data ( sdata , 
+status_code == wlan_status_success ? 
+assoc_success : 
+assoc_rejected ) ; 
+
+resp . buf = ( u8 * ) mgmt ; 
+resp . len = len ; 
+resp . req_ies = ifmgd -> assoc_req_ies ; 
+resp . req_ies_len = ifmgd -> assoc_req_ies_len ; 
+cfg80211_rx_assoc_resp ( sdata -> dev , & resp ) ; 
+notify_driver : 
+drv_mgd_complete_tx ( sdata -> local , sdata , & info ) ; 
+kfree ( elems ) ; 
+return ; 
+abandon_assoc : 
+ieee80211_destroy_assoc_data ( sdata , assoc_abandon ) ; 
+goto notify_driver ; 
+} 
+
+static void ieee80211_rx_bss_info ( struct ieee80211_link_data * link , 
+struct ieee80211_mgmt * mgmt , size_t len , 
+struct ieee80211_rx_status * rx_status ) 
+{ 
+struct ieee80211_sub_if_data * sdata = link -> sdata ; 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_bss * bss ; 
+struct ieee80211_channel * channel ; 
+
+sdata_assert_lock ( sdata ) ; 
+
+channel = ieee80211_get_channel_khz ( local -> hw . wiphy , 
+ieee80211_rx_status_to_khz ( rx_status ) ) ; 
+if ( ! channel ) 
+return ; 
+
+bss = ieee80211_bss_info_update ( local , rx_status , mgmt , len , channel ) ; 
+if ( bss ) { 
+link -> conf -> beacon_rate = bss -> beacon_rate ; 
+ieee80211_rx_bss_put ( local , bss ) ; 
+} 
+} 
+
+
+static void ieee80211_rx_mgmt_probe_resp ( struct ieee80211_link_data * link , 
+struct sk_buff * skb ) 
+{ 
+struct ieee80211_sub_if_data * sdata = link -> sdata ; 
+struct ieee80211_mgmt * mgmt = ( void * ) skb -> data ; 
+struct ieee80211_if_managed * ifmgd ; 
+struct ieee80211_rx_status * rx_status = ( void * ) skb -> cb ; 
+struct ieee80211_channel * channel ; 
+size_t baselen , len = skb -> len ; 
+
+ifmgd = & sdata -> u . mgd ; 
+
+sdata_assert_lock ( sdata ) ; 
+
+
+
+
+
+
+
+
+channel = ieee80211_get_channel ( sdata -> local -> hw . wiphy , 
+rx_status -> freq ) ; 
+if ( ! channel ) 
+return ; 
+
+if ( ! ether_addr_equal ( mgmt -> da , sdata -> vif . addr ) && 
+( channel -> band != nl80211_band_6ghz || 
+! is_broadcast_ether_addr ( mgmt -> da ) ) ) 
+return ; 
+
+baselen = ( u8 * ) mgmt -> u . probe_resp . variable - ( u8 * ) mgmt ; 
+if ( baselen > len ) 
+return ; 
+
+ieee80211_rx_bss_info ( link , mgmt , len , rx_status ) ; 
+
+if ( ifmgd -> associated && 
+ether_addr_equal ( mgmt -> bssid , link -> u . mgd . bssid ) ) 
+ieee80211_reset_ap_probe ( sdata ) ; 
+} 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+static const u64 care_about_ies = 
+( 1ull << wlan_eid_country ) | 
+( 1ull << wlan_eid_erp_info ) | 
+( 1ull << wlan_eid_channel_switch ) | 
+( 1ull << wlan_eid_pwr_constraint ) | 
+( 1ull << wlan_eid_ht_capability ) | 
+( 1ull << wlan_eid_ht_operation ) | 
+( 1ull << wlan_eid_ext_chanswitch_ann ) ; 
+
+static void ieee80211_handle_beacon_sig ( struct ieee80211_link_data * link , 
+struct ieee80211_if_managed * ifmgd , 
+struct ieee80211_bss_conf * bss_conf , 
+struct ieee80211_local * local , 
+struct ieee80211_rx_status * rx_status ) 
+{ 
+struct ieee80211_sub_if_data * sdata = link -> sdata ; 
+
+
+
+if ( ! link -> u . mgd . tracking_signal_avg ) { 
+link -> u . mgd . tracking_signal_avg = true ; 
+ewma_beacon_signal_init ( & link -> u . mgd . ave_beacon_signal ) ; 
+link -> u . mgd . last_cqm_event_signal = 0 ; 
+link -> u . mgd . count_beacon_signal = 1 ; 
+link -> u . mgd . last_ave_beacon_signal = 0 ; 
+} else { 
+link -> u . mgd . count_beacon_signal ++ ; 
+} 
+
+ewma_beacon_signal_add ( & link -> u . mgd . ave_beacon_signal , 
+- rx_status -> signal ) ; 
+
+if ( ifmgd -> rssi_min_thold != ifmgd -> rssi_max_thold && 
+link -> u . mgd . count_beacon_signal >= ieee80211_signal_ave_min_count ) { 
+int sig = - ewma_beacon_signal_read ( & link -> u . mgd . ave_beacon_signal ) ; 
+int last_sig = link -> u . mgd . last_ave_beacon_signal ; 
+struct ieee80211_event event = { 
+. type = rssi_event , 
+} ; 
+
+
+
+
+
+if ( sig > ifmgd -> rssi_max_thold && 
+( last_sig <= ifmgd -> rssi_min_thold || last_sig == 0 ) ) { 
+link -> u . mgd . last_ave_beacon_signal = sig ; 
+event . u . rssi . data = rssi_event_high ; 
+drv_event_callback ( local , sdata , & event ) ; 
+} else if ( sig < ifmgd -> rssi_min_thold && 
+( last_sig >= ifmgd -> rssi_max_thold || 
+last_sig == 0 ) ) { 
+link -> u . mgd . last_ave_beacon_signal = sig ; 
+event . u . rssi . data = rssi_event_low ; 
+drv_event_callback ( local , sdata , & event ) ; 
+} 
+} 
+
+if ( bss_conf -> cqm_rssi_thold && 
+link -> u . mgd . count_beacon_signal >= ieee80211_signal_ave_min_count && 
+! ( sdata -> vif . driver_flags & ieee80211_vif_supports_cqm_rssi ) ) { 
+int sig = - ewma_beacon_signal_read ( & link -> u . mgd . ave_beacon_signal ) ; 
+int last_event = link -> u . mgd . last_cqm_event_signal ; 
+int thold = bss_conf -> cqm_rssi_thold ; 
+int hyst = bss_conf -> cqm_rssi_hyst ; 
+
+if ( sig < thold && 
+( last_event == 0 || sig < last_event - hyst ) ) { 
+link -> u . mgd . last_cqm_event_signal = sig ; 
+ieee80211_cqm_rssi_notify ( 
+& sdata -> vif , 
+nl80211_cqm_rssi_threshold_event_low , 
+sig , gfp_kernel ) ; 
+} else if ( sig > thold && 
+( last_event == 0 || sig > last_event + hyst ) ) { 
+link -> u . mgd . last_cqm_event_signal = sig ; 
+ieee80211_cqm_rssi_notify ( 
+& sdata -> vif , 
+nl80211_cqm_rssi_threshold_event_high , 
+sig , gfp_kernel ) ; 
+} 
+} 
+
+if ( bss_conf -> cqm_rssi_low && 
+link -> u . mgd . count_beacon_signal >= ieee80211_signal_ave_min_count ) { 
+int sig = - ewma_beacon_signal_read ( & link -> u . mgd . ave_beacon_signal ) ; 
+int last_event = link -> u . mgd . last_cqm_event_signal ; 
+int low = bss_conf -> cqm_rssi_low ; 
+int high = bss_conf -> cqm_rssi_high ; 
+
+if ( sig < low && 
+( last_event == 0 || last_event >= low ) ) { 
+link -> u . mgd . last_cqm_event_signal = sig ; 
+ieee80211_cqm_rssi_notify ( 
+& sdata -> vif , 
+nl80211_cqm_rssi_threshold_event_low , 
+sig , gfp_kernel ) ; 
+} else if ( sig > high && 
+( last_event == 0 || last_event <= high ) ) { 
+link -> u . mgd . last_cqm_event_signal = sig ; 
+ieee80211_cqm_rssi_notify ( 
+& sdata -> vif , 
+nl80211_cqm_rssi_threshold_event_high , 
+sig , gfp_kernel ) ; 
+} 
+} 
+} 
+
+static bool ieee80211_rx_our_beacon ( const u8 * tx_bssid , 
+struct cfg80211_bss * bss ) 
+{ 
+if ( ether_addr_equal ( tx_bssid , bss -> bssid ) ) 
+return true ; 
+if ( ! bss -> transmitted_bss ) 
+return false ; 
+return ether_addr_equal ( tx_bssid , bss -> transmitted_bss -> bssid ) ; 
+} 
+
+static bool ieee80211_config_puncturing ( struct ieee80211_link_data * link , 
+const struct ieee80211_eht_operation * eht_oper , 
+u64 * changed ) 
+{ 
+u16 bitmap = 0 , extracted ; 
+
+if ( ( eht_oper -> params & ieee80211_eht_oper_info_present ) && 
+( eht_oper -> params & 
+ieee80211_eht_oper_disabled_subchannel_bitmap_present ) ) { 
+const struct ieee80211_eht_operation_info * info = 
+( void * ) eht_oper -> optional ; 
+const u8 * disable_subchannel_bitmap = info -> optional ; 
+
+bitmap = get_unaligned_le16 ( disable_subchannel_bitmap ) ; 
+} 
+
+extracted = ieee80211_extract_dis_subch_bmap ( eht_oper , 
+& link -> conf -> chandef , 
+bitmap ) ; 
+
+
+if ( ! ( * changed & bss_changed_bandwidth ) && 
+extracted == link -> conf -> eht_puncturing ) 
+return true ; 
+
+if ( ! cfg80211_valid_disable_subchannel_bitmap ( & bitmap , 
+& link -> conf -> chandef ) ) { 
+link_info ( link , 
+"got an invalid disable subchannel bitmap from ap %pm: bitmap = 0x%x, bw = 0x%x. disconnect\n" , 
+link -> u . mgd . bssid , 
+bitmap , 
+link -> conf -> chandef . width ) ; 
+return false ; 
+} 
+
+ieee80211_handle_puncturing_bitmap ( link , eht_oper , bitmap , changed ) ; 
+return true ; 
+} 
+
+static void ieee80211_rx_mgmt_beacon ( struct ieee80211_link_data * link , 
+struct ieee80211_hdr * hdr , size_t len , 
+struct ieee80211_rx_status * rx_status ) 
+{ 
+struct ieee80211_sub_if_data * sdata = link -> sdata ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+struct ieee80211_bss_conf * bss_conf = & sdata -> vif . bss_conf ; 
+struct ieee80211_vif_cfg * vif_cfg = & sdata -> vif . cfg ; 
+struct ieee80211_mgmt * mgmt = ( void * ) hdr ; 
+size_t baselen ; 
+struct ieee802_11_elems * elems ; 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_chanctx_conf * chanctx_conf ; 
+struct ieee80211_supported_band * sband ; 
+struct ieee80211_channel * chan ; 
+struct link_sta_info * link_sta ; 
+struct sta_info * sta ; 
+u64 changed = 0 ; 
+bool erp_valid ; 
+u8 erp_value = 0 ; 
+u32 ncrc = 0 ; 
+u8 * bssid , * variable = mgmt -> u . beacon . variable ; 
+u8 deauth_buf [ ieee80211_deauth_frame_len ] ; 
+struct ieee80211_elems_parse_params parse_params = { 
+. link_id = - 1 , 
+. from_ap = true , 
+} ; 
+
+sdata_assert_lock ( sdata ) ; 
+
+
+bssid = ieee80211_get_bssid ( hdr , len , sdata -> vif . type ) ; 
+if ( ieee80211_is_s1g_beacon ( mgmt -> frame_control ) ) { 
+struct ieee80211_ext * ext = ( void * ) mgmt ; 
+
+if ( ieee80211_is_s1g_short_beacon ( ext -> frame_control ) ) 
+variable = ext -> u . s1g_short_beacon . variable ; 
+else 
+variable = ext -> u . s1g_beacon . variable ; 
+} 
+
+baselen = ( u8 * ) variable - ( u8 * ) mgmt ; 
+if ( baselen > len ) 
+return ; 
+
+parse_params . start = variable ; 
+parse_params . len = len - baselen ; 
+
+rcu_read_lock ( ) ; 
+chanctx_conf = rcu_dereference ( link -> conf -> chanctx_conf ) ; 
+if ( ! chanctx_conf ) { 
+rcu_read_unlock ( ) ; 
+return ; 
+} 
+
+if ( ieee80211_rx_status_to_khz ( rx_status ) != 
+ieee80211_channel_to_khz ( chanctx_conf -> def . chan ) ) { 
+rcu_read_unlock ( ) ; 
+return ; 
+} 
+chan = chanctx_conf -> def . chan ; 
+rcu_read_unlock ( ) ; 
+
+if ( ifmgd -> assoc_data && ifmgd -> assoc_data -> need_beacon && 
+! warn_on ( sdata -> vif . valid_links ) && 
+ieee80211_rx_our_beacon ( bssid , ifmgd -> assoc_data -> link [ 0 ] . bss ) ) { 
+parse_params . bss = ifmgd -> assoc_data -> link [ 0 ] . bss ; 
+elems = ieee802_11_parse_elems_full ( & parse_params ) ; 
+if ( ! elems ) 
+return ; 
+
+ieee80211_rx_bss_info ( link , mgmt , len , rx_status ) ; 
+
+if ( elems -> dtim_period ) 
+link -> u . mgd . dtim_period = elems -> dtim_period ; 
+link -> u . mgd . have_beacon = true ; 
+ifmgd -> assoc_data -> need_beacon = false ; 
+if ( ieee80211_hw_check ( & local -> hw , timing_beacon_only ) ) { 
+link -> conf -> sync_tsf = 
+le64_to_cpu ( mgmt -> u . beacon . timestamp ) ; 
+link -> conf -> sync_device_ts = 
+rx_status -> device_timestamp ; 
+link -> conf -> sync_dtim_count = elems -> dtim_count ; 
+} 
+
+if ( elems -> mbssid_config_ie ) 
+bss_conf -> profile_periodicity = 
+elems -> mbssid_config_ie -> profile_periodicity ; 
+else 
+bss_conf -> profile_periodicity = 0 ; 
+
+if ( elems -> ext_capab_len >= 11 && 
+( elems -> ext_capab [ 10 ] & wlan_ext_capa11_ema_support ) ) 
+bss_conf -> ema_ap = true ; 
+else 
+bss_conf -> ema_ap = false ; 
+
+
+ifmgd -> assoc_data -> timeout = jiffies ; 
+ifmgd -> assoc_data -> timeout_started = true ; 
+run_again ( sdata , ifmgd -> assoc_data -> timeout ) ; 
+kfree ( elems ) ; 
+return ; 
+} 
+
+if ( ! ifmgd -> associated || 
+! ieee80211_rx_our_beacon ( bssid , link -> u . mgd . bss ) ) 
+return ; 
+bssid = link -> u . mgd . bssid ; 
+
+if ( ! ( rx_status -> flag & rx_flag_no_signal_val ) ) 
+ieee80211_handle_beacon_sig ( link , ifmgd , bss_conf , 
+local , rx_status ) ; 
+
+if ( ifmgd -> flags & ieee80211_sta_connection_poll ) { 
+mlme_dbg_ratelimited ( sdata , 
+"cancelling ap probe due to a received beacon\n" ) ; 
+ieee80211_reset_ap_probe ( sdata ) ; 
+} 
+
+
+
+
+
+ieee80211_sta_reset_beacon_monitor ( sdata ) ; 
+
+
+
+
+
+
+if ( ! ieee80211_is_s1g_beacon ( hdr -> frame_control ) ) 
+ncrc = crc32_be ( 0 , ( void * ) & mgmt -> u . beacon . beacon_int , 4 ) ; 
+parse_params . bss = link -> u . mgd . bss ; 
+parse_params . filter = care_about_ies ; 
+parse_params . crc = ncrc ; 
+elems = ieee802_11_parse_elems_full ( & parse_params ) ; 
+if ( ! elems ) 
+return ; 
+ncrc = elems -> crc ; 
+
+if ( ieee80211_hw_check ( & local -> hw , ps_nullfunc_stack ) && 
+ieee80211_check_tim ( elems -> tim , elems -> tim_len , vif_cfg -> aid ) ) { 
+if ( local -> hw . conf . dynamic_ps_timeout > 0 ) { 
+if ( local -> hw . conf . flags & ieee80211_conf_ps ) { 
+local -> hw . conf . flags &= ~ ieee80211_conf_ps ; 
+ieee80211_hw_config ( local , 
+ieee80211_conf_change_ps ) ; 
+} 
+ieee80211_send_nullfunc ( local , sdata , false ) ; 
+} else if ( ! local -> pspolling && sdata -> u . mgd . powersave ) { 
+local -> pspolling = true ; 
+
+
+
+
+
+
+
+
+
+ieee80211_send_pspoll ( local , sdata ) ; 
+} 
+} 
+
+if ( sdata -> vif . p2p || 
+sdata -> vif . driver_flags & ieee80211_vif_get_noa_update ) { 
+struct ieee80211_p2p_noa_attr noa = { } ; 
+int ret ; 
+
+ret = cfg80211_get_p2p_attr ( variable , 
+len - baselen , 
+ieee80211_p2p_attr_absence_notice , 
+( u8 * ) & noa , sizeof ( noa ) ) ; 
+if ( ret >= 2 ) { 
+if ( link -> u . mgd . p2p_noa_index != noa . index ) { 
+
+link -> u . mgd . p2p_noa_index = noa . index ; 
+memcpy ( & bss_conf -> p2p_noa_attr , & noa , sizeof ( noa ) ) ; 
+changed |= bss_changed_p2p_ps ; 
+
+
+
+
+link -> u . mgd . beacon_crc_valid = false ; 
+} 
+} else if ( link -> u . mgd . p2p_noa_index != - 1 ) { 
+
+link -> u . mgd . p2p_noa_index = - 1 ; 
+memset ( & bss_conf -> p2p_noa_attr , 0 , sizeof ( bss_conf -> p2p_noa_attr ) ) ; 
+changed |= bss_changed_p2p_ps ; 
+link -> u . mgd . beacon_crc_valid = false ; 
+} 
+} 
+
+if ( link -> u . mgd . csa_waiting_bcn ) 
+ieee80211_chswitch_post_beacon ( link ) ; 
+
+
+
+
+
+
+
+
+
+if ( ieee80211_hw_check ( & local -> hw , timing_beacon_only ) && 
+! ieee80211_is_s1g_beacon ( hdr -> frame_control ) ) { 
+link -> conf -> sync_tsf = 
+le64_to_cpu ( mgmt -> u . beacon . timestamp ) ; 
+link -> conf -> sync_device_ts = 
+rx_status -> device_timestamp ; 
+link -> conf -> sync_dtim_count = elems -> dtim_count ; 
+} 
+
+if ( ( ncrc == link -> u . mgd . beacon_crc && link -> u . mgd . beacon_crc_valid ) || 
+ieee80211_is_s1g_short_beacon ( mgmt -> frame_control ) ) 
+goto free ; 
+link -> u . mgd . beacon_crc = ncrc ; 
+link -> u . mgd . beacon_crc_valid = true ; 
+
+ieee80211_rx_bss_info ( link , mgmt , len , rx_status ) ; 
+
+ieee80211_sta_process_chanswitch ( link , rx_status -> mactime , 
+rx_status -> device_timestamp , 
+elems , true ) ; 
+
+if ( ! link -> u . mgd . disable_wmm_tracking && 
+ieee80211_sta_wmm_params ( local , link , elems -> wmm_param , 
+elems -> wmm_param_len , 
+elems -> mu_edca_param_set ) ) 
+changed |= bss_changed_qos ; 
+
+
+
+
+
+if ( ! link -> u . mgd . have_beacon ) { 
+
+bss_conf -> dtim_period = elems -> dtim_period ? : 1 ; 
+
+changed |= bss_changed_beacon_info ; 
+link -> u . mgd . have_beacon = true ; 
+
+mutex_lock ( & local -> iflist_mtx ) ; 
+ieee80211_recalc_ps ( local ) ; 
+mutex_unlock ( & local -> iflist_mtx ) ; 
+
+ieee80211_recalc_ps_vif ( sdata ) ; 
+} 
+
+if ( elems -> erp_info ) { 
+erp_valid = true ; 
+erp_value = elems -> erp_info [ 0 ] ; 
+} else { 
+erp_valid = false ; 
+} 
+
+if ( ! ieee80211_is_s1g_beacon ( hdr -> frame_control ) ) 
+changed |= ieee80211_handle_bss_capability ( link , 
+le16_to_cpu ( mgmt -> u . beacon . capab_info ) , 
+erp_valid , erp_value ) ; 
+
+mutex_lock ( & local -> sta_mtx ) ; 
+sta = sta_info_get ( sdata , sdata -> vif . cfg . ap_addr ) ; 
+if ( warn_on ( ! sta ) ) { 
+mutex_unlock ( & local -> sta_mtx ) ; 
+goto free ; 
+} 
+link_sta = rcu_dereference_protected ( sta -> link [ link -> link_id ] , 
+lockdep_is_held ( & local -> sta_mtx ) ) ; 
+if ( warn_on ( ! link_sta ) ) { 
+mutex_unlock ( & local -> sta_mtx ) ; 
+goto free ; 
+} 
+
+if ( warn_on ( ! link -> conf -> chandef . chan ) ) 
+goto free ; 
+
+sband = local -> hw . wiphy -> bands [ link -> conf -> chandef . chan -> band ] ; 
+
+changed |= ieee80211_recalc_twt_req ( sdata , sband , link , link_sta , elems ) ; 
+
+if ( ieee80211_config_bw ( link , elems -> ht_cap_elem , 
+elems -> vht_cap_elem , elems -> ht_operation , 
+elems -> vht_operation , elems -> he_operation , 
+elems -> eht_operation , 
+elems -> s1g_oper , bssid , & changed ) ) { 
+mutex_unlock ( & local -> sta_mtx ) ; 
+sdata_info ( sdata , 
+"failed to follow ap %pm bandwidth change, disconnect\n" , 
+bssid ) ; 
+ieee80211_set_disassoc ( sdata , ieee80211_stype_deauth , 
+wlan_reason_deauth_leaving , 
+true , deauth_buf ) ; 
+ieee80211_report_disconnect ( sdata , deauth_buf , 
+sizeof ( deauth_buf ) , true , 
+wlan_reason_deauth_leaving , 
+false ) ; 
+goto free ; 
+} 
+
+if ( sta && elems -> opmode_notif ) 
+ieee80211_vht_handle_opmode ( sdata , link_sta , 
+* elems -> opmode_notif , 
+rx_status -> band ) ; 
+mutex_unlock ( & local -> sta_mtx ) ; 
+
+changed |= ieee80211_handle_pwr_constr ( link , chan , mgmt , 
+elems -> country_elem , 
+elems -> country_elem_len , 
+elems -> pwr_constr_elem , 
+elems -> cisco_dtpc_elem ) ; 
+
+if ( elems -> eht_operation && 
+! ( link -> u . mgd . conn_flags & ieee80211_conn_disable_eht ) ) { 
+if ( ! ieee80211_config_puncturing ( link , elems -> eht_operation , 
+& changed ) ) { 
+ieee80211_set_disassoc ( sdata , ieee80211_stype_deauth , 
+wlan_reason_deauth_leaving , 
+true , deauth_buf ) ; 
+ieee80211_report_disconnect ( sdata , deauth_buf , 
+sizeof ( deauth_buf ) , true , 
+wlan_reason_deauth_leaving , 
+false ) ; 
+goto free ; 
+} 
+} 
+
+ieee80211_link_info_change_notify ( sdata , link , changed ) ; 
+free : 
+kfree ( elems ) ; 
+} 
+
+void ieee80211_sta_rx_queued_ext ( struct ieee80211_sub_if_data * sdata , 
+struct sk_buff * skb ) 
+{ 
+struct ieee80211_link_data * link = & sdata -> deflink ; 
+struct ieee80211_rx_status * rx_status ; 
+struct ieee80211_hdr * hdr ; 
+u16 fc ; 
+
+rx_status = ( struct ieee80211_rx_status * ) skb -> cb ; 
+hdr = ( struct ieee80211_hdr * ) skb -> data ; 
+fc = le16_to_cpu ( hdr -> frame_control ) ; 
+
+sdata_lock ( sdata ) ; 
+switch ( fc & ieee80211_fctl_stype ) { 
+case ieee80211_stype_s1g_beacon : 
+ieee80211_rx_mgmt_beacon ( link , hdr , skb -> len , rx_status ) ; 
+break ; 
+} 
+sdata_unlock ( sdata ) ; 
+} 
+
+void ieee80211_sta_rx_queued_mgmt ( struct ieee80211_sub_if_data * sdata , 
+struct sk_buff * skb ) 
+{ 
+struct ieee80211_link_data * link = & sdata -> deflink ; 
+struct ieee80211_rx_status * rx_status ; 
+struct ieee80211_mgmt * mgmt ; 
+u16 fc ; 
+int ies_len ; 
+
+rx_status = ( struct ieee80211_rx_status * ) skb -> cb ; 
+mgmt = ( struct ieee80211_mgmt * ) skb -> data ; 
+fc = le16_to_cpu ( mgmt -> frame_control ) ; 
+
+sdata_lock ( sdata ) ; 
+
+if ( rx_status -> link_valid ) { 
+link = sdata_dereference ( sdata -> link [ rx_status -> link_id ] , 
+sdata ) ; 
+if ( ! link ) 
+goto out ; 
+} 
+
+switch ( fc & ieee80211_fctl_stype ) { 
+case ieee80211_stype_beacon : 
+ieee80211_rx_mgmt_beacon ( link , ( void * ) mgmt , 
+skb -> len , rx_status ) ; 
+break ; 
+case ieee80211_stype_probe_resp : 
+ieee80211_rx_mgmt_probe_resp ( link , skb ) ; 
+break ; 
+case ieee80211_stype_auth : 
+ieee80211_rx_mgmt_auth ( sdata , mgmt , skb -> len ) ; 
+break ; 
+case ieee80211_stype_deauth : 
+ieee80211_rx_mgmt_deauth ( sdata , mgmt , skb -> len ) ; 
+break ; 
+case ieee80211_stype_disassoc : 
+ieee80211_rx_mgmt_disassoc ( sdata , mgmt , skb -> len ) ; 
+break ; 
+case ieee80211_stype_assoc_resp : 
+case ieee80211_stype_reassoc_resp : 
+ieee80211_rx_mgmt_assoc_resp ( sdata , mgmt , skb -> len ) ; 
+break ; 
+case ieee80211_stype_action : 
+if ( mgmt -> u . action . category == wlan_category_spectrum_mgmt ) { 
+struct ieee802_11_elems * elems ; 
+
+ies_len = skb -> len - 
+offsetof ( struct ieee80211_mgmt , 
+u . action . u . chan_switch . variable ) ; 
+
+if ( ies_len < 0 ) 
+break ; 
+
+
+elems = ieee802_11_parse_elems ( 
+mgmt -> u . action . u . chan_switch . variable , 
+ies_len , true , null ) ; 
+
+if ( elems && ! elems -> parse_error ) 
+ieee80211_sta_process_chanswitch ( link , 
+rx_status -> mactime , 
+rx_status -> device_timestamp , 
+elems , false ) ; 
+kfree ( elems ) ; 
+} else if ( mgmt -> u . action . category == wlan_category_public ) { 
+struct ieee802_11_elems * elems ; 
+
+ies_len = skb -> len - 
+offsetof ( struct ieee80211_mgmt , 
+u . action . u . ext_chan_switch . variable ) ; 
+
+if ( ies_len < 0 ) 
+break ; 
+
+
+
+
+
+elems = ieee802_11_parse_elems ( 
+mgmt -> u . action . u . ext_chan_switch . variable , 
+ies_len , true , null ) ; 
+
+if ( elems && ! elems -> parse_error ) { 
+
+elems -> ext_chansw_ie = 
+& mgmt -> u . action . u . ext_chan_switch . data ; 
+
+ieee80211_sta_process_chanswitch ( link , 
+rx_status -> mactime , 
+rx_status -> device_timestamp , 
+elems , false ) ; 
+} 
+
+kfree ( elems ) ; 
+} 
+break ; 
+} 
+out : 
+sdata_unlock ( sdata ) ; 
+} 
+
+static void ieee80211_sta_timer ( struct timer_list * t ) 
+{ 
+struct ieee80211_sub_if_data * sdata = 
+from_timer ( sdata , t , u . mgd . timer ) ; 
+
+ieee80211_queue_work ( & sdata -> local -> hw , & sdata -> work ) ; 
+} 
+
+void ieee80211_sta_connection_lost ( struct ieee80211_sub_if_data * sdata , 
+u8 reason , bool tx ) 
+{ 
+u8 frame_buf [ ieee80211_deauth_frame_len ] ; 
+
+ieee80211_set_disassoc ( sdata , ieee80211_stype_deauth , reason , 
+tx , frame_buf ) ; 
+
+ieee80211_report_disconnect ( sdata , frame_buf , sizeof ( frame_buf ) , true , 
+reason , false ) ; 
+} 
+
+static int ieee80211_auth ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+struct ieee80211_mgd_auth_data * auth_data = ifmgd -> auth_data ; 
+u32 tx_flags = 0 ; 
+u16 trans = 1 ; 
+u16 status = 0 ; 
+struct ieee80211_prep_tx_info info = { 
+. subtype = ieee80211_stype_auth , 
+} ; 
+
+sdata_assert_lock ( sdata ) ; 
+
+if ( warn_on_once ( ! auth_data ) ) 
+return - einval ; 
+
+auth_data -> tries ++ ; 
+
+if ( auth_data -> tries > ieee80211_auth_max_tries ) { 
+sdata_info ( sdata , "authentication with %pm timed out\n" , 
+auth_data -> ap_addr ) ; 
+
+
+
+
+
+cfg80211_unlink_bss ( local -> hw . wiphy , auth_data -> bss ) ; 
+
+return - etimedout ; 
+} 
+
+if ( auth_data -> algorithm == wlan_auth_sae ) 
+info . duration = jiffies_to_msecs ( ieee80211_auth_timeout_sae ) ; 
+
+drv_mgd_prepare_tx ( local , sdata , & info ) ; 
+
+sdata_info ( sdata , "send auth to %pm (try %d/%d)\n" , 
+auth_data -> ap_addr , auth_data -> tries , 
+ieee80211_auth_max_tries ) ; 
+
+auth_data -> expected_transaction = 2 ; 
+
+if ( auth_data -> algorithm == wlan_auth_sae ) { 
+trans = auth_data -> sae_trans ; 
+status = auth_data -> sae_status ; 
+auth_data -> expected_transaction = trans ; 
+} 
+
+if ( ieee80211_hw_check ( & local -> hw , reports_tx_ack_status ) ) 
+tx_flags = ieee80211_tx_ctl_req_tx_status | 
+ieee80211_tx_intfl_mlme_conn_tx ; 
+
+ieee80211_send_auth ( sdata , trans , auth_data -> algorithm , status , 
+auth_data -> data , auth_data -> data_len , 
+auth_data -> ap_addr , auth_data -> ap_addr , 
+null , 0 , 0 , tx_flags ) ; 
+
+if ( tx_flags == 0 ) { 
+if ( auth_data -> algorithm == wlan_auth_sae ) 
+auth_data -> timeout = jiffies + 
+ieee80211_auth_timeout_sae ; 
+else 
+auth_data -> timeout = jiffies + ieee80211_auth_timeout ; 
+} else { 
+auth_data -> timeout = 
+round_jiffies_up ( jiffies + ieee80211_auth_timeout_long ) ; 
+} 
+
+auth_data -> timeout_started = true ; 
+run_again ( sdata , auth_data -> timeout ) ; 
+
+return 0 ; 
+} 
+
+static int ieee80211_do_assoc ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct ieee80211_mgd_assoc_data * assoc_data = sdata -> u . mgd . assoc_data ; 
+struct ieee80211_local * local = sdata -> local ; 
+int ret ; 
+
+sdata_assert_lock ( sdata ) ; 
+
+assoc_data -> tries ++ ; 
+if ( assoc_data -> tries > ieee80211_assoc_max_tries ) { 
+sdata_info ( sdata , "association with %pm timed out\n" , 
+assoc_data -> ap_addr ) ; 
+
+
+
+
+
+cfg80211_unlink_bss ( local -> hw . wiphy , 
+assoc_data -> link [ assoc_data -> assoc_link_id ] . bss ) ; 
+
+return - etimedout ; 
+} 
+
+sdata_info ( sdata , "associate with %pm (try %d/%d)\n" , 
+assoc_data -> ap_addr , assoc_data -> tries , 
+ieee80211_assoc_max_tries ) ; 
+ret = ieee80211_send_assoc ( sdata ) ; 
+if ( ret ) 
+return ret ; 
+
+if ( ! ieee80211_hw_check ( & local -> hw , reports_tx_ack_status ) ) { 
+assoc_data -> timeout = jiffies + ieee80211_assoc_timeout ; 
+assoc_data -> timeout_started = true ; 
+run_again ( sdata , assoc_data -> timeout ) ; 
+} else { 
+assoc_data -> timeout = 
+round_jiffies_up ( jiffies + 
+ieee80211_assoc_timeout_long ) ; 
+assoc_data -> timeout_started = true ; 
+run_again ( sdata , assoc_data -> timeout ) ; 
+} 
+
+return 0 ; 
+} 
+
+void ieee80211_mgd_conn_tx_status ( struct ieee80211_sub_if_data * sdata , 
+__le16 fc , bool acked ) 
+{ 
+struct ieee80211_local * local = sdata -> local ; 
+
+sdata -> u . mgd . status_fc = fc ; 
+sdata -> u . mgd . status_acked = acked ; 
+sdata -> u . mgd . status_received = true ; 
+
+ieee80211_queue_work ( & local -> hw , & sdata -> work ) ; 
+} 
+
+void ieee80211_sta_work ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+
+sdata_lock ( sdata ) ; 
+
+if ( ifmgd -> status_received ) { 
+__le16 fc = ifmgd -> status_fc ; 
+bool status_acked = ifmgd -> status_acked ; 
+
+ifmgd -> status_received = false ; 
+if ( ifmgd -> auth_data && ieee80211_is_auth ( fc ) ) { 
+if ( status_acked ) { 
+if ( ifmgd -> auth_data -> algorithm == 
+wlan_auth_sae ) 
+ifmgd -> auth_data -> timeout = 
+jiffies + 
+ieee80211_auth_timeout_sae ; 
+else 
+ifmgd -> auth_data -> timeout = 
+jiffies + 
+ieee80211_auth_timeout_short ; 
+run_again ( sdata , ifmgd -> auth_data -> timeout ) ; 
+} else { 
+ifmgd -> auth_data -> timeout = jiffies - 1 ; 
+} 
+ifmgd -> auth_data -> timeout_started = true ; 
+} else if ( ifmgd -> assoc_data && 
+( ieee80211_is_assoc_req ( fc ) || 
+ieee80211_is_reassoc_req ( fc ) ) ) { 
+if ( status_acked ) { 
+ifmgd -> assoc_data -> timeout = 
+jiffies + ieee80211_assoc_timeout_short ; 
+run_again ( sdata , ifmgd -> assoc_data -> timeout ) ; 
+} else { 
+ifmgd -> assoc_data -> timeout = jiffies - 1 ; 
+} 
+ifmgd -> assoc_data -> timeout_started = true ; 
+} 
+} 
+
+if ( ifmgd -> auth_data && ifmgd -> auth_data -> timeout_started && 
+time_after ( jiffies , ifmgd -> auth_data -> timeout ) ) { 
+if ( ifmgd -> auth_data -> done || ifmgd -> auth_data -> waiting ) { 
+
+
+
+
+ieee80211_destroy_auth_data ( sdata , false ) ; 
+} else if ( ieee80211_auth ( sdata ) ) { 
+u8 ap_addr [ eth_alen ] ; 
+struct ieee80211_event event = { 
+. type = mlme_event , 
+. u . mlme . data = auth_event , 
+. u . mlme . status = mlme_timeout , 
+} ; 
+
+memcpy ( ap_addr , ifmgd -> auth_data -> ap_addr , eth_alen ) ; 
+
+ieee80211_destroy_auth_data ( sdata , false ) ; 
+
+cfg80211_auth_timeout ( sdata -> dev , ap_addr ) ; 
+drv_event_callback ( sdata -> local , sdata , & event ) ; 
+} 
+} else if ( ifmgd -> auth_data && ifmgd -> auth_data -> timeout_started ) 
+run_again ( sdata , ifmgd -> auth_data -> timeout ) ; 
+
+if ( ifmgd -> assoc_data && ifmgd -> assoc_data -> timeout_started && 
+time_after ( jiffies , ifmgd -> assoc_data -> timeout ) ) { 
+if ( ( ifmgd -> assoc_data -> need_beacon && 
+! sdata -> deflink . u . mgd . have_beacon ) || 
+ieee80211_do_assoc ( sdata ) ) { 
+struct ieee80211_event event = { 
+. type = mlme_event , 
+. u . mlme . data = assoc_event , 
+. u . mlme . status = mlme_timeout , 
+} ; 
+
+ieee80211_destroy_assoc_data ( sdata , assoc_timeout ) ; 
+drv_event_callback ( sdata -> local , sdata , & event ) ; 
+} 
+} else if ( ifmgd -> assoc_data && ifmgd -> assoc_data -> timeout_started ) 
+run_again ( sdata , ifmgd -> assoc_data -> timeout ) ; 
+
+if ( ifmgd -> flags & ieee80211_sta_connection_poll && 
+ifmgd -> associated ) { 
+u8 * bssid = sdata -> deflink . u . mgd . bssid ; 
+int max_tries ; 
+
+if ( ieee80211_hw_check ( & local -> hw , reports_tx_ack_status ) ) 
+max_tries = max_nullfunc_tries ; 
+else 
+max_tries = max_probe_tries ; 
+
+
+if ( ! ifmgd -> probe_send_count ) 
+ieee80211_reset_ap_probe ( sdata ) ; 
+else if ( ifmgd -> nullfunc_failed ) { 
+if ( ifmgd -> probe_send_count < max_tries ) { 
+mlme_dbg ( sdata , 
+"no ack for nullfunc frame to ap %pm, try %d/%i\n" , 
+bssid , ifmgd -> probe_send_count , 
+max_tries ) ; 
+ieee80211_mgd_probe_ap_send ( sdata ) ; 
+} else { 
+mlme_dbg ( sdata , 
+"no ack for nullfunc frame to ap %pm, disconnecting.\n" , 
+bssid ) ; 
+ieee80211_sta_connection_lost ( sdata , 
+wlan_reason_disassoc_due_to_inactivity , 
+false ) ; 
+} 
+} else if ( time_is_after_jiffies ( ifmgd -> probe_timeout ) ) 
+run_again ( sdata , ifmgd -> probe_timeout ) ; 
+else if ( ieee80211_hw_check ( & local -> hw , reports_tx_ack_status ) ) { 
+mlme_dbg ( sdata , 
+"failed to send nullfunc to ap %pm after %dms, disconnecting\n" , 
+bssid , probe_wait_ms ) ; 
+ieee80211_sta_connection_lost ( sdata , 
+wlan_reason_disassoc_due_to_inactivity , false ) ; 
+} else if ( ifmgd -> probe_send_count < max_tries ) { 
+mlme_dbg ( sdata , 
+"no probe response from ap %pm after %dms, try %d/%i\n" , 
+bssid , probe_wait_ms , 
+ifmgd -> probe_send_count , max_tries ) ; 
+ieee80211_mgd_probe_ap_send ( sdata ) ; 
+} else { 
+
+
+
+
+mlme_dbg ( sdata , 
+"no probe response from ap %pm after %dms, disconnecting.\n" , 
+bssid , probe_wait_ms ) ; 
+
+ieee80211_sta_connection_lost ( sdata , 
+wlan_reason_disassoc_due_to_inactivity , false ) ; 
+} 
+} 
+
+sdata_unlock ( sdata ) ; 
+} 
+
+static void ieee80211_sta_bcn_mon_timer ( struct timer_list * t ) 
+{ 
+struct ieee80211_sub_if_data * sdata = 
+from_timer ( sdata , t , u . mgd . bcn_mon_timer ) ; 
+
+if ( warn_on ( sdata -> vif . valid_links ) ) 
+return ; 
+
+if ( sdata -> vif . bss_conf . csa_active && 
+! sdata -> deflink . u . mgd . csa_waiting_bcn ) 
+return ; 
+
+if ( sdata -> vif . driver_flags & ieee80211_vif_beacon_filter ) 
+return ; 
+
+sdata -> u . mgd . connection_loss = false ; 
+ieee80211_queue_work ( & sdata -> local -> hw , 
+& sdata -> u . mgd . beacon_connection_loss_work ) ; 
+} 
+
+static void ieee80211_sta_conn_mon_timer ( struct timer_list * t ) 
+{ 
+struct ieee80211_sub_if_data * sdata = 
+from_timer ( sdata , t , u . mgd . conn_mon_timer ) ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+struct ieee80211_local * local = sdata -> local ; 
+struct sta_info * sta ; 
+unsigned long timeout ; 
+
+if ( warn_on ( sdata -> vif . valid_links ) ) 
+return ; 
+
+if ( sdata -> vif . bss_conf . csa_active && 
+! sdata -> deflink . u . mgd . csa_waiting_bcn ) 
+return ; 
+
+sta = sta_info_get ( sdata , sdata -> vif . cfg . ap_addr ) ; 
+if ( ! sta ) 
+return ; 
+
+timeout = sta -> deflink . status_stats . last_ack ; 
+if ( time_before ( sta -> deflink . status_stats . last_ack , sta -> deflink . rx_stats . last_rx ) ) 
+timeout = sta -> deflink . rx_stats . last_rx ; 
+timeout += ieee80211_connection_idle_time ; 
+
+
+
+
+if ( time_is_after_jiffies ( timeout ) ) { 
+mod_timer ( & ifmgd -> conn_mon_timer , round_jiffies_up ( timeout ) ) ; 
+return ; 
+} 
+
+ieee80211_queue_work ( & local -> hw , & ifmgd -> monitor_work ) ; 
+} 
+
+static void ieee80211_sta_monitor_work ( struct work_struct * work ) 
+{ 
+struct ieee80211_sub_if_data * sdata = 
+container_of ( work , struct ieee80211_sub_if_data , 
+u . mgd . monitor_work ) ; 
+
+ieee80211_mgd_probe_ap ( sdata , false ) ; 
+} 
+
+static void ieee80211_restart_sta_timer ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+if ( sdata -> vif . type == nl80211_iftype_station ) { 
+__ieee80211_stop_poll ( sdata ) ; 
+
+
+if ( ! ieee80211_hw_check ( & sdata -> local -> hw , connection_monitor ) ) 
+ieee80211_queue_work ( & sdata -> local -> hw , 
+& sdata -> u . mgd . monitor_work ) ; 
+} 
+} 
+
+
+void ieee80211_mgd_quiesce ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+u8 frame_buf [ ieee80211_deauth_frame_len ] ; 
+
+sdata_lock ( sdata ) ; 
+
+if ( ifmgd -> auth_data || ifmgd -> assoc_data ) { 
+const u8 * ap_addr = ifmgd -> auth_data ? 
+ifmgd -> auth_data -> ap_addr : 
+ifmgd -> assoc_data -> ap_addr ; 
+
+
+
+
+
+
+ieee80211_send_deauth_disassoc ( sdata , ap_addr , ap_addr , 
+ieee80211_stype_deauth , 
+wlan_reason_deauth_leaving , 
+false , frame_buf ) ; 
+if ( ifmgd -> assoc_data ) 
+ieee80211_destroy_assoc_data ( sdata , assoc_abandon ) ; 
+if ( ifmgd -> auth_data ) 
+ieee80211_destroy_auth_data ( sdata , false ) ; 
+cfg80211_tx_mlme_mgmt ( sdata -> dev , frame_buf , 
+ieee80211_deauth_frame_len , 
+false ) ; 
+} 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+if ( ifmgd -> associated && ! sdata -> local -> wowlan ) { 
+u8 bssid [ eth_alen ] ; 
+struct cfg80211_deauth_request req = { 
+. reason_code = wlan_reason_deauth_leaving , 
+. bssid = bssid , 
+} ; 
+
+memcpy ( bssid , sdata -> vif . cfg . ap_addr , eth_alen ) ; 
+ieee80211_mgd_deauth ( sdata , & req ) ; 
+} 
+
+sdata_unlock ( sdata ) ; 
+} 
+
+
+void ieee80211_sta_restart ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+
+sdata_lock ( sdata ) ; 
+if ( ! ifmgd -> associated ) { 
+sdata_unlock ( sdata ) ; 
+return ; 
+} 
+
+if ( sdata -> flags & ieee80211_sdata_disconnect_resume ) { 
+sdata -> flags &= ~ ieee80211_sdata_disconnect_resume ; 
+mlme_dbg ( sdata , "driver requested disconnect after resume\n" ) ; 
+ieee80211_sta_connection_lost ( sdata , 
+wlan_reason_unspecified , 
+true ) ; 
+sdata_unlock ( sdata ) ; 
+return ; 
+} 
+
+if ( sdata -> flags & ieee80211_sdata_disconnect_hw_restart ) { 
+sdata -> flags &= ~ ieee80211_sdata_disconnect_hw_restart ; 
+mlme_dbg ( sdata , "driver requested disconnect after hardware restart\n" ) ; 
+ieee80211_sta_connection_lost ( sdata , 
+wlan_reason_unspecified , 
+true ) ; 
+sdata_unlock ( sdata ) ; 
+return ; 
+} 
+
+sdata_unlock ( sdata ) ; 
+} 
+
+static void ieee80211_request_smps_mgd_work ( struct work_struct * work ) 
+{ 
+struct ieee80211_link_data * link = 
+container_of ( work , struct ieee80211_link_data , 
+u . mgd . request_smps_work ) ; 
+
+sdata_lock ( link -> sdata ) ; 
+__ieee80211_request_smps_mgd ( link -> sdata , link , 
+link -> u . mgd . driver_smps_mode ) ; 
+sdata_unlock ( link -> sdata ) ; 
+} 
+
+
+void ieee80211_sta_setup_sdata ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+
+init_work ( & ifmgd -> monitor_work , ieee80211_sta_monitor_work ) ; 
+init_work ( & ifmgd -> beacon_connection_loss_work , 
+ieee80211_beacon_connection_loss_work ) ; 
+init_work ( & ifmgd -> csa_connection_drop_work , 
+ieee80211_csa_connection_drop_work ) ; 
+init_delayed_work ( & ifmgd -> tdls_peer_del_work , 
+ieee80211_tdls_peer_del_work ) ; 
+timer_setup ( & ifmgd -> timer , ieee80211_sta_timer , 0 ) ; 
+timer_setup ( & ifmgd -> bcn_mon_timer , ieee80211_sta_bcn_mon_timer , 0 ) ; 
+timer_setup ( & ifmgd -> conn_mon_timer , ieee80211_sta_conn_mon_timer , 0 ) ; 
+init_delayed_work ( & ifmgd -> tx_tspec_wk , 
+ieee80211_sta_handle_tspec_ac_params_wk ) ; 
+
+ifmgd -> flags = 0 ; 
+ifmgd -> powersave = sdata -> wdev . ps ; 
+ifmgd -> uapsd_queues = sdata -> local -> hw . uapsd_queues ; 
+ifmgd -> uapsd_max_sp_len = sdata -> local -> hw . uapsd_max_sp_len ; 
+
+spin_lock_init ( & ifmgd -> teardown_lock ) ; 
+ifmgd -> teardown_skb = null ; 
+ifmgd -> orig_teardown_skb = null ; 
+} 
+
+void ieee80211_mgd_setup_link ( struct ieee80211_link_data * link ) 
+{ 
+struct ieee80211_sub_if_data * sdata = link -> sdata ; 
+struct ieee80211_local * local = sdata -> local ; 
+unsigned int link_id = link -> link_id ; 
+
+link -> u . mgd . p2p_noa_index = - 1 ; 
+link -> u . mgd . conn_flags = 0 ; 
+link -> conf -> bssid = link -> u . mgd . bssid ; 
+
+init_work ( & link -> u . mgd . request_smps_work , 
+ieee80211_request_smps_mgd_work ) ; 
+if ( local -> hw . wiphy -> features & nl80211_feature_dynamic_smps ) 
+link -> u . mgd . req_smps = ieee80211_smps_automatic ; 
+else 
+link -> u . mgd . req_smps = ieee80211_smps_off ; 
+
+init_work ( & link -> u . mgd . chswitch_work , ieee80211_chswitch_work ) ; 
+timer_setup ( & link -> u . mgd . chswitch_timer , ieee80211_chswitch_timer , 0 ) ; 
+
+if ( sdata -> u . mgd . assoc_data ) 
+ether_addr_copy ( link -> conf -> addr , 
+sdata -> u . mgd . assoc_data -> link [ link_id ] . addr ) ; 
+else if ( ! is_valid_ether_addr ( link -> conf -> addr ) ) 
+eth_random_addr ( link -> conf -> addr ) ; 
+} 
+
+
+void ieee80211_mlme_notify_scan_completed ( struct ieee80211_local * local ) 
+{ 
+struct ieee80211_sub_if_data * sdata ; 
+
+
+rcu_read_lock ( ) ; 
+list_for_each_entry_rcu ( sdata , & local -> interfaces , list ) { 
+if ( ieee80211_sdata_running ( sdata ) ) 
+ieee80211_restart_sta_timer ( sdata ) ; 
+} 
+rcu_read_unlock ( ) ; 
+} 
+
+static int ieee80211_prep_connection ( struct ieee80211_sub_if_data * sdata , 
+struct cfg80211_bss * cbss , s8 link_id , 
+const u8 * ap_mld_addr , bool assoc , 
+bool override ) 
+{ 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+struct ieee80211_bss * bss = ( void * ) cbss -> priv ; 
+struct sta_info * new_sta = null ; 
+struct ieee80211_link_data * link ; 
+bool have_sta = false ; 
+bool mlo ; 
+int err ; 
+
+if ( link_id >= 0 ) { 
+mlo = true ; 
+if ( warn_on ( ! ap_mld_addr ) ) 
+return - einval ; 
+err = ieee80211_vif_set_links ( sdata , bit ( link_id ) ) ; 
+} else { 
+if ( warn_on ( ap_mld_addr ) ) 
+return - einval ; 
+ap_mld_addr = cbss -> bssid ; 
+err = ieee80211_vif_set_links ( sdata , 0 ) ; 
+link_id = 0 ; 
+mlo = false ; 
+} 
+
+if ( err ) 
+return err ; 
+
+link = sdata_dereference ( sdata -> link [ link_id ] , sdata ) ; 
+if ( warn_on ( ! link ) ) { 
+err = - enolink ; 
+goto out_err ; 
+} 
+
+if ( warn_on ( ! ifmgd -> auth_data && ! ifmgd -> assoc_data ) ) { 
+err = - einval ; 
+goto out_err ; 
+} 
+
+
+if ( local -> in_reconfig ) { 
+err = - ebusy ; 
+goto out_err ; 
+} 
+
+if ( assoc ) { 
+rcu_read_lock ( ) ; 
+have_sta = sta_info_get ( sdata , ap_mld_addr ) ; 
+rcu_read_unlock ( ) ; 
+} 
+
+if ( ! have_sta ) { 
+if ( mlo ) 
+new_sta = sta_info_alloc_with_link ( sdata , ap_mld_addr , 
+link_id , cbss -> bssid , 
+gfp_kernel ) ; 
+else 
+new_sta = sta_info_alloc ( sdata , ap_mld_addr , gfp_kernel ) ; 
+
+if ( ! new_sta ) { 
+err = - enomem ; 
+goto out_err ; 
+} 
+
+new_sta -> sta . mlo = mlo ; 
+} 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+if ( new_sta ) { 
+const struct cfg80211_bss_ies * ies ; 
+struct link_sta_info * link_sta ; 
+
+rcu_read_lock ( ) ; 
+link_sta = rcu_dereference ( new_sta -> link [ link_id ] ) ; 
+if ( warn_on ( ! link_sta ) ) { 
+rcu_read_unlock ( ) ; 
+sta_info_free ( local , new_sta ) ; 
+err = - einval ; 
+goto out_err ; 
+} 
+
+err = ieee80211_mgd_setup_link_sta ( link , new_sta , 
+link_sta , cbss ) ; 
+if ( err ) { 
+rcu_read_unlock ( ) ; 
+sta_info_free ( local , new_sta ) ; 
+goto out_err ; 
+} 
+
+memcpy ( link -> u . mgd . bssid , cbss -> bssid , eth_alen ) ; 
+
+
+link -> conf -> beacon_int = cbss -> beacon_interval ; 
+ies = rcu_dereference ( cbss -> beacon_ies ) ; 
+if ( ies ) { 
+link -> conf -> sync_tsf = ies -> tsf ; 
+link -> conf -> sync_device_ts = 
+bss -> device_ts_beacon ; 
+
+ieee80211_get_dtim ( ies , 
+& link -> conf -> sync_dtim_count , 
+null ) ; 
+} else if ( ! ieee80211_hw_check ( & sdata -> local -> hw , 
+timing_beacon_only ) ) { 
+ies = rcu_dereference ( cbss -> proberesp_ies ) ; 
+
+link -> conf -> sync_tsf = ies -> tsf ; 
+link -> conf -> sync_device_ts = 
+bss -> device_ts_presp ; 
+link -> conf -> sync_dtim_count = 0 ; 
+} else { 
+link -> conf -> sync_tsf = 0 ; 
+link -> conf -> sync_device_ts = 0 ; 
+link -> conf -> sync_dtim_count = 0 ; 
+} 
+rcu_read_unlock ( ) ; 
+} 
+
+if ( new_sta || override ) { 
+err = ieee80211_prep_channel ( sdata , link , cbss , 
+& link -> u . mgd . conn_flags ) ; 
+if ( err ) { 
+if ( new_sta ) 
+sta_info_free ( local , new_sta ) ; 
+goto out_err ; 
+} 
+} 
+
+if ( new_sta ) { 
+
+
+
+
+ieee80211_link_info_change_notify ( sdata , link , 
+bss_changed_bssid | 
+bss_changed_basic_rates | 
+bss_changed_beacon_int ) ; 
+
+if ( assoc ) 
+sta_info_pre_move_state ( new_sta , ieee80211_sta_auth ) ; 
+
+err = sta_info_insert ( new_sta ) ; 
+new_sta = null ; 
+if ( err ) { 
+sdata_info ( sdata , 
+"failed to insert sta entry for the ap (error %d)\n" , 
+err ) ; 
+goto out_err ; 
+} 
+} else 
+warn_on_once ( ! ether_addr_equal ( link -> u . mgd . bssid , cbss -> bssid ) ) ; 
+
+
+if ( local -> scanning ) 
+ieee80211_scan_cancel ( local ) ; 
+
+return 0 ; 
+
+out_err : 
+ieee80211_link_release_channel ( & sdata -> deflink ) ; 
+ieee80211_vif_set_links ( sdata , 0 ) ; 
+return err ; 
+} 
+
+
+int ieee80211_mgd_auth ( struct ieee80211_sub_if_data * sdata , 
+struct cfg80211_auth_request * req ) 
+{ 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+struct ieee80211_mgd_auth_data * auth_data ; 
+u16 auth_alg ; 
+int err ; 
+bool cont_auth ; 
+
+
+
+switch ( req -> auth_type ) { 
+case nl80211_authtype_open_system : 
+auth_alg = wlan_auth_open ; 
+break ; 
+case nl80211_authtype_shared_key : 
+if ( fips_enabled ) 
+return - eopnotsupp ; 
+auth_alg = wlan_auth_shared_key ; 
+break ; 
+case nl80211_authtype_ft : 
+auth_alg = wlan_auth_ft ; 
+break ; 
+case nl80211_authtype_network_eap : 
+auth_alg = wlan_auth_leap ; 
+break ; 
+case nl80211_authtype_sae : 
+auth_alg = wlan_auth_sae ; 
+break ; 
+case nl80211_authtype_fils_sk : 
+auth_alg = wlan_auth_fils_sk ; 
+break ; 
+case nl80211_authtype_fils_sk_pfs : 
+auth_alg = wlan_auth_fils_sk_pfs ; 
+break ; 
+case nl80211_authtype_fils_pk : 
+auth_alg = wlan_auth_fils_pk ; 
+break ; 
+default : 
+return - eopnotsupp ; 
+} 
+
+if ( ifmgd -> assoc_data ) 
+return - ebusy ; 
+
+auth_data = kzalloc ( sizeof ( * auth_data ) + req -> auth_data_len + 
+req -> ie_len , gfp_kernel ) ; 
+if ( ! auth_data ) 
+return - enomem ; 
+
+memcpy ( auth_data -> ap_addr , 
+req -> ap_mld_addr ? : req -> bss -> bssid , 
+eth_alen ) ; 
+auth_data -> bss = req -> bss ; 
+auth_data -> link_id = req -> link_id ; 
+
+if ( req -> auth_data_len >= 4 ) { 
+if ( req -> auth_type == nl80211_authtype_sae ) { 
+__le16 * pos = ( __le16 * ) req -> auth_data ; 
+
+auth_data -> sae_trans = le16_to_cpu ( pos [ 0 ] ) ; 
+auth_data -> sae_status = le16_to_cpu ( pos [ 1 ] ) ; 
+} 
+memcpy ( auth_data -> data , req -> auth_data + 4 , 
+req -> auth_data_len - 4 ) ; 
+auth_data -> data_len += req -> auth_data_len - 4 ; 
+} 
+
+
+
+
+
+
+cont_auth = ifmgd -> auth_data && req -> bss == ifmgd -> auth_data -> bss && 
+ifmgd -> auth_data -> link_id == req -> link_id ; 
+
+if ( req -> ie && req -> ie_len ) { 
+memcpy ( & auth_data -> data [ auth_data -> data_len ] , 
+req -> ie , req -> ie_len ) ; 
+auth_data -> data_len += req -> ie_len ; 
+} 
+
+if ( req -> key && req -> key_len ) { 
+auth_data -> key_len = req -> key_len ; 
+auth_data -> key_idx = req -> key_idx ; 
+memcpy ( auth_data -> key , req -> key , req -> key_len ) ; 
+} 
+
+auth_data -> algorithm = auth_alg ; 
+
+
+
+if ( ifmgd -> auth_data ) { 
+if ( cont_auth && req -> auth_type == nl80211_authtype_sae ) { 
+auth_data -> peer_confirmed = 
+ifmgd -> auth_data -> peer_confirmed ; 
+} 
+ieee80211_destroy_auth_data ( sdata , cont_auth ) ; 
+} 
+
+
+ifmgd -> auth_data = auth_data ; 
+
+
+
+
+
+
+if ( cont_auth && req -> auth_type == nl80211_authtype_sae && 
+auth_data -> peer_confirmed && auth_data -> sae_trans == 2 ) 
+ieee80211_mark_sta_auth ( sdata ) ; 
+
+if ( ifmgd -> associated ) { 
+u8 frame_buf [ ieee80211_deauth_frame_len ] ; 
+
+sdata_info ( sdata , 
+"disconnect from ap %pm for new auth to %pm\n" , 
+sdata -> vif . cfg . ap_addr , auth_data -> ap_addr ) ; 
+ieee80211_set_disassoc ( sdata , ieee80211_stype_deauth , 
+wlan_reason_unspecified , 
+false , frame_buf ) ; 
+
+ieee80211_report_disconnect ( sdata , frame_buf , 
+sizeof ( frame_buf ) , true , 
+wlan_reason_unspecified , 
+false ) ; 
+} 
+
+sdata_info ( sdata , "authenticate with %pm\n" , auth_data -> ap_addr ) ; 
+
+
+memcpy ( sdata -> vif . cfg . ap_addr , auth_data -> ap_addr , eth_alen ) ; 
+
+err = ieee80211_prep_connection ( sdata , req -> bss , req -> link_id , 
+req -> ap_mld_addr , cont_auth , false ) ; 
+if ( err ) 
+goto err_clear ; 
+
+err = ieee80211_auth ( sdata ) ; 
+if ( err ) { 
+sta_info_destroy_addr ( sdata , auth_data -> ap_addr ) ; 
+goto err_clear ; 
+} 
+
+
+cfg80211_ref_bss ( local -> hw . wiphy , auth_data -> bss ) ; 
+return 0 ; 
+
+err_clear : 
+if ( ! sdata -> vif . valid_links ) { 
+eth_zero_addr ( sdata -> deflink . u . mgd . bssid ) ; 
+ieee80211_link_info_change_notify ( sdata , & sdata -> deflink , 
+bss_changed_bssid ) ; 
+mutex_lock ( & sdata -> local -> mtx ) ; 
+ieee80211_link_release_channel ( & sdata -> deflink ) ; 
+mutex_unlock ( & sdata -> local -> mtx ) ; 
+} 
+ifmgd -> auth_data = null ; 
+kfree ( auth_data ) ; 
+return err ; 
+} 
+
+static ieee80211_conn_flags_t 
+ieee80211_setup_assoc_link ( struct ieee80211_sub_if_data * sdata , 
+struct ieee80211_mgd_assoc_data * assoc_data , 
+struct cfg80211_assoc_request * req , 
+ieee80211_conn_flags_t conn_flags , 
+unsigned int link_id ) 
+{ 
+struct ieee80211_local * local = sdata -> local ; 
+const struct cfg80211_bss_ies * beacon_ies ; 
+struct ieee80211_supported_band * sband ; 
+const struct element * ht_elem , * vht_elem ; 
+struct ieee80211_link_data * link ; 
+struct cfg80211_bss * cbss ; 
+struct ieee80211_bss * bss ; 
+bool is_5ghz , is_6ghz ; 
+
+cbss = assoc_data -> link [ link_id ] . bss ; 
+if ( warn_on ( ! cbss ) ) 
+return 0 ; 
+
+bss = ( void * ) cbss -> priv ; 
+
+sband = local -> hw . wiphy -> bands [ cbss -> channel -> band ] ; 
+if ( warn_on ( ! sband ) ) 
+return 0 ; 
+
+link = sdata_dereference ( sdata -> link [ link_id ] , sdata ) ; 
+if ( warn_on ( ! link ) ) 
+return 0 ; 
+
+is_5ghz = cbss -> channel -> band == nl80211_band_5ghz ; 
+is_6ghz = cbss -> channel -> band == nl80211_band_6ghz ; 
+
+
+if ( ! req -> ap_mld_addr ) { 
+assoc_data -> supp_rates = bss -> supp_rates ; 
+assoc_data -> supp_rates_len = bss -> supp_rates_len ; 
+} 
+
+
+if ( req -> links [ link_id ] . elems_len ) { 
+memcpy ( assoc_data -> ie_pos , req -> links [ link_id ] . elems , 
+req -> links [ link_id ] . elems_len ) ; 
+assoc_data -> link [ link_id ] . elems = assoc_data -> ie_pos ; 
+assoc_data -> link [ link_id ] . elems_len = req -> links [ link_id ] . elems_len ; 
+assoc_data -> ie_pos += req -> links [ link_id ] . elems_len ; 
+} 
+
+rcu_read_lock ( ) ; 
+ht_elem = ieee80211_bss_get_elem ( cbss , wlan_eid_ht_operation ) ; 
+if ( ht_elem && ht_elem -> datalen >= sizeof ( struct ieee80211_ht_operation ) ) 
+assoc_data -> link [ link_id ] . ap_ht_param = 
+( ( struct ieee80211_ht_operation * ) ( ht_elem -> data ) ) -> ht_param ; 
+else if ( ! is_6ghz ) 
+conn_flags |= ieee80211_conn_disable_ht ; 
+vht_elem = ieee80211_bss_get_elem ( cbss , wlan_eid_vht_capability ) ; 
+if ( vht_elem && vht_elem -> datalen >= sizeof ( struct ieee80211_vht_cap ) ) { 
+memcpy ( & assoc_data -> link [ link_id ] . ap_vht_cap , vht_elem -> data , 
+sizeof ( struct ieee80211_vht_cap ) ) ; 
+} else if ( is_5ghz ) { 
+link_info ( link , 
+"vht capa missing/short, disabling vht/he/eht\n" ) ; 
+conn_flags |= ieee80211_conn_disable_vht | 
+ieee80211_conn_disable_he | 
+ieee80211_conn_disable_eht ; 
+} 
+rcu_read_unlock ( ) ; 
+
+link -> u . mgd . beacon_crc_valid = false ; 
+link -> u . mgd . dtim_period = 0 ; 
+link -> u . mgd . have_beacon = false ; 
+
+
+if ( ! ( conn_flags & ieee80211_conn_disable_ht ) ) { 
+struct ieee80211_sta_ht_cap sta_ht_cap ; 
+
+memcpy ( & sta_ht_cap , & sband -> ht_cap , sizeof ( sta_ht_cap ) ) ; 
+ieee80211_apply_htcap_overrides ( sdata , & sta_ht_cap ) ; 
+} 
+
+link -> conf -> eht_puncturing = 0 ; 
+
+rcu_read_lock ( ) ; 
+beacon_ies = rcu_dereference ( cbss -> beacon_ies ) ; 
+if ( beacon_ies ) { 
+const struct ieee80211_eht_operation * eht_oper ; 
+const struct element * elem ; 
+u8 dtim_count = 0 ; 
+
+ieee80211_get_dtim ( beacon_ies , & dtim_count , 
+& link -> u . mgd . dtim_period ) ; 
+
+sdata -> deflink . u . mgd . have_beacon = true ; 
+
+if ( ieee80211_hw_check ( & local -> hw , timing_beacon_only ) ) { 
+link -> conf -> sync_tsf = beacon_ies -> tsf ; 
+link -> conf -> sync_device_ts = bss -> device_ts_beacon ; 
+link -> conf -> sync_dtim_count = dtim_count ; 
+} 
+
+elem = cfg80211_find_ext_elem ( wlan_eid_ext_multiple_bssid_configuration , 
+beacon_ies -> data , beacon_ies -> len ) ; 
+if ( elem && elem -> datalen >= 3 ) 
+link -> conf -> profile_periodicity = elem -> data [ 2 ] ; 
+else 
+link -> conf -> profile_periodicity = 0 ; 
+
+elem = cfg80211_find_elem ( wlan_eid_ext_capability , 
+beacon_ies -> data , beacon_ies -> len ) ; 
+if ( elem && elem -> datalen >= 11 && 
+( elem -> data [ 10 ] & wlan_ext_capa11_ema_support ) ) 
+link -> conf -> ema_ap = true ; 
+else 
+link -> conf -> ema_ap = false ; 
+
+elem = cfg80211_find_ext_elem ( wlan_eid_ext_eht_operation , 
+beacon_ies -> data , beacon_ies -> len ) ; 
+eht_oper = ( const void * ) ( elem -> data + 1 ) ; 
+
+if ( elem && 
+ieee80211_eht_oper_size_ok ( ( const void * ) ( elem -> data + 1 ) , 
+elem -> datalen - 1 ) && 
+( eht_oper -> params & ieee80211_eht_oper_info_present ) && 
+( eht_oper -> params & ieee80211_eht_oper_disabled_subchannel_bitmap_present ) ) { 
+const struct ieee80211_eht_operation_info * info = 
+( void * ) eht_oper -> optional ; 
+const u8 * disable_subchannel_bitmap = info -> optional ; 
+u16 bitmap ; 
+
+bitmap = get_unaligned_le16 ( disable_subchannel_bitmap ) ; 
+if ( cfg80211_valid_disable_subchannel_bitmap ( & bitmap , 
+& link -> conf -> chandef ) ) 
+ieee80211_handle_puncturing_bitmap ( link , 
+eht_oper , 
+bitmap , 
+null ) ; 
+else 
+conn_flags |= ieee80211_conn_disable_eht ; 
+} 
+} 
+rcu_read_unlock ( ) ; 
+
+if ( bss -> corrupt_data ) { 
+char * corrupt_type = "data" ; 
+
+if ( bss -> corrupt_data & ieee80211_bss_corrupt_beacon ) { 
+if ( bss -> corrupt_data & ieee80211_bss_corrupt_probe_resp ) 
+corrupt_type = "beacon and probe response" ; 
+else 
+corrupt_type = "beacon" ; 
+} else if ( bss -> corrupt_data & ieee80211_bss_corrupt_probe_resp ) { 
+corrupt_type = "probe response" ; 
+} 
+sdata_info ( sdata , "associating to ap %pm with corrupt %s\n" , 
+cbss -> bssid , corrupt_type ) ; 
+} 
+
+if ( link -> u . mgd . req_smps == ieee80211_smps_automatic ) { 
+if ( sdata -> u . mgd . powersave ) 
+link -> smps_mode = ieee80211_smps_dynamic ; 
+else 
+link -> smps_mode = ieee80211_smps_off ; 
+} else { 
+link -> smps_mode = link -> u . mgd . req_smps ; 
+} 
+
+return conn_flags ; 
+} 
+
+int ieee80211_mgd_assoc ( struct ieee80211_sub_if_data * sdata , 
+struct cfg80211_assoc_request * req ) 
+{ 
+unsigned int assoc_link_id = req -> link_id < 0 ? 0 : req -> link_id ; 
+struct ieee80211_local * local = sdata -> local ; 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+struct ieee80211_mgd_assoc_data * assoc_data ; 
+const struct element * ssid_elem ; 
+struct ieee80211_vif_cfg * vif_cfg = & sdata -> vif . cfg ; 
+ieee80211_conn_flags_t conn_flags = 0 ; 
+struct ieee80211_link_data * link ; 
+struct cfg80211_bss * cbss ; 
+struct ieee80211_bss * bss ; 
+bool override ; 
+int i , err ; 
+size_t size = sizeof ( * assoc_data ) + req -> ie_len ; 
+
+for ( i = 0 ; i < ieee80211_mld_max_num_links ; i ++ ) 
+size += req -> links [ i ] . elems_len ; 
+
+
+if ( sdata -> u . mgd . use_4addr && req -> link_id >= 0 ) 
+return - eopnotsupp ; 
+
+assoc_data = kzalloc ( size , gfp_kernel ) ; 
+if ( ! assoc_data ) 
+return - enomem ; 
+
+cbss = req -> link_id < 0 ? req -> bss : req -> links [ req -> link_id ] . bss ; 
+
+rcu_read_lock ( ) ; 
+ssid_elem = ieee80211_bss_get_elem ( cbss , wlan_eid_ssid ) ; 
+if ( ! ssid_elem || ssid_elem -> datalen > sizeof ( assoc_data -> ssid ) ) { 
+rcu_read_unlock ( ) ; 
+kfree ( assoc_data ) ; 
+return - einval ; 
+} 
+memcpy ( assoc_data -> ssid , ssid_elem -> data , ssid_elem -> datalen ) ; 
+assoc_data -> ssid_len = ssid_elem -> datalen ; 
+memcpy ( vif_cfg -> ssid , assoc_data -> ssid , assoc_data -> ssid_len ) ; 
+vif_cfg -> ssid_len = assoc_data -> ssid_len ; 
+rcu_read_unlock ( ) ; 
+
+if ( req -> ap_mld_addr ) { 
+for ( i = 0 ; i < ieee80211_mld_max_num_links ; i ++ ) { 
+if ( ! req -> links [ i ] . bss ) 
+continue ; 
+link = sdata_dereference ( sdata -> link [ i ] , sdata ) ; 
+if ( link ) 
+ether_addr_copy ( assoc_data -> link [ i ] . addr , 
+link -> conf -> addr ) ; 
+else 
+eth_random_addr ( assoc_data -> link [ i ] . addr ) ; 
+} 
+} else { 
+memcpy ( assoc_data -> link [ 0 ] . addr , sdata -> vif . addr , eth_alen ) ; 
+} 
+
+assoc_data -> s1g = cbss -> channel -> band == nl80211_band_s1ghz ; 
+
+memcpy ( assoc_data -> ap_addr , 
+req -> ap_mld_addr ? : req -> bss -> bssid , 
+eth_alen ) ; 
+
+if ( ifmgd -> associated ) { 
+u8 frame_buf [ ieee80211_deauth_frame_len ] ; 
+
+sdata_info ( sdata , 
+"disconnect from ap %pm for new assoc to %pm\n" , 
+sdata -> vif . cfg . ap_addr , assoc_data -> ap_addr ) ; 
+ieee80211_set_disassoc ( sdata , ieee80211_stype_deauth , 
+wlan_reason_unspecified , 
+false , frame_buf ) ; 
+
+ieee80211_report_disconnect ( sdata , frame_buf , 
+sizeof ( frame_buf ) , true , 
+wlan_reason_unspecified , 
+false ) ; 
+} 
+
+if ( ifmgd -> auth_data && ! ifmgd -> auth_data -> done ) { 
+err = - ebusy ; 
+goto err_free ; 
+} 
+
+if ( ifmgd -> assoc_data ) { 
+err = - ebusy ; 
+goto err_free ; 
+} 
+
+if ( ifmgd -> auth_data ) { 
+bool match ; 
+
+
+match = ether_addr_equal ( ifmgd -> auth_data -> ap_addr , 
+assoc_data -> ap_addr ) && 
+ifmgd -> auth_data -> link_id == req -> link_id ; 
+ieee80211_destroy_auth_data ( sdata , match ) ; 
+} 
+
+
+
+bss = ( void * ) cbss -> priv ; 
+assoc_data -> wmm = bss -> wmm_used && 
+( local -> hw . queues >= ieee80211_num_acs ) ; 
+
+
+
+
+
+
+
+
+for ( i = 0 ; i < req -> crypto . n_ciphers_pairwise ; i ++ ) { 
+if ( req -> crypto . ciphers_pairwise [ i ] == wlan_cipher_suite_wep40 || 
+req -> crypto . ciphers_pairwise [ i ] == wlan_cipher_suite_tkip || 
+req -> crypto . ciphers_pairwise [ i ] == wlan_cipher_suite_wep104 ) { 
+conn_flags |= ieee80211_conn_disable_ht ; 
+conn_flags |= ieee80211_conn_disable_vht ; 
+conn_flags |= ieee80211_conn_disable_he ; 
+conn_flags |= ieee80211_conn_disable_eht ; 
+netdev_info ( sdata -> dev , 
+"disabling ht/vht/he due to wep/tkip use\n" ) ; 
+} 
+} 
+
+
+if ( ! bss -> wmm_used ) { 
+conn_flags |= ieee80211_conn_disable_ht ; 
+conn_flags |= ieee80211_conn_disable_vht ; 
+conn_flags |= ieee80211_conn_disable_he ; 
+conn_flags |= ieee80211_conn_disable_eht ; 
+netdev_info ( sdata -> dev , 
+"disabling ht/vht/he as wmm/qos is not supported by the ap\n" ) ; 
+} 
+
+if ( req -> flags & assoc_req_disable_ht ) { 
+mlme_dbg ( sdata , "ht disabled by flag, disabling ht/vht/he\n" ) ; 
+conn_flags |= ieee80211_conn_disable_ht ; 
+conn_flags |= ieee80211_conn_disable_vht ; 
+conn_flags |= ieee80211_conn_disable_he ; 
+conn_flags |= ieee80211_conn_disable_eht ; 
+} 
+
+if ( req -> flags & assoc_req_disable_vht ) { 
+mlme_dbg ( sdata , "vht disabled by flag, disabling vht\n" ) ; 
+conn_flags |= ieee80211_conn_disable_vht ; 
+} 
+
+if ( req -> flags & assoc_req_disable_he ) { 
+mlme_dbg ( sdata , "he disabled by flag, disabling he/eht\n" ) ; 
+conn_flags |= ieee80211_conn_disable_he ; 
+conn_flags |= ieee80211_conn_disable_eht ; 
+} 
+
+if ( req -> flags & assoc_req_disable_eht ) 
+conn_flags |= ieee80211_conn_disable_eht ; 
+
+memcpy ( & ifmgd -> ht_capa , & req -> ht_capa , sizeof ( ifmgd -> ht_capa ) ) ; 
+memcpy ( & ifmgd -> ht_capa_mask , & req -> ht_capa_mask , 
+sizeof ( ifmgd -> ht_capa_mask ) ) ; 
+
+memcpy ( & ifmgd -> vht_capa , & req -> vht_capa , sizeof ( ifmgd -> vht_capa ) ) ; 
+memcpy ( & ifmgd -> vht_capa_mask , & req -> vht_capa_mask , 
+sizeof ( ifmgd -> vht_capa_mask ) ) ; 
+
+memcpy ( & ifmgd -> s1g_capa , & req -> s1g_capa , sizeof ( ifmgd -> s1g_capa ) ) ; 
+memcpy ( & ifmgd -> s1g_capa_mask , & req -> s1g_capa_mask , 
+sizeof ( ifmgd -> s1g_capa_mask ) ) ; 
+
+if ( req -> ie && req -> ie_len ) { 
+memcpy ( assoc_data -> ie , req -> ie , req -> ie_len ) ; 
+assoc_data -> ie_len = req -> ie_len ; 
+assoc_data -> ie_pos = assoc_data -> ie + assoc_data -> ie_len ; 
+} else { 
+assoc_data -> ie_pos = assoc_data -> ie ; 
+} 
+
+if ( req -> fils_kek ) { 
+
+if ( warn_on ( req -> fils_kek_len > fils_max_kek_len ) ) { 
+err = - einval ; 
+goto err_free ; 
+} 
+memcpy ( assoc_data -> fils_kek , req -> fils_kek , 
+req -> fils_kek_len ) ; 
+assoc_data -> fils_kek_len = req -> fils_kek_len ; 
+} 
+
+if ( req -> fils_nonces ) 
+memcpy ( assoc_data -> fils_nonces , req -> fils_nonces , 
+2 * fils_nonce_len ) ; 
+
+
+assoc_data -> timeout = jiffies ; 
+assoc_data -> timeout_started = true ; 
+
+assoc_data -> assoc_link_id = assoc_link_id ; 
+
+if ( req -> ap_mld_addr ) { 
+for ( i = 0 ; i < array_size ( assoc_data -> link ) ; i ++ ) { 
+assoc_data -> link [ i ] . conn_flags = conn_flags ; 
+assoc_data -> link [ i ] . bss = req -> links [ i ] . bss ; 
+} 
+
+
+err = ieee80211_vif_set_links ( sdata , bit ( assoc_link_id ) ) ; 
+if ( err ) 
+goto err_clear ; 
+} else { 
+assoc_data -> link [ 0 ] . conn_flags = conn_flags ; 
+assoc_data -> link [ 0 ] . bss = cbss ; 
+} 
+
+link = sdata_dereference ( sdata -> link [ assoc_link_id ] , sdata ) ; 
+if ( warn_on ( ! link ) ) { 
+err = - einval ; 
+goto err_clear ; 
+} 
+
+
+conn_flags |= link -> u . mgd . conn_flags ; 
+conn_flags |= ieee80211_setup_assoc_link ( sdata , assoc_data , req , 
+conn_flags , assoc_link_id ) ; 
+override = link -> u . mgd . conn_flags != conn_flags ; 
+link -> u . mgd . conn_flags |= conn_flags ; 
+
+if ( warn ( ( sdata -> vif . driver_flags & ieee80211_vif_supports_uapsd ) && 
+ieee80211_hw_check ( & local -> hw , ps_nullfunc_stack ) , 
+"u-apsd not supported with hw_ps_nullfunc_stack\n" ) ) 
+sdata -> vif . driver_flags &= ~ ieee80211_vif_supports_uapsd ; 
+
+if ( bss -> wmm_used && bss -> uapsd_supported && 
+( sdata -> vif . driver_flags & ieee80211_vif_supports_uapsd ) ) { 
+assoc_data -> uapsd = true ; 
+ifmgd -> flags |= ieee80211_sta_uapsd_enabled ; 
+} else { 
+assoc_data -> uapsd = false ; 
+ifmgd -> flags &= ~ ieee80211_sta_uapsd_enabled ; 
+} 
+
+if ( req -> prev_bssid ) 
+memcpy ( assoc_data -> prev_ap_addr , req -> prev_bssid , eth_alen ) ; 
+
+if ( req -> use_mfp ) { 
+ifmgd -> mfp = ieee80211_mfp_required ; 
+ifmgd -> flags |= ieee80211_sta_mfp_enabled ; 
+} else { 
+ifmgd -> mfp = ieee80211_mfp_disabled ; 
+ifmgd -> flags &= ~ ieee80211_sta_mfp_enabled ; 
+} 
+
+if ( req -> flags & assoc_req_use_rrm ) 
+ifmgd -> flags |= ieee80211_sta_enable_rrm ; 
+else 
+ifmgd -> flags &= ~ ieee80211_sta_enable_rrm ; 
+
+if ( req -> crypto . control_port ) 
+ifmgd -> flags |= ieee80211_sta_control_port ; 
+else 
+ifmgd -> flags &= ~ ieee80211_sta_control_port ; 
+
+sdata -> control_port_protocol = req -> crypto . control_port_ethertype ; 
+sdata -> control_port_no_encrypt = req -> crypto . control_port_no_encrypt ; 
+sdata -> control_port_over_nl80211 = 
+req -> crypto . control_port_over_nl80211 ; 
+sdata -> control_port_no_preauth = req -> crypto . control_port_no_preauth ; 
+
+
+ifmgd -> assoc_data = assoc_data ; 
+
+for ( i = 0 ; i < array_size ( assoc_data -> link ) ; i ++ ) { 
+if ( ! assoc_data -> link [ i ] . bss ) 
+continue ; 
+if ( i == assoc_data -> assoc_link_id ) 
+continue ; 
+
+err = ieee80211_prep_channel ( sdata , null , assoc_data -> link [ i ] . bss , 
+& assoc_data -> link [ i ] . conn_flags ) ; 
+if ( err ) 
+goto err_clear ; 
+} 
+
+
+memcpy ( sdata -> vif . cfg . ap_addr , assoc_data -> ap_addr , eth_alen ) ; 
+
+err = ieee80211_prep_connection ( sdata , cbss , req -> link_id , 
+req -> ap_mld_addr , true , override ) ; 
+if ( err ) 
+goto err_clear ; 
+
+assoc_data -> link [ assoc_data -> assoc_link_id ] . conn_flags = 
+link -> u . mgd . conn_flags ; 
+
+if ( ieee80211_hw_check ( & sdata -> local -> hw , need_dtim_before_assoc ) ) { 
+const struct cfg80211_bss_ies * beacon_ies ; 
+
+rcu_read_lock ( ) ; 
+beacon_ies = rcu_dereference ( req -> bss -> beacon_ies ) ; 
+
+if ( beacon_ies ) { 
+
+
+
+
+sdata_info ( sdata , "waiting for beacon from %pm\n" , 
+link -> u . mgd . bssid ) ; 
+assoc_data -> timeout = tu_to_exp_time ( req -> bss -> beacon_interval ) ; 
+assoc_data -> timeout_started = true ; 
+assoc_data -> need_beacon = true ; 
+} 
+rcu_read_unlock ( ) ; 
+} 
+
+run_again ( sdata , assoc_data -> timeout ) ; 
+
+return 0 ; 
+err_clear : 
+eth_zero_addr ( sdata -> deflink . u . mgd . bssid ) ; 
+ieee80211_link_info_change_notify ( sdata , & sdata -> deflink , 
+bss_changed_bssid ) ; 
+ifmgd -> assoc_data = null ; 
+err_free : 
+kfree ( assoc_data ) ; 
+return err ; 
+} 
+
+int ieee80211_mgd_deauth ( struct ieee80211_sub_if_data * sdata , 
+struct cfg80211_deauth_request * req ) 
+{ 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+u8 frame_buf [ ieee80211_deauth_frame_len ] ; 
+bool tx = ! req -> local_state_change ; 
+struct ieee80211_prep_tx_info info = { 
+. subtype = ieee80211_stype_deauth , 
+} ; 
+
+if ( ifmgd -> auth_data && 
+ether_addr_equal ( ifmgd -> auth_data -> ap_addr , req -> bssid ) ) { 
+sdata_info ( sdata , 
+"aborting authentication with %pm by local choice (reason: %u=%s)\n" , 
+req -> bssid , req -> reason_code , 
+ieee80211_get_reason_code_string ( req -> reason_code ) ) ; 
+
+drv_mgd_prepare_tx ( sdata -> local , sdata , & info ) ; 
+ieee80211_send_deauth_disassoc ( sdata , req -> bssid , req -> bssid , 
+ieee80211_stype_deauth , 
+req -> reason_code , tx , 
+frame_buf ) ; 
+ieee80211_destroy_auth_data ( sdata , false ) ; 
+ieee80211_report_disconnect ( sdata , frame_buf , 
+sizeof ( frame_buf ) , true , 
+req -> reason_code , false ) ; 
+drv_mgd_complete_tx ( sdata -> local , sdata , & info ) ; 
+return 0 ; 
+} 
+
+if ( ifmgd -> assoc_data && 
+ether_addr_equal ( ifmgd -> assoc_data -> ap_addr , req -> bssid ) ) { 
+sdata_info ( sdata , 
+"aborting association with %pm by local choice (reason: %u=%s)\n" , 
+req -> bssid , req -> reason_code , 
+ieee80211_get_reason_code_string ( req -> reason_code ) ) ; 
+
+drv_mgd_prepare_tx ( sdata -> local , sdata , & info ) ; 
+ieee80211_send_deauth_disassoc ( sdata , req -> bssid , req -> bssid , 
+ieee80211_stype_deauth , 
+req -> reason_code , tx , 
+frame_buf ) ; 
+ieee80211_destroy_assoc_data ( sdata , assoc_abandon ) ; 
+ieee80211_report_disconnect ( sdata , frame_buf , 
+sizeof ( frame_buf ) , true , 
+req -> reason_code , false ) ; 
+return 0 ; 
+} 
+
+if ( ifmgd -> associated && 
+ether_addr_equal ( sdata -> vif . cfg . ap_addr , req -> bssid ) ) { 
+sdata_info ( sdata , 
+"deauthenticating from %pm by local choice (reason: %u=%s)\n" , 
+req -> bssid , req -> reason_code , 
+ieee80211_get_reason_code_string ( req -> reason_code ) ) ; 
+
+ieee80211_set_disassoc ( sdata , ieee80211_stype_deauth , 
+req -> reason_code , tx , frame_buf ) ; 
+ieee80211_report_disconnect ( sdata , frame_buf , 
+sizeof ( frame_buf ) , true , 
+req -> reason_code , false ) ; 
+drv_mgd_complete_tx ( sdata -> local , sdata , & info ) ; 
+return 0 ; 
+} 
+
+return - enotconn ; 
+} 
+
+int ieee80211_mgd_disassoc ( struct ieee80211_sub_if_data * sdata , 
+struct cfg80211_disassoc_request * req ) 
+{ 
+u8 frame_buf [ ieee80211_deauth_frame_len ] ; 
+
+if ( ! sdata -> u . mgd . associated || 
+memcmp ( sdata -> vif . cfg . ap_addr , req -> ap_addr , eth_alen ) ) 
+return - enotconn ; 
+
+sdata_info ( sdata , 
+"disassociating from %pm by local choice (reason: %u=%s)\n" , 
+req -> ap_addr , req -> reason_code , 
+ieee80211_get_reason_code_string ( req -> reason_code ) ) ; 
+
+ieee80211_set_disassoc ( sdata , ieee80211_stype_disassoc , 
+req -> reason_code , ! req -> local_state_change , 
+frame_buf ) ; 
+
+ieee80211_report_disconnect ( sdata , frame_buf , sizeof ( frame_buf ) , true , 
+req -> reason_code , false ) ; 
+
+return 0 ; 
+} 
+
+void ieee80211_mgd_stop_link ( struct ieee80211_link_data * link ) 
+{ 
+cancel_work_sync ( & link -> u . mgd . request_smps_work ) ; 
+cancel_work_sync ( & link -> u . mgd . chswitch_work ) ; 
+} 
+
+void ieee80211_mgd_stop ( struct ieee80211_sub_if_data * sdata ) 
+{ 
+struct ieee80211_if_managed * ifmgd = & sdata -> u . mgd ; 
+
+
+
+
+
+
+cancel_work_sync ( & ifmgd -> monitor_work ) ; 
+cancel_work_sync ( & ifmgd -> beacon_connection_loss_work ) ; 
+cancel_work_sync ( & ifmgd -> csa_connection_drop_work ) ; 
+cancel_delayed_work_sync ( & ifmgd -> tdls_peer_del_work ) ; 
+
+sdata_lock ( sdata ) ; 
+if ( ifmgd -> assoc_data ) 
+ieee80211_destroy_assoc_data ( sdata , assoc_timeout ) ; 
+if ( ifmgd -> auth_data ) 
+ieee80211_destroy_auth_data ( sdata , false ) ; 
+spin_lock_bh ( & ifmgd -> teardown_lock ) ; 
+if ( ifmgd -> teardown_skb ) { 
+kfree_skb ( ifmgd -> teardown_skb ) ; 
+ifmgd -> teardown_skb = null ; 
+ifmgd -> orig_teardown_skb = null ; 
+} 
+kfree ( ifmgd -> assoc_req_ies ) ; 
+ifmgd -> assoc_req_ies = null ; 
+ifmgd -> assoc_req_ies_len = 0 ; 
+spin_unlock_bh ( & ifmgd -> teardown_lock ) ; 
+del_timer_sync ( & ifmgd -> timer ) ; 
+sdata_unlock ( sdata ) ; 
+} 
+
+void ieee80211_cqm_rssi_notify ( struct ieee80211_vif * vif , 
+enum nl80211_cqm_rssi_threshold_event rssi_event , 
+s32 rssi_level , 
+gfp_t gfp ) 
+{ 
+struct ieee80211_sub_if_data * sdata = vif_to_sdata ( vif ) ; 
+
+trace_api_cqm_rssi_notify ( sdata , rssi_event , rssi_level ) ; 
+
+cfg80211_cqm_rssi_notify ( sdata -> dev , rssi_event , rssi_level , gfp ) ; 
+} 
+export_symbol ( ieee80211_cqm_rssi_notify ) ; 
+
+void ieee80211_cqm_beacon_loss_notify ( struct ieee80211_vif * vif , gfp_t gfp ) 
+{ 
+struct ieee80211_sub_if_data * sdata = vif_to_sdata ( vif ) ; 
+
+trace_api_cqm_beacon_loss_notify ( sdata -> local , sdata ) ; 
+
+cfg80211_cqm_beacon_loss_notify ( sdata -> dev , gfp ) ; 
+} 
+export_symbol ( ieee80211_cqm_beacon_loss_notify ) ; 
+
+static void _ieee80211_enable_rssi_reports ( struct ieee80211_sub_if_data * sdata , 
+int rssi_min_thold , 
+int rssi_max_thold ) 
+{ 
+trace_api_enable_rssi_reports ( sdata , rssi_min_thold , rssi_max_thold ) ; 
+
+if ( warn_on ( sdata -> vif . type != nl80211_iftype_station ) ) 
+return ; 
+
+
+
+
+
+
+sdata -> u . mgd . rssi_min_thold = rssi_min_thold * 16 ; 
+sdata -> u . mgd . rssi_max_thold = rssi_max_thold * 16 ; 
+} 
+
+void ieee80211_enable_rssi_reports ( struct ieee80211_vif * vif , 
+int rssi_min_thold , 
+int rssi_max_thold ) 
+{ 
+struct ieee80211_sub_if_data * sdata = vif_to_sdata ( vif ) ; 
+
+warn_on ( rssi_min_thold == rssi_max_thold || 
+rssi_min_thold > rssi_max_thold ) ; 
+
+_ieee80211_enable_rssi_reports ( sdata , rssi_min_thold , 
+rssi_max_thold ) ; 
+} 
+export_symbol ( ieee80211_enable_rssi_reports ) ; 
+
+void ieee80211_disable_rssi_reports ( struct ieee80211_vif * vif ) 
+{ 
+struct ieee80211_sub_if_data * sdata = vif_to_sdata ( vif ) ; 
+
+_ieee80211_enable_rssi_reports ( sdata , 0 , 0 ) ; 
+} 
+export_symbol ( ieee80211_disable_rssi_reports ) ; 
diff --git a/static-analysis/test_inputs/simple_if.c b/static-analysis/test_inputs/simple_if.c
new file mode 100644
index 0000000..4b7ff37
--- /dev/null
+++ b/static-analysis/test_inputs/simple_if.c
@@ -0,0 +1,11 @@
+void foo(int *x) {
+    *x = 5;
+    if (x)
+        *x = 6;
+}
+
+void bar(int *x) {
+    *x = 5;
+    while (x)
+        x = 6;
+}
diff --git a/static-analysis/utils.c b/static-analysis/utils.c
new file mode 100644
index 0000000..ad5b7f9
--- /dev/null
+++ b/static-analysis/utils.c
@@ -0,0 +1,41 @@
+#include "compiler.h"
+
+struct lexeme *find(struct lexeme *l, struct lexeme *rm, char *str) {
+  if (!rm) rm = LEXEMES + N_LEXEMES;
+  int paren_depth = 0,
+      delta = (l <= rm) ? 1 : -1;
+  for (; l != rm; l += delta) {
+    paren_depth += LEXSTR(l, "(") - LEXSTR(l, ")");
+    paren_depth += LEXSTR(l, "[") - LEXSTR(l, "]");
+    paren_depth += LEXSTR(l, "{") - LEXSTR(l, "}");
+    if (!paren_depth && LEXSTR(l, str))
+      return l;
+  }
+  return NULL;
+}
+
+// TODO: fails on while (...) if (...) ...; else ...;
+struct lexeme *match_body(struct lexeme *l) {
+  int paren_depth = 0;
+  for (; l != LEXEMES + N_LEXEMES; l++) {
+    if (!paren_depth && LEXSTR(l, "{")) {
+      struct lexeme *match = find(l, NULL, "}");
+      return match ? match + 1 : 0;
+    }
+    paren_depth += LEXSTR(l, "(") - LEXSTR(l, ")");
+    paren_depth += LEXSTR(l, "[") - LEXSTR(l, "]");
+    paren_depth += LEXSTR(l, "{") - LEXSTR(l, "}");
+    if (!paren_depth && LEXSTR(l, ";"))
+      return l + 1;
+  }
+  return NULL;
+}
+
+// http://www.cse.yorku.ca/~oz/hash.html
+uint64_t hash_range(struct lexrange range) {
+    unsigned long hash = 5381;
+    for (struct lexeme *l = range.lm; l < range.rm; l++)
+        for (char *c = l->string; *c; c++)
+            hash = ((hash << 5) + hash) + (*c);
+    return hash;
+}