1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright 2002-2005, Instant802 Networks, Inc.
4  * Copyright 2005-2006, Devicescape Software, Inc.
5  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
6  * Copyright 2007	Johannes Berg <johannes@sipsolutions.net>
7  * Copyright 2013-2014  Intel Mobile Communications GmbH
8  * Copyright (C) 2015-2017	Intel Deutschland GmbH
9  * Copyright (C) 2018-2023 Intel Corporation
10  *
11  * utilities for mac80211
12  */
13 
14 #include <net/mac80211.h>
15 #include <linux/netdevice.h>
16 #include <linux/export.h>
17 #include <linux/types.h>
18 #include <linux/slab.h>
19 #include <linux/skbuff.h>
20 #include <linux/etherdevice.h>
21 #include <linux/if_arp.h>
22 #include <linux/bitmap.h>
23 #include <linux/crc32.h>
24 #include <net/net_namespace.h>
25 #include <net/cfg80211.h>
26 #include <net/rtnetlink.h>
27 
28 #include "ieee80211_i.h"
29 #include "driver-ops.h"
30 #include "rate.h"
31 #include "mesh.h"
32 #include "wme.h"
33 #include "led.h"
34 #include "wep.h"
35 
36 /* privid for wiphys to determine whether they belong to us or not */
37 const void *const mac80211_wiphy_privid = &mac80211_wiphy_privid;
38 
wiphy_to_ieee80211_hw(struct wiphy * wiphy)39 struct ieee80211_hw *wiphy_to_ieee80211_hw(struct wiphy *wiphy)
40 {
41 	struct ieee80211_local *local;
42 
43 	local = wiphy_priv(wiphy);
44 	return &local->hw;
45 }
46 EXPORT_SYMBOL(wiphy_to_ieee80211_hw);
47 
ieee80211_get_bssid(struct ieee80211_hdr * hdr,size_t len,enum nl80211_iftype type)48 u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
49 			enum nl80211_iftype type)
50 {
51 	__le16 fc = hdr->frame_control;
52 
53 	if (ieee80211_is_data(fc)) {
54 		if (len < 24) /* drop incorrect hdr len (data) */
55 			return NULL;
56 
57 		if (ieee80211_has_a4(fc))
58 			return NULL;
59 		if (ieee80211_has_tods(fc))
60 			return hdr->addr1;
61 		if (ieee80211_has_fromds(fc))
62 			return hdr->addr2;
63 
64 		return hdr->addr3;
65 	}
66 
67 	if (ieee80211_is_s1g_beacon(fc)) {
68 		struct ieee80211_ext *ext = (void *) hdr;
69 
70 		return ext->u.s1g_beacon.sa;
71 	}
72 
73 	if (ieee80211_is_mgmt(fc)) {
74 		if (len < 24) /* drop incorrect hdr len (mgmt) */
75 			return NULL;
76 		return hdr->addr3;
77 	}
78 
79 	if (ieee80211_is_ctl(fc)) {
80 		if (ieee80211_is_pspoll(fc))
81 			return hdr->addr1;
82 
83 		if (ieee80211_is_back_req(fc)) {
84 			switch (type) {
85 			case NL80211_IFTYPE_STATION:
86 				return hdr->addr2;
87 			case NL80211_IFTYPE_AP:
88 			case NL80211_IFTYPE_AP_VLAN:
89 				return hdr->addr1;
90 			default:
91 				break; /* fall through to the return */
92 			}
93 		}
94 	}
95 
96 	return NULL;
97 }
98 EXPORT_SYMBOL(ieee80211_get_bssid);
99 
ieee80211_tx_set_protected(struct ieee80211_tx_data * tx)100 void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx)
101 {
102 	struct sk_buff *skb;
103 	struct ieee80211_hdr *hdr;
104 
105 	skb_queue_walk(&tx->skbs, skb) {
106 		hdr = (struct ieee80211_hdr *) skb->data;
107 		hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
108 	}
109 }
110 
ieee80211_frame_duration(enum nl80211_band band,size_t len,int rate,int erp,int short_preamble,int shift)111 int ieee80211_frame_duration(enum nl80211_band band, size_t len,
112 			     int rate, int erp, int short_preamble,
113 			     int shift)
114 {
115 	int dur;
116 
117 	/* calculate duration (in microseconds, rounded up to next higher
118 	 * integer if it includes a fractional microsecond) to send frame of
119 	 * len bytes (does not include FCS) at the given rate. Duration will
120 	 * also include SIFS.
121 	 *
122 	 * rate is in 100 kbps, so divident is multiplied by 10 in the
123 	 * DIV_ROUND_UP() operations.
124 	 *
125 	 * shift may be 2 for 5 MHz channels or 1 for 10 MHz channels, and
126 	 * is assumed to be 0 otherwise.
127 	 */
128 
129 	if (band == NL80211_BAND_5GHZ || erp) {
130 		/*
131 		 * OFDM:
132 		 *
133 		 * N_DBPS = DATARATE x 4
134 		 * N_SYM = Ceiling((16+8xLENGTH+6) / N_DBPS)
135 		 *	(16 = SIGNAL time, 6 = tail bits)
136 		 * TXTIME = T_PREAMBLE + T_SIGNAL + T_SYM x N_SYM + Signal Ext
137 		 *
138 		 * T_SYM = 4 usec
139 		 * 802.11a - 18.5.2: aSIFSTime = 16 usec
140 		 * 802.11g - 19.8.4: aSIFSTime = 10 usec +
141 		 *	signal ext = 6 usec
142 		 */
143 		dur = 16; /* SIFS + signal ext */
144 		dur += 16; /* IEEE 802.11-2012 18.3.2.4: T_PREAMBLE = 16 usec */
145 		dur += 4; /* IEEE 802.11-2012 18.3.2.4: T_SIGNAL = 4 usec */
146 
147 		/* IEEE 802.11-2012 18.3.2.4: all values above are:
148 		 *  * times 4 for 5 MHz
149 		 *  * times 2 for 10 MHz
150 		 */
151 		dur *= 1 << shift;
152 
153 		/* rates should already consider the channel bandwidth,
154 		 * don't apply divisor again.
155 		 */
156 		dur += 4 * DIV_ROUND_UP((16 + 8 * (len + 4) + 6) * 10,
157 					4 * rate); /* T_SYM x N_SYM */
158 	} else {
159 		/*
160 		 * 802.11b or 802.11g with 802.11b compatibility:
161 		 * 18.3.4: TXTIME = PreambleLength + PLCPHeaderTime +
162 		 * Ceiling(((LENGTH+PBCC)x8)/DATARATE). PBCC=0.
163 		 *
164 		 * 802.11 (DS): 15.3.3, 802.11b: 18.3.4
165 		 * aSIFSTime = 10 usec
166 		 * aPreambleLength = 144 usec or 72 usec with short preamble
167 		 * aPLCPHeaderLength = 48 usec or 24 usec with short preamble
168 		 */
169 		dur = 10; /* aSIFSTime = 10 usec */
170 		dur += short_preamble ? (72 + 24) : (144 + 48);
171 
172 		dur += DIV_ROUND_UP(8 * (len + 4) * 10, rate);
173 	}
174 
175 	return dur;
176 }
177 
178 /* Exported duration function for driver use */
ieee80211_generic_frame_duration(struct ieee80211_hw * hw,struct ieee80211_vif * vif,enum nl80211_band band,size_t frame_len,struct ieee80211_rate * rate)179 __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
180 					struct ieee80211_vif *vif,
181 					enum nl80211_band band,
182 					size_t frame_len,
183 					struct ieee80211_rate *rate)
184 {
185 	struct ieee80211_sub_if_data *sdata;
186 	u16 dur;
187 	int erp, shift = 0;
188 	bool short_preamble = false;
189 
190 	erp = 0;
191 	if (vif) {
192 		sdata = vif_to_sdata(vif);
193 		short_preamble = sdata->vif.bss_conf.use_short_preamble;
194 		if (sdata->deflink.operating_11g_mode)
195 			erp = rate->flags & IEEE80211_RATE_ERP_G;
196 		shift = ieee80211_vif_get_shift(vif);
197 	}
198 
199 	dur = ieee80211_frame_duration(band, frame_len, rate->bitrate, erp,
200 				       short_preamble, shift);
201 
202 	return cpu_to_le16(dur);
203 }
204 EXPORT_SYMBOL(ieee80211_generic_frame_duration);
205 
ieee80211_rts_duration(struct ieee80211_hw * hw,struct ieee80211_vif * vif,size_t frame_len,const struct ieee80211_tx_info * frame_txctl)206 __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
207 			      struct ieee80211_vif *vif, size_t frame_len,
208 			      const struct ieee80211_tx_info *frame_txctl)
209 {
210 	struct ieee80211_local *local = hw_to_local(hw);
211 	struct ieee80211_rate *rate;
212 	struct ieee80211_sub_if_data *sdata;
213 	bool short_preamble;
214 	int erp, shift = 0, bitrate;
215 	u16 dur;
216 	struct ieee80211_supported_band *sband;
217 
218 	sband = local->hw.wiphy->bands[frame_txctl->band];
219 
220 	short_preamble = false;
221 
222 	rate = &sband->bitrates[frame_txctl->control.rts_cts_rate_idx];
223 
224 	erp = 0;
225 	if (vif) {
226 		sdata = vif_to_sdata(vif);
227 		short_preamble = sdata->vif.bss_conf.use_short_preamble;
228 		if (sdata->deflink.operating_11g_mode)
229 			erp = rate->flags & IEEE80211_RATE_ERP_G;
230 		shift = ieee80211_vif_get_shift(vif);
231 	}
232 
233 	bitrate = DIV_ROUND_UP(rate->bitrate, 1 << shift);
234 
235 	/* CTS duration */
236 	dur = ieee80211_frame_duration(sband->band, 10, bitrate,
237 				       erp, short_preamble, shift);
238 	/* Data frame duration */
239 	dur += ieee80211_frame_duration(sband->band, frame_len, bitrate,
240 					erp, short_preamble, shift);
241 	/* ACK duration */
242 	dur += ieee80211_frame_duration(sband->band, 10, bitrate,
243 					erp, short_preamble, shift);
244 
245 	return cpu_to_le16(dur);
246 }
247 EXPORT_SYMBOL(ieee80211_rts_duration);
248 
ieee80211_ctstoself_duration(struct ieee80211_hw * hw,struct ieee80211_vif * vif,size_t frame_len,const struct ieee80211_tx_info * frame_txctl)249 __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
250 				    struct ieee80211_vif *vif,
251 				    size_t frame_len,
252 				    const struct ieee80211_tx_info *frame_txctl)
253 {
254 	struct ieee80211_local *local = hw_to_local(hw);
255 	struct ieee80211_rate *rate;
256 	struct ieee80211_sub_if_data *sdata;
257 	bool short_preamble;
258 	int erp, shift = 0, bitrate;
259 	u16 dur;
260 	struct ieee80211_supported_band *sband;
261 
262 	sband = local->hw.wiphy->bands[frame_txctl->band];
263 
264 	short_preamble = false;
265 
266 	rate = &sband->bitrates[frame_txctl->control.rts_cts_rate_idx];
267 	erp = 0;
268 	if (vif) {
269 		sdata = vif_to_sdata(vif);
270 		short_preamble = sdata->vif.bss_conf.use_short_preamble;
271 		if (sdata->deflink.operating_11g_mode)
272 			erp = rate->flags & IEEE80211_RATE_ERP_G;
273 		shift = ieee80211_vif_get_shift(vif);
274 	}
275 
276 	bitrate = DIV_ROUND_UP(rate->bitrate, 1 << shift);
277 
278 	/* Data frame duration */
279 	dur = ieee80211_frame_duration(sband->band, frame_len, bitrate,
280 				       erp, short_preamble, shift);
281 	if (!(frame_txctl->flags & IEEE80211_TX_CTL_NO_ACK)) {
282 		/* ACK duration */
283 		dur += ieee80211_frame_duration(sband->band, 10, bitrate,
284 						erp, short_preamble, shift);
285 	}
286 
287 	return cpu_to_le16(dur);
288 }
289 EXPORT_SYMBOL(ieee80211_ctstoself_duration);
290 
wake_tx_push_queue(struct ieee80211_local * local,struct ieee80211_sub_if_data * sdata,struct ieee80211_txq * queue)291 static void wake_tx_push_queue(struct ieee80211_local *local,
292 			       struct ieee80211_sub_if_data *sdata,
293 			       struct ieee80211_txq *queue)
294 {
295 	struct ieee80211_tx_control control = {
296 		.sta = queue->sta,
297 	};
298 	struct sk_buff *skb;
299 
300 	while (1) {
301 		skb = ieee80211_tx_dequeue(&local->hw, queue);
302 		if (!skb)
303 			break;
304 
305 		drv_tx(local, &control, skb);
306 	}
307 }
308 
309 /* wake_tx_queue handler for driver not implementing a custom one*/
ieee80211_handle_wake_tx_queue(struct ieee80211_hw * hw,struct ieee80211_txq * txq)310 void ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw,
311 				    struct ieee80211_txq *txq)
312 {
313 	struct ieee80211_local *local = hw_to_local(hw);
314 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
315 	struct ieee80211_txq *queue;
316 
317 	spin_lock(&local->handle_wake_tx_queue_lock);
318 
319 	/* Use ieee80211_next_txq() for airtime fairness accounting */
320 	ieee80211_txq_schedule_start(hw, txq->ac);
321 	while ((queue = ieee80211_next_txq(hw, txq->ac))) {
322 		wake_tx_push_queue(local, sdata, queue);
323 		ieee80211_return_txq(hw, queue, false);
324 	}
325 	ieee80211_txq_schedule_end(hw, txq->ac);
326 	spin_unlock(&local->handle_wake_tx_queue_lock);
327 }
328 EXPORT_SYMBOL(ieee80211_handle_wake_tx_queue);
329 
__ieee80211_wake_txqs(struct ieee80211_sub_if_data * sdata,int ac)330 static void __ieee80211_wake_txqs(struct ieee80211_sub_if_data *sdata, int ac)
331 {
332 	struct ieee80211_local *local = sdata->local;
333 	struct ieee80211_vif *vif = &sdata->vif;
334 	struct fq *fq = &local->fq;
335 	struct ps_data *ps = NULL;
336 	struct txq_info *txqi;
337 	struct sta_info *sta;
338 	int i;
339 
340 	local_bh_disable();
341 	spin_lock(&fq->lock);
342 
343 	if (!test_bit(SDATA_STATE_RUNNING, &sdata->state))
344 		goto out;
345 
346 	if (sdata->vif.type == NL80211_IFTYPE_AP)
347 		ps = &sdata->bss->ps;
348 
349 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
350 		if (sdata != sta->sdata)
351 			continue;
352 
353 		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
354 			struct ieee80211_txq *txq = sta->sta.txq[i];
355 
356 			if (!txq)
357 				continue;
358 
359 			txqi = to_txq_info(txq);
360 
361 			if (ac != txq->ac)
362 				continue;
363 
364 			if (!test_and_clear_bit(IEEE80211_TXQ_DIRTY,
365 						&txqi->flags))
366 				continue;
367 
368 			spin_unlock(&fq->lock);
369 			drv_wake_tx_queue(local, txqi);
370 			spin_lock(&fq->lock);
371 		}
372 	}
373 
374 	if (!vif->txq)
375 		goto out;
376 
377 	txqi = to_txq_info(vif->txq);
378 
379 	if (!test_and_clear_bit(IEEE80211_TXQ_DIRTY, &txqi->flags) ||
380 	    (ps && atomic_read(&ps->num_sta_ps)) || ac != vif->txq->ac)
381 		goto out;
382 
383 	spin_unlock(&fq->lock);
384 
385 	drv_wake_tx_queue(local, txqi);
386 	local_bh_enable();
387 	return;
388 out:
389 	spin_unlock(&fq->lock);
390 	local_bh_enable();
391 }
392 
393 static void
394 __releases(&local->queue_stop_reason_lock)
395 __acquires(&local->queue_stop_reason_lock)
_ieee80211_wake_txqs(struct ieee80211_local * local,unsigned long * flags)396 _ieee80211_wake_txqs(struct ieee80211_local *local, unsigned long *flags)
397 {
398 	struct ieee80211_sub_if_data *sdata;
399 	int n_acs = IEEE80211_NUM_ACS;
400 	int i;
401 
402 	rcu_read_lock();
403 
404 	if (local->hw.queues < IEEE80211_NUM_ACS)
405 		n_acs = 1;
406 
407 	for (i = 0; i < local->hw.queues; i++) {
408 		if (local->queue_stop_reasons[i])
409 			continue;
410 
411 		spin_unlock_irqrestore(&local->queue_stop_reason_lock, *flags);
412 		list_for_each_entry_rcu(sdata, &local->interfaces, list) {
413 			int ac;
414 
415 			for (ac = 0; ac < n_acs; ac++) {
416 				int ac_queue = sdata->vif.hw_queue[ac];
417 
418 				if (ac_queue == i ||
419 				    sdata->vif.cab_queue == i)
420 					__ieee80211_wake_txqs(sdata, ac);
421 			}
422 		}
423 		spin_lock_irqsave(&local->queue_stop_reason_lock, *flags);
424 	}
425 
426 	rcu_read_unlock();
427 }
428 
ieee80211_wake_txqs(struct tasklet_struct * t)429 void ieee80211_wake_txqs(struct tasklet_struct *t)
430 {
431 	struct ieee80211_local *local = from_tasklet(local, t,
432 						     wake_txqs_tasklet);
433 	unsigned long flags;
434 
435 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
436 	_ieee80211_wake_txqs(local, &flags);
437 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
438 }
439 
__ieee80211_wake_queue(struct ieee80211_hw * hw,int queue,enum queue_stop_reason reason,bool refcounted,unsigned long * flags)440 static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
441 				   enum queue_stop_reason reason,
442 				   bool refcounted,
443 				   unsigned long *flags)
444 {
445 	struct ieee80211_local *local = hw_to_local(hw);
446 
447 	trace_wake_queue(local, queue, reason);
448 
449 	if (WARN_ON(queue >= hw->queues))
450 		return;
451 
452 	if (!test_bit(reason, &local->queue_stop_reasons[queue]))
453 		return;
454 
455 	if (!refcounted) {
456 		local->q_stop_reasons[queue][reason] = 0;
457 	} else {
458 		local->q_stop_reasons[queue][reason]--;
459 		if (WARN_ON(local->q_stop_reasons[queue][reason] < 0))
460 			local->q_stop_reasons[queue][reason] = 0;
461 	}
462 
463 	if (local->q_stop_reasons[queue][reason] == 0)
464 		__clear_bit(reason, &local->queue_stop_reasons[queue]);
465 
466 	if (local->queue_stop_reasons[queue] != 0)
467 		/* someone still has this queue stopped */
468 		return;
469 
470 	if (!skb_queue_empty(&local->pending[queue]))
471 		tasklet_schedule(&local->tx_pending_tasklet);
472 
473 	/*
474 	 * Calling _ieee80211_wake_txqs here can be a problem because it may
475 	 * release queue_stop_reason_lock which has been taken by
476 	 * __ieee80211_wake_queue's caller. It is certainly not very nice to
477 	 * release someone's lock, but it is fine because all the callers of
478 	 * __ieee80211_wake_queue call it right before releasing the lock.
479 	 */
480 	if (reason == IEEE80211_QUEUE_STOP_REASON_DRIVER)
481 		tasklet_schedule(&local->wake_txqs_tasklet);
482 	else
483 		_ieee80211_wake_txqs(local, flags);
484 }
485 
ieee80211_wake_queue_by_reason(struct ieee80211_hw * hw,int queue,enum queue_stop_reason reason,bool refcounted)486 void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
487 				    enum queue_stop_reason reason,
488 				    bool refcounted)
489 {
490 	struct ieee80211_local *local = hw_to_local(hw);
491 	unsigned long flags;
492 
493 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
494 	__ieee80211_wake_queue(hw, queue, reason, refcounted, &flags);
495 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
496 }
497 
ieee80211_wake_queue(struct ieee80211_hw * hw,int queue)498 void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue)
499 {
500 	ieee80211_wake_queue_by_reason(hw, queue,
501 				       IEEE80211_QUEUE_STOP_REASON_DRIVER,
502 				       false);
503 }
504 EXPORT_SYMBOL(ieee80211_wake_queue);
505 
__ieee80211_stop_queue(struct ieee80211_hw * hw,int queue,enum queue_stop_reason reason,bool refcounted)506 static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
507 				   enum queue_stop_reason reason,
508 				   bool refcounted)
509 {
510 	struct ieee80211_local *local = hw_to_local(hw);
511 
512 	trace_stop_queue(local, queue, reason);
513 
514 	if (WARN_ON(queue >= hw->queues))
515 		return;
516 
517 	if (!refcounted)
518 		local->q_stop_reasons[queue][reason] = 1;
519 	else
520 		local->q_stop_reasons[queue][reason]++;
521 
522 	set_bit(reason, &local->queue_stop_reasons[queue]);
523 }
524 
ieee80211_stop_queue_by_reason(struct ieee80211_hw * hw,int queue,enum queue_stop_reason reason,bool refcounted)525 void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
526 				    enum queue_stop_reason reason,
527 				    bool refcounted)
528 {
529 	struct ieee80211_local *local = hw_to_local(hw);
530 	unsigned long flags;
531 
532 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
533 	__ieee80211_stop_queue(hw, queue, reason, refcounted);
534 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
535 }
536 
ieee80211_stop_queue(struct ieee80211_hw * hw,int queue)537 void ieee80211_stop_queue(struct ieee80211_hw *hw, int queue)
538 {
539 	ieee80211_stop_queue_by_reason(hw, queue,
540 				       IEEE80211_QUEUE_STOP_REASON_DRIVER,
541 				       false);
542 }
543 EXPORT_SYMBOL(ieee80211_stop_queue);
544 
ieee80211_add_pending_skb(struct ieee80211_local * local,struct sk_buff * skb)545 void ieee80211_add_pending_skb(struct ieee80211_local *local,
546 			       struct sk_buff *skb)
547 {
548 	struct ieee80211_hw *hw = &local->hw;
549 	unsigned long flags;
550 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
551 	int queue = info->hw_queue;
552 
553 	if (WARN_ON(!info->control.vif)) {
554 		ieee80211_free_txskb(&local->hw, skb);
555 		return;
556 	}
557 
558 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
559 	__ieee80211_stop_queue(hw, queue, IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
560 			       false);
561 	__skb_queue_tail(&local->pending[queue], skb);
562 	__ieee80211_wake_queue(hw, queue, IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
563 			       false, &flags);
564 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
565 }
566 
ieee80211_add_pending_skbs(struct ieee80211_local * local,struct sk_buff_head * skbs)567 void ieee80211_add_pending_skbs(struct ieee80211_local *local,
568 				struct sk_buff_head *skbs)
569 {
570 	struct ieee80211_hw *hw = &local->hw;
571 	struct sk_buff *skb;
572 	unsigned long flags;
573 	int queue, i;
574 
575 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
576 	while ((skb = skb_dequeue(skbs))) {
577 		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
578 
579 		if (WARN_ON(!info->control.vif)) {
580 			ieee80211_free_txskb(&local->hw, skb);
581 			continue;
582 		}
583 
584 		queue = info->hw_queue;
585 
586 		__ieee80211_stop_queue(hw, queue,
587 				IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
588 				false);
589 
590 		__skb_queue_tail(&local->pending[queue], skb);
591 	}
592 
593 	for (i = 0; i < hw->queues; i++)
594 		__ieee80211_wake_queue(hw, i,
595 			IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
596 			false, &flags);
597 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
598 }
599 
ieee80211_stop_queues_by_reason(struct ieee80211_hw * hw,unsigned long queues,enum queue_stop_reason reason,bool refcounted)600 void ieee80211_stop_queues_by_reason(struct ieee80211_hw *hw,
601 				     unsigned long queues,
602 				     enum queue_stop_reason reason,
603 				     bool refcounted)
604 {
605 	struct ieee80211_local *local = hw_to_local(hw);
606 	unsigned long flags;
607 	int i;
608 
609 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
610 
611 	for_each_set_bit(i, &queues, hw->queues)
612 		__ieee80211_stop_queue(hw, i, reason, refcounted);
613 
614 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
615 }
616 
ieee80211_stop_queues(struct ieee80211_hw * hw)617 void ieee80211_stop_queues(struct ieee80211_hw *hw)
618 {
619 	ieee80211_stop_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP,
620 					IEEE80211_QUEUE_STOP_REASON_DRIVER,
621 					false);
622 }
623 EXPORT_SYMBOL(ieee80211_stop_queues);
624 
ieee80211_queue_stopped(struct ieee80211_hw * hw,int queue)625 int ieee80211_queue_stopped(struct ieee80211_hw *hw, int queue)
626 {
627 	struct ieee80211_local *local = hw_to_local(hw);
628 	unsigned long flags;
629 	int ret;
630 
631 	if (WARN_ON(queue >= hw->queues))
632 		return true;
633 
634 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
635 	ret = test_bit(IEEE80211_QUEUE_STOP_REASON_DRIVER,
636 		       &local->queue_stop_reasons[queue]);
637 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
638 	return ret;
639 }
640 EXPORT_SYMBOL(ieee80211_queue_stopped);
641 
ieee80211_wake_queues_by_reason(struct ieee80211_hw * hw,unsigned long queues,enum queue_stop_reason reason,bool refcounted)642 void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
643 				     unsigned long queues,
644 				     enum queue_stop_reason reason,
645 				     bool refcounted)
646 {
647 	struct ieee80211_local *local = hw_to_local(hw);
648 	unsigned long flags;
649 	int i;
650 
651 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
652 
653 	for_each_set_bit(i, &queues, hw->queues)
654 		__ieee80211_wake_queue(hw, i, reason, refcounted, &flags);
655 
656 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
657 }
658 
ieee80211_wake_queues(struct ieee80211_hw * hw)659 void ieee80211_wake_queues(struct ieee80211_hw *hw)
660 {
661 	ieee80211_wake_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP,
662 					IEEE80211_QUEUE_STOP_REASON_DRIVER,
663 					false);
664 }
665 EXPORT_SYMBOL(ieee80211_wake_queues);
666 
667 static unsigned int
ieee80211_get_vif_queues(struct ieee80211_local * local,struct ieee80211_sub_if_data * sdata)668 ieee80211_get_vif_queues(struct ieee80211_local *local,
669 			 struct ieee80211_sub_if_data *sdata)
670 {
671 	unsigned int queues;
672 
673 	if (sdata && ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) {
674 		int ac;
675 
676 		queues = 0;
677 
678 		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
679 			queues |= BIT(sdata->vif.hw_queue[ac]);
680 		if (sdata->vif.cab_queue != IEEE80211_INVAL_HW_QUEUE)
681 			queues |= BIT(sdata->vif.cab_queue);
682 	} else {
683 		/* all queues */
684 		queues = BIT(local->hw.queues) - 1;
685 	}
686 
687 	return queues;
688 }
689 
__ieee80211_flush_queues(struct ieee80211_local * local,struct ieee80211_sub_if_data * sdata,unsigned int queues,bool drop)690 void __ieee80211_flush_queues(struct ieee80211_local *local,
691 			      struct ieee80211_sub_if_data *sdata,
692 			      unsigned int queues, bool drop)
693 {
694 	if (!local->ops->flush)
695 		return;
696 
697 	/*
698 	 * If no queue was set, or if the HW doesn't support
699 	 * IEEE80211_HW_QUEUE_CONTROL - flush all queues
700 	 */
701 	if (!queues || !ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
702 		queues = ieee80211_get_vif_queues(local, sdata);
703 
704 	ieee80211_stop_queues_by_reason(&local->hw, queues,
705 					IEEE80211_QUEUE_STOP_REASON_FLUSH,
706 					false);
707 
708 	drv_flush(local, sdata, queues, drop);
709 
710 	ieee80211_wake_queues_by_reason(&local->hw, queues,
711 					IEEE80211_QUEUE_STOP_REASON_FLUSH,
712 					false);
713 }
714 
ieee80211_flush_queues(struct ieee80211_local * local,struct ieee80211_sub_if_data * sdata,bool drop)715 void ieee80211_flush_queues(struct ieee80211_local *local,
716 			    struct ieee80211_sub_if_data *sdata, bool drop)
717 {
718 	__ieee80211_flush_queues(local, sdata, 0, drop);
719 }
720 
ieee80211_stop_vif_queues(struct ieee80211_local * local,struct ieee80211_sub_if_data * sdata,enum queue_stop_reason reason)721 void ieee80211_stop_vif_queues(struct ieee80211_local *local,
722 			       struct ieee80211_sub_if_data *sdata,
723 			       enum queue_stop_reason reason)
724 {
725 	ieee80211_stop_queues_by_reason(&local->hw,
726 					ieee80211_get_vif_queues(local, sdata),
727 					reason, true);
728 }
729 
ieee80211_wake_vif_queues(struct ieee80211_local * local,struct ieee80211_sub_if_data * sdata,enum queue_stop_reason reason)730 void ieee80211_wake_vif_queues(struct ieee80211_local *local,
731 			       struct ieee80211_sub_if_data *sdata,
732 			       enum queue_stop_reason reason)
733 {
734 	ieee80211_wake_queues_by_reason(&local->hw,
735 					ieee80211_get_vif_queues(local, sdata),
736 					reason, true);
737 }
738 
__iterate_interfaces(struct ieee80211_local * local,u32 iter_flags,void (* iterator)(void * data,u8 * mac,struct ieee80211_vif * vif),void * data)739 static void __iterate_interfaces(struct ieee80211_local *local,
740 				 u32 iter_flags,
741 				 void (*iterator)(void *data, u8 *mac,
742 						  struct ieee80211_vif *vif),
743 				 void *data)
744 {
745 	struct ieee80211_sub_if_data *sdata;
746 	bool active_only = iter_flags & IEEE80211_IFACE_ITER_ACTIVE;
747 
748 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
749 		switch (sdata->vif.type) {
750 		case NL80211_IFTYPE_MONITOR:
751 			if (!(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE))
752 				continue;
753 			break;
754 		case NL80211_IFTYPE_AP_VLAN:
755 			continue;
756 		default:
757 			break;
758 		}
759 		if (!(iter_flags & IEEE80211_IFACE_ITER_RESUME_ALL) &&
760 		    active_only && !(sdata->flags & IEEE80211_SDATA_IN_DRIVER))
761 			continue;
762 		if ((iter_flags & IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER) &&
763 		    !(sdata->flags & IEEE80211_SDATA_IN_DRIVER))
764 			continue;
765 		if (ieee80211_sdata_running(sdata) || !active_only)
766 			iterator(data, sdata->vif.addr,
767 				 &sdata->vif);
768 	}
769 
770 	sdata = rcu_dereference_check(local->monitor_sdata,
771 				      lockdep_is_held(&local->iflist_mtx) ||
772 				      lockdep_is_held(&local->hw.wiphy->mtx));
773 	if (sdata &&
774 	    (iter_flags & IEEE80211_IFACE_ITER_RESUME_ALL || !active_only ||
775 	     sdata->flags & IEEE80211_SDATA_IN_DRIVER))
776 		iterator(data, sdata->vif.addr, &sdata->vif);
777 }
778 
ieee80211_iterate_interfaces(struct ieee80211_hw * hw,u32 iter_flags,void (* iterator)(void * data,u8 * mac,struct ieee80211_vif * vif),void * data)779 void ieee80211_iterate_interfaces(
780 	struct ieee80211_hw *hw, u32 iter_flags,
781 	void (*iterator)(void *data, u8 *mac,
782 			 struct ieee80211_vif *vif),
783 	void *data)
784 {
785 	struct ieee80211_local *local = hw_to_local(hw);
786 
787 	mutex_lock(&local->iflist_mtx);
788 	__iterate_interfaces(local, iter_flags, iterator, data);
789 	mutex_unlock(&local->iflist_mtx);
790 }
791 EXPORT_SYMBOL_GPL(ieee80211_iterate_interfaces);
792 
ieee80211_iterate_active_interfaces_atomic(struct ieee80211_hw * hw,u32 iter_flags,void (* iterator)(void * data,u8 * mac,struct ieee80211_vif * vif),void * data)793 void ieee80211_iterate_active_interfaces_atomic(
794 	struct ieee80211_hw *hw, u32 iter_flags,
795 	void (*iterator)(void *data, u8 *mac,
796 			 struct ieee80211_vif *vif),
797 	void *data)
798 {
799 	struct ieee80211_local *local = hw_to_local(hw);
800 
801 	rcu_read_lock();
802 	__iterate_interfaces(local, iter_flags | IEEE80211_IFACE_ITER_ACTIVE,
803 			     iterator, data);
804 	rcu_read_unlock();
805 }
806 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
807 
ieee80211_iterate_active_interfaces_mtx(struct ieee80211_hw * hw,u32 iter_flags,void (* iterator)(void * data,u8 * mac,struct ieee80211_vif * vif),void * data)808 void ieee80211_iterate_active_interfaces_mtx(
809 	struct ieee80211_hw *hw, u32 iter_flags,
810 	void (*iterator)(void *data, u8 *mac,
811 			 struct ieee80211_vif *vif),
812 	void *data)
813 {
814 	struct ieee80211_local *local = hw_to_local(hw);
815 
816 	lockdep_assert_wiphy(hw->wiphy);
817 
818 	__iterate_interfaces(local, iter_flags | IEEE80211_IFACE_ITER_ACTIVE,
819 			     iterator, data);
820 }
821 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_mtx);
822 
__iterate_stations(struct ieee80211_local * local,void (* iterator)(void * data,struct ieee80211_sta * sta),void * data)823 static void __iterate_stations(struct ieee80211_local *local,
824 			       void (*iterator)(void *data,
825 						struct ieee80211_sta *sta),
826 			       void *data)
827 {
828 	struct sta_info *sta;
829 
830 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
831 		if (!sta->uploaded)
832 			continue;
833 
834 		iterator(data, &sta->sta);
835 	}
836 }
837 
ieee80211_iterate_stations_atomic(struct ieee80211_hw * hw,void (* iterator)(void * data,struct ieee80211_sta * sta),void * data)838 void ieee80211_iterate_stations_atomic(struct ieee80211_hw *hw,
839 			void (*iterator)(void *data,
840 					 struct ieee80211_sta *sta),
841 			void *data)
842 {
843 	struct ieee80211_local *local = hw_to_local(hw);
844 
845 	rcu_read_lock();
846 	__iterate_stations(local, iterator, data);
847 	rcu_read_unlock();
848 }
849 EXPORT_SYMBOL_GPL(ieee80211_iterate_stations_atomic);
850 
wdev_to_ieee80211_vif(struct wireless_dev * wdev)851 struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev)
852 {
853 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
854 
855 	if (!ieee80211_sdata_running(sdata) ||
856 	    !(sdata->flags & IEEE80211_SDATA_IN_DRIVER))
857 		return NULL;
858 	return &sdata->vif;
859 }
860 EXPORT_SYMBOL_GPL(wdev_to_ieee80211_vif);
861 
ieee80211_vif_to_wdev(struct ieee80211_vif * vif)862 struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
863 {
864 	if (!vif)
865 		return NULL;
866 
867 	return &vif_to_sdata(vif)->wdev;
868 }
869 EXPORT_SYMBOL_GPL(ieee80211_vif_to_wdev);
870 
871 /*
872  * Nothing should have been stuffed into the workqueue during
873  * the suspend->resume cycle. Since we can't check each caller
874  * of this function if we are already quiescing / suspended,
875  * check here and don't WARN since this can actually happen when
876  * the rx path (for example) is racing against __ieee80211_suspend
877  * and suspending / quiescing was set after the rx path checked
878  * them.
879  */
ieee80211_can_queue_work(struct ieee80211_local * local)880 static bool ieee80211_can_queue_work(struct ieee80211_local *local)
881 {
882 	if (local->quiescing || (local->suspended && !local->resuming)) {
883 		pr_warn("queueing ieee80211 work while going to suspend\n");
884 		return false;
885 	}
886 
887 	return true;
888 }
889 
ieee80211_queue_work(struct ieee80211_hw * hw,struct work_struct * work)890 void ieee80211_queue_work(struct ieee80211_hw *hw, struct work_struct *work)
891 {
892 	struct ieee80211_local *local = hw_to_local(hw);
893 
894 	if (!ieee80211_can_queue_work(local))
895 		return;
896 
897 	queue_work(local->workqueue, work);
898 }
899 EXPORT_SYMBOL(ieee80211_queue_work);
900 
ieee80211_queue_delayed_work(struct ieee80211_hw * hw,struct delayed_work * dwork,unsigned long delay)901 void ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
902 				  struct delayed_work *dwork,
903 				  unsigned long delay)
904 {
905 	struct ieee80211_local *local = hw_to_local(hw);
906 
907 	if (!ieee80211_can_queue_work(local))
908 		return;
909 
910 	queue_delayed_work(local->workqueue, dwork, delay);
911 }
912 EXPORT_SYMBOL(ieee80211_queue_delayed_work);
913 
914 static void
ieee80211_parse_extension_element(u32 * crc,const struct element * elem,struct ieee802_11_elems * elems,struct ieee80211_elems_parse_params * params)915 ieee80211_parse_extension_element(u32 *crc,
916 				  const struct element *elem,
917 				  struct ieee802_11_elems *elems,
918 				  struct ieee80211_elems_parse_params *params)
919 {
920 	const void *data = elem->data + 1;
921 	bool calc_crc = false;
922 	u8 len;
923 
924 	if (!elem->datalen)
925 		return;
926 
927 	len = elem->datalen - 1;
928 
929 	switch (elem->data[0]) {
930 	case WLAN_EID_EXT_HE_MU_EDCA:
931 		calc_crc = true;
932 		if (len >= sizeof(*elems->mu_edca_param_set))
933 			elems->mu_edca_param_set = data;
934 		break;
935 	case WLAN_EID_EXT_HE_CAPABILITY:
936 		if (ieee80211_he_capa_size_ok(data, len)) {
937 			elems->he_cap = data;
938 			elems->he_cap_len = len;
939 		}
940 		break;
941 	case WLAN_EID_EXT_HE_OPERATION:
942 		calc_crc = true;
943 		if (len >= sizeof(*elems->he_operation) &&
944 		    len >= ieee80211_he_oper_size(data) - 1)
945 			elems->he_operation = data;
946 		break;
947 	case WLAN_EID_EXT_UORA:
948 		if (len >= 1)
949 			elems->uora_element = data;
950 		break;
951 	case WLAN_EID_EXT_MAX_CHANNEL_SWITCH_TIME:
952 		if (len == 3)
953 			elems->max_channel_switch_time = data;
954 		break;
955 	case WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION:
956 		if (len >= sizeof(*elems->mbssid_config_ie))
957 			elems->mbssid_config_ie = data;
958 		break;
959 	case WLAN_EID_EXT_HE_SPR:
960 		if (len >= sizeof(*elems->he_spr) &&
961 		    len >= ieee80211_he_spr_size(data))
962 			elems->he_spr = data;
963 		break;
964 	case WLAN_EID_EXT_HE_6GHZ_CAPA:
965 		if (len >= sizeof(*elems->he_6ghz_capa))
966 			elems->he_6ghz_capa = data;
967 		break;
968 	case WLAN_EID_EXT_EHT_CAPABILITY:
969 		if (ieee80211_eht_capa_size_ok(elems->he_cap,
970 					       data, len,
971 					       params->from_ap)) {
972 			elems->eht_cap = data;
973 			elems->eht_cap_len = len;
974 		}
975 		break;
976 	case WLAN_EID_EXT_EHT_OPERATION:
977 		if (ieee80211_eht_oper_size_ok(data, len))
978 			elems->eht_operation = data;
979 		calc_crc = true;
980 		break;
981 	case WLAN_EID_EXT_EHT_MULTI_LINK:
982 		calc_crc = true;
983 
984 		if (ieee80211_mle_size_ok(data, len)) {
985 			const struct ieee80211_multi_link_elem *mle =
986 				(void *)data;
987 
988 			switch (le16_get_bits(mle->control,
989 					      IEEE80211_ML_CONTROL_TYPE)) {
990 			case IEEE80211_ML_CONTROL_TYPE_BASIC:
991 				elems->ml_basic_elem = (void *)elem;
992 				elems->ml_basic = data;
993 				elems->ml_basic_len = len;
994 				break;
995 			case IEEE80211_ML_CONTROL_TYPE_RECONF:
996 				elems->ml_reconf_elem = (void *)elem;
997 				elems->ml_reconf = data;
998 				elems->ml_reconf_len = len;
999 				break;
1000 			default:
1001 				break;
1002 			}
1003 		}
1004 		break;
1005 	}
1006 
1007 	if (crc && calc_crc)
1008 		*crc = crc32_be(*crc, (void *)elem, elem->datalen + 2);
1009 }
1010 
1011 static u32
_ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params * params,struct ieee802_11_elems * elems,const struct element * check_inherit)1012 _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params,
1013 			     struct ieee802_11_elems *elems,
1014 			     const struct element *check_inherit)
1015 {
1016 	const struct element *elem;
1017 	bool calc_crc = params->filter != 0;
1018 	DECLARE_BITMAP(seen_elems, 256);
1019 	u32 crc = params->crc;
1020 	const u8 *ie;
1021 
1022 	bitmap_zero(seen_elems, 256);
1023 
1024 	for_each_element(elem, params->start, params->len) {
1025 		bool elem_parse_failed;
1026 		u8 id = elem->id;
1027 		u8 elen = elem->datalen;
1028 		const u8 *pos = elem->data;
1029 
1030 		if (check_inherit &&
1031 		    !cfg80211_is_element_inherited(elem,
1032 						   check_inherit))
1033 			continue;
1034 
1035 		switch (id) {
1036 		case WLAN_EID_SSID:
1037 		case WLAN_EID_SUPP_RATES:
1038 		case WLAN_EID_FH_PARAMS:
1039 		case WLAN_EID_DS_PARAMS:
1040 		case WLAN_EID_CF_PARAMS:
1041 		case WLAN_EID_TIM:
1042 		case WLAN_EID_IBSS_PARAMS:
1043 		case WLAN_EID_CHALLENGE:
1044 		case WLAN_EID_RSN:
1045 		case WLAN_EID_ERP_INFO:
1046 		case WLAN_EID_EXT_SUPP_RATES:
1047 		case WLAN_EID_HT_CAPABILITY:
1048 		case WLAN_EID_HT_OPERATION:
1049 		case WLAN_EID_VHT_CAPABILITY:
1050 		case WLAN_EID_VHT_OPERATION:
1051 		case WLAN_EID_MESH_ID:
1052 		case WLAN_EID_MESH_CONFIG:
1053 		case WLAN_EID_PEER_MGMT:
1054 		case WLAN_EID_PREQ:
1055 		case WLAN_EID_PREP:
1056 		case WLAN_EID_PERR:
1057 		case WLAN_EID_RANN:
1058 		case WLAN_EID_CHANNEL_SWITCH:
1059 		case WLAN_EID_EXT_CHANSWITCH_ANN:
1060 		case WLAN_EID_COUNTRY:
1061 		case WLAN_EID_PWR_CONSTRAINT:
1062 		case WLAN_EID_TIMEOUT_INTERVAL:
1063 		case WLAN_EID_SECONDARY_CHANNEL_OFFSET:
1064 		case WLAN_EID_WIDE_BW_CHANNEL_SWITCH:
1065 		case WLAN_EID_CHAN_SWITCH_PARAM:
1066 		case WLAN_EID_EXT_CAPABILITY:
1067 		case WLAN_EID_CHAN_SWITCH_TIMING:
1068 		case WLAN_EID_LINK_ID:
1069 		case WLAN_EID_BSS_MAX_IDLE_PERIOD:
1070 		case WLAN_EID_RSNX:
1071 		case WLAN_EID_S1G_BCN_COMPAT:
1072 		case WLAN_EID_S1G_CAPABILITIES:
1073 		case WLAN_EID_S1G_OPERATION:
1074 		case WLAN_EID_AID_RESPONSE:
1075 		case WLAN_EID_S1G_SHORT_BCN_INTERVAL:
1076 		/*
1077 		 * not listing WLAN_EID_CHANNEL_SWITCH_WRAPPER -- it seems possible
1078 		 * that if the content gets bigger it might be needed more than once
1079 		 */
1080 			if (test_bit(id, seen_elems)) {
1081 				elems->parse_error = true;
1082 				continue;
1083 			}
1084 			break;
1085 		}
1086 
1087 		if (calc_crc && id < 64 && (params->filter & (1ULL << id)))
1088 			crc = crc32_be(crc, pos - 2, elen + 2);
1089 
1090 		elem_parse_failed = false;
1091 
1092 		switch (id) {
1093 		case WLAN_EID_LINK_ID:
1094 			if (elen + 2 < sizeof(struct ieee80211_tdls_lnkie)) {
1095 				elem_parse_failed = true;
1096 				break;
1097 			}
1098 			elems->lnk_id = (void *)(pos - 2);
1099 			break;
1100 		case WLAN_EID_CHAN_SWITCH_TIMING:
1101 			if (elen < sizeof(struct ieee80211_ch_switch_timing)) {
1102 				elem_parse_failed = true;
1103 				break;
1104 			}
1105 			elems->ch_sw_timing = (void *)pos;
1106 			break;
1107 		case WLAN_EID_EXT_CAPABILITY:
1108 			elems->ext_capab = pos;
1109 			elems->ext_capab_len = elen;
1110 			break;
1111 		case WLAN_EID_SSID:
1112 			elems->ssid = pos;
1113 			elems->ssid_len = elen;
1114 			break;
1115 		case WLAN_EID_SUPP_RATES:
1116 			elems->supp_rates = pos;
1117 			elems->supp_rates_len = elen;
1118 			break;
1119 		case WLAN_EID_DS_PARAMS:
1120 			if (elen >= 1)
1121 				elems->ds_params = pos;
1122 			else
1123 				elem_parse_failed = true;
1124 			break;
1125 		case WLAN_EID_TIM:
1126 			if (elen >= sizeof(struct ieee80211_tim_ie)) {
1127 				elems->tim = (void *)pos;
1128 				elems->tim_len = elen;
1129 			} else
1130 				elem_parse_failed = true;
1131 			break;
1132 		case WLAN_EID_VENDOR_SPECIFIC:
1133 			if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
1134 			    pos[2] == 0xf2) {
1135 				/* Microsoft OUI (00:50:F2) */
1136 
1137 				if (calc_crc)
1138 					crc = crc32_be(crc, pos - 2, elen + 2);
1139 
1140 				if (elen >= 5 && pos[3] == 2) {
1141 					/* OUI Type 2 - WMM IE */
1142 					if (pos[4] == 0) {
1143 						elems->wmm_info = pos;
1144 						elems->wmm_info_len = elen;
1145 					} else if (pos[4] == 1) {
1146 						elems->wmm_param = pos;
1147 						elems->wmm_param_len = elen;
1148 					}
1149 				}
1150 			}
1151 			break;
1152 		case WLAN_EID_RSN:
1153 			elems->rsn = pos;
1154 			elems->rsn_len = elen;
1155 			break;
1156 		case WLAN_EID_ERP_INFO:
1157 			if (elen >= 1)
1158 				elems->erp_info = pos;
1159 			else
1160 				elem_parse_failed = true;
1161 			break;
1162 		case WLAN_EID_EXT_SUPP_RATES:
1163 			elems->ext_supp_rates = pos;
1164 			elems->ext_supp_rates_len = elen;
1165 			break;
1166 		case WLAN_EID_HT_CAPABILITY:
1167 			if (elen >= sizeof(struct ieee80211_ht_cap))
1168 				elems->ht_cap_elem = (void *)pos;
1169 			else
1170 				elem_parse_failed = true;
1171 			break;
1172 		case WLAN_EID_HT_OPERATION:
1173 			if (elen >= sizeof(struct ieee80211_ht_operation))
1174 				elems->ht_operation = (void *)pos;
1175 			else
1176 				elem_parse_failed = true;
1177 			break;
1178 		case WLAN_EID_VHT_CAPABILITY:
1179 			if (elen >= sizeof(struct ieee80211_vht_cap))
1180 				elems->vht_cap_elem = (void *)pos;
1181 			else
1182 				elem_parse_failed = true;
1183 			break;
1184 		case WLAN_EID_VHT_OPERATION:
1185 			if (elen >= sizeof(struct ieee80211_vht_operation)) {
1186 				elems->vht_operation = (void *)pos;
1187 				if (calc_crc)
1188 					crc = crc32_be(crc, pos - 2, elen + 2);
1189 				break;
1190 			}
1191 			elem_parse_failed = true;
1192 			break;
1193 		case WLAN_EID_OPMODE_NOTIF:
1194 			if (elen > 0) {
1195 				elems->opmode_notif = pos;
1196 				if (calc_crc)
1197 					crc = crc32_be(crc, pos - 2, elen + 2);
1198 				break;
1199 			}
1200 			elem_parse_failed = true;
1201 			break;
1202 		case WLAN_EID_MESH_ID:
1203 			elems->mesh_id = pos;
1204 			elems->mesh_id_len = elen;
1205 			break;
1206 		case WLAN_EID_MESH_CONFIG:
1207 			if (elen >= sizeof(struct ieee80211_meshconf_ie))
1208 				elems->mesh_config = (void *)pos;
1209 			else
1210 				elem_parse_failed = true;
1211 			break;
1212 		case WLAN_EID_PEER_MGMT:
1213 			elems->peering = pos;
1214 			elems->peering_len = elen;
1215 			break;
1216 		case WLAN_EID_MESH_AWAKE_WINDOW:
1217 			if (elen >= 2)
1218 				elems->awake_window = (void *)pos;
1219 			break;
1220 		case WLAN_EID_PREQ:
1221 			elems->preq = pos;
1222 			elems->preq_len = elen;
1223 			break;
1224 		case WLAN_EID_PREP:
1225 			elems->prep = pos;
1226 			elems->prep_len = elen;
1227 			break;
1228 		case WLAN_EID_PERR:
1229 			elems->perr = pos;
1230 			elems->perr_len = elen;
1231 			break;
1232 		case WLAN_EID_RANN:
1233 			if (elen >= sizeof(struct ieee80211_rann_ie))
1234 				elems->rann = (void *)pos;
1235 			else
1236 				elem_parse_failed = true;
1237 			break;
1238 		case WLAN_EID_CHANNEL_SWITCH:
1239 			if (elen != sizeof(struct ieee80211_channel_sw_ie)) {
1240 				elem_parse_failed = true;
1241 				break;
1242 			}
1243 			elems->ch_switch_ie = (void *)pos;
1244 			break;
1245 		case WLAN_EID_EXT_CHANSWITCH_ANN:
1246 			if (elen != sizeof(struct ieee80211_ext_chansw_ie)) {
1247 				elem_parse_failed = true;
1248 				break;
1249 			}
1250 			elems->ext_chansw_ie = (void *)pos;
1251 			break;
1252 		case WLAN_EID_SECONDARY_CHANNEL_OFFSET:
1253 			if (elen != sizeof(struct ieee80211_sec_chan_offs_ie)) {
1254 				elem_parse_failed = true;
1255 				break;
1256 			}
1257 			elems->sec_chan_offs = (void *)pos;
1258 			break;
1259 		case WLAN_EID_CHAN_SWITCH_PARAM:
1260 			if (elen <
1261 			    sizeof(*elems->mesh_chansw_params_ie)) {
1262 				elem_parse_failed = true;
1263 				break;
1264 			}
1265 			elems->mesh_chansw_params_ie = (void *)pos;
1266 			break;
1267 		case WLAN_EID_WIDE_BW_CHANNEL_SWITCH:
1268 			if (!params->action ||
1269 			    elen < sizeof(*elems->wide_bw_chansw_ie)) {
1270 				elem_parse_failed = true;
1271 				break;
1272 			}
1273 			elems->wide_bw_chansw_ie = (void *)pos;
1274 			break;
1275 		case WLAN_EID_CHANNEL_SWITCH_WRAPPER:
1276 			if (params->action) {
1277 				elem_parse_failed = true;
1278 				break;
1279 			}
1280 			/*
1281 			 * This is a bit tricky, but as we only care about
1282 			 * the wide bandwidth channel switch element, so
1283 			 * just parse it out manually.
1284 			 */
1285 			ie = cfg80211_find_ie(WLAN_EID_WIDE_BW_CHANNEL_SWITCH,
1286 					      pos, elen);
1287 			if (ie) {
1288 				if (ie[1] >= sizeof(*elems->wide_bw_chansw_ie))
1289 					elems->wide_bw_chansw_ie =
1290 						(void *)(ie + 2);
1291 				else
1292 					elem_parse_failed = true;
1293 			}
1294 			break;
1295 		case WLAN_EID_COUNTRY:
1296 			elems->country_elem = pos;
1297 			elems->country_elem_len = elen;
1298 			break;
1299 		case WLAN_EID_PWR_CONSTRAINT:
1300 			if (elen != 1) {
1301 				elem_parse_failed = true;
1302 				break;
1303 			}
1304 			elems->pwr_constr_elem = pos;
1305 			break;
1306 		case WLAN_EID_CISCO_VENDOR_SPECIFIC:
1307 			/* Lots of different options exist, but we only care
1308 			 * about the Dynamic Transmit Power Control element.
1309 			 * First check for the Cisco OUI, then for the DTPC
1310 			 * tag (0x00).
1311 			 */
1312 			if (elen < 4) {
1313 				elem_parse_failed = true;
1314 				break;
1315 			}
1316 
1317 			if (pos[0] != 0x00 || pos[1] != 0x40 ||
1318 			    pos[2] != 0x96 || pos[3] != 0x00)
1319 				break;
1320 
1321 			if (elen != 6) {
1322 				elem_parse_failed = true;
1323 				break;
1324 			}
1325 
1326 			if (calc_crc)
1327 				crc = crc32_be(crc, pos - 2, elen + 2);
1328 
1329 			elems->cisco_dtpc_elem = pos;
1330 			break;
1331 		case WLAN_EID_ADDBA_EXT:
1332 			if (elen < sizeof(struct ieee80211_addba_ext_ie)) {
1333 				elem_parse_failed = true;
1334 				break;
1335 			}
1336 			elems->addba_ext_ie = (void *)pos;
1337 			break;
1338 		case WLAN_EID_TIMEOUT_INTERVAL:
1339 			if (elen >= sizeof(struct ieee80211_timeout_interval_ie))
1340 				elems->timeout_int = (void *)pos;
1341 			else
1342 				elem_parse_failed = true;
1343 			break;
1344 		case WLAN_EID_BSS_MAX_IDLE_PERIOD:
1345 			if (elen >= sizeof(*elems->max_idle_period_ie))
1346 				elems->max_idle_period_ie = (void *)pos;
1347 			break;
1348 		case WLAN_EID_RSNX:
1349 			elems->rsnx = pos;
1350 			elems->rsnx_len = elen;
1351 			break;
1352 		case WLAN_EID_TX_POWER_ENVELOPE:
1353 			if (elen < 1 ||
1354 			    elen > sizeof(struct ieee80211_tx_pwr_env))
1355 				break;
1356 
1357 			if (elems->tx_pwr_env_num >= ARRAY_SIZE(elems->tx_pwr_env))
1358 				break;
1359 
1360 			elems->tx_pwr_env[elems->tx_pwr_env_num] = (void *)pos;
1361 			elems->tx_pwr_env_len[elems->tx_pwr_env_num] = elen;
1362 			elems->tx_pwr_env_num++;
1363 			break;
1364 		case WLAN_EID_EXTENSION:
1365 			ieee80211_parse_extension_element(calc_crc ?
1366 								&crc : NULL,
1367 							  elem, elems, params);
1368 			break;
1369 		case WLAN_EID_S1G_CAPABILITIES:
1370 			if (elen >= sizeof(*elems->s1g_capab))
1371 				elems->s1g_capab = (void *)pos;
1372 			else
1373 				elem_parse_failed = true;
1374 			break;
1375 		case WLAN_EID_S1G_OPERATION:
1376 			if (elen == sizeof(*elems->s1g_oper))
1377 				elems->s1g_oper = (void *)pos;
1378 			else
1379 				elem_parse_failed = true;
1380 			break;
1381 		case WLAN_EID_S1G_BCN_COMPAT:
1382 			if (elen == sizeof(*elems->s1g_bcn_compat))
1383 				elems->s1g_bcn_compat = (void *)pos;
1384 			else
1385 				elem_parse_failed = true;
1386 			break;
1387 		case WLAN_EID_AID_RESPONSE:
1388 			if (elen == sizeof(struct ieee80211_aid_response_ie))
1389 				elems->aid_resp = (void *)pos;
1390 			else
1391 				elem_parse_failed = true;
1392 			break;
1393 		default:
1394 			break;
1395 		}
1396 
1397 		if (elem_parse_failed)
1398 			elems->parse_error = true;
1399 		else
1400 			__set_bit(id, seen_elems);
1401 	}
1402 
1403 	if (!for_each_element_completed(elem, params->start, params->len))
1404 		elems->parse_error = true;
1405 
1406 	return crc;
1407 }
1408 
ieee802_11_find_bssid_profile(const u8 * start,size_t len,struct ieee802_11_elems * elems,struct cfg80211_bss * bss,u8 * nontransmitted_profile)1409 static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len,
1410 					    struct ieee802_11_elems *elems,
1411 					    struct cfg80211_bss *bss,
1412 					    u8 *nontransmitted_profile)
1413 {
1414 	const struct element *elem, *sub;
1415 	size_t profile_len = 0;
1416 	bool found = false;
1417 
1418 	if (!bss || !bss->transmitted_bss)
1419 		return profile_len;
1420 
1421 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, start, len) {
1422 		if (elem->datalen < 2)
1423 			continue;
1424 		if (elem->data[0] < 1 || elem->data[0] > 8)
1425 			continue;
1426 
1427 		for_each_element(sub, elem->data + 1, elem->datalen - 1) {
1428 			u8 new_bssid[ETH_ALEN];
1429 			const u8 *index;
1430 
1431 			if (sub->id != 0 || sub->datalen < 4) {
1432 				/* not a valid BSS profile */
1433 				continue;
1434 			}
1435 
1436 			if (sub->data[0] != WLAN_EID_NON_TX_BSSID_CAP ||
1437 			    sub->data[1] != 2) {
1438 				/* The first element of the
1439 				 * Nontransmitted BSSID Profile is not
1440 				 * the Nontransmitted BSSID Capability
1441 				 * element.
1442 				 */
1443 				continue;
1444 			}
1445 
1446 			memset(nontransmitted_profile, 0, len);
1447 			profile_len = cfg80211_merge_profile(start, len,
1448 							     elem,
1449 							     sub,
1450 							     nontransmitted_profile,
1451 							     len);
1452 
1453 			/* found a Nontransmitted BSSID Profile */
1454 			index = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1455 						 nontransmitted_profile,
1456 						 profile_len);
1457 			if (!index || index[1] < 1 || index[2] == 0) {
1458 				/* Invalid MBSSID Index element */
1459 				continue;
1460 			}
1461 
1462 			cfg80211_gen_new_bssid(bss->transmitted_bss->bssid,
1463 					       elem->data[0],
1464 					       index[2],
1465 					       new_bssid);
1466 			if (ether_addr_equal(new_bssid, bss->bssid)) {
1467 				found = true;
1468 				elems->bssid_index_len = index[1];
1469 				elems->bssid_index = (void *)&index[2];
1470 				break;
1471 			}
1472 		}
1473 	}
1474 
1475 	return found ? profile_len : 0;
1476 }
1477 
ieee80211_mle_get_sta_prof(struct ieee802_11_elems * elems,u8 link_id)1478 static void ieee80211_mle_get_sta_prof(struct ieee802_11_elems *elems,
1479 				       u8 link_id)
1480 {
1481 	const struct ieee80211_multi_link_elem *ml = elems->ml_basic;
1482 	ssize_t ml_len = elems->ml_basic_len;
1483 	const struct element *sub;
1484 
1485 	if (!ml || !ml_len)
1486 		return;
1487 
1488 	if (le16_get_bits(ml->control, IEEE80211_ML_CONTROL_TYPE) !=
1489 	    IEEE80211_ML_CONTROL_TYPE_BASIC)
1490 		return;
1491 
1492 	for_each_mle_subelement(sub, (u8 *)ml, ml_len) {
1493 		struct ieee80211_mle_per_sta_profile *prof = (void *)sub->data;
1494 		ssize_t sta_prof_len;
1495 		u16 control;
1496 
1497 		if (sub->id != IEEE80211_MLE_SUBELEM_PER_STA_PROFILE)
1498 			continue;
1499 
1500 		if (!ieee80211_mle_basic_sta_prof_size_ok(sub->data,
1501 							  sub->datalen))
1502 			return;
1503 
1504 		control = le16_to_cpu(prof->control);
1505 
1506 		if (link_id != u16_get_bits(control,
1507 					    IEEE80211_MLE_STA_CONTROL_LINK_ID))
1508 			continue;
1509 
1510 		if (!(control & IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE))
1511 			return;
1512 
1513 		/* the sub element can be fragmented */
1514 		sta_prof_len =
1515 			cfg80211_defragment_element(sub,
1516 						    (u8 *)ml, ml_len,
1517 						    elems->scratch_pos,
1518 						    elems->scratch +
1519 							elems->scratch_len -
1520 							elems->scratch_pos,
1521 						    IEEE80211_MLE_SUBELEM_FRAGMENT);
1522 
1523 		if (sta_prof_len < 0)
1524 			return;
1525 
1526 		elems->prof = (void *)elems->scratch_pos;
1527 		elems->sta_prof_len = sta_prof_len;
1528 		elems->scratch_pos += sta_prof_len;
1529 
1530 		return;
1531 	}
1532 }
1533 
ieee80211_mle_parse_link(struct ieee802_11_elems * elems,struct ieee80211_elems_parse_params * params)1534 static void ieee80211_mle_parse_link(struct ieee802_11_elems *elems,
1535 				     struct ieee80211_elems_parse_params *params)
1536 {
1537 	struct ieee80211_mle_per_sta_profile *prof;
1538 	struct ieee80211_elems_parse_params sub = {
1539 		.action = params->action,
1540 		.from_ap = params->from_ap,
1541 		.link_id = -1,
1542 	};
1543 	ssize_t ml_len = elems->ml_basic_len;
1544 	const struct element *non_inherit = NULL;
1545 	const u8 *end;
1546 
1547 	if (params->link_id == -1)
1548 		return;
1549 
1550 	ml_len = cfg80211_defragment_element(elems->ml_basic_elem,
1551 					     elems->ie_start,
1552 					     elems->total_len,
1553 					     elems->scratch_pos,
1554 					     elems->scratch +
1555 						elems->scratch_len -
1556 						elems->scratch_pos,
1557 					     WLAN_EID_FRAGMENT);
1558 
1559 	if (ml_len < 0)
1560 		return;
1561 
1562 	elems->ml_basic = (const void *)elems->scratch_pos;
1563 	elems->ml_basic_len = ml_len;
1564 
1565 	ieee80211_mle_get_sta_prof(elems, params->link_id);
1566 	prof = elems->prof;
1567 
1568 	if (!prof)
1569 		return;
1570 
1571 	/* check if we have the 4 bytes for the fixed part in assoc response */
1572 	if (elems->sta_prof_len < sizeof(*prof) + prof->sta_info_len - 1 + 4) {
1573 		elems->prof = NULL;
1574 		elems->sta_prof_len = 0;
1575 		return;
1576 	}
1577 
1578 	/*
1579 	 * Skip the capability information and the status code that are expected
1580 	 * as part of the station profile in association response frames. Note
1581 	 * the -1 is because the 'sta_info_len' is accounted to as part of the
1582 	 * per-STA profile, but not part of the 'u8 variable[]' portion.
1583 	 */
1584 	sub.start = prof->variable + prof->sta_info_len - 1 + 4;
1585 	end = (const u8 *)prof + elems->sta_prof_len;
1586 	sub.len = end - sub.start;
1587 
1588 	non_inherit = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
1589 					     sub.start, sub.len);
1590 	_ieee802_11_parse_elems_full(&sub, elems, non_inherit);
1591 }
1592 
1593 struct ieee802_11_elems *
ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params * params)1594 ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params)
1595 {
1596 	struct ieee802_11_elems *elems;
1597 	const struct element *non_inherit = NULL;
1598 	u8 *nontransmitted_profile;
1599 	int nontransmitted_profile_len = 0;
1600 	size_t scratch_len = 3 * params->len;
1601 
1602 	elems = kzalloc(sizeof(*elems) + scratch_len, GFP_ATOMIC);
1603 	if (!elems)
1604 		return NULL;
1605 	elems->ie_start = params->start;
1606 	elems->total_len = params->len;
1607 	elems->scratch_len = scratch_len;
1608 	elems->scratch_pos = elems->scratch;
1609 
1610 	nontransmitted_profile = elems->scratch_pos;
1611 	nontransmitted_profile_len =
1612 		ieee802_11_find_bssid_profile(params->start, params->len,
1613 					      elems, params->bss,
1614 					      nontransmitted_profile);
1615 	elems->scratch_pos += nontransmitted_profile_len;
1616 	elems->scratch_len -= nontransmitted_profile_len;
1617 	non_inherit = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
1618 					     nontransmitted_profile,
1619 					     nontransmitted_profile_len);
1620 
1621 	elems->crc = _ieee802_11_parse_elems_full(params, elems, non_inherit);
1622 
1623 	/* Override with nontransmitted profile, if found */
1624 	if (nontransmitted_profile_len) {
1625 		struct ieee80211_elems_parse_params sub = {
1626 			.start = nontransmitted_profile,
1627 			.len = nontransmitted_profile_len,
1628 			.action = params->action,
1629 			.link_id = params->link_id,
1630 		};
1631 
1632 		_ieee802_11_parse_elems_full(&sub, elems, NULL);
1633 	}
1634 
1635 	ieee80211_mle_parse_link(elems, params);
1636 
1637 	if (elems->tim && !elems->parse_error) {
1638 		const struct ieee80211_tim_ie *tim_ie = elems->tim;
1639 
1640 		elems->dtim_period = tim_ie->dtim_period;
1641 		elems->dtim_count = tim_ie->dtim_count;
1642 	}
1643 
1644 	/* Override DTIM period and count if needed */
1645 	if (elems->bssid_index &&
1646 	    elems->bssid_index_len >=
1647 	    offsetofend(struct ieee80211_bssid_index, dtim_period))
1648 		elems->dtim_period = elems->bssid_index->dtim_period;
1649 
1650 	if (elems->bssid_index &&
1651 	    elems->bssid_index_len >=
1652 	    offsetofend(struct ieee80211_bssid_index, dtim_count))
1653 		elems->dtim_count = elems->bssid_index->dtim_count;
1654 
1655 	return elems;
1656 }
1657 
ieee80211_regulatory_limit_wmm_params(struct ieee80211_sub_if_data * sdata,struct ieee80211_tx_queue_params * qparam,int ac)1658 void ieee80211_regulatory_limit_wmm_params(struct ieee80211_sub_if_data *sdata,
1659 					   struct ieee80211_tx_queue_params
1660 					   *qparam, int ac)
1661 {
1662 	struct ieee80211_chanctx_conf *chanctx_conf;
1663 	const struct ieee80211_reg_rule *rrule;
1664 	const struct ieee80211_wmm_ac *wmm_ac;
1665 	u16 center_freq = 0;
1666 
1667 	if (sdata->vif.type != NL80211_IFTYPE_AP &&
1668 	    sdata->vif.type != NL80211_IFTYPE_STATION)
1669 		return;
1670 
1671 	rcu_read_lock();
1672 	chanctx_conf = rcu_dereference(sdata->vif.bss_conf.chanctx_conf);
1673 	if (chanctx_conf)
1674 		center_freq = chanctx_conf->def.chan->center_freq;
1675 
1676 	if (!center_freq) {
1677 		rcu_read_unlock();
1678 		return;
1679 	}
1680 
1681 	rrule = freq_reg_info(sdata->wdev.wiphy, MHZ_TO_KHZ(center_freq));
1682 
1683 	if (IS_ERR_OR_NULL(rrule) || !rrule->has_wmm) {
1684 		rcu_read_unlock();
1685 		return;
1686 	}
1687 
1688 	if (sdata->vif.type == NL80211_IFTYPE_AP)
1689 		wmm_ac = &rrule->wmm_rule.ap[ac];
1690 	else
1691 		wmm_ac = &rrule->wmm_rule.client[ac];
1692 	qparam->cw_min = max_t(u16, qparam->cw_min, wmm_ac->cw_min);
1693 	qparam->cw_max = max_t(u16, qparam->cw_max, wmm_ac->cw_max);
1694 	qparam->aifs = max_t(u8, qparam->aifs, wmm_ac->aifsn);
1695 	qparam->txop = min_t(u16, qparam->txop, wmm_ac->cot / 32);
1696 	rcu_read_unlock();
1697 }
1698 
ieee80211_set_wmm_default(struct ieee80211_link_data * link,bool bss_notify,bool enable_qos)1699 void ieee80211_set_wmm_default(struct ieee80211_link_data *link,
1700 			       bool bss_notify, bool enable_qos)
1701 {
1702 	struct ieee80211_sub_if_data *sdata = link->sdata;
1703 	struct ieee80211_local *local = sdata->local;
1704 	struct ieee80211_tx_queue_params qparam;
1705 	struct ieee80211_chanctx_conf *chanctx_conf;
1706 	int ac;
1707 	bool use_11b;
1708 	bool is_ocb; /* Use another EDCA parameters if dot11OCBActivated=true */
1709 	int aCWmin, aCWmax;
1710 
1711 	if (!local->ops->conf_tx)
1712 		return;
1713 
1714 	if (local->hw.queues < IEEE80211_NUM_ACS)
1715 		return;
1716 
1717 	memset(&qparam, 0, sizeof(qparam));
1718 
1719 	rcu_read_lock();
1720 	chanctx_conf = rcu_dereference(link->conf->chanctx_conf);
1721 	use_11b = (chanctx_conf &&
1722 		   chanctx_conf->def.chan->band == NL80211_BAND_2GHZ) &&
1723 		 !link->operating_11g_mode;
1724 	rcu_read_unlock();
1725 
1726 	is_ocb = (sdata->vif.type == NL80211_IFTYPE_OCB);
1727 
1728 	/* Set defaults according to 802.11-2007 Table 7-37 */
1729 	aCWmax = 1023;
1730 	if (use_11b)
1731 		aCWmin = 31;
1732 	else
1733 		aCWmin = 15;
1734 
1735 	/* Confiure old 802.11b/g medium access rules. */
1736 	qparam.cw_max = aCWmax;
1737 	qparam.cw_min = aCWmin;
1738 	qparam.txop = 0;
1739 	qparam.aifs = 2;
1740 
1741 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1742 		/* Update if QoS is enabled. */
1743 		if (enable_qos) {
1744 			switch (ac) {
1745 			case IEEE80211_AC_BK:
1746 				qparam.cw_max = aCWmax;
1747 				qparam.cw_min = aCWmin;
1748 				qparam.txop = 0;
1749 				if (is_ocb)
1750 					qparam.aifs = 9;
1751 				else
1752 					qparam.aifs = 7;
1753 				break;
1754 			/* never happens but let's not leave undefined */
1755 			default:
1756 			case IEEE80211_AC_BE:
1757 				qparam.cw_max = aCWmax;
1758 				qparam.cw_min = aCWmin;
1759 				qparam.txop = 0;
1760 				if (is_ocb)
1761 					qparam.aifs = 6;
1762 				else
1763 					qparam.aifs = 3;
1764 				break;
1765 			case IEEE80211_AC_VI:
1766 				qparam.cw_max = aCWmin;
1767 				qparam.cw_min = (aCWmin + 1) / 2 - 1;
1768 				if (is_ocb)
1769 					qparam.txop = 0;
1770 				else if (use_11b)
1771 					qparam.txop = 6016/32;
1772 				else
1773 					qparam.txop = 3008/32;
1774 
1775 				if (is_ocb)
1776 					qparam.aifs = 3;
1777 				else
1778 					qparam.aifs = 2;
1779 				break;
1780 			case IEEE80211_AC_VO:
1781 				qparam.cw_max = (aCWmin + 1) / 2 - 1;
1782 				qparam.cw_min = (aCWmin + 1) / 4 - 1;
1783 				if (is_ocb)
1784 					qparam.txop = 0;
1785 				else if (use_11b)
1786 					qparam.txop = 3264/32;
1787 				else
1788 					qparam.txop = 1504/32;
1789 				qparam.aifs = 2;
1790 				break;
1791 			}
1792 		}
1793 		ieee80211_regulatory_limit_wmm_params(sdata, &qparam, ac);
1794 
1795 		qparam.uapsd = false;
1796 
1797 		link->tx_conf[ac] = qparam;
1798 		drv_conf_tx(local, link, ac, &qparam);
1799 	}
1800 
1801 	if (sdata->vif.type != NL80211_IFTYPE_MONITOR &&
1802 	    sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
1803 	    sdata->vif.type != NL80211_IFTYPE_NAN) {
1804 		link->conf->qos = enable_qos;
1805 		if (bss_notify)
1806 			ieee80211_link_info_change_notify(sdata, link,
1807 							  BSS_CHANGED_QOS);
1808 	}
1809 }
1810 
ieee80211_send_auth(struct ieee80211_sub_if_data * sdata,u16 transaction,u16 auth_alg,u16 status,const u8 * extra,size_t extra_len,const u8 * da,const u8 * bssid,const u8 * key,u8 key_len,u8 key_idx,u32 tx_flags)1811 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
1812 			 u16 transaction, u16 auth_alg, u16 status,
1813 			 const u8 *extra, size_t extra_len, const u8 *da,
1814 			 const u8 *bssid, const u8 *key, u8 key_len, u8 key_idx,
1815 			 u32 tx_flags)
1816 {
1817 	struct ieee80211_local *local = sdata->local;
1818 	struct sk_buff *skb;
1819 	struct ieee80211_mgmt *mgmt;
1820 	bool multi_link = ieee80211_vif_is_mld(&sdata->vif);
1821 	struct {
1822 		u8 id;
1823 		u8 len;
1824 		u8 ext_id;
1825 		struct ieee80211_multi_link_elem ml;
1826 		struct ieee80211_mle_basic_common_info basic;
1827 	} __packed mle = {
1828 		.id = WLAN_EID_EXTENSION,
1829 		.len = sizeof(mle) - 2,
1830 		.ext_id = WLAN_EID_EXT_EHT_MULTI_LINK,
1831 		.ml.control = cpu_to_le16(IEEE80211_ML_CONTROL_TYPE_BASIC),
1832 		.basic.len = sizeof(mle.basic),
1833 	};
1834 	int err;
1835 
1836 	memcpy(mle.basic.mld_mac_addr, sdata->vif.addr, ETH_ALEN);
1837 
1838 	/* 24 + 6 = header + auth_algo + auth_transaction + status_code */
1839 	skb = dev_alloc_skb(local->hw.extra_tx_headroom + IEEE80211_WEP_IV_LEN +
1840 			    24 + 6 + extra_len + IEEE80211_WEP_ICV_LEN +
1841 			    multi_link * sizeof(mle));
1842 	if (!skb)
1843 		return;
1844 
1845 	skb_reserve(skb, local->hw.extra_tx_headroom + IEEE80211_WEP_IV_LEN);
1846 
1847 	mgmt = skb_put_zero(skb, 24 + 6);
1848 	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1849 					  IEEE80211_STYPE_AUTH);
1850 	memcpy(mgmt->da, da, ETH_ALEN);
1851 	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
1852 	memcpy(mgmt->bssid, bssid, ETH_ALEN);
1853 	mgmt->u.auth.auth_alg = cpu_to_le16(auth_alg);
1854 	mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
1855 	mgmt->u.auth.status_code = cpu_to_le16(status);
1856 	if (extra)
1857 		skb_put_data(skb, extra, extra_len);
1858 	if (multi_link)
1859 		skb_put_data(skb, &mle, sizeof(mle));
1860 
1861 	if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) {
1862 		mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
1863 		err = ieee80211_wep_encrypt(local, skb, key, key_len, key_idx);
1864 		if (WARN_ON(err)) {
1865 			kfree_skb(skb);
1866 			return;
1867 		}
1868 	}
1869 
1870 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
1871 					tx_flags;
1872 	ieee80211_tx_skb(sdata, skb);
1873 }
1874 
ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data * sdata,const u8 * da,const u8 * bssid,u16 stype,u16 reason,bool send_frame,u8 * frame_buf)1875 void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
1876 				    const u8 *da, const u8 *bssid,
1877 				    u16 stype, u16 reason,
1878 				    bool send_frame, u8 *frame_buf)
1879 {
1880 	struct ieee80211_local *local = sdata->local;
1881 	struct sk_buff *skb;
1882 	struct ieee80211_mgmt *mgmt = (void *)frame_buf;
1883 
1884 	/* build frame */
1885 	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype);
1886 	mgmt->duration = 0; /* initialize only */
1887 	mgmt->seq_ctrl = 0; /* initialize only */
1888 	memcpy(mgmt->da, da, ETH_ALEN);
1889 	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
1890 	memcpy(mgmt->bssid, bssid, ETH_ALEN);
1891 	/* u.deauth.reason_code == u.disassoc.reason_code */
1892 	mgmt->u.deauth.reason_code = cpu_to_le16(reason);
1893 
1894 	if (send_frame) {
1895 		skb = dev_alloc_skb(local->hw.extra_tx_headroom +
1896 				    IEEE80211_DEAUTH_FRAME_LEN);
1897 		if (!skb)
1898 			return;
1899 
1900 		skb_reserve(skb, local->hw.extra_tx_headroom);
1901 
1902 		/* copy in frame */
1903 		skb_put_data(skb, mgmt, IEEE80211_DEAUTH_FRAME_LEN);
1904 
1905 		if (sdata->vif.type != NL80211_IFTYPE_STATION ||
1906 		    !(sdata->u.mgd.flags & IEEE80211_STA_MFP_ENABLED))
1907 			IEEE80211_SKB_CB(skb)->flags |=
1908 				IEEE80211_TX_INTFL_DONT_ENCRYPT;
1909 
1910 		ieee80211_tx_skb(sdata, skb);
1911 	}
1912 }
1913 
ieee80211_write_he_6ghz_cap(u8 * pos,__le16 cap,u8 * end)1914 u8 *ieee80211_write_he_6ghz_cap(u8 *pos, __le16 cap, u8 *end)
1915 {
1916 	if ((end - pos) < 5)
1917 		return pos;
1918 
1919 	*pos++ = WLAN_EID_EXTENSION;
1920 	*pos++ = 1 + sizeof(cap);
1921 	*pos++ = WLAN_EID_EXT_HE_6GHZ_CAPA;
1922 	memcpy(pos, &cap, sizeof(cap));
1923 
1924 	return pos + 2;
1925 }
1926 
ieee80211_build_preq_ies_band(struct ieee80211_sub_if_data * sdata,u8 * buffer,size_t buffer_len,const u8 * ie,size_t ie_len,enum nl80211_band band,u32 rate_mask,struct cfg80211_chan_def * chandef,size_t * offset,u32 flags)1927 static int ieee80211_build_preq_ies_band(struct ieee80211_sub_if_data *sdata,
1928 					 u8 *buffer, size_t buffer_len,
1929 					 const u8 *ie, size_t ie_len,
1930 					 enum nl80211_band band,
1931 					 u32 rate_mask,
1932 					 struct cfg80211_chan_def *chandef,
1933 					 size_t *offset, u32 flags)
1934 {
1935 	struct ieee80211_local *local = sdata->local;
1936 	struct ieee80211_supported_band *sband;
1937 	const struct ieee80211_sta_he_cap *he_cap;
1938 	const struct ieee80211_sta_eht_cap *eht_cap;
1939 	u8 *pos = buffer, *end = buffer + buffer_len;
1940 	size_t noffset;
1941 	int supp_rates_len, i;
1942 	u8 rates[32];
1943 	int num_rates;
1944 	int ext_rates_len;
1945 	int shift;
1946 	u32 rate_flags;
1947 	bool have_80mhz = false;
1948 
1949 	*offset = 0;
1950 
1951 	sband = local->hw.wiphy->bands[band];
1952 	if (WARN_ON_ONCE(!sband))
1953 		return 0;
1954 
1955 	rate_flags = ieee80211_chandef_rate_flags(chandef);
1956 	shift = ieee80211_chandef_get_shift(chandef);
1957 
1958 	/* For direct scan add S1G IE and consider its override bits */
1959 	if (band == NL80211_BAND_S1GHZ) {
1960 		if (end - pos < 2 + sizeof(struct ieee80211_s1g_cap))
1961 			goto out_err;
1962 		pos = ieee80211_ie_build_s1g_cap(pos, &sband->s1g_cap);
1963 		goto done;
1964 	}
1965 
1966 	num_rates = 0;
1967 	for (i = 0; i < sband->n_bitrates; i++) {
1968 		if ((BIT(i) & rate_mask) == 0)
1969 			continue; /* skip rate */
1970 		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
1971 			continue;
1972 
1973 		rates[num_rates++] =
1974 			(u8) DIV_ROUND_UP(sband->bitrates[i].bitrate,
1975 					  (1 << shift) * 5);
1976 	}
1977 
1978 	supp_rates_len = min_t(int, num_rates, 8);
1979 
1980 	if (end - pos < 2 + supp_rates_len)
1981 		goto out_err;
1982 	*pos++ = WLAN_EID_SUPP_RATES;
1983 	*pos++ = supp_rates_len;
1984 	memcpy(pos, rates, supp_rates_len);
1985 	pos += supp_rates_len;
1986 
1987 	/* insert "request information" if in custom IEs */
1988 	if (ie && ie_len) {
1989 		static const u8 before_extrates[] = {
1990 			WLAN_EID_SSID,
1991 			WLAN_EID_SUPP_RATES,
1992 			WLAN_EID_REQUEST,
1993 		};
1994 		noffset = ieee80211_ie_split(ie, ie_len,
1995 					     before_extrates,
1996 					     ARRAY_SIZE(before_extrates),
1997 					     *offset);
1998 		if (end - pos < noffset - *offset)
1999 			goto out_err;
2000 		memcpy(pos, ie + *offset, noffset - *offset);
2001 		pos += noffset - *offset;
2002 		*offset = noffset;
2003 	}
2004 
2005 	ext_rates_len = num_rates - supp_rates_len;
2006 	if (ext_rates_len > 0) {
2007 		if (end - pos < 2 + ext_rates_len)
2008 			goto out_err;
2009 		*pos++ = WLAN_EID_EXT_SUPP_RATES;
2010 		*pos++ = ext_rates_len;
2011 		memcpy(pos, rates + supp_rates_len, ext_rates_len);
2012 		pos += ext_rates_len;
2013 	}
2014 
2015 	if (chandef->chan && sband->band == NL80211_BAND_2GHZ) {
2016 		if (end - pos < 3)
2017 			goto out_err;
2018 		*pos++ = WLAN_EID_DS_PARAMS;
2019 		*pos++ = 1;
2020 		*pos++ = ieee80211_frequency_to_channel(
2021 				chandef->chan->center_freq);
2022 	}
2023 
2024 	if (flags & IEEE80211_PROBE_FLAG_MIN_CONTENT)
2025 		goto done;
2026 
2027 	/* insert custom IEs that go before HT */
2028 	if (ie && ie_len) {
2029 		static const u8 before_ht[] = {
2030 			/*
2031 			 * no need to list the ones split off already
2032 			 * (or generated here)
2033 			 */
2034 			WLAN_EID_DS_PARAMS,
2035 			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
2036 		};
2037 		noffset = ieee80211_ie_split(ie, ie_len,
2038 					     before_ht, ARRAY_SIZE(before_ht),
2039 					     *offset);
2040 		if (end - pos < noffset - *offset)
2041 			goto out_err;
2042 		memcpy(pos, ie + *offset, noffset - *offset);
2043 		pos += noffset - *offset;
2044 		*offset = noffset;
2045 	}
2046 
2047 	if (sband->ht_cap.ht_supported) {
2048 		if (end - pos < 2 + sizeof(struct ieee80211_ht_cap))
2049 			goto out_err;
2050 		pos = ieee80211_ie_build_ht_cap(pos, &sband->ht_cap,
2051 						sband->ht_cap.cap);
2052 	}
2053 
2054 	/* insert custom IEs that go before VHT */
2055 	if (ie && ie_len) {
2056 		static const u8 before_vht[] = {
2057 			/*
2058 			 * no need to list the ones split off already
2059 			 * (or generated here)
2060 			 */
2061 			WLAN_EID_BSS_COEX_2040,
2062 			WLAN_EID_EXT_CAPABILITY,
2063 			WLAN_EID_SSID_LIST,
2064 			WLAN_EID_CHANNEL_USAGE,
2065 			WLAN_EID_INTERWORKING,
2066 			WLAN_EID_MESH_ID,
2067 			/* 60 GHz (Multi-band, DMG, MMS) can't happen */
2068 		};
2069 		noffset = ieee80211_ie_split(ie, ie_len,
2070 					     before_vht, ARRAY_SIZE(before_vht),
2071 					     *offset);
2072 		if (end - pos < noffset - *offset)
2073 			goto out_err;
2074 		memcpy(pos, ie + *offset, noffset - *offset);
2075 		pos += noffset - *offset;
2076 		*offset = noffset;
2077 	}
2078 
2079 	/* Check if any channel in this sband supports at least 80 MHz */
2080 	for (i = 0; i < sband->n_channels; i++) {
2081 		if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
2082 						IEEE80211_CHAN_NO_80MHZ))
2083 			continue;
2084 
2085 		have_80mhz = true;
2086 		break;
2087 	}
2088 
2089 	if (sband->vht_cap.vht_supported && have_80mhz) {
2090 		if (end - pos < 2 + sizeof(struct ieee80211_vht_cap))
2091 			goto out_err;
2092 		pos = ieee80211_ie_build_vht_cap(pos, &sband->vht_cap,
2093 						 sband->vht_cap.cap);
2094 	}
2095 
2096 	/* insert custom IEs that go before HE */
2097 	if (ie && ie_len) {
2098 		static const u8 before_he[] = {
2099 			/*
2100 			 * no need to list the ones split off before VHT
2101 			 * or generated here
2102 			 */
2103 			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_REQ_PARAMS,
2104 			WLAN_EID_AP_CSN,
2105 			/* TODO: add 11ah/11aj/11ak elements */
2106 		};
2107 		noffset = ieee80211_ie_split(ie, ie_len,
2108 					     before_he, ARRAY_SIZE(before_he),
2109 					     *offset);
2110 		if (end - pos < noffset - *offset)
2111 			goto out_err;
2112 		memcpy(pos, ie + *offset, noffset - *offset);
2113 		pos += noffset - *offset;
2114 		*offset = noffset;
2115 	}
2116 
2117 	he_cap = ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
2118 	if (he_cap &&
2119 	    cfg80211_any_usable_channels(local->hw.wiphy, BIT(sband->band),
2120 					 IEEE80211_CHAN_NO_HE)) {
2121 		pos = ieee80211_ie_build_he_cap(0, pos, he_cap, end);
2122 		if (!pos)
2123 			goto out_err;
2124 	}
2125 
2126 	eht_cap = ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif);
2127 
2128 	if (eht_cap &&
2129 	    cfg80211_any_usable_channels(local->hw.wiphy, BIT(sband->band),
2130 					 IEEE80211_CHAN_NO_HE |
2131 					 IEEE80211_CHAN_NO_EHT)) {
2132 		pos = ieee80211_ie_build_eht_cap(pos, he_cap, eht_cap, end,
2133 						 sdata->vif.type == NL80211_IFTYPE_AP);
2134 		if (!pos)
2135 			goto out_err;
2136 	}
2137 
2138 	if (cfg80211_any_usable_channels(local->hw.wiphy,
2139 					 BIT(NL80211_BAND_6GHZ),
2140 					 IEEE80211_CHAN_NO_HE)) {
2141 		struct ieee80211_supported_band *sband6;
2142 
2143 		sband6 = local->hw.wiphy->bands[NL80211_BAND_6GHZ];
2144 		he_cap = ieee80211_get_he_iftype_cap_vif(sband6, &sdata->vif);
2145 
2146 		if (he_cap) {
2147 			enum nl80211_iftype iftype =
2148 				ieee80211_vif_type_p2p(&sdata->vif);
2149 			__le16 cap = ieee80211_get_he_6ghz_capa(sband6, iftype);
2150 
2151 			pos = ieee80211_write_he_6ghz_cap(pos, cap, end);
2152 		}
2153 	}
2154 
2155 	/*
2156 	 * If adding more here, adjust code in main.c
2157 	 * that calculates local->scan_ies_len.
2158 	 */
2159 
2160 	return pos - buffer;
2161  out_err:
2162 	WARN_ONCE(1, "not enough space for preq IEs\n");
2163  done:
2164 	return pos - buffer;
2165 }
2166 
ieee80211_build_preq_ies(struct ieee80211_sub_if_data * sdata,u8 * buffer,size_t buffer_len,struct ieee80211_scan_ies * ie_desc,const u8 * ie,size_t ie_len,u8 bands_used,u32 * rate_masks,struct cfg80211_chan_def * chandef,u32 flags)2167 int ieee80211_build_preq_ies(struct ieee80211_sub_if_data *sdata, u8 *buffer,
2168 			     size_t buffer_len,
2169 			     struct ieee80211_scan_ies *ie_desc,
2170 			     const u8 *ie, size_t ie_len,
2171 			     u8 bands_used, u32 *rate_masks,
2172 			     struct cfg80211_chan_def *chandef,
2173 			     u32 flags)
2174 {
2175 	size_t pos = 0, old_pos = 0, custom_ie_offset = 0;
2176 	int i;
2177 
2178 	memset(ie_desc, 0, sizeof(*ie_desc));
2179 
2180 	for (i = 0; i < NUM_NL80211_BANDS; i++) {
2181 		if (bands_used & BIT(i)) {
2182 			pos += ieee80211_build_preq_ies_band(sdata,
2183 							     buffer + pos,
2184 							     buffer_len - pos,
2185 							     ie, ie_len, i,
2186 							     rate_masks[i],
2187 							     chandef,
2188 							     &custom_ie_offset,
2189 							     flags);
2190 			ie_desc->ies[i] = buffer + old_pos;
2191 			ie_desc->len[i] = pos - old_pos;
2192 			old_pos = pos;
2193 		}
2194 	}
2195 
2196 	/* add any remaining custom IEs */
2197 	if (ie && ie_len) {
2198 		if (WARN_ONCE(buffer_len - pos < ie_len - custom_ie_offset,
2199 			      "not enough space for preq custom IEs\n"))
2200 			return pos;
2201 		memcpy(buffer + pos, ie + custom_ie_offset,
2202 		       ie_len - custom_ie_offset);
2203 		ie_desc->common_ies = buffer + pos;
2204 		ie_desc->common_ie_len = ie_len - custom_ie_offset;
2205 		pos += ie_len - custom_ie_offset;
2206 	}
2207 
2208 	return pos;
2209 };
2210 
ieee80211_build_probe_req(struct ieee80211_sub_if_data * sdata,const u8 * src,const u8 * dst,u32 ratemask,struct ieee80211_channel * chan,const u8 * ssid,size_t ssid_len,const u8 * ie,size_t ie_len,u32 flags)2211 struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
2212 					  const u8 *src, const u8 *dst,
2213 					  u32 ratemask,
2214 					  struct ieee80211_channel *chan,
2215 					  const u8 *ssid, size_t ssid_len,
2216 					  const u8 *ie, size_t ie_len,
2217 					  u32 flags)
2218 {
2219 	struct ieee80211_local *local = sdata->local;
2220 	struct cfg80211_chan_def chandef;
2221 	struct sk_buff *skb;
2222 	struct ieee80211_mgmt *mgmt;
2223 	int ies_len;
2224 	u32 rate_masks[NUM_NL80211_BANDS] = {};
2225 	struct ieee80211_scan_ies dummy_ie_desc;
2226 
2227 	/*
2228 	 * Do not send DS Channel parameter for directed probe requests
2229 	 * in order to maximize the chance that we get a response.  Some
2230 	 * badly-behaved APs don't respond when this parameter is included.
2231 	 */
2232 	chandef.width = sdata->vif.bss_conf.chandef.width;
2233 	if (flags & IEEE80211_PROBE_FLAG_DIRECTED)
2234 		chandef.chan = NULL;
2235 	else
2236 		chandef.chan = chan;
2237 
2238 	skb = ieee80211_probereq_get(&local->hw, src, ssid, ssid_len,
2239 				     local->scan_ies_len + ie_len);
2240 	if (!skb)
2241 		return NULL;
2242 
2243 	rate_masks[chan->band] = ratemask;
2244 	ies_len = ieee80211_build_preq_ies(sdata, skb_tail_pointer(skb),
2245 					   skb_tailroom(skb), &dummy_ie_desc,
2246 					   ie, ie_len, BIT(chan->band),
2247 					   rate_masks, &chandef, flags);
2248 	skb_put(skb, ies_len);
2249 
2250 	if (dst) {
2251 		mgmt = (struct ieee80211_mgmt *) skb->data;
2252 		memcpy(mgmt->da, dst, ETH_ALEN);
2253 		memcpy(mgmt->bssid, dst, ETH_ALEN);
2254 	}
2255 
2256 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
2257 
2258 	return skb;
2259 }
2260 
ieee80211_sta_get_rates(struct ieee80211_sub_if_data * sdata,struct ieee802_11_elems * elems,enum nl80211_band band,u32 * basic_rates)2261 u32 ieee80211_sta_get_rates(struct ieee80211_sub_if_data *sdata,
2262 			    struct ieee802_11_elems *elems,
2263 			    enum nl80211_band band, u32 *basic_rates)
2264 {
2265 	struct ieee80211_supported_band *sband;
2266 	size_t num_rates;
2267 	u32 supp_rates, rate_flags;
2268 	int i, j, shift;
2269 
2270 	sband = sdata->local->hw.wiphy->bands[band];
2271 	if (WARN_ON(!sband))
2272 		return 1;
2273 
2274 	rate_flags = ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chandef);
2275 	shift = ieee80211_vif_get_shift(&sdata->vif);
2276 
2277 	num_rates = sband->n_bitrates;
2278 	supp_rates = 0;
2279 	for (i = 0; i < elems->supp_rates_len +
2280 		     elems->ext_supp_rates_len; i++) {
2281 		u8 rate = 0;
2282 		int own_rate;
2283 		bool is_basic;
2284 		if (i < elems->supp_rates_len)
2285 			rate = elems->supp_rates[i];
2286 		else if (elems->ext_supp_rates)
2287 			rate = elems->ext_supp_rates
2288 				[i - elems->supp_rates_len];
2289 		own_rate = 5 * (rate & 0x7f);
2290 		is_basic = !!(rate & 0x80);
2291 
2292 		if (is_basic && (rate & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
2293 			continue;
2294 
2295 		for (j = 0; j < num_rates; j++) {
2296 			int brate;
2297 			if ((rate_flags & sband->bitrates[j].flags)
2298 			    != rate_flags)
2299 				continue;
2300 
2301 			brate = DIV_ROUND_UP(sband->bitrates[j].bitrate,
2302 					     1 << shift);
2303 
2304 			if (brate == own_rate) {
2305 				supp_rates |= BIT(j);
2306 				if (basic_rates && is_basic)
2307 					*basic_rates |= BIT(j);
2308 			}
2309 		}
2310 	}
2311 	return supp_rates;
2312 }
2313 
ieee80211_stop_device(struct ieee80211_local * local)2314 void ieee80211_stop_device(struct ieee80211_local *local)
2315 {
2316 	ieee80211_led_radio(local, false);
2317 	ieee80211_mod_tpt_led_trig(local, 0, IEEE80211_TPT_LEDTRIG_FL_RADIO);
2318 
2319 	cancel_work_sync(&local->reconfig_filter);
2320 
2321 	flush_workqueue(local->workqueue);
2322 	drv_stop(local);
2323 }
2324 
ieee80211_flush_completed_scan(struct ieee80211_local * local,bool aborted)2325 static void ieee80211_flush_completed_scan(struct ieee80211_local *local,
2326 					   bool aborted)
2327 {
2328 	/* It's possible that we don't handle the scan completion in
2329 	 * time during suspend, so if it's still marked as completed
2330 	 * here, queue the work and flush it to clean things up.
2331 	 * Instead of calling the worker function directly here, we
2332 	 * really queue it to avoid potential races with other flows
2333 	 * scheduling the same work.
2334 	 */
2335 	if (test_bit(SCAN_COMPLETED, &local->scanning)) {
2336 		/* If coming from reconfiguration failure, abort the scan so
2337 		 * we don't attempt to continue a partial HW scan - which is
2338 		 * possible otherwise if (e.g.) the 2.4 GHz portion was the
2339 		 * completed scan, and a 5 GHz portion is still pending.
2340 		 */
2341 		if (aborted)
2342 			set_bit(SCAN_ABORTED, &local->scanning);
2343 		wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work, 0);
2344 		wiphy_delayed_work_flush(local->hw.wiphy, &local->scan_work);
2345 	}
2346 }
2347 
ieee80211_handle_reconfig_failure(struct ieee80211_local * local)2348 static void ieee80211_handle_reconfig_failure(struct ieee80211_local *local)
2349 {
2350 	struct ieee80211_sub_if_data *sdata;
2351 	struct ieee80211_chanctx *ctx;
2352 
2353 	/*
2354 	 * We get here if during resume the device can't be restarted properly.
2355 	 * We might also get here if this happens during HW reset, which is a
2356 	 * slightly different situation and we need to drop all connections in
2357 	 * the latter case.
2358 	 *
2359 	 * Ask cfg80211 to turn off all interfaces, this will result in more
2360 	 * warnings but at least we'll then get into a clean stopped state.
2361 	 */
2362 
2363 	local->resuming = false;
2364 	local->suspended = false;
2365 	local->in_reconfig = false;
2366 	local->reconfig_failure = true;
2367 
2368 	ieee80211_flush_completed_scan(local, true);
2369 
2370 	/* scheduled scan clearly can't be running any more, but tell
2371 	 * cfg80211 and clear local state
2372 	 */
2373 	ieee80211_sched_scan_end(local);
2374 
2375 	list_for_each_entry(sdata, &local->interfaces, list)
2376 		sdata->flags &= ~IEEE80211_SDATA_IN_DRIVER;
2377 
2378 	/* Mark channel contexts as not being in the driver any more to avoid
2379 	 * removing them from the driver during the shutdown process...
2380 	 */
2381 	mutex_lock(&local->chanctx_mtx);
2382 	list_for_each_entry(ctx, &local->chanctx_list, list)
2383 		ctx->driver_present = false;
2384 	mutex_unlock(&local->chanctx_mtx);
2385 }
2386 
ieee80211_assign_chanctx(struct ieee80211_local * local,struct ieee80211_sub_if_data * sdata,struct ieee80211_link_data * link)2387 static void ieee80211_assign_chanctx(struct ieee80211_local *local,
2388 				     struct ieee80211_sub_if_data *sdata,
2389 				     struct ieee80211_link_data *link)
2390 {
2391 	struct ieee80211_chanctx_conf *conf;
2392 	struct ieee80211_chanctx *ctx;
2393 
2394 	if (!local->use_chanctx)
2395 		return;
2396 
2397 	mutex_lock(&local->chanctx_mtx);
2398 	conf = rcu_dereference_protected(link->conf->chanctx_conf,
2399 					 lockdep_is_held(&local->chanctx_mtx));
2400 	if (conf) {
2401 		ctx = container_of(conf, struct ieee80211_chanctx, conf);
2402 		drv_assign_vif_chanctx(local, sdata, link->conf, ctx);
2403 	}
2404 	mutex_unlock(&local->chanctx_mtx);
2405 }
2406 
ieee80211_reconfig_stations(struct ieee80211_sub_if_data * sdata)2407 static void ieee80211_reconfig_stations(struct ieee80211_sub_if_data *sdata)
2408 {
2409 	struct ieee80211_local *local = sdata->local;
2410 	struct sta_info *sta;
2411 
2412 	/* add STAs back */
2413 	mutex_lock(&local->sta_mtx);
2414 	list_for_each_entry(sta, &local->sta_list, list) {
2415 		enum ieee80211_sta_state state;
2416 
2417 		if (!sta->uploaded || sta->sdata != sdata)
2418 			continue;
2419 
2420 		for (state = IEEE80211_STA_NOTEXIST;
2421 		     state < sta->sta_state; state++)
2422 			WARN_ON(drv_sta_state(local, sta->sdata, sta, state,
2423 					      state + 1));
2424 	}
2425 	mutex_unlock(&local->sta_mtx);
2426 }
2427 
ieee80211_reconfig_nan(struct ieee80211_sub_if_data * sdata)2428 static int ieee80211_reconfig_nan(struct ieee80211_sub_if_data *sdata)
2429 {
2430 	struct cfg80211_nan_func *func, **funcs;
2431 	int res, id, i = 0;
2432 
2433 	res = drv_start_nan(sdata->local, sdata,
2434 			    &sdata->u.nan.conf);
2435 	if (WARN_ON(res))
2436 		return res;
2437 
2438 	funcs = kcalloc(sdata->local->hw.max_nan_de_entries + 1,
2439 			sizeof(*funcs),
2440 			GFP_KERNEL);
2441 	if (!funcs)
2442 		return -ENOMEM;
2443 
2444 	/* Add all the functions:
2445 	 * This is a little bit ugly. We need to call a potentially sleeping
2446 	 * callback for each NAN function, so we can't hold the spinlock.
2447 	 */
2448 	spin_lock_bh(&sdata->u.nan.func_lock);
2449 
2450 	idr_for_each_entry(&sdata->u.nan.function_inst_ids, func, id)
2451 		funcs[i++] = func;
2452 
2453 	spin_unlock_bh(&sdata->u.nan.func_lock);
2454 
2455 	for (i = 0; funcs[i]; i++) {
2456 		res = drv_add_nan_func(sdata->local, sdata, funcs[i]);
2457 		if (WARN_ON(res))
2458 			ieee80211_nan_func_terminated(&sdata->vif,
2459 						      funcs[i]->instance_id,
2460 						      NL80211_NAN_FUNC_TERM_REASON_ERROR,
2461 						      GFP_KERNEL);
2462 	}
2463 
2464 	kfree(funcs);
2465 
2466 	return 0;
2467 }
2468 
ieee80211_reconfig_ap_links(struct ieee80211_local * local,struct ieee80211_sub_if_data * sdata,u64 changed)2469 static void ieee80211_reconfig_ap_links(struct ieee80211_local *local,
2470 					struct ieee80211_sub_if_data *sdata,
2471 					u64 changed)
2472 {
2473 	int link_id;
2474 
2475 	for (link_id = 0; link_id < ARRAY_SIZE(sdata->link); link_id++) {
2476 		struct ieee80211_link_data *link;
2477 
2478 		if (!(sdata->vif.active_links & BIT(link_id)))
2479 			continue;
2480 
2481 		link = sdata_dereference(sdata->link[link_id], sdata);
2482 		if (!link)
2483 			continue;
2484 
2485 		if (rcu_access_pointer(link->u.ap.beacon))
2486 			drv_start_ap(local, sdata, link->conf);
2487 
2488 		if (!link->conf->enable_beacon)
2489 			continue;
2490 
2491 		changed |= BSS_CHANGED_BEACON |
2492 			   BSS_CHANGED_BEACON_ENABLED;
2493 
2494 		ieee80211_link_info_change_notify(sdata, link, changed);
2495 	}
2496 }
2497 
ieee80211_reconfig(struct ieee80211_local * local)2498 int ieee80211_reconfig(struct ieee80211_local *local)
2499 {
2500 	struct ieee80211_hw *hw = &local->hw;
2501 	struct ieee80211_sub_if_data *sdata;
2502 	struct ieee80211_chanctx *ctx;
2503 	struct sta_info *sta;
2504 	int res, i;
2505 	bool reconfig_due_to_wowlan = false;
2506 	struct ieee80211_sub_if_data *sched_scan_sdata;
2507 	struct cfg80211_sched_scan_request *sched_scan_req;
2508 	bool sched_scan_stopped = false;
2509 	bool suspended = local->suspended;
2510 	bool in_reconfig = false;
2511 
2512 	/* nothing to do if HW shouldn't run */
2513 	if (!local->open_count)
2514 		goto wake_up;
2515 
2516 #ifdef CONFIG_PM
2517 	if (suspended)
2518 		local->resuming = true;
2519 
2520 	if (local->wowlan) {
2521 		/*
2522 		 * In the wowlan case, both mac80211 and the device
2523 		 * are functional when the resume op is called, so
2524 		 * clear local->suspended so the device could operate
2525 		 * normally (e.g. pass rx frames).
2526 		 */
2527 		local->suspended = false;
2528 		res = drv_resume(local);
2529 		local->wowlan = false;
2530 		if (res < 0) {
2531 			local->resuming = false;
2532 			return res;
2533 		}
2534 		if (res == 0)
2535 			goto wake_up;
2536 		WARN_ON(res > 1);
2537 		/*
2538 		 * res is 1, which means the driver requested
2539 		 * to go through a regular reset on wakeup.
2540 		 * restore local->suspended in this case.
2541 		 */
2542 		reconfig_due_to_wowlan = true;
2543 		local->suspended = true;
2544 	}
2545 #endif
2546 
2547 	/*
2548 	 * In case of hw_restart during suspend (without wowlan),
2549 	 * cancel restart work, as we are reconfiguring the device
2550 	 * anyway.
2551 	 * Note that restart_work is scheduled on a frozen workqueue,
2552 	 * so we can't deadlock in this case.
2553 	 */
2554 	if (suspended && local->in_reconfig && !reconfig_due_to_wowlan)
2555 		cancel_work_sync(&local->restart_work);
2556 
2557 	local->started = false;
2558 
2559 	/*
2560 	 * Upon resume hardware can sometimes be goofy due to
2561 	 * various platform / driver / bus issues, so restarting
2562 	 * the device may at times not work immediately. Propagate
2563 	 * the error.
2564 	 */
2565 	res = drv_start(local);
2566 	if (res) {
2567 		if (suspended)
2568 			WARN(1, "Hardware became unavailable upon resume. This could be a software issue prior to suspend or a hardware issue.\n");
2569 		else
2570 			WARN(1, "Hardware became unavailable during restart.\n");
2571 		ieee80211_handle_reconfig_failure(local);
2572 		return res;
2573 	}
2574 
2575 	/* setup fragmentation threshold */
2576 	drv_set_frag_threshold(local, hw->wiphy->frag_threshold);
2577 
2578 	/* setup RTS threshold */
2579 	drv_set_rts_threshold(local, hw->wiphy->rts_threshold);
2580 
2581 	/* reset coverage class */
2582 	drv_set_coverage_class(local, hw->wiphy->coverage_class);
2583 
2584 	ieee80211_led_radio(local, true);
2585 	ieee80211_mod_tpt_led_trig(local,
2586 				   IEEE80211_TPT_LEDTRIG_FL_RADIO, 0);
2587 
2588 	/* add interfaces */
2589 	sdata = wiphy_dereference(local->hw.wiphy, local->monitor_sdata);
2590 	if (sdata) {
2591 		/* in HW restart it exists already */
2592 		WARN_ON(local->resuming);
2593 		res = drv_add_interface(local, sdata);
2594 		if (WARN_ON(res)) {
2595 			RCU_INIT_POINTER(local->monitor_sdata, NULL);
2596 			synchronize_net();
2597 			kfree(sdata);
2598 		}
2599 	}
2600 
2601 	list_for_each_entry(sdata, &local->interfaces, list) {
2602 		if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2603 		    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
2604 		    ieee80211_sdata_running(sdata)) {
2605 			res = drv_add_interface(local, sdata);
2606 			if (WARN_ON(res))
2607 				break;
2608 		}
2609 	}
2610 
2611 	/* If adding any of the interfaces failed above, roll back and
2612 	 * report failure.
2613 	 */
2614 	if (res) {
2615 		list_for_each_entry_continue_reverse(sdata, &local->interfaces,
2616 						     list)
2617 			if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2618 			    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
2619 			    ieee80211_sdata_running(sdata))
2620 				drv_remove_interface(local, sdata);
2621 		ieee80211_handle_reconfig_failure(local);
2622 		return res;
2623 	}
2624 
2625 	/* add channel contexts */
2626 	if (local->use_chanctx) {
2627 		mutex_lock(&local->chanctx_mtx);
2628 		list_for_each_entry(ctx, &local->chanctx_list, list)
2629 			if (ctx->replace_state !=
2630 			    IEEE80211_CHANCTX_REPLACES_OTHER)
2631 				WARN_ON(drv_add_chanctx(local, ctx));
2632 		mutex_unlock(&local->chanctx_mtx);
2633 
2634 		sdata = wiphy_dereference(local->hw.wiphy,
2635 					  local->monitor_sdata);
2636 		if (sdata && ieee80211_sdata_running(sdata))
2637 			ieee80211_assign_chanctx(local, sdata, &sdata->deflink);
2638 	}
2639 
2640 	/* reconfigure hardware */
2641 	ieee80211_hw_config(local, ~0);
2642 
2643 	ieee80211_configure_filter(local);
2644 
2645 	/* Finally also reconfigure all the BSS information */
2646 	list_for_each_entry(sdata, &local->interfaces, list) {
2647 		/* common change flags for all interface types - link only */
2648 		u64 changed = BSS_CHANGED_ERP_CTS_PROT |
2649 			      BSS_CHANGED_ERP_PREAMBLE |
2650 			      BSS_CHANGED_ERP_SLOT |
2651 			      BSS_CHANGED_HT |
2652 			      BSS_CHANGED_BASIC_RATES |
2653 			      BSS_CHANGED_BEACON_INT |
2654 			      BSS_CHANGED_BSSID |
2655 			      BSS_CHANGED_CQM |
2656 			      BSS_CHANGED_QOS |
2657 			      BSS_CHANGED_TXPOWER |
2658 			      BSS_CHANGED_MCAST_RATE;
2659 		struct ieee80211_link_data *link = NULL;
2660 		unsigned int link_id;
2661 		u32 active_links = 0;
2662 
2663 		if (!ieee80211_sdata_running(sdata))
2664 			continue;
2665 
2666 		sdata_lock(sdata);
2667 		if (ieee80211_vif_is_mld(&sdata->vif)) {
2668 			struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS] = {
2669 				[0] = &sdata->vif.bss_conf,
2670 			};
2671 
2672 			if (sdata->vif.type == NL80211_IFTYPE_STATION) {
2673 				/* start with a single active link */
2674 				active_links = sdata->vif.active_links;
2675 				link_id = ffs(active_links) - 1;
2676 				sdata->vif.active_links = BIT(link_id);
2677 			}
2678 
2679 			drv_change_vif_links(local, sdata, 0,
2680 					     sdata->vif.active_links,
2681 					     old);
2682 		}
2683 
2684 		for (link_id = 0;
2685 		     link_id < ARRAY_SIZE(sdata->vif.link_conf);
2686 		     link_id++) {
2687 			if (ieee80211_vif_is_mld(&sdata->vif) &&
2688 			    !(sdata->vif.active_links & BIT(link_id)))
2689 				continue;
2690 
2691 			link = sdata_dereference(sdata->link[link_id], sdata);
2692 			if (!link)
2693 				continue;
2694 
2695 			ieee80211_assign_chanctx(local, sdata, link);
2696 		}
2697 
2698 		switch (sdata->vif.type) {
2699 		case NL80211_IFTYPE_AP_VLAN:
2700 		case NL80211_IFTYPE_MONITOR:
2701 			break;
2702 		case NL80211_IFTYPE_ADHOC:
2703 			if (sdata->vif.cfg.ibss_joined)
2704 				WARN_ON(drv_join_ibss(local, sdata));
2705 			fallthrough;
2706 		default:
2707 			ieee80211_reconfig_stations(sdata);
2708 			fallthrough;
2709 		case NL80211_IFTYPE_AP: /* AP stations are handled later */
2710 			for (i = 0; i < IEEE80211_NUM_ACS; i++)
2711 				drv_conf_tx(local, &sdata->deflink, i,
2712 					    &sdata->deflink.tx_conf[i]);
2713 			break;
2714 		}
2715 
2716 		if (sdata->vif.bss_conf.mu_mimo_owner)
2717 			changed |= BSS_CHANGED_MU_GROUPS;
2718 
2719 		if (!ieee80211_vif_is_mld(&sdata->vif))
2720 			changed |= BSS_CHANGED_IDLE;
2721 
2722 		switch (sdata->vif.type) {
2723 		case NL80211_IFTYPE_STATION:
2724 			if (!ieee80211_vif_is_mld(&sdata->vif)) {
2725 				changed |= BSS_CHANGED_ASSOC |
2726 					   BSS_CHANGED_ARP_FILTER |
2727 					   BSS_CHANGED_PS;
2728 
2729 				/* Re-send beacon info report to the driver */
2730 				if (sdata->deflink.u.mgd.have_beacon)
2731 					changed |= BSS_CHANGED_BEACON_INFO;
2732 
2733 				if (sdata->vif.bss_conf.max_idle_period ||
2734 				    sdata->vif.bss_conf.protected_keep_alive)
2735 					changed |= BSS_CHANGED_KEEP_ALIVE;
2736 
2737 				if (sdata->vif.bss_conf.eht_puncturing)
2738 					changed |= BSS_CHANGED_EHT_PUNCTURING;
2739 
2740 				ieee80211_bss_info_change_notify(sdata,
2741 								 changed);
2742 			} else if (!WARN_ON(!link)) {
2743 				ieee80211_link_info_change_notify(sdata, link,
2744 								  changed);
2745 				changed = BSS_CHANGED_ASSOC |
2746 					  BSS_CHANGED_IDLE |
2747 					  BSS_CHANGED_PS |
2748 					  BSS_CHANGED_ARP_FILTER;
2749 				ieee80211_vif_cfg_change_notify(sdata, changed);
2750 			}
2751 			break;
2752 		case NL80211_IFTYPE_OCB:
2753 			changed |= BSS_CHANGED_OCB;
2754 			ieee80211_bss_info_change_notify(sdata, changed);
2755 			break;
2756 		case NL80211_IFTYPE_ADHOC:
2757 			changed |= BSS_CHANGED_IBSS;
2758 			fallthrough;
2759 		case NL80211_IFTYPE_AP:
2760 			changed |= BSS_CHANGED_P2P_PS;
2761 
2762 			if (ieee80211_vif_is_mld(&sdata->vif))
2763 				ieee80211_vif_cfg_change_notify(sdata,
2764 								BSS_CHANGED_SSID);
2765 			else
2766 				changed |= BSS_CHANGED_SSID;
2767 
2768 			if (sdata->vif.bss_conf.ftm_responder == 1 &&
2769 			    wiphy_ext_feature_isset(sdata->local->hw.wiphy,
2770 					NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
2771 				changed |= BSS_CHANGED_FTM_RESPONDER;
2772 
2773 			if (sdata->vif.type == NL80211_IFTYPE_AP) {
2774 				changed |= BSS_CHANGED_AP_PROBE_RESP;
2775 
2776 				if (ieee80211_vif_is_mld(&sdata->vif)) {
2777 					ieee80211_reconfig_ap_links(local,
2778 								    sdata,
2779 								    changed);
2780 					break;
2781 				}
2782 
2783 				if (rcu_access_pointer(sdata->deflink.u.ap.beacon))
2784 					drv_start_ap(local, sdata,
2785 						     sdata->deflink.conf);
2786 			}
2787 			fallthrough;
2788 		case NL80211_IFTYPE_MESH_POINT:
2789 			if (sdata->vif.bss_conf.enable_beacon) {
2790 				changed |= BSS_CHANGED_BEACON |
2791 					   BSS_CHANGED_BEACON_ENABLED;
2792 				ieee80211_bss_info_change_notify(sdata, changed);
2793 			}
2794 			break;
2795 		case NL80211_IFTYPE_NAN:
2796 			res = ieee80211_reconfig_nan(sdata);
2797 			if (res < 0) {
2798 				sdata_unlock(sdata);
2799 				ieee80211_handle_reconfig_failure(local);
2800 				return res;
2801 			}
2802 			break;
2803 		case NL80211_IFTYPE_AP_VLAN:
2804 		case NL80211_IFTYPE_MONITOR:
2805 		case NL80211_IFTYPE_P2P_DEVICE:
2806 			/* nothing to do */
2807 			break;
2808 		case NL80211_IFTYPE_UNSPECIFIED:
2809 		case NUM_NL80211_IFTYPES:
2810 		case NL80211_IFTYPE_P2P_CLIENT:
2811 		case NL80211_IFTYPE_P2P_GO:
2812 		case NL80211_IFTYPE_WDS:
2813 			WARN_ON(1);
2814 			break;
2815 		}
2816 		sdata_unlock(sdata);
2817 
2818 		if (active_links)
2819 			ieee80211_set_active_links(&sdata->vif, active_links);
2820 	}
2821 
2822 	ieee80211_recalc_ps(local);
2823 
2824 	/*
2825 	 * The sta might be in psm against the ap (e.g. because
2826 	 * this was the state before a hw restart), so we
2827 	 * explicitly send a null packet in order to make sure
2828 	 * it'll sync against the ap (and get out of psm).
2829 	 */
2830 	if (!(local->hw.conf.flags & IEEE80211_CONF_PS)) {
2831 		list_for_each_entry(sdata, &local->interfaces, list) {
2832 			if (sdata->vif.type != NL80211_IFTYPE_STATION)
2833 				continue;
2834 			if (!sdata->u.mgd.associated)
2835 				continue;
2836 
2837 			ieee80211_send_nullfunc(local, sdata, false);
2838 		}
2839 	}
2840 
2841 	/* APs are now beaconing, add back stations */
2842 	list_for_each_entry(sdata, &local->interfaces, list) {
2843 		if (!ieee80211_sdata_running(sdata))
2844 			continue;
2845 
2846 		sdata_lock(sdata);
2847 		switch (sdata->vif.type) {
2848 		case NL80211_IFTYPE_AP_VLAN:
2849 		case NL80211_IFTYPE_AP:
2850 			ieee80211_reconfig_stations(sdata);
2851 			break;
2852 		default:
2853 			break;
2854 		}
2855 		sdata_unlock(sdata);
2856 	}
2857 
2858 	/* add back keys */
2859 	list_for_each_entry(sdata, &local->interfaces, list)
2860 		ieee80211_reenable_keys(sdata);
2861 
2862 	/* Reconfigure sched scan if it was interrupted by FW restart */
2863 	mutex_lock(&local->mtx);
2864 	sched_scan_sdata = rcu_dereference_protected(local->sched_scan_sdata,
2865 						lockdep_is_held(&local->mtx));
2866 	sched_scan_req = rcu_dereference_protected(local->sched_scan_req,
2867 						lockdep_is_held(&local->mtx));
2868 	if (sched_scan_sdata && sched_scan_req)
2869 		/*
2870 		 * Sched scan stopped, but we don't want to report it. Instead,
2871 		 * we're trying to reschedule. However, if more than one scan
2872 		 * plan was set, we cannot reschedule since we don't know which
2873 		 * scan plan was currently running (and some scan plans may have
2874 		 * already finished).
2875 		 */
2876 		if (sched_scan_req->n_scan_plans > 1 ||
2877 		    __ieee80211_request_sched_scan_start(sched_scan_sdata,
2878 							 sched_scan_req)) {
2879 			RCU_INIT_POINTER(local->sched_scan_sdata, NULL);
2880 			RCU_INIT_POINTER(local->sched_scan_req, NULL);
2881 			sched_scan_stopped = true;
2882 		}
2883 	mutex_unlock(&local->mtx);
2884 
2885 	if (sched_scan_stopped)
2886 		cfg80211_sched_scan_stopped_locked(local->hw.wiphy, 0);
2887 
2888  wake_up:
2889 
2890 	if (local->monitors == local->open_count && local->monitors > 0)
2891 		ieee80211_add_virtual_monitor(local);
2892 
2893 	/*
2894 	 * Clear the WLAN_STA_BLOCK_BA flag so new aggregation
2895 	 * sessions can be established after a resume.
2896 	 *
2897 	 * Also tear down aggregation sessions since reconfiguring
2898 	 * them in a hardware restart scenario is not easily done
2899 	 * right now, and the hardware will have lost information
2900 	 * about the sessions, but we and the AP still think they
2901 	 * are active. This is really a workaround though.
2902 	 */
2903 	if (ieee80211_hw_check(hw, AMPDU_AGGREGATION)) {
2904 		mutex_lock(&local->sta_mtx);
2905 
2906 		list_for_each_entry(sta, &local->sta_list, list) {
2907 			if (!local->resuming)
2908 				ieee80211_sta_tear_down_BA_sessions(
2909 						sta, AGG_STOP_LOCAL_REQUEST);
2910 			clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
2911 		}
2912 
2913 		mutex_unlock(&local->sta_mtx);
2914 	}
2915 
2916 	/*
2917 	 * If this is for hw restart things are still running.
2918 	 * We may want to change that later, however.
2919 	 */
2920 	if (local->open_count && (!suspended || reconfig_due_to_wowlan))
2921 		drv_reconfig_complete(local, IEEE80211_RECONFIG_TYPE_RESTART);
2922 
2923 	if (local->in_reconfig) {
2924 		in_reconfig = local->in_reconfig;
2925 		local->in_reconfig = false;
2926 		barrier();
2927 
2928 		/* Restart deferred ROCs */
2929 		mutex_lock(&local->mtx);
2930 		ieee80211_start_next_roc(local);
2931 		mutex_unlock(&local->mtx);
2932 
2933 		/* Requeue all works */
2934 		list_for_each_entry(sdata, &local->interfaces, list)
2935 			wiphy_work_queue(local->hw.wiphy, &sdata->work);
2936 	}
2937 
2938 	ieee80211_wake_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP,
2939 					IEEE80211_QUEUE_STOP_REASON_SUSPEND,
2940 					false);
2941 
2942 	if (in_reconfig) {
2943 		list_for_each_entry(sdata, &local->interfaces, list) {
2944 			if (!ieee80211_sdata_running(sdata))
2945 				continue;
2946 			if (sdata->vif.type == NL80211_IFTYPE_STATION)
2947 				ieee80211_sta_restart(sdata);
2948 		}
2949 	}
2950 
2951 	if (!suspended)
2952 		return 0;
2953 
2954 #ifdef CONFIG_PM
2955 	/* first set suspended false, then resuming */
2956 	local->suspended = false;
2957 	mb();
2958 	local->resuming = false;
2959 
2960 	ieee80211_flush_completed_scan(local, false);
2961 
2962 	if (local->open_count && !reconfig_due_to_wowlan)
2963 		drv_reconfig_complete(local, IEEE80211_RECONFIG_TYPE_SUSPEND);
2964 
2965 	list_for_each_entry(sdata, &local->interfaces, list) {
2966 		if (!ieee80211_sdata_running(sdata))
2967 			continue;
2968 		if (sdata->vif.type == NL80211_IFTYPE_STATION)
2969 			ieee80211_sta_restart(sdata);
2970 	}
2971 
2972 	mod_timer(&local->sta_cleanup, jiffies + 1);
2973 #else
2974 	WARN_ON(1);
2975 #endif
2976 
2977 	return 0;
2978 }
2979 
ieee80211_reconfig_disconnect(struct ieee80211_vif * vif,u8 flag)2980 static void ieee80211_reconfig_disconnect(struct ieee80211_vif *vif, u8 flag)
2981 {
2982 	struct ieee80211_sub_if_data *sdata;
2983 	struct ieee80211_local *local;
2984 	struct ieee80211_key *key;
2985 
2986 	if (WARN_ON(!vif))
2987 		return;
2988 
2989 	sdata = vif_to_sdata(vif);
2990 	local = sdata->local;
2991 
2992 	if (WARN_ON(flag & IEEE80211_SDATA_DISCONNECT_RESUME &&
2993 		    !local->resuming))
2994 		return;
2995 
2996 	if (WARN_ON(flag & IEEE80211_SDATA_DISCONNECT_HW_RESTART &&
2997 		    !local->in_reconfig))
2998 		return;
2999 
3000 	if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
3001 		return;
3002 
3003 	sdata->flags |= flag;
3004 
3005 	mutex_lock(&local->key_mtx);
3006 	list_for_each_entry(key, &sdata->key_list, list)
3007 		key->flags |= KEY_FLAG_TAINTED;
3008 	mutex_unlock(&local->key_mtx);
3009 }
3010 
ieee80211_hw_restart_disconnect(struct ieee80211_vif * vif)3011 void ieee80211_hw_restart_disconnect(struct ieee80211_vif *vif)
3012 {
3013 	ieee80211_reconfig_disconnect(vif, IEEE80211_SDATA_DISCONNECT_HW_RESTART);
3014 }
3015 EXPORT_SYMBOL_GPL(ieee80211_hw_restart_disconnect);
3016 
ieee80211_resume_disconnect(struct ieee80211_vif * vif)3017 void ieee80211_resume_disconnect(struct ieee80211_vif *vif)
3018 {
3019 	ieee80211_reconfig_disconnect(vif, IEEE80211_SDATA_DISCONNECT_RESUME);
3020 }
3021 EXPORT_SYMBOL_GPL(ieee80211_resume_disconnect);
3022 
ieee80211_recalc_smps(struct ieee80211_sub_if_data * sdata,struct ieee80211_link_data * link)3023 void ieee80211_recalc_smps(struct ieee80211_sub_if_data *sdata,
3024 			   struct ieee80211_link_data *link)
3025 {
3026 	struct ieee80211_local *local = sdata->local;
3027 	struct ieee80211_chanctx_conf *chanctx_conf;
3028 	struct ieee80211_chanctx *chanctx;
3029 
3030 	mutex_lock(&local->chanctx_mtx);
3031 
3032 	chanctx_conf = rcu_dereference_protected(link->conf->chanctx_conf,
3033 						 lockdep_is_held(&local->chanctx_mtx));
3034 
3035 	/*
3036 	 * This function can be called from a work, thus it may be possible
3037 	 * that the chanctx_conf is removed (due to a disconnection, for
3038 	 * example).
3039 	 * So nothing should be done in such case.
3040 	 */
3041 	if (!chanctx_conf)
3042 		goto unlock;
3043 
3044 	chanctx = container_of(chanctx_conf, struct ieee80211_chanctx, conf);
3045 	ieee80211_recalc_smps_chanctx(local, chanctx);
3046  unlock:
3047 	mutex_unlock(&local->chanctx_mtx);
3048 }
3049 
ieee80211_recalc_min_chandef(struct ieee80211_sub_if_data * sdata,int link_id)3050 void ieee80211_recalc_min_chandef(struct ieee80211_sub_if_data *sdata,
3051 				  int link_id)
3052 {
3053 	struct ieee80211_local *local = sdata->local;
3054 	struct ieee80211_chanctx_conf *chanctx_conf;
3055 	struct ieee80211_chanctx *chanctx;
3056 	int i;
3057 
3058 	mutex_lock(&local->chanctx_mtx);
3059 
3060 	for (i = 0; i < ARRAY_SIZE(sdata->vif.link_conf); i++) {
3061 		struct ieee80211_bss_conf *bss_conf;
3062 
3063 		if (link_id >= 0 && link_id != i)
3064 			continue;
3065 
3066 		rcu_read_lock();
3067 		bss_conf = rcu_dereference(sdata->vif.link_conf[i]);
3068 		if (!bss_conf) {
3069 			rcu_read_unlock();
3070 			continue;
3071 		}
3072 
3073 		chanctx_conf = rcu_dereference_protected(bss_conf->chanctx_conf,
3074 							 lockdep_is_held(&local->chanctx_mtx));
3075 		/*
3076 		 * Since we hold the chanctx_mtx (checked above)
3077 		 * we can take the chanctx_conf pointer out of the
3078 		 * RCU critical section, it cannot go away without
3079 		 * the mutex. Just the way we reached it could - in
3080 		 * theory - go away, but we don't really care and
3081 		 * it really shouldn't happen anyway.
3082 		 */
3083 		rcu_read_unlock();
3084 
3085 		if (!chanctx_conf)
3086 			goto unlock;
3087 
3088 		chanctx = container_of(chanctx_conf, struct ieee80211_chanctx,
3089 				       conf);
3090 		ieee80211_recalc_chanctx_min_def(local, chanctx, NULL);
3091 	}
3092  unlock:
3093 	mutex_unlock(&local->chanctx_mtx);
3094 }
3095 
ieee80211_ie_split_vendor(const u8 * ies,size_t ielen,size_t offset)3096 size_t ieee80211_ie_split_vendor(const u8 *ies, size_t ielen, size_t offset)
3097 {
3098 	size_t pos = offset;
3099 
3100 	while (pos < ielen && ies[pos] != WLAN_EID_VENDOR_SPECIFIC)
3101 		pos += 2 + ies[pos + 1];
3102 
3103 	return pos;
3104 }
3105 
ieee80211_ie_build_s1g_cap(u8 * pos,struct ieee80211_sta_s1g_cap * s1g_cap)3106 u8 *ieee80211_ie_build_s1g_cap(u8 *pos, struct ieee80211_sta_s1g_cap *s1g_cap)
3107 {
3108 	*pos++ = WLAN_EID_S1G_CAPABILITIES;
3109 	*pos++ = sizeof(struct ieee80211_s1g_cap);
3110 	memset(pos, 0, sizeof(struct ieee80211_s1g_cap));
3111 
3112 	memcpy(pos, &s1g_cap->cap, sizeof(s1g_cap->cap));
3113 	pos += sizeof(s1g_cap->cap);
3114 
3115 	memcpy(pos, &s1g_cap->nss_mcs, sizeof(s1g_cap->nss_mcs));
3116 	pos += sizeof(s1g_cap->nss_mcs);
3117 
3118 	return pos;
3119 }
3120 
ieee80211_ie_build_ht_cap(u8 * pos,struct ieee80211_sta_ht_cap * ht_cap,u16 cap)3121 u8 *ieee80211_ie_build_ht_cap(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
3122 			      u16 cap)
3123 {
3124 	__le16 tmp;
3125 
3126 	*pos++ = WLAN_EID_HT_CAPABILITY;
3127 	*pos++ = sizeof(struct ieee80211_ht_cap);
3128 	memset(pos, 0, sizeof(struct ieee80211_ht_cap));
3129 
3130 	/* capability flags */
3131 	tmp = cpu_to_le16(cap);
3132 	memcpy(pos, &tmp, sizeof(u16));
3133 	pos += sizeof(u16);
3134 
3135 	/* AMPDU parameters */
3136 	*pos++ = ht_cap->ampdu_factor |
3137 		 (ht_cap->ampdu_density <<
3138 			IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT);
3139 
3140 	/* MCS set */
3141 	memcpy(pos, &ht_cap->mcs, sizeof(ht_cap->mcs));
3142 	pos += sizeof(ht_cap->mcs);
3143 
3144 	/* extended capabilities */
3145 	pos += sizeof(__le16);
3146 
3147 	/* BF capabilities */
3148 	pos += sizeof(__le32);
3149 
3150 	/* antenna selection */
3151 	pos += sizeof(u8);
3152 
3153 	return pos;
3154 }
3155 
ieee80211_ie_build_vht_cap(u8 * pos,struct ieee80211_sta_vht_cap * vht_cap,u32 cap)3156 u8 *ieee80211_ie_build_vht_cap(u8 *pos, struct ieee80211_sta_vht_cap *vht_cap,
3157 			       u32 cap)
3158 {
3159 	__le32 tmp;
3160 
3161 	*pos++ = WLAN_EID_VHT_CAPABILITY;
3162 	*pos++ = sizeof(struct ieee80211_vht_cap);
3163 	memset(pos, 0, sizeof(struct ieee80211_vht_cap));
3164 
3165 	/* capability flags */
3166 	tmp = cpu_to_le32(cap);
3167 	memcpy(pos, &tmp, sizeof(u32));
3168 	pos += sizeof(u32);
3169 
3170 	/* VHT MCS set */
3171 	memcpy(pos, &vht_cap->vht_mcs, sizeof(vht_cap->vht_mcs));
3172 	pos += sizeof(vht_cap->vht_mcs);
3173 
3174 	return pos;
3175 }
3176 
ieee80211_ie_len_he_cap(struct ieee80211_sub_if_data * sdata,u8 iftype)3177 u8 ieee80211_ie_len_he_cap(struct ieee80211_sub_if_data *sdata, u8 iftype)
3178 {
3179 	const struct ieee80211_sta_he_cap *he_cap;
3180 	struct ieee80211_supported_band *sband;
3181 	u8 n;
3182 
3183 	sband = ieee80211_get_sband(sdata);
3184 	if (!sband)
3185 		return 0;
3186 
3187 	he_cap = ieee80211_get_he_iftype_cap(sband, iftype);
3188 	if (!he_cap)
3189 		return 0;
3190 
3191 	n = ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem);
3192 	return 2 + 1 +
3193 	       sizeof(he_cap->he_cap_elem) + n +
3194 	       ieee80211_he_ppe_size(he_cap->ppe_thres[0],
3195 				     he_cap->he_cap_elem.phy_cap_info);
3196 }
3197 
ieee80211_ie_build_he_cap(ieee80211_conn_flags_t disable_flags,u8 * pos,const struct ieee80211_sta_he_cap * he_cap,u8 * end)3198 u8 *ieee80211_ie_build_he_cap(ieee80211_conn_flags_t disable_flags, u8 *pos,
3199 			      const struct ieee80211_sta_he_cap *he_cap,
3200 			      u8 *end)
3201 {
3202 	struct ieee80211_he_cap_elem elem;
3203 	u8 n;
3204 	u8 ie_len;
3205 	u8 *orig_pos = pos;
3206 
3207 	/* Make sure we have place for the IE */
3208 	/*
3209 	 * TODO: the 1 added is because this temporarily is under the EXTENSION
3210 	 * IE. Get rid of it when it moves.
3211 	 */
3212 	if (!he_cap)
3213 		return orig_pos;
3214 
3215 	/* modify on stack first to calculate 'n' and 'ie_len' correctly */
3216 	elem = he_cap->he_cap_elem;
3217 
3218 	if (disable_flags & IEEE80211_CONN_DISABLE_40MHZ)
3219 		elem.phy_cap_info[0] &=
3220 			~(IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
3221 			  IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G);
3222 
3223 	if (disable_flags & IEEE80211_CONN_DISABLE_160MHZ)
3224 		elem.phy_cap_info[0] &=
3225 			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
3226 
3227 	if (disable_flags & IEEE80211_CONN_DISABLE_80P80MHZ)
3228 		elem.phy_cap_info[0] &=
3229 			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G;
3230 
3231 	n = ieee80211_he_mcs_nss_size(&elem);
3232 	ie_len = 2 + 1 +
3233 		 sizeof(he_cap->he_cap_elem) + n +
3234 		 ieee80211_he_ppe_size(he_cap->ppe_thres[0],
3235 				       he_cap->he_cap_elem.phy_cap_info);
3236 
3237 	if ((end - pos) < ie_len)
3238 		return orig_pos;
3239 
3240 	*pos++ = WLAN_EID_EXTENSION;
3241 	pos++; /* We'll set the size later below */
3242 	*pos++ = WLAN_EID_EXT_HE_CAPABILITY;
3243 
3244 	/* Fixed data */
3245 	memcpy(pos, &elem, sizeof(elem));
3246 	pos += sizeof(elem);
3247 
3248 	memcpy(pos, &he_cap->he_mcs_nss_supp, n);
3249 	pos += n;
3250 
3251 	/* Check if PPE Threshold should be present */
3252 	if ((he_cap->he_cap_elem.phy_cap_info[6] &
3253 	     IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) == 0)
3254 		goto end;
3255 
3256 	/*
3257 	 * Calculate how many PPET16/PPET8 pairs are to come. Algorithm:
3258 	 * (NSS_M1 + 1) x (num of 1 bits in RU_INDEX_BITMASK)
3259 	 */
3260 	n = hweight8(he_cap->ppe_thres[0] &
3261 		     IEEE80211_PPE_THRES_RU_INDEX_BITMASK_MASK);
3262 	n *= (1 + ((he_cap->ppe_thres[0] & IEEE80211_PPE_THRES_NSS_MASK) >>
3263 		   IEEE80211_PPE_THRES_NSS_POS));
3264 
3265 	/*
3266 	 * Each pair is 6 bits, and we need to add the 7 "header" bits to the
3267 	 * total size.
3268 	 */
3269 	n = (n * IEEE80211_PPE_THRES_INFO_PPET_SIZE * 2) + 7;
3270 	n = DIV_ROUND_UP(n, 8);
3271 
3272 	/* Copy PPE Thresholds */
3273 	memcpy(pos, &he_cap->ppe_thres, n);
3274 	pos += n;
3275 
3276 end:
3277 	orig_pos[1] = (pos - orig_pos) - 2;
3278 	return pos;
3279 }
3280 
ieee80211_ie_build_he_6ghz_cap(struct ieee80211_sub_if_data * sdata,enum ieee80211_smps_mode smps_mode,struct sk_buff * skb)3281 void ieee80211_ie_build_he_6ghz_cap(struct ieee80211_sub_if_data *sdata,
3282 				    enum ieee80211_smps_mode smps_mode,
3283 				    struct sk_buff *skb)
3284 {
3285 	struct ieee80211_supported_band *sband;
3286 	const struct ieee80211_sband_iftype_data *iftd;
3287 	enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
3288 	u8 *pos;
3289 	u16 cap;
3290 
3291 	if (!cfg80211_any_usable_channels(sdata->local->hw.wiphy,
3292 					  BIT(NL80211_BAND_6GHZ),
3293 					  IEEE80211_CHAN_NO_HE))
3294 		return;
3295 
3296 	sband = sdata->local->hw.wiphy->bands[NL80211_BAND_6GHZ];
3297 
3298 	iftd = ieee80211_get_sband_iftype_data(sband, iftype);
3299 	if (!iftd)
3300 		return;
3301 
3302 	/* Check for device HE 6 GHz capability before adding element */
3303 	if (!iftd->he_6ghz_capa.capa)
3304 		return;
3305 
3306 	cap = le16_to_cpu(iftd->he_6ghz_capa.capa);
3307 	cap &= ~IEEE80211_HE_6GHZ_CAP_SM_PS;
3308 
3309 	switch (smps_mode) {
3310 	case IEEE80211_SMPS_AUTOMATIC:
3311 	case IEEE80211_SMPS_NUM_MODES:
3312 		WARN_ON(1);
3313 		fallthrough;
3314 	case IEEE80211_SMPS_OFF:
3315 		cap |= u16_encode_bits(WLAN_HT_CAP_SM_PS_DISABLED,
3316 				       IEEE80211_HE_6GHZ_CAP_SM_PS);
3317 		break;
3318 	case IEEE80211_SMPS_STATIC:
3319 		cap |= u16_encode_bits(WLAN_HT_CAP_SM_PS_STATIC,
3320 				       IEEE80211_HE_6GHZ_CAP_SM_PS);
3321 		break;
3322 	case IEEE80211_SMPS_DYNAMIC:
3323 		cap |= u16_encode_bits(WLAN_HT_CAP_SM_PS_DYNAMIC,
3324 				       IEEE80211_HE_6GHZ_CAP_SM_PS);
3325 		break;
3326 	}
3327 
3328 	pos = skb_put(skb, 2 + 1 + sizeof(cap));
3329 	ieee80211_write_he_6ghz_cap(pos, cpu_to_le16(cap),
3330 				    pos + 2 + 1 + sizeof(cap));
3331 }
3332 
ieee80211_ie_build_ht_oper(u8 * pos,struct ieee80211_sta_ht_cap * ht_cap,const struct cfg80211_chan_def * chandef,u16 prot_mode,bool rifs_mode)3333 u8 *ieee80211_ie_build_ht_oper(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
3334 			       const struct cfg80211_chan_def *chandef,
3335 			       u16 prot_mode, bool rifs_mode)
3336 {
3337 	struct ieee80211_ht_operation *ht_oper;
3338 	/* Build HT Information */
3339 	*pos++ = WLAN_EID_HT_OPERATION;
3340 	*pos++ = sizeof(struct ieee80211_ht_operation);
3341 	ht_oper = (struct ieee80211_ht_operation *)pos;
3342 	ht_oper->primary_chan = ieee80211_frequency_to_channel(
3343 					chandef->chan->center_freq);
3344 	switch (chandef->width) {
3345 	case NL80211_CHAN_WIDTH_160:
3346 	case NL80211_CHAN_WIDTH_80P80:
3347 	case NL80211_CHAN_WIDTH_80:
3348 	case NL80211_CHAN_WIDTH_40:
3349 		if (chandef->center_freq1 > chandef->chan->center_freq)
3350 			ht_oper->ht_param = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
3351 		else
3352 			ht_oper->ht_param = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
3353 		break;
3354 	case NL80211_CHAN_WIDTH_320:
3355 		/* HT information element should not be included on 6GHz */
3356 		WARN_ON(1);
3357 		return pos;
3358 	default:
3359 		ht_oper->ht_param = IEEE80211_HT_PARAM_CHA_SEC_NONE;
3360 		break;
3361 	}
3362 	if (ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 &&
3363 	    chandef->width != NL80211_CHAN_WIDTH_20_NOHT &&
3364 	    chandef->width != NL80211_CHAN_WIDTH_20)
3365 		ht_oper->ht_param |= IEEE80211_HT_PARAM_CHAN_WIDTH_ANY;
3366 
3367 	if (rifs_mode)
3368 		ht_oper->ht_param |= IEEE80211_HT_PARAM_RIFS_MODE;
3369 
3370 	ht_oper->operation_mode = cpu_to_le16(prot_mode);
3371 	ht_oper->stbc_param = 0x0000;
3372 
3373 	/* It seems that Basic MCS set and Supported MCS set
3374 	   are identical for the first 10 bytes */
3375 	memset(&ht_oper->basic_set, 0, 16);
3376 	memcpy(&ht_oper->basic_set, &ht_cap->mcs, 10);
3377 
3378 	return pos + sizeof(struct ieee80211_ht_operation);
3379 }
3380 
ieee80211_ie_build_wide_bw_cs(u8 * pos,const struct cfg80211_chan_def * chandef)3381 void ieee80211_ie_build_wide_bw_cs(u8 *pos,
3382 				   const struct cfg80211_chan_def *chandef)
3383 {
3384 	*pos++ = WLAN_EID_WIDE_BW_CHANNEL_SWITCH;	/* EID */
3385 	*pos++ = 3;					/* IE length */
3386 	/* New channel width */
3387 	switch (chandef->width) {
3388 	case NL80211_CHAN_WIDTH_80:
3389 		*pos++ = IEEE80211_VHT_CHANWIDTH_80MHZ;
3390 		break;
3391 	case NL80211_CHAN_WIDTH_160:
3392 		*pos++ = IEEE80211_VHT_CHANWIDTH_160MHZ;
3393 		break;
3394 	case NL80211_CHAN_WIDTH_80P80:
3395 		*pos++ = IEEE80211_VHT_CHANWIDTH_80P80MHZ;
3396 		break;
3397 	case NL80211_CHAN_WIDTH_320:
3398 		/* The behavior is not defined for 320 MHz channels */
3399 		WARN_ON(1);
3400 		fallthrough;
3401 	default:
3402 		*pos++ = IEEE80211_VHT_CHANWIDTH_USE_HT;
3403 	}
3404 
3405 	/* new center frequency segment 0 */
3406 	*pos++ = ieee80211_frequency_to_channel(chandef->center_freq1);
3407 	/* new center frequency segment 1 */
3408 	if (chandef->center_freq2)
3409 		*pos++ = ieee80211_frequency_to_channel(chandef->center_freq2);
3410 	else
3411 		*pos++ = 0;
3412 }
3413 
ieee80211_ie_build_vht_oper(u8 * pos,struct ieee80211_sta_vht_cap * vht_cap,const struct cfg80211_chan_def * chandef)3414 u8 *ieee80211_ie_build_vht_oper(u8 *pos, struct ieee80211_sta_vht_cap *vht_cap,
3415 				const struct cfg80211_chan_def *chandef)
3416 {
3417 	struct ieee80211_vht_operation *vht_oper;
3418 
3419 	*pos++ = WLAN_EID_VHT_OPERATION;
3420 	*pos++ = sizeof(struct ieee80211_vht_operation);
3421 	vht_oper = (struct ieee80211_vht_operation *)pos;
3422 	vht_oper->center_freq_seg0_idx = ieee80211_frequency_to_channel(
3423 							chandef->center_freq1);
3424 	if (chandef->center_freq2)
3425 		vht_oper->center_freq_seg1_idx =
3426 			ieee80211_frequency_to_channel(chandef->center_freq2);
3427 	else
3428 		vht_oper->center_freq_seg1_idx = 0x00;
3429 
3430 	switch (chandef->width) {
3431 	case NL80211_CHAN_WIDTH_160:
3432 		/*
3433 		 * Convert 160 MHz channel width to new style as interop
3434 		 * workaround.
3435 		 */
3436 		vht_oper->chan_width = IEEE80211_VHT_CHANWIDTH_80MHZ;
3437 		vht_oper->center_freq_seg1_idx = vht_oper->center_freq_seg0_idx;
3438 		if (chandef->chan->center_freq < chandef->center_freq1)
3439 			vht_oper->center_freq_seg0_idx -= 8;
3440 		else
3441 			vht_oper->center_freq_seg0_idx += 8;
3442 		break;
3443 	case NL80211_CHAN_WIDTH_80P80:
3444 		/*
3445 		 * Convert 80+80 MHz channel width to new style as interop
3446 		 * workaround.
3447 		 */
3448 		vht_oper->chan_width = IEEE80211_VHT_CHANWIDTH_80MHZ;
3449 		break;
3450 	case NL80211_CHAN_WIDTH_80:
3451 		vht_oper->chan_width = IEEE80211_VHT_CHANWIDTH_80MHZ;
3452 		break;
3453 	case NL80211_CHAN_WIDTH_320:
3454 		/* VHT information element should not be included on 6GHz */
3455 		WARN_ON(1);
3456 		return pos;
3457 	default:
3458 		vht_oper->chan_width = IEEE80211_VHT_CHANWIDTH_USE_HT;
3459 		break;
3460 	}
3461 
3462 	/* don't require special VHT peer rates */
3463 	vht_oper->basic_mcs_set = cpu_to_le16(0xffff);
3464 
3465 	return pos + sizeof(struct ieee80211_vht_operation);
3466 }
3467 
ieee80211_ie_build_he_oper(u8 * pos,struct cfg80211_chan_def * chandef)3468 u8 *ieee80211_ie_build_he_oper(u8 *pos, struct cfg80211_chan_def *chandef)
3469 {
3470 	struct ieee80211_he_operation *he_oper;
3471 	struct ieee80211_he_6ghz_oper *he_6ghz_op;
3472 	u32 he_oper_params;
3473 	u8 ie_len = 1 + sizeof(struct ieee80211_he_operation);
3474 
3475 	if (chandef->chan->band == NL80211_BAND_6GHZ)
3476 		ie_len += sizeof(struct ieee80211_he_6ghz_oper);
3477 
3478 	*pos++ = WLAN_EID_EXTENSION;
3479 	*pos++ = ie_len;
3480 	*pos++ = WLAN_EID_EXT_HE_OPERATION;
3481 
3482 	he_oper_params = 0;
3483 	he_oper_params |= u32_encode_bits(1023, /* disabled */
3484 				IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
3485 	he_oper_params |= u32_encode_bits(1,
3486 				IEEE80211_HE_OPERATION_ER_SU_DISABLE);
3487 	he_oper_params |= u32_encode_bits(1,
3488 				IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED);
3489 	if (chandef->chan->band == NL80211_BAND_6GHZ)
3490 		he_oper_params |= u32_encode_bits(1,
3491 				IEEE80211_HE_OPERATION_6GHZ_OP_INFO);
3492 
3493 	he_oper = (struct ieee80211_he_operation *)pos;
3494 	he_oper->he_oper_params = cpu_to_le32(he_oper_params);
3495 
3496 	/* don't require special HE peer rates */
3497 	he_oper->he_mcs_nss_set = cpu_to_le16(0xffff);
3498 	pos += sizeof(struct ieee80211_he_operation);
3499 
3500 	if (chandef->chan->band != NL80211_BAND_6GHZ)
3501 		goto out;
3502 
3503 	/* TODO add VHT operational */
3504 	he_6ghz_op = (struct ieee80211_he_6ghz_oper *)pos;
3505 	he_6ghz_op->minrate = 6; /* 6 Mbps */
3506 	he_6ghz_op->primary =
3507 		ieee80211_frequency_to_channel(chandef->chan->center_freq);
3508 	he_6ghz_op->ccfs0 =
3509 		ieee80211_frequency_to_channel(chandef->center_freq1);
3510 	if (chandef->center_freq2)
3511 		he_6ghz_op->ccfs1 =
3512 			ieee80211_frequency_to_channel(chandef->center_freq2);
3513 	else
3514 		he_6ghz_op->ccfs1 = 0;
3515 
3516 	switch (chandef->width) {
3517 	case NL80211_CHAN_WIDTH_320:
3518 		/*
3519 		 * TODO: mesh operation is not defined over 6GHz 320 MHz
3520 		 * channels.
3521 		 */
3522 		WARN_ON(1);
3523 		break;
3524 	case NL80211_CHAN_WIDTH_160:
3525 		/* Convert 160 MHz channel width to new style as interop
3526 		 * workaround.
3527 		 */
3528 		he_6ghz_op->control =
3529 			IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_160MHZ;
3530 		he_6ghz_op->ccfs1 = he_6ghz_op->ccfs0;
3531 		if (chandef->chan->center_freq < chandef->center_freq1)
3532 			he_6ghz_op->ccfs0 -= 8;
3533 		else
3534 			he_6ghz_op->ccfs0 += 8;
3535 		fallthrough;
3536 	case NL80211_CHAN_WIDTH_80P80:
3537 		he_6ghz_op->control =
3538 			IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_160MHZ;
3539 		break;
3540 	case NL80211_CHAN_WIDTH_80:
3541 		he_6ghz_op->control =
3542 			IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_80MHZ;
3543 		break;
3544 	case NL80211_CHAN_WIDTH_40:
3545 		he_6ghz_op->control =
3546 			IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_40MHZ;
3547 		break;
3548 	default:
3549 		he_6ghz_op->control =
3550 			IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_20MHZ;
3551 		break;
3552 	}
3553 
3554 	pos += sizeof(struct ieee80211_he_6ghz_oper);
3555 
3556 out:
3557 	return pos;
3558 }
3559 
ieee80211_ie_build_eht_oper(u8 * pos,struct cfg80211_chan_def * chandef,const struct ieee80211_sta_eht_cap * eht_cap)3560 u8 *ieee80211_ie_build_eht_oper(u8 *pos, struct cfg80211_chan_def *chandef,
3561 				const struct ieee80211_sta_eht_cap *eht_cap)
3562 
3563 {
3564 	const struct ieee80211_eht_mcs_nss_supp_20mhz_only *eht_mcs_nss =
3565 					&eht_cap->eht_mcs_nss_supp.only_20mhz;
3566 	struct ieee80211_eht_operation *eht_oper;
3567 	struct ieee80211_eht_operation_info *eht_oper_info;
3568 	u8 eht_oper_len = offsetof(struct ieee80211_eht_operation, optional);
3569 	u8 eht_oper_info_len =
3570 		offsetof(struct ieee80211_eht_operation_info, optional);
3571 	u8 chan_width = 0;
3572 
3573 	*pos++ = WLAN_EID_EXTENSION;
3574 	*pos++ = 1 + eht_oper_len + eht_oper_info_len;
3575 	*pos++ = WLAN_EID_EXT_EHT_OPERATION;
3576 
3577 	eht_oper = (struct ieee80211_eht_operation *)pos;
3578 
3579 	memcpy(&eht_oper->basic_mcs_nss, eht_mcs_nss, sizeof(*eht_mcs_nss));
3580 	eht_oper->params |= IEEE80211_EHT_OPER_INFO_PRESENT;
3581 	pos += eht_oper_len;
3582 
3583 	eht_oper_info =
3584 		(struct ieee80211_eht_operation_info *)eht_oper->optional;
3585 
3586 	eht_oper_info->ccfs0 =
3587 		ieee80211_frequency_to_channel(chandef->center_freq1);
3588 	if (chandef->center_freq2)
3589 		eht_oper_info->ccfs1 =
3590 			ieee80211_frequency_to_channel(chandef->center_freq2);
3591 	else
3592 		eht_oper_info->ccfs1 = 0;
3593 
3594 	switch (chandef->width) {
3595 	case NL80211_CHAN_WIDTH_320:
3596 		chan_width = IEEE80211_EHT_OPER_CHAN_WIDTH_320MHZ;
3597 		eht_oper_info->ccfs1 = eht_oper_info->ccfs0;
3598 		if (chandef->chan->center_freq < chandef->center_freq1)
3599 			eht_oper_info->ccfs0 -= 16;
3600 		else
3601 			eht_oper_info->ccfs0 += 16;
3602 		break;
3603 	case NL80211_CHAN_WIDTH_160:
3604 		eht_oper_info->ccfs1 = eht_oper_info->ccfs0;
3605 		if (chandef->chan->center_freq < chandef->center_freq1)
3606 			eht_oper_info->ccfs0 -= 8;
3607 		else
3608 			eht_oper_info->ccfs0 += 8;
3609 		fallthrough;
3610 	case NL80211_CHAN_WIDTH_80P80:
3611 		chan_width = IEEE80211_EHT_OPER_CHAN_WIDTH_160MHZ;
3612 		break;
3613 	case NL80211_CHAN_WIDTH_80:
3614 		chan_width = IEEE80211_EHT_OPER_CHAN_WIDTH_80MHZ;
3615 		break;
3616 	case NL80211_CHAN_WIDTH_40:
3617 		chan_width = IEEE80211_EHT_OPER_CHAN_WIDTH_40MHZ;
3618 		break;
3619 	default:
3620 		chan_width = IEEE80211_EHT_OPER_CHAN_WIDTH_20MHZ;
3621 		break;
3622 	}
3623 	eht_oper_info->control = chan_width;
3624 	pos += eht_oper_info_len;
3625 
3626 	/* TODO: eht_oper_info->optional */
3627 
3628 	return pos;
3629 }
3630 
ieee80211_chandef_ht_oper(const struct ieee80211_ht_operation * ht_oper,struct cfg80211_chan_def * chandef)3631 bool ieee80211_chandef_ht_oper(const struct ieee80211_ht_operation *ht_oper,
3632 			       struct cfg80211_chan_def *chandef)
3633 {
3634 	enum nl80211_channel_type channel_type;
3635 
3636 	if (!ht_oper)
3637 		return false;
3638 
3639 	switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
3640 	case IEEE80211_HT_PARAM_CHA_SEC_NONE:
3641 		channel_type = NL80211_CHAN_HT20;
3642 		break;
3643 	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
3644 		channel_type = NL80211_CHAN_HT40PLUS;
3645 		break;
3646 	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
3647 		channel_type = NL80211_CHAN_HT40MINUS;
3648 		break;
3649 	default:
3650 		return false;
3651 	}
3652 
3653 	cfg80211_chandef_create(chandef, chandef->chan, channel_type);
3654 	return true;
3655 }
3656 
ieee80211_chandef_vht_oper(struct ieee80211_hw * hw,u32 vht_cap_info,const struct ieee80211_vht_operation * oper,const struct ieee80211_ht_operation * htop,struct cfg80211_chan_def * chandef)3657 bool ieee80211_chandef_vht_oper(struct ieee80211_hw *hw, u32 vht_cap_info,
3658 				const struct ieee80211_vht_operation *oper,
3659 				const struct ieee80211_ht_operation *htop,
3660 				struct cfg80211_chan_def *chandef)
3661 {
3662 	struct cfg80211_chan_def new = *chandef;
3663 	int cf0, cf1;
3664 	int ccfs0, ccfs1, ccfs2;
3665 	int ccf0, ccf1;
3666 	u32 vht_cap;
3667 	bool support_80_80 = false;
3668 	bool support_160 = false;
3669 	u8 ext_nss_bw_supp = u32_get_bits(vht_cap_info,
3670 					  IEEE80211_VHT_CAP_EXT_NSS_BW_MASK);
3671 	u8 supp_chwidth = u32_get_bits(vht_cap_info,
3672 				       IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK);
3673 
3674 	if (!oper || !htop)
3675 		return false;
3676 
3677 	vht_cap = hw->wiphy->bands[chandef->chan->band]->vht_cap.cap;
3678 	support_160 = (vht_cap & (IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK |
3679 				  IEEE80211_VHT_CAP_EXT_NSS_BW_MASK));
3680 	support_80_80 = ((vht_cap &
3681 			 IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ) ||
3682 			(vht_cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ &&
3683 			 vht_cap & IEEE80211_VHT_CAP_EXT_NSS_BW_MASK) ||
3684 			((vht_cap & IEEE80211_VHT_CAP_EXT_NSS_BW_MASK) >>
3685 				    IEEE80211_VHT_CAP_EXT_NSS_BW_SHIFT > 1));
3686 	ccfs0 = oper->center_freq_seg0_idx;
3687 	ccfs1 = oper->center_freq_seg1_idx;
3688 	ccfs2 = (le16_to_cpu(htop->operation_mode) &
3689 				IEEE80211_HT_OP_MODE_CCFS2_MASK)
3690 			>> IEEE80211_HT_OP_MODE_CCFS2_SHIFT;
3691 
3692 	ccf0 = ccfs0;
3693 
3694 	/* if not supported, parse as though we didn't understand it */
3695 	if (!ieee80211_hw_check(hw, SUPPORTS_VHT_EXT_NSS_BW))
3696 		ext_nss_bw_supp = 0;
3697 
3698 	/*
3699 	 * Cf. IEEE 802.11 Table 9-250
3700 	 *
3701 	 * We really just consider that because it's inefficient to connect
3702 	 * at a higher bandwidth than we'll actually be able to use.
3703 	 */
3704 	switch ((supp_chwidth << 4) | ext_nss_bw_supp) {
3705 	default:
3706 	case 0x00:
3707 		ccf1 = 0;
3708 		support_160 = false;
3709 		support_80_80 = false;
3710 		break;
3711 	case 0x01:
3712 		support_80_80 = false;
3713 		fallthrough;
3714 	case 0x02:
3715 	case 0x03:
3716 		ccf1 = ccfs2;
3717 		break;
3718 	case 0x10:
3719 		ccf1 = ccfs1;
3720 		break;
3721 	case 0x11:
3722 	case 0x12:
3723 		if (!ccfs1)
3724 			ccf1 = ccfs2;
3725 		else
3726 			ccf1 = ccfs1;
3727 		break;
3728 	case 0x13:
3729 	case 0x20:
3730 	case 0x23:
3731 		ccf1 = ccfs1;
3732 		break;
3733 	}
3734 
3735 	cf0 = ieee80211_channel_to_frequency(ccf0, chandef->chan->band);
3736 	cf1 = ieee80211_channel_to_frequency(ccf1, chandef->chan->band);
3737 
3738 	switch (oper->chan_width) {
3739 	case IEEE80211_VHT_CHANWIDTH_USE_HT:
3740 		/* just use HT information directly */
3741 		break;
3742 	case IEEE80211_VHT_CHANWIDTH_80MHZ:
3743 		new.width = NL80211_CHAN_WIDTH_80;
3744 		new.center_freq1 = cf0;
3745 		/* If needed, adjust based on the newer interop workaround. */
3746 		if (ccf1) {
3747 			unsigned int diff;
3748 
3749 			diff = abs(ccf1 - ccf0);
3750 			if ((diff == 8) && support_160) {
3751 				new.width = NL80211_CHAN_WIDTH_160;
3752 				new.center_freq1 = cf1;
3753 			} else if ((diff > 8) && support_80_80) {
3754 				new.width = NL80211_CHAN_WIDTH_80P80;
3755 				new.center_freq2 = cf1;
3756 			}
3757 		}
3758 		break;
3759 	case IEEE80211_VHT_CHANWIDTH_160MHZ:
3760 		/* deprecated encoding */
3761 		new.width = NL80211_CHAN_WIDTH_160;
3762 		new.center_freq1 = cf0;
3763 		break;
3764 	case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
3765 		/* deprecated encoding */
3766 		new.width = NL80211_CHAN_WIDTH_80P80;
3767 		new.center_freq1 = cf0;
3768 		new.center_freq2 = cf1;
3769 		break;
3770 	default:
3771 		return false;
3772 	}
3773 
3774 	if (!cfg80211_chandef_valid(&new))
3775 		return false;
3776 
3777 	*chandef = new;
3778 	return true;
3779 }
3780 
ieee80211_chandef_eht_oper(const struct ieee80211_eht_operation * eht_oper,bool support_160,bool support_320,struct cfg80211_chan_def * chandef)3781 void ieee80211_chandef_eht_oper(const struct ieee80211_eht_operation *eht_oper,
3782 				bool support_160, bool support_320,
3783 				struct cfg80211_chan_def *chandef)
3784 {
3785 	struct ieee80211_eht_operation_info *info = (void *)eht_oper->optional;
3786 
3787 	chandef->center_freq1 =
3788 		ieee80211_channel_to_frequency(info->ccfs0,
3789 					       chandef->chan->band);
3790 
3791 	switch (u8_get_bits(info->control,
3792 			    IEEE80211_EHT_OPER_CHAN_WIDTH)) {
3793 	case IEEE80211_EHT_OPER_CHAN_WIDTH_20MHZ:
3794 		chandef->width = NL80211_CHAN_WIDTH_20;
3795 		break;
3796 	case IEEE80211_EHT_OPER_CHAN_WIDTH_40MHZ:
3797 		chandef->width = NL80211_CHAN_WIDTH_40;
3798 		break;
3799 	case IEEE80211_EHT_OPER_CHAN_WIDTH_80MHZ:
3800 		chandef->width = NL80211_CHAN_WIDTH_80;
3801 		break;
3802 	case IEEE80211_EHT_OPER_CHAN_WIDTH_160MHZ:
3803 		if (support_160) {
3804 			chandef->width = NL80211_CHAN_WIDTH_160;
3805 			chandef->center_freq1 =
3806 				ieee80211_channel_to_frequency(info->ccfs1,
3807 							       chandef->chan->band);
3808 		} else {
3809 			chandef->width = NL80211_CHAN_WIDTH_80;
3810 		}
3811 		break;
3812 	case IEEE80211_EHT_OPER_CHAN_WIDTH_320MHZ:
3813 		if (support_320) {
3814 			chandef->width = NL80211_CHAN_WIDTH_320;
3815 			chandef->center_freq1 =
3816 				ieee80211_channel_to_frequency(info->ccfs1,
3817 							       chandef->chan->band);
3818 		} else if (support_160) {
3819 			chandef->width = NL80211_CHAN_WIDTH_160;
3820 		} else {
3821 			chandef->width = NL80211_CHAN_WIDTH_80;
3822 
3823 			if (chandef->center_freq1 > chandef->chan->center_freq)
3824 				chandef->center_freq1 -= 40;
3825 			else
3826 				chandef->center_freq1 += 40;
3827 		}
3828 		break;
3829 	}
3830 }
3831 
ieee80211_chandef_he_6ghz_oper(struct ieee80211_sub_if_data * sdata,const struct ieee80211_he_operation * he_oper,const struct ieee80211_eht_operation * eht_oper,struct cfg80211_chan_def * chandef)3832 bool ieee80211_chandef_he_6ghz_oper(struct ieee80211_sub_if_data *sdata,
3833 				    const struct ieee80211_he_operation *he_oper,
3834 				    const struct ieee80211_eht_operation *eht_oper,
3835 				    struct cfg80211_chan_def *chandef)
3836 {
3837 	struct ieee80211_local *local = sdata->local;
3838 	struct ieee80211_supported_band *sband;
3839 	enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
3840 	const struct ieee80211_sta_he_cap *he_cap;
3841 	const struct ieee80211_sta_eht_cap *eht_cap;
3842 	struct cfg80211_chan_def he_chandef = *chandef;
3843 	const struct ieee80211_he_6ghz_oper *he_6ghz_oper;
3844 	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3845 	bool support_80_80, support_160, support_320;
3846 	u8 he_phy_cap, eht_phy_cap;
3847 	u32 freq;
3848 
3849 	if (chandef->chan->band != NL80211_BAND_6GHZ)
3850 		return true;
3851 
3852 	sband = local->hw.wiphy->bands[NL80211_BAND_6GHZ];
3853 
3854 	he_cap = ieee80211_get_he_iftype_cap(sband, iftype);
3855 	if (!he_cap) {
3856 		sdata_info(sdata, "Missing iftype sband data/HE cap");
3857 		return false;
3858 	}
3859 
3860 	he_phy_cap = he_cap->he_cap_elem.phy_cap_info[0];
3861 	support_160 =
3862 		he_phy_cap &
3863 		IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
3864 	support_80_80 =
3865 		he_phy_cap &
3866 		IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G;
3867 
3868 	if (!he_oper) {
3869 		sdata_info(sdata,
3870 			   "HE is not advertised on (on %d MHz), expect issues\n",
3871 			   chandef->chan->center_freq);
3872 		return false;
3873 	}
3874 
3875 	eht_cap = ieee80211_get_eht_iftype_cap(sband, iftype);
3876 	if (!eht_cap)
3877 		eht_oper = NULL;
3878 
3879 	he_6ghz_oper = ieee80211_he_6ghz_oper(he_oper);
3880 
3881 	if (!he_6ghz_oper) {
3882 		sdata_info(sdata,
3883 			   "HE 6GHz operation missing (on %d MHz), expect issues\n",
3884 			   chandef->chan->center_freq);
3885 		return false;
3886 	}
3887 
3888 	/*
3889 	 * The EHT operation IE does not contain the primary channel so the
3890 	 * primary channel frequency should be taken from the 6 GHz operation
3891 	 * information.
3892 	 */
3893 	freq = ieee80211_channel_to_frequency(he_6ghz_oper->primary,
3894 					      NL80211_BAND_6GHZ);
3895 	he_chandef.chan = ieee80211_get_channel(sdata->local->hw.wiphy, freq);
3896 
3897 	switch (u8_get_bits(he_6ghz_oper->control,
3898 			    IEEE80211_HE_6GHZ_OPER_CTRL_REG_INFO)) {
3899 	case IEEE80211_6GHZ_CTRL_REG_LPI_AP:
3900 		bss_conf->power_type = IEEE80211_REG_LPI_AP;
3901 		break;
3902 	case IEEE80211_6GHZ_CTRL_REG_SP_AP:
3903 		bss_conf->power_type = IEEE80211_REG_SP_AP;
3904 		break;
3905 	default:
3906 		bss_conf->power_type = IEEE80211_REG_UNSET_AP;
3907 		break;
3908 	}
3909 
3910 	if (!eht_oper ||
3911 	    !(eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT)) {
3912 		switch (u8_get_bits(he_6ghz_oper->control,
3913 				    IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH)) {
3914 		case IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_20MHZ:
3915 			he_chandef.width = NL80211_CHAN_WIDTH_20;
3916 			break;
3917 		case IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_40MHZ:
3918 			he_chandef.width = NL80211_CHAN_WIDTH_40;
3919 			break;
3920 		case IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_80MHZ:
3921 			he_chandef.width = NL80211_CHAN_WIDTH_80;
3922 			break;
3923 		case IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_160MHZ:
3924 			he_chandef.width = NL80211_CHAN_WIDTH_80;
3925 			if (!he_6ghz_oper->ccfs1)
3926 				break;
3927 			if (abs(he_6ghz_oper->ccfs1 - he_6ghz_oper->ccfs0) == 8) {
3928 				if (support_160)
3929 					he_chandef.width = NL80211_CHAN_WIDTH_160;
3930 			} else {
3931 				if (support_80_80)
3932 					he_chandef.width = NL80211_CHAN_WIDTH_80P80;
3933 			}
3934 			break;
3935 		}
3936 
3937 		if (he_chandef.width == NL80211_CHAN_WIDTH_160) {
3938 			he_chandef.center_freq1 =
3939 				ieee80211_channel_to_frequency(he_6ghz_oper->ccfs1,
3940 							       NL80211_BAND_6GHZ);
3941 		} else {
3942 			he_chandef.center_freq1 =
3943 				ieee80211_channel_to_frequency(he_6ghz_oper->ccfs0,
3944 							       NL80211_BAND_6GHZ);
3945 			if (support_80_80 || support_160)
3946 				he_chandef.center_freq2 =
3947 					ieee80211_channel_to_frequency(he_6ghz_oper->ccfs1,
3948 								       NL80211_BAND_6GHZ);
3949 		}
3950 	} else {
3951 		eht_phy_cap = eht_cap->eht_cap_elem.phy_cap_info[0];
3952 		support_320 =
3953 			eht_phy_cap & IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
3954 
3955 		ieee80211_chandef_eht_oper(eht_oper, support_160,
3956 					   support_320, &he_chandef);
3957 	}
3958 
3959 	if (!cfg80211_chandef_valid(&he_chandef)) {
3960 		sdata_info(sdata,
3961 			   "HE 6GHz operation resulted in invalid chandef: %d MHz/%d/%d MHz/%d MHz\n",
3962 			   he_chandef.chan ? he_chandef.chan->center_freq : 0,
3963 			   he_chandef.width,
3964 			   he_chandef.center_freq1,
3965 			   he_chandef.center_freq2);
3966 		return false;
3967 	}
3968 
3969 	*chandef = he_chandef;
3970 
3971 	return true;
3972 }
3973 
ieee80211_chandef_s1g_oper(const struct ieee80211_s1g_oper_ie * oper,struct cfg80211_chan_def * chandef)3974 bool ieee80211_chandef_s1g_oper(const struct ieee80211_s1g_oper_ie *oper,
3975 				struct cfg80211_chan_def *chandef)
3976 {
3977 	u32 oper_freq;
3978 
3979 	if (!oper)
3980 		return false;
3981 
3982 	switch (FIELD_GET(S1G_OPER_CH_WIDTH_OPER, oper->ch_width)) {
3983 	case IEEE80211_S1G_CHANWIDTH_1MHZ:
3984 		chandef->width = NL80211_CHAN_WIDTH_1;
3985 		break;
3986 	case IEEE80211_S1G_CHANWIDTH_2MHZ:
3987 		chandef->width = NL80211_CHAN_WIDTH_2;
3988 		break;
3989 	case IEEE80211_S1G_CHANWIDTH_4MHZ:
3990 		chandef->width = NL80211_CHAN_WIDTH_4;
3991 		break;
3992 	case IEEE80211_S1G_CHANWIDTH_8MHZ:
3993 		chandef->width = NL80211_CHAN_WIDTH_8;
3994 		break;
3995 	case IEEE80211_S1G_CHANWIDTH_16MHZ:
3996 		chandef->width = NL80211_CHAN_WIDTH_16;
3997 		break;
3998 	default:
3999 		return false;
4000 	}
4001 
4002 	oper_freq = ieee80211_channel_to_freq_khz(oper->oper_ch,
4003 						  NL80211_BAND_S1GHZ);
4004 	chandef->center_freq1 = KHZ_TO_MHZ(oper_freq);
4005 	chandef->freq1_offset = oper_freq % 1000;
4006 
4007 	return true;
4008 }
4009 
ieee80211_parse_bitrates(enum nl80211_chan_width width,const struct ieee80211_supported_band * sband,const u8 * srates,int srates_len,u32 * rates)4010 int ieee80211_parse_bitrates(enum nl80211_chan_width width,
4011 			     const struct ieee80211_supported_band *sband,
4012 			     const u8 *srates, int srates_len, u32 *rates)
4013 {
4014 	u32 rate_flags = ieee80211_chanwidth_rate_flags(width);
4015 	int shift = ieee80211_chanwidth_get_shift(width);
4016 	struct ieee80211_rate *br;
4017 	int brate, rate, i, j, count = 0;
4018 
4019 	*rates = 0;
4020 
4021 	for (i = 0; i < srates_len; i++) {
4022 		rate = srates[i] & 0x7f;
4023 
4024 		for (j = 0; j < sband->n_bitrates; j++) {
4025 			br = &sband->bitrates[j];
4026 			if ((rate_flags & br->flags) != rate_flags)
4027 				continue;
4028 
4029 			brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
4030 			if (brate == rate) {
4031 				*rates |= BIT(j);
4032 				count++;
4033 				break;
4034 			}
4035 		}
4036 	}
4037 	return count;
4038 }
4039 
ieee80211_add_srates_ie(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,bool need_basic,enum nl80211_band band)4040 int ieee80211_add_srates_ie(struct ieee80211_sub_if_data *sdata,
4041 			    struct sk_buff *skb, bool need_basic,
4042 			    enum nl80211_band band)
4043 {
4044 	struct ieee80211_local *local = sdata->local;
4045 	struct ieee80211_supported_band *sband;
4046 	int rate, shift;
4047 	u8 i, rates, *pos;
4048 	u32 basic_rates = sdata->vif.bss_conf.basic_rates;
4049 	u32 rate_flags;
4050 
4051 	shift = ieee80211_vif_get_shift(&sdata->vif);
4052 	rate_flags = ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chandef);
4053 	sband = local->hw.wiphy->bands[band];
4054 	rates = 0;
4055 	for (i = 0; i < sband->n_bitrates; i++) {
4056 		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
4057 			continue;
4058 		rates++;
4059 	}
4060 	if (rates > 8)
4061 		rates = 8;
4062 
4063 	if (skb_tailroom(skb) < rates + 2)
4064 		return -ENOMEM;
4065 
4066 	pos = skb_put(skb, rates + 2);
4067 	*pos++ = WLAN_EID_SUPP_RATES;
4068 	*pos++ = rates;
4069 	for (i = 0; i < rates; i++) {
4070 		u8 basic = 0;
4071 		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
4072 			continue;
4073 
4074 		if (need_basic && basic_rates & BIT(i))
4075 			basic = 0x80;
4076 		rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
4077 				    5 * (1 << shift));
4078 		*pos++ = basic | (u8) rate;
4079 	}
4080 
4081 	return 0;
4082 }
4083 
ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,bool need_basic,enum nl80211_band band)4084 int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
4085 				struct sk_buff *skb, bool need_basic,
4086 				enum nl80211_band band)
4087 {
4088 	struct ieee80211_local *local = sdata->local;
4089 	struct ieee80211_supported_band *sband;
4090 	int rate, shift;
4091 	u8 i, exrates, *pos;
4092 	u32 basic_rates = sdata->vif.bss_conf.basic_rates;
4093 	u32 rate_flags;
4094 
4095 	rate_flags = ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chandef);
4096 	shift = ieee80211_vif_get_shift(&sdata->vif);
4097 
4098 	sband = local->hw.wiphy->bands[band];
4099 	exrates = 0;
4100 	for (i = 0; i < sband->n_bitrates; i++) {
4101 		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
4102 			continue;
4103 		exrates++;
4104 	}
4105 
4106 	if (exrates > 8)
4107 		exrates -= 8;
4108 	else
4109 		exrates = 0;
4110 
4111 	if (skb_tailroom(skb) < exrates + 2)
4112 		return -ENOMEM;
4113 
4114 	if (exrates) {
4115 		pos = skb_put(skb, exrates + 2);
4116 		*pos++ = WLAN_EID_EXT_SUPP_RATES;
4117 		*pos++ = exrates;
4118 		for (i = 8; i < sband->n_bitrates; i++) {
4119 			u8 basic = 0;
4120 			if ((rate_flags & sband->bitrates[i].flags)
4121 			    != rate_flags)
4122 				continue;
4123 			if (need_basic && basic_rates & BIT(i))
4124 				basic = 0x80;
4125 			rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
4126 					    5 * (1 << shift));
4127 			*pos++ = basic | (u8) rate;
4128 		}
4129 	}
4130 	return 0;
4131 }
4132 
ieee80211_ave_rssi(struct ieee80211_vif * vif)4133 int ieee80211_ave_rssi(struct ieee80211_vif *vif)
4134 {
4135 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
4136 
4137 	if (WARN_ON_ONCE(sdata->vif.type != NL80211_IFTYPE_STATION))
4138 		return 0;
4139 
4140 	return -ewma_beacon_signal_read(&sdata->deflink.u.mgd.ave_beacon_signal);
4141 }
4142 EXPORT_SYMBOL_GPL(ieee80211_ave_rssi);
4143 
ieee80211_mcs_to_chains(const struct ieee80211_mcs_info * mcs)4144 u8 ieee80211_mcs_to_chains(const struct ieee80211_mcs_info *mcs)
4145 {
4146 	if (!mcs)
4147 		return 1;
4148 
4149 	/* TODO: consider rx_highest */
4150 
4151 	if (mcs->rx_mask[3])
4152 		return 4;
4153 	if (mcs->rx_mask[2])
4154 		return 3;
4155 	if (mcs->rx_mask[1])
4156 		return 2;
4157 	return 1;
4158 }
4159 
4160 /**
4161  * ieee80211_calculate_rx_timestamp - calculate timestamp in frame
4162  * @local: mac80211 hw info struct
4163  * @status: RX status
4164  * @mpdu_len: total MPDU length (including FCS)
4165  * @mpdu_offset: offset into MPDU to calculate timestamp at
4166  *
4167  * This function calculates the RX timestamp at the given MPDU offset, taking
4168  * into account what the RX timestamp was. An offset of 0 will just normalize
4169  * the timestamp to TSF at beginning of MPDU reception.
4170  */
ieee80211_calculate_rx_timestamp(struct ieee80211_local * local,struct ieee80211_rx_status * status,unsigned int mpdu_len,unsigned int mpdu_offset)4171 u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
4172 				     struct ieee80211_rx_status *status,
4173 				     unsigned int mpdu_len,
4174 				     unsigned int mpdu_offset)
4175 {
4176 	u64 ts = status->mactime;
4177 	struct rate_info ri;
4178 	u16 rate;
4179 	u8 n_ltf;
4180 
4181 	if (WARN_ON(!ieee80211_have_rx_timestamp(status)))
4182 		return 0;
4183 
4184 	memset(&ri, 0, sizeof(ri));
4185 
4186 	ri.bw = status->bw;
4187 
4188 	/* Fill cfg80211 rate info */
4189 	switch (status->encoding) {
4190 	case RX_ENC_EHT:
4191 		ri.flags |= RATE_INFO_FLAGS_EHT_MCS;
4192 		ri.mcs = status->rate_idx;
4193 		ri.nss = status->nss;
4194 		ri.eht_ru_alloc = status->eht.ru;
4195 		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
4196 			ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
4197 		/* TODO/FIXME: is this right? handle other PPDUs */
4198 		if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
4199 			mpdu_offset += 2;
4200 			ts += 36;
4201 		}
4202 		break;
4203 	case RX_ENC_HE:
4204 		ri.flags |= RATE_INFO_FLAGS_HE_MCS;
4205 		ri.mcs = status->rate_idx;
4206 		ri.nss = status->nss;
4207 		ri.he_ru_alloc = status->he_ru;
4208 		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
4209 			ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
4210 
4211 		/*
4212 		 * See P802.11ax_D6.0, section 27.3.4 for
4213 		 * VHT PPDU format.
4214 		 */
4215 		if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
4216 			mpdu_offset += 2;
4217 			ts += 36;
4218 
4219 			/*
4220 			 * TODO:
4221 			 * For HE MU PPDU, add the HE-SIG-B.
4222 			 * For HE ER PPDU, add 8us for the HE-SIG-A.
4223 			 * For HE TB PPDU, add 4us for the HE-STF.
4224 			 * Add the HE-LTF durations - variable.
4225 			 */
4226 		}
4227 
4228 		break;
4229 	case RX_ENC_HT:
4230 		ri.mcs = status->rate_idx;
4231 		ri.flags |= RATE_INFO_FLAGS_MCS;
4232 		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
4233 			ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
4234 
4235 		/*
4236 		 * See P802.11REVmd_D3.0, section 19.3.2 for
4237 		 * HT PPDU format.
4238 		 */
4239 		if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
4240 			mpdu_offset += 2;
4241 			if (status->enc_flags & RX_ENC_FLAG_HT_GF)
4242 				ts += 24;
4243 			else
4244 				ts += 32;
4245 
4246 			/*
4247 			 * Add Data HT-LTFs per streams
4248 			 * TODO: add Extension HT-LTFs, 4us per LTF
4249 			 */
4250 			n_ltf = ((ri.mcs >> 3) & 3) + 1;
4251 			n_ltf = n_ltf == 3 ? 4 : n_ltf;
4252 			ts += n_ltf * 4;
4253 		}
4254 
4255 		break;
4256 	case RX_ENC_VHT:
4257 		ri.flags |= RATE_INFO_FLAGS_VHT_MCS;
4258 		ri.mcs = status->rate_idx;
4259 		ri.nss = status->nss;
4260 		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
4261 			ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
4262 
4263 		/*
4264 		 * See P802.11REVmd_D3.0, section 21.3.2 for
4265 		 * VHT PPDU format.
4266 		 */
4267 		if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
4268 			mpdu_offset += 2;
4269 			ts += 36;
4270 
4271 			/*
4272 			 * Add VHT-LTFs per streams
4273 			 */
4274 			n_ltf = (ri.nss != 1) && (ri.nss % 2) ?
4275 				ri.nss + 1 : ri.nss;
4276 			ts += 4 * n_ltf;
4277 		}
4278 
4279 		break;
4280 	default:
4281 		WARN_ON(1);
4282 		fallthrough;
4283 	case RX_ENC_LEGACY: {
4284 		struct ieee80211_supported_band *sband;
4285 		int shift = 0;
4286 		int bitrate;
4287 
4288 		switch (status->bw) {
4289 		case RATE_INFO_BW_10:
4290 			shift = 1;
4291 			break;
4292 		case RATE_INFO_BW_5:
4293 			shift = 2;
4294 			break;
4295 		}
4296 
4297 		sband = local->hw.wiphy->bands[status->band];
4298 		bitrate = sband->bitrates[status->rate_idx].bitrate;
4299 		ri.legacy = DIV_ROUND_UP(bitrate, (1 << shift));
4300 
4301 		if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
4302 			if (status->band == NL80211_BAND_5GHZ) {
4303 				ts += 20 << shift;
4304 				mpdu_offset += 2;
4305 			} else if (status->enc_flags & RX_ENC_FLAG_SHORTPRE) {
4306 				ts += 96;
4307 			} else {
4308 				ts += 192;
4309 			}
4310 		}
4311 		break;
4312 		}
4313 	}
4314 
4315 	rate = cfg80211_calculate_bitrate(&ri);
4316 	if (WARN_ONCE(!rate,
4317 		      "Invalid bitrate: flags=0x%llx, idx=%d, vht_nss=%d\n",
4318 		      (unsigned long long)status->flag, status->rate_idx,
4319 		      status->nss))
4320 		return 0;
4321 
4322 	/* rewind from end of MPDU */
4323 	if (status->flag & RX_FLAG_MACTIME_END)
4324 		ts -= mpdu_len * 8 * 10 / rate;
4325 
4326 	ts += mpdu_offset * 8 * 10 / rate;
4327 
4328 	return ts;
4329 }
4330 
ieee80211_dfs_cac_cancel(struct ieee80211_local * local)4331 void ieee80211_dfs_cac_cancel(struct ieee80211_local *local)
4332 {
4333 	struct ieee80211_sub_if_data *sdata;
4334 	struct cfg80211_chan_def chandef;
4335 
4336 	/* for interface list, to avoid linking iflist_mtx and chanctx_mtx */
4337 	lockdep_assert_wiphy(local->hw.wiphy);
4338 
4339 	mutex_lock(&local->mtx);
4340 	list_for_each_entry(sdata, &local->interfaces, list) {
4341 		/* it might be waiting for the local->mtx, but then
4342 		 * by the time it gets it, sdata->wdev.cac_started
4343 		 * will no longer be true
4344 		 */
4345 		cancel_delayed_work(&sdata->deflink.dfs_cac_timer_work);
4346 
4347 		if (sdata->wdev.cac_started) {
4348 			chandef = sdata->vif.bss_conf.chandef;
4349 			ieee80211_link_release_channel(&sdata->deflink);
4350 			cfg80211_cac_event(sdata->dev,
4351 					   &chandef,
4352 					   NL80211_RADAR_CAC_ABORTED,
4353 					   GFP_KERNEL);
4354 		}
4355 	}
4356 	mutex_unlock(&local->mtx);
4357 }
4358 
ieee80211_dfs_radar_detected_work(struct wiphy * wiphy,struct wiphy_work * work)4359 void ieee80211_dfs_radar_detected_work(struct wiphy *wiphy,
4360 				       struct wiphy_work *work)
4361 {
4362 	struct ieee80211_local *local =
4363 		container_of(work, struct ieee80211_local, radar_detected_work);
4364 	struct cfg80211_chan_def chandef = local->hw.conf.chandef;
4365 	struct ieee80211_chanctx *ctx;
4366 	int num_chanctx = 0;
4367 
4368 	mutex_lock(&local->chanctx_mtx);
4369 	list_for_each_entry(ctx, &local->chanctx_list, list) {
4370 		if (ctx->replace_state == IEEE80211_CHANCTX_REPLACES_OTHER)
4371 			continue;
4372 
4373 		num_chanctx++;
4374 		chandef = ctx->conf.def;
4375 	}
4376 	mutex_unlock(&local->chanctx_mtx);
4377 
4378 	ieee80211_dfs_cac_cancel(local);
4379 
4380 	if (num_chanctx > 1)
4381 		/* XXX: multi-channel is not supported yet */
4382 		WARN_ON(1);
4383 	else
4384 		cfg80211_radar_event(local->hw.wiphy, &chandef, GFP_KERNEL);
4385 }
4386 
ieee80211_radar_detected(struct ieee80211_hw * hw)4387 void ieee80211_radar_detected(struct ieee80211_hw *hw)
4388 {
4389 	struct ieee80211_local *local = hw_to_local(hw);
4390 
4391 	trace_api_radar_detected(local);
4392 
4393 	wiphy_work_queue(hw->wiphy, &local->radar_detected_work);
4394 }
4395 EXPORT_SYMBOL(ieee80211_radar_detected);
4396 
ieee80211_chandef_downgrade(struct cfg80211_chan_def * c)4397 ieee80211_conn_flags_t ieee80211_chandef_downgrade(struct cfg80211_chan_def *c)
4398 {
4399 	ieee80211_conn_flags_t ret;
4400 	int tmp;
4401 
4402 	switch (c->width) {
4403 	case NL80211_CHAN_WIDTH_20:
4404 		c->width = NL80211_CHAN_WIDTH_20_NOHT;
4405 		ret = IEEE80211_CONN_DISABLE_HT | IEEE80211_CONN_DISABLE_VHT;
4406 		break;
4407 	case NL80211_CHAN_WIDTH_40:
4408 		c->width = NL80211_CHAN_WIDTH_20;
4409 		c->center_freq1 = c->chan->center_freq;
4410 		ret = IEEE80211_CONN_DISABLE_40MHZ |
4411 		      IEEE80211_CONN_DISABLE_VHT;
4412 		break;
4413 	case NL80211_CHAN_WIDTH_80:
4414 		tmp = (30 + c->chan->center_freq - c->center_freq1)/20;
4415 		/* n_P40 */
4416 		tmp /= 2;
4417 		/* freq_P40 */
4418 		c->center_freq1 = c->center_freq1 - 20 + 40 * tmp;
4419 		c->width = NL80211_CHAN_WIDTH_40;
4420 		ret = IEEE80211_CONN_DISABLE_VHT;
4421 		break;
4422 	case NL80211_CHAN_WIDTH_80P80:
4423 		c->center_freq2 = 0;
4424 		c->width = NL80211_CHAN_WIDTH_80;
4425 		ret = IEEE80211_CONN_DISABLE_80P80MHZ |
4426 		      IEEE80211_CONN_DISABLE_160MHZ;
4427 		break;
4428 	case NL80211_CHAN_WIDTH_160:
4429 		/* n_P20 */
4430 		tmp = (70 + c->chan->center_freq - c->center_freq1)/20;
4431 		/* n_P80 */
4432 		tmp /= 4;
4433 		c->center_freq1 = c->center_freq1 - 40 + 80 * tmp;
4434 		c->width = NL80211_CHAN_WIDTH_80;
4435 		ret = IEEE80211_CONN_DISABLE_80P80MHZ |
4436 		      IEEE80211_CONN_DISABLE_160MHZ;
4437 		break;
4438 	case NL80211_CHAN_WIDTH_320:
4439 		/* n_P20 */
4440 		tmp = (150 + c->chan->center_freq - c->center_freq1) / 20;
4441 		/* n_P160 */
4442 		tmp /= 8;
4443 		c->center_freq1 = c->center_freq1 - 80 + 160 * tmp;
4444 		c->width = NL80211_CHAN_WIDTH_160;
4445 		ret = IEEE80211_CONN_DISABLE_320MHZ;
4446 		break;
4447 	default:
4448 	case NL80211_CHAN_WIDTH_20_NOHT:
4449 		WARN_ON_ONCE(1);
4450 		c->width = NL80211_CHAN_WIDTH_20_NOHT;
4451 		ret = IEEE80211_CONN_DISABLE_HT | IEEE80211_CONN_DISABLE_VHT;
4452 		break;
4453 	case NL80211_CHAN_WIDTH_1:
4454 	case NL80211_CHAN_WIDTH_2:
4455 	case NL80211_CHAN_WIDTH_4:
4456 	case NL80211_CHAN_WIDTH_8:
4457 	case NL80211_CHAN_WIDTH_16:
4458 	case NL80211_CHAN_WIDTH_5:
4459 	case NL80211_CHAN_WIDTH_10:
4460 		WARN_ON_ONCE(1);
4461 		/* keep c->width */
4462 		ret = IEEE80211_CONN_DISABLE_HT | IEEE80211_CONN_DISABLE_VHT;
4463 		break;
4464 	}
4465 
4466 	WARN_ON_ONCE(!cfg80211_chandef_valid(c));
4467 
4468 	return ret;
4469 }
4470 
4471 /*
4472  * Returns true if smps_mode_new is strictly more restrictive than
4473  * smps_mode_old.
4474  */
ieee80211_smps_is_restrictive(enum ieee80211_smps_mode smps_mode_old,enum ieee80211_smps_mode smps_mode_new)4475 bool ieee80211_smps_is_restrictive(enum ieee80211_smps_mode smps_mode_old,
4476 				   enum ieee80211_smps_mode smps_mode_new)
4477 {
4478 	if (WARN_ON_ONCE(smps_mode_old == IEEE80211_SMPS_AUTOMATIC ||
4479 			 smps_mode_new == IEEE80211_SMPS_AUTOMATIC))
4480 		return false;
4481 
4482 	switch (smps_mode_old) {
4483 	case IEEE80211_SMPS_STATIC:
4484 		return false;
4485 	case IEEE80211_SMPS_DYNAMIC:
4486 		return smps_mode_new == IEEE80211_SMPS_STATIC;
4487 	case IEEE80211_SMPS_OFF:
4488 		return smps_mode_new != IEEE80211_SMPS_OFF;
4489 	default:
4490 		WARN_ON(1);
4491 	}
4492 
4493 	return false;
4494 }
4495 
ieee80211_send_action_csa(struct ieee80211_sub_if_data * sdata,struct cfg80211_csa_settings * csa_settings)4496 int ieee80211_send_action_csa(struct ieee80211_sub_if_data *sdata,
4497 			      struct cfg80211_csa_settings *csa_settings)
4498 {
4499 	struct sk_buff *skb;
4500 	struct ieee80211_mgmt *mgmt;
4501 	struct ieee80211_local *local = sdata->local;
4502 	int freq;
4503 	int hdr_len = offsetofend(struct ieee80211_mgmt,
4504 				  u.action.u.chan_switch);
4505 	u8 *pos;
4506 
4507 	if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
4508 	    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
4509 		return -EOPNOTSUPP;
4510 
4511 	skb = dev_alloc_skb(local->tx_headroom + hdr_len +
4512 			    5 + /* channel switch announcement element */
4513 			    3 + /* secondary channel offset element */
4514 			    5 + /* wide bandwidth channel switch announcement */
4515 			    8); /* mesh channel switch parameters element */
4516 	if (!skb)
4517 		return -ENOMEM;
4518 
4519 	skb_reserve(skb, local->tx_headroom);
4520 	mgmt = skb_put_zero(skb, hdr_len);
4521 	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
4522 					  IEEE80211_STYPE_ACTION);
4523 
4524 	eth_broadcast_addr(mgmt->da);
4525 	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
4526 	if (ieee80211_vif_is_mesh(&sdata->vif)) {
4527 		memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
4528 	} else {
4529 		struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
4530 		memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
4531 	}
4532 	mgmt->u.action.category = WLAN_CATEGORY_SPECTRUM_MGMT;
4533 	mgmt->u.action.u.chan_switch.action_code = WLAN_ACTION_SPCT_CHL_SWITCH;
4534 	pos = skb_put(skb, 5);
4535 	*pos++ = WLAN_EID_CHANNEL_SWITCH;			/* EID */
4536 	*pos++ = 3;						/* IE length */
4537 	*pos++ = csa_settings->block_tx ? 1 : 0;		/* CSA mode */
4538 	freq = csa_settings->chandef.chan->center_freq;
4539 	*pos++ = ieee80211_frequency_to_channel(freq);		/* channel */
4540 	*pos++ = csa_settings->count;				/* count */
4541 
4542 	if (csa_settings->chandef.width == NL80211_CHAN_WIDTH_40) {
4543 		enum nl80211_channel_type ch_type;
4544 
4545 		skb_put(skb, 3);
4546 		*pos++ = WLAN_EID_SECONDARY_CHANNEL_OFFSET;	/* EID */
4547 		*pos++ = 1;					/* IE length */
4548 		ch_type = cfg80211_get_chandef_type(&csa_settings->chandef);
4549 		if (ch_type == NL80211_CHAN_HT40PLUS)
4550 			*pos++ = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
4551 		else
4552 			*pos++ = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
4553 	}
4554 
4555 	if (ieee80211_vif_is_mesh(&sdata->vif)) {
4556 		struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
4557 
4558 		skb_put(skb, 8);
4559 		*pos++ = WLAN_EID_CHAN_SWITCH_PARAM;		/* EID */
4560 		*pos++ = 6;					/* IE length */
4561 		*pos++ = sdata->u.mesh.mshcfg.dot11MeshTTL;	/* Mesh TTL */
4562 		*pos = 0x00;	/* Mesh Flag: Tx Restrict, Initiator, Reason */
4563 		*pos |= WLAN_EID_CHAN_SWITCH_PARAM_INITIATOR;
4564 		*pos++ |= csa_settings->block_tx ?
4565 			  WLAN_EID_CHAN_SWITCH_PARAM_TX_RESTRICT : 0x00;
4566 		put_unaligned_le16(WLAN_REASON_MESH_CHAN, pos); /* Reason Cd */
4567 		pos += 2;
4568 		put_unaligned_le16(ifmsh->pre_value, pos);/* Precedence Value */
4569 		pos += 2;
4570 	}
4571 
4572 	if (csa_settings->chandef.width == NL80211_CHAN_WIDTH_80 ||
4573 	    csa_settings->chandef.width == NL80211_CHAN_WIDTH_80P80 ||
4574 	    csa_settings->chandef.width == NL80211_CHAN_WIDTH_160) {
4575 		skb_put(skb, 5);
4576 		ieee80211_ie_build_wide_bw_cs(pos, &csa_settings->chandef);
4577 	}
4578 
4579 	ieee80211_tx_skb(sdata, skb);
4580 	return 0;
4581 }
4582 
4583 static bool
ieee80211_extend_noa_desc(struct ieee80211_noa_data * data,u32 tsf,int i)4584 ieee80211_extend_noa_desc(struct ieee80211_noa_data *data, u32 tsf, int i)
4585 {
4586 	s32 end = data->desc[i].start + data->desc[i].duration - (tsf + 1);
4587 	int skip;
4588 
4589 	if (end > 0)
4590 		return false;
4591 
4592 	/* One shot NOA  */
4593 	if (data->count[i] == 1)
4594 		return false;
4595 
4596 	if (data->desc[i].interval == 0)
4597 		return false;
4598 
4599 	/* End time is in the past, check for repetitions */
4600 	skip = DIV_ROUND_UP(-end, data->desc[i].interval);
4601 	if (data->count[i] < 255) {
4602 		if (data->count[i] <= skip) {
4603 			data->count[i] = 0;
4604 			return false;
4605 		}
4606 
4607 		data->count[i] -= skip;
4608 	}
4609 
4610 	data->desc[i].start += skip * data->desc[i].interval;
4611 
4612 	return true;
4613 }
4614 
4615 static bool
ieee80211_extend_absent_time(struct ieee80211_noa_data * data,u32 tsf,s32 * offset)4616 ieee80211_extend_absent_time(struct ieee80211_noa_data *data, u32 tsf,
4617 			     s32 *offset)
4618 {
4619 	bool ret = false;
4620 	int i;
4621 
4622 	for (i = 0; i < IEEE80211_P2P_NOA_DESC_MAX; i++) {
4623 		s32 cur;
4624 
4625 		if (!data->count[i])
4626 			continue;
4627 
4628 		if (ieee80211_extend_noa_desc(data, tsf + *offset, i))
4629 			ret = true;
4630 
4631 		cur = data->desc[i].start - tsf;
4632 		if (cur > *offset)
4633 			continue;
4634 
4635 		cur = data->desc[i].start + data->desc[i].duration - tsf;
4636 		if (cur > *offset)
4637 			*offset = cur;
4638 	}
4639 
4640 	return ret;
4641 }
4642 
4643 static u32
ieee80211_get_noa_absent_time(struct ieee80211_noa_data * data,u32 tsf)4644 ieee80211_get_noa_absent_time(struct ieee80211_noa_data *data, u32 tsf)
4645 {
4646 	s32 offset = 0;
4647 	int tries = 0;
4648 	/*
4649 	 * arbitrary limit, used to avoid infinite loops when combined NoA
4650 	 * descriptors cover the full time period.
4651 	 */
4652 	int max_tries = 5;
4653 
4654 	ieee80211_extend_absent_time(data, tsf, &offset);
4655 	do {
4656 		if (!ieee80211_extend_absent_time(data, tsf, &offset))
4657 			break;
4658 
4659 		tries++;
4660 	} while (tries < max_tries);
4661 
4662 	return offset;
4663 }
4664 
ieee80211_update_p2p_noa(struct ieee80211_noa_data * data,u32 tsf)4665 void ieee80211_update_p2p_noa(struct ieee80211_noa_data *data, u32 tsf)
4666 {
4667 	u32 next_offset = BIT(31) - 1;
4668 	int i;
4669 
4670 	data->absent = 0;
4671 	data->has_next_tsf = false;
4672 	for (i = 0; i < IEEE80211_P2P_NOA_DESC_MAX; i++) {
4673 		s32 start;
4674 
4675 		if (!data->count[i])
4676 			continue;
4677 
4678 		ieee80211_extend_noa_desc(data, tsf, i);
4679 		start = data->desc[i].start - tsf;
4680 		if (start <= 0)
4681 			data->absent |= BIT(i);
4682 
4683 		if (next_offset > start)
4684 			next_offset = start;
4685 
4686 		data->has_next_tsf = true;
4687 	}
4688 
4689 	if (data->absent)
4690 		next_offset = ieee80211_get_noa_absent_time(data, tsf);
4691 
4692 	data->next_tsf = tsf + next_offset;
4693 }
4694 EXPORT_SYMBOL(ieee80211_update_p2p_noa);
4695 
ieee80211_parse_p2p_noa(const struct ieee80211_p2p_noa_attr * attr,struct ieee80211_noa_data * data,u32 tsf)4696 int ieee80211_parse_p2p_noa(const struct ieee80211_p2p_noa_attr *attr,
4697 			    struct ieee80211_noa_data *data, u32 tsf)
4698 {
4699 	int ret = 0;
4700 	int i;
4701 
4702 	memset(data, 0, sizeof(*data));
4703 
4704 	for (i = 0; i < IEEE80211_P2P_NOA_DESC_MAX; i++) {
4705 		const struct ieee80211_p2p_noa_desc *desc = &attr->desc[i];
4706 
4707 		if (!desc->count || !desc->duration)
4708 			continue;
4709 
4710 		data->count[i] = desc->count;
4711 		data->desc[i].start = le32_to_cpu(desc->start_time);
4712 		data->desc[i].duration = le32_to_cpu(desc->duration);
4713 		data->desc[i].interval = le32_to_cpu(desc->interval);
4714 
4715 		if (data->count[i] > 1 &&
4716 		    data->desc[i].interval < data->desc[i].duration)
4717 			continue;
4718 
4719 		ieee80211_extend_noa_desc(data, tsf, i);
4720 		ret++;
4721 	}
4722 
4723 	if (ret)
4724 		ieee80211_update_p2p_noa(data, tsf);
4725 
4726 	return ret;
4727 }
4728 EXPORT_SYMBOL(ieee80211_parse_p2p_noa);
4729 
ieee80211_recalc_dtim(struct ieee80211_local * local,struct ieee80211_sub_if_data * sdata)4730 void ieee80211_recalc_dtim(struct ieee80211_local *local,
4731 			   struct ieee80211_sub_if_data *sdata)
4732 {
4733 	u64 tsf = drv_get_tsf(local, sdata);
4734 	u64 dtim_count = 0;
4735 	u16 beacon_int = sdata->vif.bss_conf.beacon_int * 1024;
4736 	u8 dtim_period = sdata->vif.bss_conf.dtim_period;
4737 	struct ps_data *ps;
4738 	u8 bcns_from_dtim;
4739 
4740 	if (tsf == -1ULL || !beacon_int || !dtim_period)
4741 		return;
4742 
4743 	if (sdata->vif.type == NL80211_IFTYPE_AP ||
4744 	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
4745 		if (!sdata->bss)
4746 			return;
4747 
4748 		ps = &sdata->bss->ps;
4749 	} else if (ieee80211_vif_is_mesh(&sdata->vif)) {
4750 		ps = &sdata->u.mesh.ps;
4751 	} else {
4752 		return;
4753 	}
4754 
4755 	/*
4756 	 * actually finds last dtim_count, mac80211 will update in
4757 	 * __beacon_add_tim().
4758 	 * dtim_count = dtim_period - (tsf / bcn_int) % dtim_period
4759 	 */
4760 	do_div(tsf, beacon_int);
4761 	bcns_from_dtim = do_div(tsf, dtim_period);
4762 	/* just had a DTIM */
4763 	if (!bcns_from_dtim)
4764 		dtim_count = 0;
4765 	else
4766 		dtim_count = dtim_period - bcns_from_dtim;
4767 
4768 	ps->dtim_count = dtim_count;
4769 }
4770 
ieee80211_chanctx_radar_detect(struct ieee80211_local * local,struct ieee80211_chanctx * ctx)4771 static u8 ieee80211_chanctx_radar_detect(struct ieee80211_local *local,
4772 					 struct ieee80211_chanctx *ctx)
4773 {
4774 	struct ieee80211_link_data *link;
4775 	u8 radar_detect = 0;
4776 
4777 	lockdep_assert_held(&local->chanctx_mtx);
4778 
4779 	if (WARN_ON(ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED))
4780 		return 0;
4781 
4782 	list_for_each_entry(link, &ctx->reserved_links, reserved_chanctx_list)
4783 		if (link->reserved_radar_required)
4784 			radar_detect |= BIT(link->reserved_chandef.width);
4785 
4786 	/*
4787 	 * An in-place reservation context should not have any assigned vifs
4788 	 * until it replaces the other context.
4789 	 */
4790 	WARN_ON(ctx->replace_state == IEEE80211_CHANCTX_REPLACES_OTHER &&
4791 		!list_empty(&ctx->assigned_links));
4792 
4793 	list_for_each_entry(link, &ctx->assigned_links, assigned_chanctx_list) {
4794 		if (!link->radar_required)
4795 			continue;
4796 
4797 		radar_detect |=
4798 			BIT(link->conf->chandef.width);
4799 	}
4800 
4801 	return radar_detect;
4802 }
4803 
ieee80211_check_combinations(struct ieee80211_sub_if_data * sdata,const struct cfg80211_chan_def * chandef,enum ieee80211_chanctx_mode chanmode,u8 radar_detect)4804 int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
4805 				 const struct cfg80211_chan_def *chandef,
4806 				 enum ieee80211_chanctx_mode chanmode,
4807 				 u8 radar_detect)
4808 {
4809 	struct ieee80211_local *local = sdata->local;
4810 	struct ieee80211_sub_if_data *sdata_iter;
4811 	enum nl80211_iftype iftype = sdata->wdev.iftype;
4812 	struct ieee80211_chanctx *ctx;
4813 	int total = 1;
4814 	struct iface_combination_params params = {
4815 		.radar_detect = radar_detect,
4816 	};
4817 
4818 	lockdep_assert_held(&local->chanctx_mtx);
4819 
4820 	if (WARN_ON(hweight32(radar_detect) > 1))
4821 		return -EINVAL;
4822 
4823 	if (WARN_ON(chandef && chanmode == IEEE80211_CHANCTX_SHARED &&
4824 		    !chandef->chan))
4825 		return -EINVAL;
4826 
4827 	if (WARN_ON(iftype >= NUM_NL80211_IFTYPES))
4828 		return -EINVAL;
4829 
4830 	if (sdata->vif.type == NL80211_IFTYPE_AP ||
4831 	    sdata->vif.type == NL80211_IFTYPE_MESH_POINT) {
4832 		/*
4833 		 * always passing this is harmless, since it'll be the
4834 		 * same value that cfg80211 finds if it finds the same
4835 		 * interface ... and that's always allowed
4836 		 */
4837 		params.new_beacon_int = sdata->vif.bss_conf.beacon_int;
4838 	}
4839 
4840 	/* Always allow software iftypes */
4841 	if (cfg80211_iftype_allowed(local->hw.wiphy, iftype, 0, 1)) {
4842 		if (radar_detect)
4843 			return -EINVAL;
4844 		return 0;
4845 	}
4846 
4847 	if (chandef)
4848 		params.num_different_channels = 1;
4849 
4850 	if (iftype != NL80211_IFTYPE_UNSPECIFIED)
4851 		params.iftype_num[iftype] = 1;
4852 
4853 	list_for_each_entry(ctx, &local->chanctx_list, list) {
4854 		if (ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
4855 			continue;
4856 		params.radar_detect |=
4857 			ieee80211_chanctx_radar_detect(local, ctx);
4858 		if (ctx->mode == IEEE80211_CHANCTX_EXCLUSIVE) {
4859 			params.num_different_channels++;
4860 			continue;
4861 		}
4862 		if (chandef && chanmode == IEEE80211_CHANCTX_SHARED &&
4863 		    cfg80211_chandef_compatible(chandef,
4864 						&ctx->conf.def))
4865 			continue;
4866 		params.num_different_channels++;
4867 	}
4868 
4869 	list_for_each_entry_rcu(sdata_iter, &local->interfaces, list) {
4870 		struct wireless_dev *wdev_iter;
4871 
4872 		wdev_iter = &sdata_iter->wdev;
4873 
4874 		if (sdata_iter == sdata ||
4875 		    !ieee80211_sdata_running(sdata_iter) ||
4876 		    cfg80211_iftype_allowed(local->hw.wiphy,
4877 					    wdev_iter->iftype, 0, 1))
4878 			continue;
4879 
4880 		params.iftype_num[wdev_iter->iftype]++;
4881 		total++;
4882 	}
4883 
4884 	if (total == 1 && !params.radar_detect)
4885 		return 0;
4886 
4887 	return cfg80211_check_combinations(local->hw.wiphy, &params);
4888 }
4889 
4890 static void
ieee80211_iter_max_chans(const struct ieee80211_iface_combination * c,void * data)4891 ieee80211_iter_max_chans(const struct ieee80211_iface_combination *c,
4892 			 void *data)
4893 {
4894 	u32 *max_num_different_channels = data;
4895 
4896 	*max_num_different_channels = max(*max_num_different_channels,
4897 					  c->num_different_channels);
4898 }
4899 
ieee80211_max_num_channels(struct ieee80211_local * local)4900 int ieee80211_max_num_channels(struct ieee80211_local *local)
4901 {
4902 	struct ieee80211_sub_if_data *sdata;
4903 	struct ieee80211_chanctx *ctx;
4904 	u32 max_num_different_channels = 1;
4905 	int err;
4906 	struct iface_combination_params params = {0};
4907 
4908 	lockdep_assert_held(&local->chanctx_mtx);
4909 
4910 	list_for_each_entry(ctx, &local->chanctx_list, list) {
4911 		if (ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
4912 			continue;
4913 
4914 		params.num_different_channels++;
4915 
4916 		params.radar_detect |=
4917 			ieee80211_chanctx_radar_detect(local, ctx);
4918 	}
4919 
4920 	list_for_each_entry_rcu(sdata, &local->interfaces, list)
4921 		params.iftype_num[sdata->wdev.iftype]++;
4922 
4923 	err = cfg80211_iter_combinations(local->hw.wiphy, &params,
4924 					 ieee80211_iter_max_chans,
4925 					 &max_num_different_channels);
4926 	if (err < 0)
4927 		return err;
4928 
4929 	return max_num_different_channels;
4930 }
4931 
ieee80211_add_s1g_capab_ie(struct ieee80211_sub_if_data * sdata,struct ieee80211_sta_s1g_cap * caps,struct sk_buff * skb)4932 void ieee80211_add_s1g_capab_ie(struct ieee80211_sub_if_data *sdata,
4933 				struct ieee80211_sta_s1g_cap *caps,
4934 				struct sk_buff *skb)
4935 {
4936 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4937 	struct ieee80211_s1g_cap s1g_capab;
4938 	u8 *pos;
4939 	int i;
4940 
4941 	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
4942 		return;
4943 
4944 	if (!caps->s1g)
4945 		return;
4946 
4947 	memcpy(s1g_capab.capab_info, caps->cap, sizeof(caps->cap));
4948 	memcpy(s1g_capab.supp_mcs_nss, caps->nss_mcs, sizeof(caps->nss_mcs));
4949 
4950 	/* override the capability info */
4951 	for (i = 0; i < sizeof(ifmgd->s1g_capa.capab_info); i++) {
4952 		u8 mask = ifmgd->s1g_capa_mask.capab_info[i];
4953 
4954 		s1g_capab.capab_info[i] &= ~mask;
4955 		s1g_capab.capab_info[i] |= ifmgd->s1g_capa.capab_info[i] & mask;
4956 	}
4957 
4958 	/* then MCS and NSS set */
4959 	for (i = 0; i < sizeof(ifmgd->s1g_capa.supp_mcs_nss); i++) {
4960 		u8 mask = ifmgd->s1g_capa_mask.supp_mcs_nss[i];
4961 
4962 		s1g_capab.supp_mcs_nss[i] &= ~mask;
4963 		s1g_capab.supp_mcs_nss[i] |=
4964 			ifmgd->s1g_capa.supp_mcs_nss[i] & mask;
4965 	}
4966 
4967 	pos = skb_put(skb, 2 + sizeof(s1g_capab));
4968 	*pos++ = WLAN_EID_S1G_CAPABILITIES;
4969 	*pos++ = sizeof(s1g_capab);
4970 
4971 	memcpy(pos, &s1g_capab, sizeof(s1g_capab));
4972 }
4973 
ieee80211_add_aid_request_ie(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb)4974 void ieee80211_add_aid_request_ie(struct ieee80211_sub_if_data *sdata,
4975 				  struct sk_buff *skb)
4976 {
4977 	u8 *pos = skb_put(skb, 3);
4978 
4979 	*pos++ = WLAN_EID_AID_REQUEST;
4980 	*pos++ = 1;
4981 	*pos++ = 0;
4982 }
4983 
ieee80211_add_wmm_info_ie(u8 * buf,u8 qosinfo)4984 u8 *ieee80211_add_wmm_info_ie(u8 *buf, u8 qosinfo)
4985 {
4986 	*buf++ = WLAN_EID_VENDOR_SPECIFIC;
4987 	*buf++ = 7; /* len */
4988 	*buf++ = 0x00; /* Microsoft OUI 00:50:F2 */
4989 	*buf++ = 0x50;
4990 	*buf++ = 0xf2;
4991 	*buf++ = 2; /* WME */
4992 	*buf++ = 0; /* WME info */
4993 	*buf++ = 1; /* WME ver */
4994 	*buf++ = qosinfo; /* U-APSD no in use */
4995 
4996 	return buf;
4997 }
4998 
ieee80211_txq_get_depth(struct ieee80211_txq * txq,unsigned long * frame_cnt,unsigned long * byte_cnt)4999 void ieee80211_txq_get_depth(struct ieee80211_txq *txq,
5000 			     unsigned long *frame_cnt,
5001 			     unsigned long *byte_cnt)
5002 {
5003 	struct txq_info *txqi = to_txq_info(txq);
5004 	u32 frag_cnt = 0, frag_bytes = 0;
5005 	struct sk_buff *skb;
5006 
5007 	skb_queue_walk(&txqi->frags, skb) {
5008 		frag_cnt++;
5009 		frag_bytes += skb->len;
5010 	}
5011 
5012 	if (frame_cnt)
5013 		*frame_cnt = txqi->tin.backlog_packets + frag_cnt;
5014 
5015 	if (byte_cnt)
5016 		*byte_cnt = txqi->tin.backlog_bytes + frag_bytes;
5017 }
5018 EXPORT_SYMBOL(ieee80211_txq_get_depth);
5019 
5020 const u8 ieee80211_ac_to_qos_mask[IEEE80211_NUM_ACS] = {
5021 	IEEE80211_WMM_IE_STA_QOSINFO_AC_VO,
5022 	IEEE80211_WMM_IE_STA_QOSINFO_AC_VI,
5023 	IEEE80211_WMM_IE_STA_QOSINFO_AC_BE,
5024 	IEEE80211_WMM_IE_STA_QOSINFO_AC_BK
5025 };
5026 
ieee80211_encode_usf(int listen_interval)5027 u16 ieee80211_encode_usf(int listen_interval)
5028 {
5029 	static const int listen_int_usf[] = { 1, 10, 1000, 10000 };
5030 	u16 ui, usf = 0;
5031 
5032 	/* find greatest USF */
5033 	while (usf < IEEE80211_MAX_USF) {
5034 		if (listen_interval % listen_int_usf[usf + 1])
5035 			break;
5036 		usf += 1;
5037 	}
5038 	ui = listen_interval / listen_int_usf[usf];
5039 
5040 	/* error if there is a remainder. Should've been checked by user */
5041 	WARN_ON_ONCE(ui > IEEE80211_MAX_UI);
5042 	listen_interval = FIELD_PREP(LISTEN_INT_USF, usf) |
5043 			  FIELD_PREP(LISTEN_INT_UI, ui);
5044 
5045 	return (u16) listen_interval;
5046 }
5047 
ieee80211_ie_len_eht_cap(struct ieee80211_sub_if_data * sdata,u8 iftype)5048 u8 ieee80211_ie_len_eht_cap(struct ieee80211_sub_if_data *sdata, u8 iftype)
5049 {
5050 	const struct ieee80211_sta_he_cap *he_cap;
5051 	const struct ieee80211_sta_eht_cap *eht_cap;
5052 	struct ieee80211_supported_band *sband;
5053 	bool is_ap;
5054 	u8 n;
5055 
5056 	sband = ieee80211_get_sband(sdata);
5057 	if (!sband)
5058 		return 0;
5059 
5060 	he_cap = ieee80211_get_he_iftype_cap(sband, iftype);
5061 	eht_cap = ieee80211_get_eht_iftype_cap(sband, iftype);
5062 	if (!he_cap || !eht_cap)
5063 		return 0;
5064 
5065 	is_ap = iftype == NL80211_IFTYPE_AP ||
5066 		iftype == NL80211_IFTYPE_P2P_GO;
5067 
5068 	n = ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
5069 				       &eht_cap->eht_cap_elem,
5070 				       is_ap);
5071 	return 2 + 1 +
5072 	       sizeof(eht_cap->eht_cap_elem) + n +
5073 	       ieee80211_eht_ppe_size(eht_cap->eht_ppe_thres[0],
5074 				      eht_cap->eht_cap_elem.phy_cap_info);
5075 	return 0;
5076 }
5077 
ieee80211_ie_build_eht_cap(u8 * pos,const struct ieee80211_sta_he_cap * he_cap,const struct ieee80211_sta_eht_cap * eht_cap,u8 * end,bool for_ap)5078 u8 *ieee80211_ie_build_eht_cap(u8 *pos,
5079 			       const struct ieee80211_sta_he_cap *he_cap,
5080 			       const struct ieee80211_sta_eht_cap *eht_cap,
5081 			       u8 *end,
5082 			       bool for_ap)
5083 {
5084 	u8 mcs_nss_len, ppet_len;
5085 	u8 ie_len;
5086 	u8 *orig_pos = pos;
5087 
5088 	/* Make sure we have place for the IE */
5089 	if (!he_cap || !eht_cap)
5090 		return orig_pos;
5091 
5092 	mcs_nss_len = ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
5093 						 &eht_cap->eht_cap_elem,
5094 						 for_ap);
5095 	ppet_len = ieee80211_eht_ppe_size(eht_cap->eht_ppe_thres[0],
5096 					  eht_cap->eht_cap_elem.phy_cap_info);
5097 
5098 	ie_len = 2 + 1 + sizeof(eht_cap->eht_cap_elem) + mcs_nss_len + ppet_len;
5099 	if ((end - pos) < ie_len)
5100 		return orig_pos;
5101 
5102 	*pos++ = WLAN_EID_EXTENSION;
5103 	*pos++ = ie_len - 2;
5104 	*pos++ = WLAN_EID_EXT_EHT_CAPABILITY;
5105 
5106 	/* Fixed data */
5107 	memcpy(pos, &eht_cap->eht_cap_elem, sizeof(eht_cap->eht_cap_elem));
5108 	pos += sizeof(eht_cap->eht_cap_elem);
5109 
5110 	memcpy(pos, &eht_cap->eht_mcs_nss_supp, mcs_nss_len);
5111 	pos += mcs_nss_len;
5112 
5113 	if (ppet_len) {
5114 		memcpy(pos, &eht_cap->eht_ppe_thres, ppet_len);
5115 		pos += ppet_len;
5116 	}
5117 
5118 	return pos;
5119 }
5120 
ieee80211_fragment_element(struct sk_buff * skb,u8 * len_pos,u8 frag_id)5121 void ieee80211_fragment_element(struct sk_buff *skb, u8 *len_pos, u8 frag_id)
5122 {
5123 	unsigned int elem_len;
5124 
5125 	if (!len_pos)
5126 		return;
5127 
5128 	elem_len = skb->data + skb->len - len_pos - 1;
5129 
5130 	while (elem_len > 255) {
5131 		/* this one is 255 */
5132 		*len_pos = 255;
5133 		/* remaining data gets smaller */
5134 		elem_len -= 255;
5135 		/* make space for the fragment ID/len in SKB */
5136 		skb_put(skb, 2);
5137 		/* shift back the remaining data to place fragment ID/len */
5138 		memmove(len_pos + 255 + 3, len_pos + 255 + 1, elem_len);
5139 		/* place the fragment ID */
5140 		len_pos += 255 + 1;
5141 		*len_pos = frag_id;
5142 		/* and point to fragment length to update later */
5143 		len_pos++;
5144 	}
5145 
5146 	*len_pos = elem_len;
5147 }
5148