hostapd: add missing NULL pointer check on radar notification
[openwrt/openwrt.git] / package / network / services / hostapd / src / src / ap / ubus.c
index 9918f17d6709c794d7a96d0c77d412661c39865b..66eba99901726854b71b99ae1e0421ef430db868 100644 (file)
@@ -11,6 +11,7 @@
 #include "utils/eloop.h"
 #include "utils/wpabuf.h"
 #include "common/ieee802_11_defs.h"
+#include "common/hw_features_common.h"
 #include "hostapd.h"
 #include "neighbor_db.h"
 #include "wps_hostapd.h"
 #include "wnm_ap.h"
 #include "taxonomy.h"
 #include "airtime_policy.h"
+#include "hw_features.h"
 
 static struct ubus_context *ctx;
 static struct blob_buf b;
 static int ctx_ref;
 
-static inline struct hapd_interfaces *get_hapd_interfaces_from_object(struct ubus_object *obj)
-{
-       return container_of(obj, struct hapd_interfaces, ubus);
-}
-
 static inline struct hostapd_data *get_hapd_from_object(struct ubus_object *obj)
 {
        return container_of(obj, struct hostapd_data, ubus.obj);
@@ -42,12 +39,6 @@ struct ubus_banned_client {
        u8 addr[ETH_ALEN];
 };
 
-static void ubus_receive(int sock, void *eloop_ctx, void *sock_ctx)
-{
-       struct ubus_context *ctx = eloop_ctx;
-       ubus_handle_event(ctx);
-}
-
 static void ubus_reconnect_timeout(void *eloop_data, void *user_ctx)
 {
        if (ubus_reconnect(ctx, NULL)) {
@@ -55,12 +46,12 @@ static void ubus_reconnect_timeout(void *eloop_data, void *user_ctx)
                return;
        }
 
-       eloop_register_read_sock(ctx->sock.fd, ubus_receive, ctx, NULL);
+       ubus_add_uloop(ctx);
 }
 
 static void hostapd_ubus_connection_lost(struct ubus_context *ctx)
 {
-       eloop_unregister_read_sock(ctx->sock.fd);
+       uloop_fd_delete(&ctx->sock);
        eloop_register_timeout(1, 0, ubus_reconnect_timeout, ctx, NULL);
 }
 
@@ -69,12 +60,14 @@ static bool hostapd_ubus_init(void)
        if (ctx)
                return true;
 
+       eloop_add_uloop();
        ctx = ubus_connect(NULL);
        if (!ctx)
                return false;
 
        ctx->connection_lost = hostapd_ubus_connection_lost;
-       eloop_register_read_sock(ctx->sock.fd, ubus_receive, ctx, NULL);
+       ubus_add_uloop(ctx);
+
        return true;
 }
 
@@ -92,7 +85,7 @@ static void hostapd_ubus_ref_dec(void)
        if (ctx_ref)
                return;
 
-       eloop_unregister_read_sock(ctx->sock.fd);
+       uloop_fd_delete(&ctx->sock);
        ubus_free(ctx);
        ctx = NULL;
 }
@@ -125,38 +118,6 @@ static void hostapd_notify_ubus(struct ubus_object *obj, char *bssname, char *ev
        free(event_type);
 }
 
-static void hostapd_send_procd_event(char *bssname, char *event)
-{
-       char *name, *s;
-       uint32_t id;
-       void *v;
-
-       if (!ctx || ubus_lookup_id(ctx, "service", &id))
-               return;
-
-       if (asprintf(&name, "hostapd.%s.%s", bssname, event) < 0)
-               return;
-
-       blob_buf_init(&b, 0);
-
-       s = blobmsg_alloc_string_buffer(&b, "type", strlen(name) + 1);
-       sprintf(s, "%s", name);
-       blobmsg_add_string_buffer(&b);
-
-       v = blobmsg_open_table(&b, "data");
-       blobmsg_close_table(&b, v);
-
-       ubus_invoke(ctx, id, "event", b.head, NULL, NULL, 1000);
-
-       free(name);
-}
-
-static void hostapd_send_shared_event(struct ubus_object *obj, char *bssname, char *event)
-{
-       hostapd_send_procd_event(bssname, event);
-       hostapd_notify_ubus(obj, bssname, event);
-}
-
 static void
 hostapd_bss_del_ban(void *eloop_data, void *user_ctx)
 {
@@ -201,10 +162,8 @@ hostapd_bss_reload(struct ubus_context *ctx, struct ubus_object *obj,
                   struct blob_attr *msg)
 {
        struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj);
-       int ret = hostapd_reload_config(hapd->iface, 1);
 
-       hostapd_send_shared_event(&hapd->iface->interfaces->ubus, hapd->conf->iface, "reload");
-       return ret;
+       return hostapd_reload_config(hapd->iface);
 }
 
 
@@ -316,10 +275,24 @@ hostapd_bss_get_clients(struct ubus_context *ctx, struct ubus_object *obj,
                        blobmsg_add_u8(&b, sta_flags[i].name,
                                       !!(sta->flags & sta_flags[i].flag));
 
+#ifdef CONFIG_MBO
+               blobmsg_add_u8(&b, "mbo", !!(sta->cell_capa));
+#endif
+
                r = blobmsg_open_array(&b, "rrm");
                for (i = 0; i < ARRAY_SIZE(sta->rrm_enabled_capa); i++)
                        blobmsg_add_u32(&b, "", sta->rrm_enabled_capa[i]);
                blobmsg_close_array(&b, r);
+
+               r = blobmsg_open_array(&b, "extended_capabilities");
+               /* Check if client advertises extended capabilities */
+               if (sta->ext_capability && sta->ext_capability[0] > 0) {
+                       for (i = 0; i < sta->ext_capability[0]; i++) {
+                               blobmsg_add_u32(&b, "", sta->ext_capability[1 + i]);
+                       }
+               }
+               blobmsg_close_array(&b, r);
+
                blobmsg_add_u32(&b, "aid", sta->aid);
 #ifdef CONFIG_TAXONOMY
                r = blobmsg_alloc_string_buffer(&b, "signature", 1024);
@@ -374,46 +347,26 @@ hostapd_bss_get_features(struct ubus_context *ctx, struct ubus_object *obj,
        return 0;
 }
 
-/* Imported from iw/util.c
- *  https://git.kernel.org/pub/scm/linux/kernel/git/jberg/iw.git/tree/util.c?id=4b25ae3537af48dbf9d0abf94132e5ba01b32c18#n200
- */
-int ieee80211_frequency_to_channel(int freq)
-{
-       /* see 802.11-2007 17.3.8.3.2 and Annex J */
-       if (freq == 2484)
-               return 14;
-       /* see 802.11ax D6.1 27.3.23.2 and Annex E */
-       else if (freq == 5935)
-               return 2;
-       else if (freq < 2484)
-               return (freq - 2407) / 5;
-       else if (freq >= 4910 && freq <= 4980)
-               return (freq - 4000) / 5;
-       else if (freq < 5950)
-               return (freq - 5000) / 5;
-       else if (freq <= 45000) /* DMG band lower limit */
-               /* see 802.11ax D6.1 27.3.23.2 */
-               return (freq - 5950) / 5;
-       else if (freq >= 58320 && freq <= 70200)
-               return (freq - 56160) / 2160;
-       else
-               return 0;
-}
-
 static int
 hostapd_bss_get_status(struct ubus_context *ctx, struct ubus_object *obj,
                       struct ubus_request_data *req, const char *method,
                       struct blob_attr *msg)
 {
        struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj);
-       void *airtime_table, *dfs_table;
+       void *airtime_table, *dfs_table, *rrm_table, *wnm_table;
        struct os_reltime now;
        char ssid[SSID_MAX_LEN + 1];
        char phy_name[17];
        size_t ssid_len = SSID_MAX_LEN;
+       u8 channel = 0, op_class = 0;
 
        if (hapd->conf->ssid.ssid_len < SSID_MAX_LEN)
                ssid_len = hapd->conf->ssid.ssid_len;
+       
+       ieee80211_freq_to_channel_ext(hapd->iface->freq,
+                                     hapd->iconf->secondary_channel,
+                                     hostapd_get_oper_chwidth(hapd->iconf),
+                                     &op_class, &channel);
 
        blob_buf_init(&b, 0);
        blobmsg_add_string(&b, "status", hostapd_state_text(hapd->iface->state));
@@ -424,11 +377,31 @@ hostapd_bss_get_status(struct ubus_context *ctx, struct ubus_object *obj,
        blobmsg_add_string(&b, "ssid", ssid);
 
        blobmsg_add_u32(&b, "freq", hapd->iface->freq);
-       blobmsg_add_u32(&b, "channel", ieee80211_frequency_to_channel(hapd->iface->freq));
+       blobmsg_add_u32(&b, "channel", channel);
+       blobmsg_add_u32(&b, "op_class", op_class);
+       blobmsg_add_u32(&b, "beacon_interval", hapd->iconf->beacon_int);
+#ifdef CONFIG_IEEE80211AX
+       blobmsg_add_u32(&b, "bss_color", hapd->iface->conf->he_op.he_bss_color_disabled ? -1 :
+                                        hapd->iface->conf->he_op.he_bss_color);
+#else
+       blobmsg_add_u32(&b, "bss_color", -1);
+#endif
 
        snprintf(phy_name, 17, "%s", hapd->iface->phy);
        blobmsg_add_string(&b, "phy", phy_name);
 
+       /* RRM */
+       rrm_table = blobmsg_open_table(&b, "rrm");
+       blobmsg_add_u64(&b, "neighbor_report_tx", hapd->openwrt_stats.rrm.neighbor_report_tx);
+       blobmsg_close_table(&b, rrm_table);
+
+       /* WNM */
+       wnm_table = blobmsg_open_table(&b, "wnm");
+       blobmsg_add_u64(&b, "bss_transition_query_rx", hapd->openwrt_stats.wnm.bss_transition_query_rx);
+       blobmsg_add_u64(&b, "bss_transition_request_tx", hapd->openwrt_stats.wnm.bss_transition_request_tx);
+       blobmsg_add_u64(&b, "bss_transition_response_rx", hapd->openwrt_stats.wnm.bss_transition_response_rx);
+       blobmsg_close_table(&b, wnm_table);
+
        /* Airtime */
        airtime_table = blobmsg_open_table(&b, "airtime");
        blobmsg_add_u64(&b, "time", hapd->iface->last_channel_time);
@@ -671,68 +644,6 @@ enum {
        __CONFIG_MAX
 };
 
-static const struct blobmsg_policy config_add_policy[__CONFIG_MAX] = {
-       [CONFIG_IFACE] = { "iface", BLOBMSG_TYPE_STRING },
-       [CONFIG_FILE] = { "config", BLOBMSG_TYPE_STRING },
-};
-
-static int
-hostapd_config_add(struct ubus_context *ctx, struct ubus_object *obj,
-                  struct ubus_request_data *req, const char *method,
-                  struct blob_attr *msg)
-{
-       struct blob_attr *tb[__CONFIG_MAX];
-       struct hapd_interfaces *interfaces = get_hapd_interfaces_from_object(obj);
-       char buf[128];
-
-       blobmsg_parse(config_add_policy, __CONFIG_MAX, tb, blob_data(msg), blob_len(msg));
-
-       if (!tb[CONFIG_FILE] || !tb[CONFIG_IFACE])
-               return UBUS_STATUS_INVALID_ARGUMENT;
-
-       snprintf(buf, sizeof(buf), "bss_config=%s:%s",
-               blobmsg_get_string(tb[CONFIG_IFACE]),
-               blobmsg_get_string(tb[CONFIG_FILE]));
-
-       if (hostapd_add_iface(interfaces, buf))
-               return UBUS_STATUS_INVALID_ARGUMENT;
-
-       blob_buf_init(&b, 0);
-       blobmsg_add_u32(&b, "pid", getpid());
-       ubus_send_reply(ctx, req, b.head);
-
-       return UBUS_STATUS_OK;
-}
-
-enum {
-       CONFIG_REM_IFACE,
-       __CONFIG_REM_MAX
-};
-
-static const struct blobmsg_policy config_remove_policy[__CONFIG_REM_MAX] = {
-       [CONFIG_REM_IFACE] = { "iface", BLOBMSG_TYPE_STRING },
-};
-
-static int
-hostapd_config_remove(struct ubus_context *ctx, struct ubus_object *obj,
-                     struct ubus_request_data *req, const char *method,
-                     struct blob_attr *msg)
-{
-       struct blob_attr *tb[__CONFIG_REM_MAX];
-       struct hapd_interfaces *interfaces = get_hapd_interfaces_from_object(obj);
-       char buf[128];
-
-       blobmsg_parse(config_remove_policy, __CONFIG_REM_MAX, tb, blob_data(msg), blob_len(msg));
-
-       if (!tb[CONFIG_REM_IFACE])
-               return UBUS_STATUS_INVALID_ARGUMENT;
-
-       if (hostapd_remove_iface(interfaces, blobmsg_get_string(tb[CONFIG_REM_IFACE])))
-               return UBUS_STATUS_INVALID_ARGUMENT;
-
-       return UBUS_STATUS_OK;
-}
-
 enum {
        CSA_FREQ,
        CSA_BCN_COUNT,
@@ -744,6 +655,7 @@ enum {
        CSA_VHT,
        CSA_HE,
        CSA_BLOCK_TX,
+       CSA_FORCE,
        __CSA_MAX
 };
 
@@ -758,8 +670,18 @@ static const struct blobmsg_policy csa_policy[__CSA_MAX] = {
        [CSA_VHT] = { "vht", BLOBMSG_TYPE_BOOL },
        [CSA_HE] = { "he", BLOBMSG_TYPE_BOOL },
        [CSA_BLOCK_TX] = { "block_tx", BLOBMSG_TYPE_BOOL },
+       [CSA_FORCE] = { "force", BLOBMSG_TYPE_BOOL },
 };
 
+
+static void switch_chan_fallback_cb(void *eloop_data, void *user_ctx)
+{
+       struct hostapd_iface *iface = eloop_data;
+       struct hostapd_freq_params *freq_params = user_ctx;
+
+       hostapd_switch_channel_fallback(iface, freq_params);
+}
+
 #ifdef NEED_AP_MLME
 static int
 hostapd_switch_chan(struct ubus_context *ctx, struct ubus_object *obj,
@@ -769,6 +691,8 @@ hostapd_switch_chan(struct ubus_context *ctx, struct ubus_object *obj,
        struct blob_attr *tb[__CSA_MAX];
        struct hostapd_data *hapd = get_hapd_from_object(obj);
        struct hostapd_config *iconf = hapd->iface->conf;
+       struct hostapd_freq_params *freq_params;
+       struct hostapd_hw_modes *mode = hapd->iface->current_mode;
        struct csa_settings css = {
                .freq_params = {
                        .ht_enabled = iconf->ieee80211n,
@@ -777,6 +701,8 @@ hostapd_switch_chan(struct ubus_context *ctx, struct ubus_object *obj,
                        .sec_channel_offset = iconf->secondary_channel,
                }
        };
+       u8 chwidth = hostapd_get_oper_chwidth(iconf);
+       u8 seg0 = 0, seg1 = 0;
        int ret = UBUS_STATUS_OK;
        int i;
 
@@ -818,6 +744,38 @@ hostapd_switch_chan(struct ubus_context *ctx, struct ubus_object *obj,
        SET_CSA_SETTING(CSA_HE, freq_params.he_enabled, bool);
        SET_CSA_SETTING(CSA_BLOCK_TX, block_tx, bool);
 
+       css.freq_params.channel = hostapd_hw_get_channel(hapd, css.freq_params.freq);
+       if (!css.freq_params.channel)
+               return UBUS_STATUS_NOT_SUPPORTED;
+
+       switch (css.freq_params.bandwidth) {
+       case 160:
+               chwidth = CHANWIDTH_160MHZ;
+               break;
+       case 80:
+               chwidth = css.freq_params.center_freq2 ? CHANWIDTH_80P80MHZ : CHANWIDTH_80MHZ;
+               break;
+       default:
+               chwidth = CHANWIDTH_USE_HT;
+               break;
+       }
+
+       hostapd_set_freq_params(&css.freq_params, iconf->hw_mode,
+                               css.freq_params.freq,
+                               css.freq_params.channel, iconf->enable_edmg,
+                               iconf->edmg_channel,
+                               css.freq_params.ht_enabled,
+                               css.freq_params.vht_enabled,
+                               css.freq_params.he_enabled,
+                               css.freq_params.eht_enabled,
+                               css.freq_params.sec_channel_offset,
+                               chwidth, seg0, seg1,
+                               iconf->vht_capab,
+                               mode ? &mode->he_capab[IEEE80211_MODE_AP] :
+                               NULL,
+                               mode ? &mode->eht_capab[IEEE80211_MODE_AP] :
+                               NULL);
+
        for (i = 0; i < hapd->iface->num_bss; i++) {
                struct hostapd_data *bss = hapd->iface->bss[i];
 
@@ -825,7 +783,15 @@ hostapd_switch_chan(struct ubus_context *ctx, struct ubus_object *obj,
                        ret = UBUS_STATUS_NOT_SUPPORTED;
        }
 
-       return ret;
+       if (!ret || !tb[CSA_FORCE] || !blobmsg_get_bool(tb[CSA_FORCE]))
+               return ret;
+
+       freq_params = malloc(sizeof(*freq_params));
+       memcpy(freq_params, &css.freq_params, sizeof(*freq_params));
+       eloop_register_timeout(0, 1, switch_chan_fallback_cb,
+                              hapd->iface, freq_params);
+
+       return 0;
 #undef SET_CSA_SETTING
 }
 #endif
@@ -911,6 +877,7 @@ hostapd_rrm_print_nr(struct hostapd_neighbor_entry *nr)
 enum {
        BSS_MGMT_EN_NEIGHBOR,
        BSS_MGMT_EN_BEACON,
+       BSS_MGMT_EN_LINK_MEASUREMENT,
 #ifdef CONFIG_WNM_AP
        BSS_MGMT_EN_BSS_TRANSITION,
 #endif
@@ -938,6 +905,14 @@ __hostapd_bss_mgmt_enable_f(struct hostapd_data *hapd, int flag)
                        WLAN_RRM_CAPS_BEACON_REPORT_ACTIVE |
                        WLAN_RRM_CAPS_BEACON_REPORT_TABLE;
 
+               if (bss->radio_measurements[0] & flags == flags)
+                       return false;
+
+               bss->radio_measurements[0] |= (u8) flags;
+               return true;
+       case BSS_MGMT_EN_LINK_MEASUREMENT:
+               flags = WLAN_RRM_CAPS_LINK_MEASUREMENT;
+
                if (bss->radio_measurements[0] & flags == flags)
                        return false;
 
@@ -975,6 +950,7 @@ __hostapd_bss_mgmt_enable(struct hostapd_data *hapd, uint32_t flags)
 static const struct blobmsg_policy bss_mgmt_enable_policy[__BSS_MGMT_EN_MAX] = {
        [BSS_MGMT_EN_NEIGHBOR] = { "neighbor_report", BLOBMSG_TYPE_BOOL },
        [BSS_MGMT_EN_BEACON] = { "beacon_report", BLOBMSG_TYPE_BOOL },
+       [BSS_MGMT_EN_LINK_MEASUREMENT] = { "link_measurement", BLOBMSG_TYPE_BOOL },
 #ifdef CONFIG_WNM_AP
        [BSS_MGMT_EN_BSS_TRANSITION] = { "bss_transition", BLOBMSG_TYPE_BOOL },
 #endif
@@ -1003,6 +979,8 @@ hostapd_bss_mgmt_enable(struct ubus_context *ctx, struct ubus_object *obj,
        }
 
        __hostapd_bss_mgmt_enable(hapd, flags);
+
+       return 0;
 }
 
 
@@ -1155,7 +1133,7 @@ hostapd_rrm_nr_set(struct ubus_context *ctx, struct ubus_object *obj,
                        memcpy(&ssid, s, ssid.ssid_len);
                }
 
-               hostapd_neighbor_set(hapd, bssid, &ssid, data, NULL, NULL, 0);
+               hostapd_neighbor_set(hapd, bssid, &ssid, data, NULL, NULL, 0, 0);
                wpabuf_free(data);
                continue;
 
@@ -1253,62 +1231,127 @@ hostapd_rrm_beacon_req(struct ubus_context *ctx, struct ubus_object *obj,
        return 0;
 }
 
-
-#ifdef CONFIG_WNM_AP
 enum {
-       WNM_DISASSOC_ADDR,
-       WNM_DISASSOC_DURATION,
-       WNM_DISASSOC_NEIGHBORS,
-       WNM_DISASSOC_ABRIDGED,
-       __WNM_DISASSOC_MAX,
+       LM_REQ_ADDR,
+       LM_REQ_TX_POWER_USED,
+       LM_REQ_TX_POWER_MAX,
+       __LM_REQ_MAX,
 };
 
-static const struct blobmsg_policy wnm_disassoc_policy[__WNM_DISASSOC_MAX] = {
-       [WNM_DISASSOC_ADDR] = { "addr", BLOBMSG_TYPE_STRING },
-       [WNM_DISASSOC_DURATION] { "duration", BLOBMSG_TYPE_INT32 },
-       [WNM_DISASSOC_NEIGHBORS] { "neighbors", BLOBMSG_TYPE_ARRAY },
-       [WNM_DISASSOC_ABRIDGED] { "abridged", BLOBMSG_TYPE_BOOL },
+static const struct blobmsg_policy lm_req_policy[__LM_REQ_MAX] = {
+       [LM_REQ_ADDR] = { "addr", BLOBMSG_TYPE_STRING },
+       [LM_REQ_TX_POWER_USED] = { "tx-power-used", BLOBMSG_TYPE_INT32 },
+       [LM_REQ_TX_POWER_MAX] = { "tx-power-max", BLOBMSG_TYPE_INT32 },
 };
 
 static int
-hostapd_wnm_disassoc_imminent(struct ubus_context *ctx, struct ubus_object *obj,
-                             struct ubus_request_data *ureq, const char *method,
-                             struct blob_attr *msg)
+hostapd_rrm_lm_req(struct ubus_context *ctx, struct ubus_object *obj,
+                  struct ubus_request_data *ureq, const char *method,
+                  struct blob_attr *msg)
 {
        struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj);
-       struct blob_attr *tb[__WNM_DISASSOC_MAX];
-       struct blob_attr *cur;
-       struct sta_info *sta;
-       int duration = 10;
-       int rem;
-       int nr_len = 0;
-       u8 *nr = NULL;
-       u8 req_mode = WNM_BSS_TM_REQ_DISASSOC_IMMINENT;
+       struct blob_attr *tb[__LM_REQ_MAX];
+       struct wpabuf *buf;
        u8 addr[ETH_ALEN];
+       int ret;
+       int8_t txp_used, txp_max;
 
-       blobmsg_parse(wnm_disassoc_policy, __WNM_DISASSOC_MAX, tb, blob_data(msg), blob_len(msg));
+       txp_used = 0;
+       txp_max = 0;
 
-       if (!tb[WNM_DISASSOC_ADDR])
+       blobmsg_parse(lm_req_policy, __LM_REQ_MAX, tb, blob_data(msg), blob_len(msg));
+
+       if (!tb[LM_REQ_ADDR])
                return UBUS_STATUS_INVALID_ARGUMENT;
 
-       if (hwaddr_aton(blobmsg_data(tb[WNM_DISASSOC_ADDR]), addr))
+       if (tb[LM_REQ_TX_POWER_USED])
+               txp_used = (int8_t) blobmsg_get_u32(tb[LM_REQ_TX_POWER_USED]);
+
+       if (tb[LM_REQ_TX_POWER_MAX])
+               txp_max = (int8_t) blobmsg_get_u32(tb[LM_REQ_TX_POWER_MAX]);
+
+       if (hwaddr_aton(blobmsg_data(tb[LM_REQ_ADDR]), addr))
                return UBUS_STATUS_INVALID_ARGUMENT;
 
-       if ((cur = tb[WNM_DISASSOC_DURATION]) != NULL)
-               duration = blobmsg_get_u32(cur);
+       buf = wpabuf_alloc(5);
+       if (!buf)
+               return UBUS_STATUS_UNKNOWN_ERROR;
+
+       wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
+       wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REQUEST);
+       wpabuf_put_u8(buf, 1);
+       /* TX-Power used */
+       wpabuf_put_u8(buf, txp_used);
+       /* Max TX Power */
+       wpabuf_put_u8(buf, txp_max);
+
+       ret = hostapd_drv_send_action(hapd, hapd->iface->freq, 0, addr,
+                                     wpabuf_head(buf), wpabuf_len(buf));
+
+       wpabuf_free(buf);
+       if (ret < 0)
+               return -ret;
+
+       return 0;
+}
+
+
+void hostapd_ubus_handle_link_measurement(struct hostapd_data *hapd, const u8 *data, size_t len)
+{
+       const struct ieee80211_mgmt *mgmt = (const struct ieee80211_mgmt *) data;
+       const u8 *pos, *end;
+       u8 token;
+
+       end = data + len;
+       token = mgmt->u.action.u.rrm.dialog_token;
+       pos = mgmt->u.action.u.rrm.variable;
+
+       if (end - pos < 8)
+               return;
+
+       if (!hapd->ubus.obj.has_subscribers)
+               return;
+
+       blob_buf_init(&b, 0);
+       blobmsg_add_macaddr(&b, "address", mgmt->sa);
+       blobmsg_add_u16(&b, "dialog-token", token);
+       blobmsg_add_u16(&b, "rx-antenna-id", pos[4]);
+       blobmsg_add_u16(&b, "tx-antenna-id", pos[5]);
+       blobmsg_add_u16(&b, "rcpi", pos[6]);
+       blobmsg_add_u16(&b, "rsni", pos[7]);
+
+       ubus_notify(ctx, &hapd->ubus.obj, "link-measurement-report", b.head, -1);
+}
+
+
+#ifdef CONFIG_WNM_AP
+
+static int
+hostapd_bss_tr_send(struct hostapd_data *hapd, u8 *addr, bool disassoc_imminent, bool abridged,
+                   u16 disassoc_timer, u8 validity_period, u8 dialog_token,
+                   struct blob_attr *neighbors, u8 mbo_reason, u8 cell_pref, u8 reassoc_delay)
+{
+       struct blob_attr *cur;
+       struct sta_info *sta;
+       int nr_len = 0;
+       int rem;
+       u8 *nr = NULL;
+       u8 req_mode = 0;
+       u8 mbo[10];
+       size_t mbo_len = 0;
 
        sta = ap_get_sta(hapd, addr);
        if (!sta)
                return UBUS_STATUS_NOT_FOUND;
 
-       if (tb[WNM_DISASSOC_NEIGHBORS]) {
+       if (neighbors) {
                u8 *nr_cur;
 
-               if (blobmsg_check_array(tb[WNM_DISASSOC_NEIGHBORS],
+               if (blobmsg_check_array(neighbors,
                                        BLOBMSG_TYPE_STRING) < 0)
                        return UBUS_STATUS_INVALID_ARGUMENT;
 
-               blobmsg_for_each_attr(cur, tb[WNM_DISASSOC_NEIGHBORS], rem) {
+               blobmsg_for_each_attr(cur, neighbors, rem) {
                        int len = strlen(blobmsg_get_string(cur));
 
                        if (len % 2)
@@ -1324,7 +1367,7 @@ hostapd_wnm_disassoc_imminent(struct ubus_context *ctx, struct ubus_object *obj,
                }
 
                nr_cur = nr;
-               blobmsg_for_each_attr(cur, tb[WNM_DISASSOC_NEIGHBORS], rem) {
+               blobmsg_for_each_attr(cur, neighbors, rem) {
                        int len = strlen(blobmsg_get_string(cur)) / 2;
 
                        *nr_cur++ = WLAN_EID_NEIGHBOR_REPORT;
@@ -1341,15 +1384,131 @@ hostapd_wnm_disassoc_imminent(struct ubus_context *ctx, struct ubus_object *obj,
        if (nr)
                req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
 
-       if (tb[WNM_DISASSOC_ABRIDGED] && blobmsg_get_bool(tb[WNM_DISASSOC_ABRIDGED]))
+       if (abridged)
                req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
 
-       if (wnm_send_bss_tm_req(hapd, sta, req_mode, duration, duration, NULL,
-                               NULL, nr, nr_len, NULL, 0))
+       if (disassoc_imminent)
+               req_mode |= WNM_BSS_TM_REQ_DISASSOC_IMMINENT;
+
+#ifdef CONFIG_MBO
+       u8 *mbo_pos = mbo;
+
+       if (mbo_reason > MBO_TRANSITION_REASON_PREMIUM_AP)
+               return UBUS_STATUS_INVALID_ARGUMENT;
+
+       if (cell_pref != 0 && cell_pref != 1 && cell_pref != 255)
+               return UBUS_STATUS_INVALID_ARGUMENT;
+
+       if (reassoc_delay > 65535 || (reassoc_delay && !disassoc_imminent))
+               return UBUS_STATUS_INVALID_ARGUMENT;
+
+       *mbo_pos++ = MBO_ATTR_ID_TRANSITION_REASON;
+       *mbo_pos++ = 1;
+       *mbo_pos++ = mbo_reason;
+       *mbo_pos++ = MBO_ATTR_ID_CELL_DATA_PREF;
+       *mbo_pos++ = 1;
+       *mbo_pos++ = cell_pref;
+
+       if (reassoc_delay) {
+               *mbo_pos++ = MBO_ATTR_ID_ASSOC_RETRY_DELAY;
+               *mbo_pos++ = 2;
+               WPA_PUT_LE16(mbo_pos, reassoc_delay);
+               mbo_pos += 2;
+       }
+
+       mbo_len = mbo_pos - mbo;
+#endif
+
+       if (wnm_send_bss_tm_req(hapd, sta, req_mode, disassoc_timer, validity_period, NULL,
+                               dialog_token, NULL, nr, nr_len, mbo_len ? mbo : NULL, mbo_len))
                return UBUS_STATUS_UNKNOWN_ERROR;
 
        return 0;
 }
+
+enum {
+       BSS_TR_ADDR,
+       BSS_TR_DA_IMMINENT,
+       BSS_TR_DA_TIMER,
+       BSS_TR_VALID_PERIOD,
+       BSS_TR_NEIGHBORS,
+       BSS_TR_ABRIDGED,
+       BSS_TR_DIALOG_TOKEN,
+#ifdef CONFIG_MBO
+       BSS_TR_MBO_REASON,
+       BSS_TR_CELL_PREF,
+       BSS_TR_REASSOC_DELAY,
+#endif
+       __BSS_TR_DISASSOC_MAX
+};
+
+static const struct blobmsg_policy bss_tr_policy[__BSS_TR_DISASSOC_MAX] = {
+       [BSS_TR_ADDR] = { "addr", BLOBMSG_TYPE_STRING },
+       [BSS_TR_DA_IMMINENT] = { "disassociation_imminent", BLOBMSG_TYPE_BOOL },
+       [BSS_TR_DA_TIMER] = { "disassociation_timer", BLOBMSG_TYPE_INT32 },
+       [BSS_TR_VALID_PERIOD] = { "validity_period", BLOBMSG_TYPE_INT32 },
+       [BSS_TR_NEIGHBORS] = { "neighbors", BLOBMSG_TYPE_ARRAY },
+       [BSS_TR_ABRIDGED] = { "abridged", BLOBMSG_TYPE_BOOL },
+       [BSS_TR_DIALOG_TOKEN] = { "dialog_token", BLOBMSG_TYPE_INT32 },
+#ifdef CONFIG_MBO
+       [BSS_TR_MBO_REASON] = { "mbo_reason", BLOBMSG_TYPE_INT32 },
+       [BSS_TR_CELL_PREF] = { "cell_pref", BLOBMSG_TYPE_INT32 },
+       [BSS_TR_REASSOC_DELAY] = { "reassoc_delay", BLOBMSG_TYPE_INT32 },
+#endif
+};
+
+static int
+hostapd_bss_transition_request(struct ubus_context *ctx, struct ubus_object *obj,
+                              struct ubus_request_data *ureq, const char *method,
+                              struct blob_attr *msg)
+{
+       struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj);
+       struct blob_attr *tb[__BSS_TR_DISASSOC_MAX];
+       struct sta_info *sta;
+       u32 da_timer = 0;
+       u32 valid_period = 0;
+       u8 addr[ETH_ALEN];
+       u32 dialog_token = 1;
+       bool abridged;
+       bool da_imminent;
+       u8 mbo_reason;
+       u8 cell_pref;
+       u8 reassoc_delay;
+
+       blobmsg_parse(bss_tr_policy, __BSS_TR_DISASSOC_MAX, tb, blob_data(msg), blob_len(msg));
+
+       if (!tb[BSS_TR_ADDR])
+               return UBUS_STATUS_INVALID_ARGUMENT;
+
+       if (hwaddr_aton(blobmsg_data(tb[BSS_TR_ADDR]), addr))
+               return UBUS_STATUS_INVALID_ARGUMENT;
+
+       if (tb[BSS_TR_DA_TIMER])
+               da_timer = blobmsg_get_u32(tb[BSS_TR_DA_TIMER]);
+
+       if (tb[BSS_TR_VALID_PERIOD])
+               valid_period = blobmsg_get_u32(tb[BSS_TR_VALID_PERIOD]);
+
+       if (tb[BSS_TR_DIALOG_TOKEN])
+               dialog_token = blobmsg_get_u32(tb[BSS_TR_DIALOG_TOKEN]);
+
+       da_imminent = !!(tb[BSS_TR_DA_IMMINENT] && blobmsg_get_bool(tb[BSS_TR_DA_IMMINENT]));
+       abridged = !!(tb[BSS_TR_ABRIDGED] && blobmsg_get_bool(tb[BSS_TR_ABRIDGED]));
+
+#ifdef CONFIG_MBO
+       if (tb[BSS_TR_MBO_REASON])
+               mbo_reason = blobmsg_get_u32(tb[BSS_TR_MBO_REASON]);
+
+       if (tb[BSS_TR_CELL_PREF])
+               cell_pref = blobmsg_get_u32(tb[BSS_TR_CELL_PREF]);
+
+       if (tb[BSS_TR_REASSOC_DELAY])
+               reassoc_delay = blobmsg_get_u32(tb[BSS_TR_REASSOC_DELAY]);
+#endif
+
+       return hostapd_bss_tr_send(hapd, addr, da_imminent, abridged, da_timer, valid_period,
+                                  dialog_token, tb[BSS_TR_NEIGHBORS], mbo_reason, cell_pref, reassoc_delay);
+}
 #endif
 
 #ifdef CONFIG_AIRTIME_POLICY
@@ -1405,10 +1564,61 @@ hostapd_bss_update_airtime(struct ubus_context *ctx, struct ubus_object *obj,
 }
 #endif
 
+#ifdef CONFIG_TAXONOMY
+static const struct blobmsg_policy addr_policy[] = {
+       { "address", BLOBMSG_TYPE_STRING }
+};
+
+static bool
+hostapd_add_b64_data(const char *name, const struct wpabuf *buf)
+{
+       char *str;
+
+       if (!buf)
+               return false;
+
+       str = blobmsg_alloc_string_buffer(&b, name, B64_ENCODE_LEN(wpabuf_len(buf)));
+       b64_encode(wpabuf_head(buf), wpabuf_len(buf), str, B64_ENCODE_LEN(wpabuf_len(buf)));
+       blobmsg_add_string_buffer(&b);
+
+       return true;
+}
+
+static int
+hostapd_bss_get_sta_ies(struct ubus_context *ctx, struct ubus_object *obj,
+                       struct ubus_request_data *req, const char *method,
+                       struct blob_attr *msg)
+{
+       struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj);
+       struct blob_attr *tb;
+       struct sta_info *sta;
+       u8 addr[ETH_ALEN];
+
+       blobmsg_parse(addr_policy, 1, &tb, blobmsg_data(msg), blobmsg_len(msg));
+
+       if (!tb || hwaddr_aton(blobmsg_data(tb), addr))
+               return UBUS_STATUS_INVALID_ARGUMENT;
+
+       sta = ap_get_sta(hapd, addr);
+       if (!sta || (!sta->probe_ie_taxonomy && !sta->assoc_ie_taxonomy))
+               return UBUS_STATUS_NOT_FOUND;
+
+       blob_buf_init(&b, 0);
+       hostapd_add_b64_data("probe_ie", sta->probe_ie_taxonomy);
+       hostapd_add_b64_data("assoc_ie", sta->assoc_ie_taxonomy);
+       ubus_send_reply(ctx, req, b.head);
+
+       return 0;
+}
+#endif
+
 
 static const struct ubus_method bss_methods[] = {
        UBUS_METHOD_NOARG("reload", hostapd_bss_reload),
        UBUS_METHOD_NOARG("get_clients", hostapd_bss_get_clients),
+#ifdef CONFIG_TAXONOMY
+       UBUS_METHOD("get_sta_ies", hostapd_bss_get_sta_ies, addr_policy),
+#endif
        UBUS_METHOD_NOARG("get_status", hostapd_bss_get_status),
        UBUS_METHOD("del_client", hostapd_bss_del_client, del_policy),
 #ifdef CONFIG_AIRTIME_POLICY
@@ -1432,8 +1642,9 @@ static const struct ubus_method bss_methods[] = {
        UBUS_METHOD_NOARG("rrm_nr_list", hostapd_rrm_nr_list),
        UBUS_METHOD("rrm_nr_set", hostapd_rrm_nr_set, nr_set_policy),
        UBUS_METHOD("rrm_beacon_req", hostapd_rrm_beacon_req, beacon_req_policy),
+       UBUS_METHOD("link_measurement_req", hostapd_rrm_lm_req, lm_req_policy),
 #ifdef CONFIG_WNM_AP
-       UBUS_METHOD("wnm_disassoc_imminent", hostapd_wnm_disassoc_imminent, wnm_disassoc_policy),
+       UBUS_METHOD("bss_transition_request", hostapd_bss_transition_request, bss_tr_policy),
 #endif
 };
 
@@ -1469,8 +1680,6 @@ void hostapd_ubus_add_bss(struct hostapd_data *hapd)
        obj->n_methods = bss_object_type.n_methods;
        ret = ubus_add_object(ctx, obj);
        hostapd_ubus_ref_inc();
-
-       hostapd_send_shared_event(&hapd->iface->interfaces->ubus, hapd->conf->iface, "add");
 }
 
 void hostapd_ubus_free_bss(struct hostapd_data *hapd)
@@ -1478,10 +1687,13 @@ void hostapd_ubus_free_bss(struct hostapd_data *hapd)
        struct ubus_object *obj = &hapd->ubus.obj;
        char *name = (char *) obj->name;
 
-       if (!ctx)
+#ifdef CONFIG_MESH
+       if (hapd->conf->mesh & MESH_ENABLED)
                return;
+#endif
 
-       hostapd_send_shared_event(&hapd->iface->interfaces->ubus, hapd->conf->iface, "remove");
+       if (!ctx)
+               return;
 
        if (obj->id) {
                ubus_remove_object(ctx, obj);
@@ -1528,47 +1740,6 @@ void hostapd_ubus_remove_vlan(struct hostapd_data *hapd, struct hostapd_vlan *vl
        hostapd_ubus_vlan_action(hapd, vlan, "vlan_remove");
 }
 
-static const struct ubus_method daemon_methods[] = {
-       UBUS_METHOD("config_add", hostapd_config_add, config_add_policy),
-       UBUS_METHOD("config_remove", hostapd_config_remove, config_remove_policy),
-};
-
-static struct ubus_object_type daemon_object_type =
-       UBUS_OBJECT_TYPE("hostapd", daemon_methods);
-
-void hostapd_ubus_add(struct hapd_interfaces *interfaces)
-{
-       struct ubus_object *obj = &interfaces->ubus;
-       int ret;
-
-       if (!hostapd_ubus_init())
-               return;
-
-       obj->name = strdup("hostapd");
-
-       obj->type = &daemon_object_type;
-       obj->methods = daemon_object_type.methods;
-       obj->n_methods = daemon_object_type.n_methods;
-       ret = ubus_add_object(ctx, obj);
-       hostapd_ubus_ref_inc();
-}
-
-void hostapd_ubus_free(struct hapd_interfaces *interfaces)
-{
-       struct ubus_object *obj = &interfaces->ubus;
-       char *name = (char *) obj->name;
-
-       if (!ctx)
-               return;
-
-       if (obj->id) {
-               ubus_remove_object(ctx, obj);
-               hostapd_ubus_ref_dec();
-       }
-
-       free(name);
-}
-
 struct ubus_event_req {
        struct ubus_notify_request nreq;
        int resp;
@@ -1689,6 +1860,20 @@ void hostapd_ubus_notify(struct hostapd_data *hapd, const char *type, const u8 *
        ubus_notify(ctx, &hapd->ubus.obj, type, b.head, -1);
 }
 
+void hostapd_ubus_notify_authorized(struct hostapd_data *hapd, struct sta_info *sta,
+                                   const char *auth_alg)
+{
+       if (!hapd->ubus.obj.has_subscribers)
+               return;
+
+       blob_buf_init(&b, 0);
+       blobmsg_add_macaddr(&b, "address", sta->addr);
+       if (auth_alg)
+               blobmsg_add_string(&b, "auth-alg", auth_alg);
+
+       ubus_notify(ctx, &hapd->ubus.obj, "sta-authorized", b.head, -1);
+}
+
 void hostapd_ubus_notify_beacon_report(
        struct hostapd_data *hapd, const u8 *addr, u8 token, u8 rep_mode,
        struct rrm_measurement_beacon_report *rep, size_t len)
@@ -1711,6 +1896,7 @@ void hostapd_ubus_notify_beacon_report(
        blobmsg_add_macaddr(&b, "bssid", rep->bssid);
        blobmsg_add_u16(&b, "antenna-id", rep->antenna_id);
        blobmsg_add_u16(&b, "parent-tsf", rep->parent_tsf);
+       blobmsg_add_u16(&b, "rep-mode", rep_mode);
 
        ubus_notify(ctx, &hapd->ubus.obj, "beacon-report", b.head, -1);
 }
@@ -1721,7 +1907,7 @@ void hostapd_ubus_notify_radar_detected(struct hostapd_iface *iface, int frequen
        struct hostapd_data *hapd;
        int i;
 
-       if (!hapd->ubus.obj.has_subscribers)
+       if (!ctx)
                return;
 
        blob_buf_init(&b, 0);
@@ -1735,3 +1921,85 @@ void hostapd_ubus_notify_radar_detected(struct hostapd_iface *iface, int frequen
                ubus_notify(ctx, &hapd->ubus.obj, "radar-detected", b.head, -1);
        }
 }
+
+#ifdef CONFIG_WNM_AP
+static void hostapd_ubus_notify_bss_transition_add_candidate_list(
+       const u8 *candidate_list, u16 candidate_list_len)
+{
+       char *cl_str;
+       int i;
+
+       if (candidate_list_len == 0)
+               return;
+
+       cl_str = blobmsg_alloc_string_buffer(&b, "candidate-list", candidate_list_len * 2 + 1);
+       for (i = 0; i < candidate_list_len; i++)
+               snprintf(&cl_str[i*2], 3, "%02X", candidate_list[i]);
+       blobmsg_add_string_buffer(&b);
+
+}
+#endif
+
+void hostapd_ubus_notify_bss_transition_response(
+       struct hostapd_data *hapd, const u8 *addr, u8 dialog_token, u8 status_code,
+       u8 bss_termination_delay, const u8 *target_bssid,
+       const u8 *candidate_list, u16 candidate_list_len)
+{
+#ifdef CONFIG_WNM_AP
+       u16 i;
+
+       if (!hapd->ubus.obj.has_subscribers)
+               return;
+
+       if (!addr)
+               return;
+
+       blob_buf_init(&b, 0);
+       blobmsg_add_macaddr(&b, "address", addr);
+       blobmsg_add_u8(&b, "dialog-token", dialog_token);
+       blobmsg_add_u8(&b, "status-code", status_code);
+       blobmsg_add_u8(&b, "bss-termination-delay", bss_termination_delay);
+       if (target_bssid)
+               blobmsg_add_macaddr(&b, "target-bssid", target_bssid);
+       
+       hostapd_ubus_notify_bss_transition_add_candidate_list(candidate_list, candidate_list_len);
+
+       ubus_notify(ctx, &hapd->ubus.obj, "bss-transition-response", b.head, -1);
+#endif
+}
+
+int hostapd_ubus_notify_bss_transition_query(
+       struct hostapd_data *hapd, const u8 *addr, u8 dialog_token, u8 reason,
+       const u8 *candidate_list, u16 candidate_list_len)
+{
+#ifdef CONFIG_WNM_AP
+       struct ubus_event_req ureq = {};
+       char *cl_str;
+       u16 i;
+
+       if (!hapd->ubus.obj.has_subscribers)
+               return 0;
+
+       if (!addr)
+               return 0;
+
+       blob_buf_init(&b, 0);
+       blobmsg_add_macaddr(&b, "address", addr);
+       blobmsg_add_u8(&b, "dialog-token", dialog_token);
+       blobmsg_add_u8(&b, "reason", reason);
+       hostapd_ubus_notify_bss_transition_add_candidate_list(candidate_list, candidate_list_len);
+
+       if (!hapd->ubus.notify_response) {
+               ubus_notify(ctx, &hapd->ubus.obj, "bss-transition-query", b.head, -1);
+               return 0;
+       }
+
+       if (ubus_notify_async(ctx, &hapd->ubus.obj, "bss-transition-query", b.head, &ureq.nreq))
+               return 0;
+
+       ureq.nreq.status_cb = ubus_event_cb;
+       ubus_complete_request(ctx, &ureq.nreq.req, 100);
+
+       return ureq.resp;
+#endif
+}