net/mac80211/util.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright 2002-2005, Instant802 Networks, Inc.
   4  * Copyright 2005-2006, Devicescape Software, Inc.
   5  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   6  * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright 2013-2014  Intel Mobile Communications GmbH
   8  * Copyright (C) 2015-2017      Intel Deutschland GmbH
   9  * Copyright (C) 2018-2023 Intel Corporation
  10  *
  11  * utilities for mac80211
  12  */
  13
  14 #include <net/mac80211.h>
  15 #include <linux/netdevice.h>
  16 #include <linux/export.h>
  17 #include <linux/types.h>
  18 #include <linux/slab.h>
  19 #include <linux/skbuff.h>
  20 #include <linux/etherdevice.h>
  21 #include <linux/if_arp.h>
  22 #include <linux/bitmap.h>
  23 #include <linux/crc32.h>
  24 #include <net/net_namespace.h>
  25 #include <net/cfg80211.h>
  26 #include <net/rtnetlink.h>
  27
  28 #include "ieee80211_i.h"
  29 #include "driver-ops.h"
  30 #include "rate.h"
  31 #include "mesh.h"
  32 #include "wme.h"
  33 #include "led.h"
  34 #include "wep.h"
  35
  36 /* privid for wiphys to determine whether they belong to us or not */
  37 const void *const mac80211_wiphy_privid = &mac80211_wiphy_privid;
  38
  39 struct ieee80211_hw *wiphy_to_ieee80211_hw(struct wiphy *wiphy)
  40 {
  41         struct ieee80211_local *local;
  42
  43         local = wiphy_priv(wiphy);
  44         return &local->hw;
  45 }
  46 EXPORT_SYMBOL(wiphy_to_ieee80211_hw);
  47
  48 u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
  49                         enum nl80211_iftype type)
  50 {
  51         __le16 fc = hdr->frame_control;
  52
  53         if (ieee80211_is_data(fc)) {
  54                 if (len < 24) /* drop incorrect hdr len (data) */
  55                         return NULL;
  56
  57                 if (ieee80211_has_a4(fc))
  58                         return NULL;
  59                 if (ieee80211_has_tods(fc))
  60                         return hdr->addr1;
  61                 if (ieee80211_has_fromds(fc))
  62                         return hdr->addr2;
  63
  64                 return hdr->addr3;
  65         }
  66
  67         if (ieee80211_is_s1g_beacon(fc)) {
  68                 struct ieee80211_ext *ext = (void *) hdr;
  69
  70                 return ext->u.s1g_beacon.sa;
  71         }
  72
  73         if (ieee80211_is_mgmt(fc)) {
  74                 if (len < 24) /* drop incorrect hdr len (mgmt) */
  75                         return NULL;
  76                 return hdr->addr3;
  77         }
  78
  79         if (ieee80211_is_ctl(fc)) {
  80                 if (ieee80211_is_pspoll(fc))
  81                         return hdr->addr1;
  82
  83                 if (ieee80211_is_back_req(fc)) {
  84                         switch (type) {
  85                         case NL80211_IFTYPE_STATION:
  86                                 return hdr->addr2;
  87                         case NL80211_IFTYPE_AP:
  88                         case NL80211_IFTYPE_AP_VLAN:
  89                                 return hdr->addr1;
  90                         default:
  91                                 break; /* fall through to the return */
  92                         }
  93                 }
  94         }
  95
  96         return NULL;
  97 }
  98 EXPORT_SYMBOL(ieee80211_get_bssid);
  99
 100 void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx)
 101 {
 102         struct sk_buff *skb;
 103         struct ieee80211_hdr *hdr;
 104
 105         skb_queue_walk(&tx->skbs, skb) {
 106                 hdr = (struct ieee80211_hdr *) skb->data;
 107                 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 108         }
 109 }
 110
 111 int ieee80211_frame_duration(enum nl80211_band band, size_t len,
 112                              int rate, int erp, int short_preamble,
 113                              int shift)
 114 {
 115         int dur;
 116
 117         /* calculate duration (in microseconds, rounded up to next higher
 118          * integer if it includes a fractional microsecond) to send frame of
 119          * len bytes (does not include FCS) at the given rate. Duration will
 120          * also include SIFS.
 121          *
 122          * rate is in 100 kbps, so divident is multiplied by 10 in the
 123          * DIV_ROUND_UP() operations.
 124          *
 125          * shift may be 2 for 5 MHz channels or 1 for 10 MHz channels, and
 126          * is assumed to be 0 otherwise.
 127          */
 128
 129         if (band == NL80211_BAND_5GHZ || erp) {
 130                 /*
 131                  * OFDM:
 132                  *
 133                  * N_DBPS = DATARATE x 4
 134                  * N_SYM = Ceiling((16+8xLENGTH+6) / N_DBPS)
 135                  *      (16 = SIGNAL time, 6 = tail bits)
 136                  * TXTIME = T_PREAMBLE + T_SIGNAL + T_SYM x N_SYM + Signal Ext
 137                  *
 138                  * T_SYM = 4 usec
 139                  * 802.11a - 18.5.2: aSIFSTime = 16 usec
 140                  * 802.11g - 19.8.4: aSIFSTime = 10 usec +
 141                  *      signal ext = 6 usec
 142                  */
 143                 dur = 16; /* SIFS + signal ext */
 144                 dur += 16; /* IEEE 802.11-2012 18.3.2.4: T_PREAMBLE = 16 usec */
 145                 dur += 4; /* IEEE 802.11-2012 18.3.2.4: T_SIGNAL = 4 usec */
 146
 147                 /* IEEE 802.11-2012 18.3.2.4: all values above are:
 148                  *  * times 4 for 5 MHz
 149                  *  * times 2 for 10 MHz
 150                  */
 151                 dur *= 1 << shift;
 152
 153                 /* rates should already consider the channel bandwidth,
 154                  * don't apply divisor again.
 155                  */
 156                 dur += 4 * DIV_ROUND_UP((16 + 8 * (len + 4) + 6) * 10,
 157                                         4 * rate); /* T_SYM x N_SYM */
 158         } else {
 159                 /*
 160                  * 802.11b or 802.11g with 802.11b compatibility:
 161                  * 18.3.4: TXTIME = PreambleLength + PLCPHeaderTime +
 162                  * Ceiling(((LENGTH+PBCC)x8)/DATARATE). PBCC=0.
 163                  *
 164                  * 802.11 (DS): 15.3.3, 802.11b: 18.3.4
 165                  * aSIFSTime = 10 usec
 166                  * aPreambleLength = 144 usec or 72 usec with short preamble
 167                  * aPLCPHeaderLength = 48 usec or 24 usec with short preamble
 168                  */
 169                 dur = 10; /* aSIFSTime = 10 usec */
 170                 dur += short_preamble ? (72 + 24) : (144 + 48);
 171
 172                 dur += DIV_ROUND_UP(8 * (len + 4) * 10, rate);
 173         }
 174
 175         return dur;
 176 }
 177
 178 /* Exported duration function for driver use */
 179 __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
 180                                         struct ieee80211_vif *vif,
 181                                         enum nl80211_band band,
 182                                         size_t frame_len,
 183                                         struct ieee80211_rate *rate)
 184 {
 185         struct ieee80211_sub_if_data *sdata;
 186         u16 dur;
 187         int erp, shift = 0;
 188         bool short_preamble = false;
 189
 190         erp = 0;
 191         if (vif) {
 192                 sdata = vif_to_sdata(vif);
 193                 short_preamble = sdata->vif.bss_conf.use_short_preamble;
 194                 if (sdata->deflink.operating_11g_mode)
 195                         erp = rate->flags & IEEE80211_RATE_ERP_G;
 196                 shift = ieee80211_vif_get_shift(vif);
 197         }
 198
 199         dur = ieee80211_frame_duration(band, frame_len, rate->bitrate, erp,
 200                                        short_preamble, shift);
 201
 202         return cpu_to_le16(dur);
 203 }
 204 EXPORT_SYMBOL(ieee80211_generic_frame_duration);
 205
 206 __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
 207                               struct ieee80211_vif *vif, size_t frame_len,
 208                               const struct ieee80211_tx_info *frame_txctl)
 209 {
 210         struct ieee80211_local *local = hw_to_local(hw);
 211         struct ieee80211_rate *rate;
 212         struct ieee80211_sub_if_data *sdata;
 213         bool short_preamble;
 214         int erp, shift = 0, bitrate;
 215         u16 dur;
 216         struct ieee80211_supported_band *sband;
 217
 218         sband = local->hw.wiphy->bands[frame_txctl->band];
 219
 220         short_preamble = false;
 221
 222         rate = &sband->bitrates[frame_txctl->control.rts_cts_rate_idx];
 223
 224         erp = 0;
 225         if (vif) {
 226                 sdata = vif_to_sdata(vif);
 227                 short_preamble = sdata->vif.bss_conf.use_short_preamble;
 228                 if (sdata->deflink.operating_11g_mode)
 229                         erp = rate->flags & IEEE80211_RATE_ERP_G;
 230                 shift = ieee80211_vif_get_shift(vif);
 231         }
 232
 233         bitrate = DIV_ROUND_UP(rate->bitrate, 1 << shift);
 234
 235         /* CTS duration */
 236         dur = ieee80211_frame_duration(sband->band, 10, bitrate,
 237                                        erp, short_preamble, shift);
 238         /* Data frame duration */
 239         dur += ieee80211_frame_duration(sband->band, frame_len, bitrate,
 240                                         erp, short_preamble, shift);
 241         /* ACK duration */
 242         dur += ieee80211_frame_duration(sband->band, 10, bitrate,
 243                                         erp, short_preamble, shift);
 244
 245         return cpu_to_le16(dur);
 246 }
 247 EXPORT_SYMBOL(ieee80211_rts_duration);
 248
 249 __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
 250                                     struct ieee80211_vif *vif,
 251                                     size_t frame_len,
 252                                     const struct ieee80211_tx_info *frame_txctl)
 253 {
 254         struct ieee80211_local *local = hw_to_local(hw);
 255         struct ieee80211_rate *rate;
 256         struct ieee80211_sub_if_data *sdata;
 257         bool short_preamble;
 258         int erp, shift = 0, bitrate;
 259         u16 dur;
 260         struct ieee80211_supported_band *sband;
 261
 262         sband = local->hw.wiphy->bands[frame_txctl->band];
 263
 264         short_preamble = false;
 265
 266         rate = &sband->bitrates[frame_txctl->control.rts_cts_rate_idx];
 267         erp = 0;
 268         if (vif) {
 269                 sdata = vif_to_sdata(vif);
 270                 short_preamble = sdata->vif.bss_conf.use_short_preamble;
 271                 if (sdata->deflink.operating_11g_mode)
 272                         erp = rate->flags & IEEE80211_RATE_ERP_G;
 273                 shift = ieee80211_vif_get_shift(vif);
 274         }
 275
 276         bitrate = DIV_ROUND_UP(rate->bitrate, 1 << shift);
 277
 278         /* Data frame duration */
 279         dur = ieee80211_frame_duration(sband->band, frame_len, bitrate,
 280                                        erp, short_preamble, shift);
 281         if (!(frame_txctl->flags & IEEE80211_TX_CTL_NO_ACK)) {
 282                 /* ACK duration */
 283                 dur += ieee80211_frame_duration(sband->band, 10, bitrate,
 284                                                 erp, short_preamble, shift);
 285         }
 286
 287         return cpu_to_le16(dur);
 288 }
 289 EXPORT_SYMBOL(ieee80211_ctstoself_duration);
 290
 291 static void wake_tx_push_queue(struct ieee80211_local *local,
 292                                struct ieee80211_sub_if_data *sdata,
 293                                struct ieee80211_txq *queue)
 294 {
 295         struct ieee80211_tx_control control = {
 296                 .sta = queue->sta,
 297         };
 298         struct sk_buff *skb;
 299
 300         while (1) {
 301                 skb = ieee80211_tx_dequeue(&local->hw, queue);
 302                 if (!skb)
 303                         break;
 304
 305                 drv_tx(local, &control, skb);
 306         }
 307 }
 308
 309 /* wake_tx_queue handler for driver not implementing a custom one*/
 310 void ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw,
 311                                     struct ieee80211_txq *txq)
 312 {
 313         struct ieee80211_local *local = hw_to_local(hw);
 314         struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
 315         struct ieee80211_txq *queue;
 316
 317         spin_lock(&local->handle_wake_tx_queue_lock);
 318
 319         /* Use ieee80211_next_txq() for airtime fairness accounting */
 320         ieee80211_txq_schedule_start(hw, txq->ac);
 321         while ((queue = ieee80211_next_txq(hw, txq->ac))) {
 322                 wake_tx_push_queue(local, sdata, queue);
 323                 ieee80211_return_txq(hw, queue, false);
 324         }
 325         ieee80211_txq_schedule_end(hw, txq->ac);
 326         spin_unlock(&local->handle_wake_tx_queue_lock);
 327 }
 328 EXPORT_SYMBOL(ieee80211_handle_wake_tx_queue);
 329
 330 static void __ieee80211_wake_txqs(struct ieee80211_sub_if_data *sdata, int ac)
 331 {
 332         struct ieee80211_local *local = sdata->local;
 333         struct ieee80211_vif *vif = &sdata->vif;
 334         struct fq *fq = &local->fq;
 335         struct ps_data *ps = NULL;
 336         struct txq_info *txqi;
 337         struct sta_info *sta;
 338         int i;
 339
 340         local_bh_disable();
 341         spin_lock(&fq->lock);
 342
 343         if (!test_bit(SDATA_STATE_RUNNING, &sdata->state))
 344                 goto out;
 345
 346         if (sdata->vif.type == NL80211_IFTYPE_AP)
 347                 ps = &sdata->bss->ps;
 348
 349         list_for_each_entry_rcu(sta, &local->sta_list, list) {
 350                 if (sdata != sta->sdata)
 351                         continue;
 352
 353                 for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
 354                         struct ieee80211_txq *txq = sta->sta.txq[i];
 355
 356                         if (!txq)
 357                                 continue;
 358
 359                         txqi = to_txq_info(txq);
 360
 361                         if (ac != txq->ac)
 362                                 continue;
 363
 364                         if (!test_and_clear_bit(IEEE80211_TXQ_DIRTY,
 365                                                 &txqi->flags))
 366                                 continue;
 367
 368                         spin_unlock(&fq->lock);
 369                         drv_wake_tx_queue(local, txqi);
 370                         spin_lock(&fq->lock);
 371                 }
 372         }
 373
 374         if (!vif->txq)
 375                 goto out;
 376
 377         txqi = to_txq_info(vif->txq);
 378
 379         if (!test_and_clear_bit(IEEE80211_TXQ_DIRTY, &txqi->flags) ||
 380             (ps && atomic_read(&ps->num_sta_ps)) || ac != vif->txq->ac)
 381                 goto out;
 382
 383         spin_unlock(&fq->lock);
 384
 385         drv_wake_tx_queue(local, txqi);
 386         local_bh_enable();
 387         return;
 388 out:
 389         spin_unlock(&fq->lock);
 390         local_bh_enable();
 391 }
 392
 393 static void
 394 __releases(&local->queue_stop_reason_lock)
 395 __acquires(&local->queue_stop_reason_lock)
 396 _ieee80211_wake_txqs(struct ieee80211_local *local, unsigned long *flags)
 397 {
 398         struct ieee80211_sub_if_data *sdata;
 399         int n_acs = IEEE80211_NUM_ACS;
 400         int i;
 401
 402         rcu_read_lock();
 403
 404         if (local->hw.queues < IEEE80211_NUM_ACS)
 405                 n_acs = 1;
 406
 407         for (i = 0; i < local->hw.queues; i++) {
 408                 if (local->queue_stop_reasons[i])
 409                         continue;
 410
 411                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, *flags);
 412                 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
 413                         int ac;
 414
 415                         for (ac = 0; ac < n_acs; ac++) {
 416                                 int ac_queue = sdata->vif.hw_queue[ac];
 417
 418                                 if (ac_queue == i ||
 419                                     sdata->vif.cab_queue == i)
 420                                         __ieee80211_wake_txqs(sdata, ac);
 421                         }
 422                 }
 423                 spin_lock_irqsave(&local->queue_stop_reason_lock, *flags);
 424         }
 425
 426         rcu_read_unlock();
 427 }
 428
 429 void ieee80211_wake_txqs(struct tasklet_struct *t)
 430 {
 431         struct ieee80211_local *local = from_tasklet(local, t,
 432                                                      wake_txqs_tasklet);
 433         unsigned long flags;
 434
 435         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 436         _ieee80211_wake_txqs(local, &flags);
 437         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 438 }
 439
 440 static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
 441                                    enum queue_stop_reason reason,
 442                                    bool refcounted,
 443                                    unsigned long *flags)
 444 {
 445         struct ieee80211_local *local = hw_to_local(hw);
 446
 447         trace_wake_queue(local, queue, reason);
 448
 449         if (WARN_ON(queue >= hw->queues))
 450                 return;
 451
 452         if (!test_bit(reason, &local->queue_stop_reasons[queue]))
 453                 return;
 454
 455         if (!refcounted) {
 456                 local->q_stop_reasons[queue][reason] = 0;
 457         } else {
 458                 local->q_stop_reasons[queue][reason]--;
 459                 if (WARN_ON(local->q_stop_reasons[queue][reason] < 0))
 460                         local->q_stop_reasons[queue][reason] = 0;
 461         }
 462
 463         if (local->q_stop_reasons[queue][reason] == 0)
 464                 __clear_bit(reason, &local->queue_stop_reasons[queue]);
 465
 466         if (local->queue_stop_reasons[queue] != 0)
 467                 /* someone still has this queue stopped */
 468                 return;
 469
 470         if (!skb_queue_empty(&local->pending[queue]))
 471                 tasklet_schedule(&local->tx_pending_tasklet);
 472
 473         /*
 474          * Calling _ieee80211_wake_txqs here can be a problem because it may
 475          * release queue_stop_reason_lock which has been taken by
 476          * __ieee80211_wake_queue's caller. It is certainly not very nice to
 477          * release someone's lock, but it is fine because all the callers of
 478          * __ieee80211_wake_queue call it right before releasing the lock.
 479          */
 480         if (reason == IEEE80211_QUEUE_STOP_REASON_DRIVER)
 481                 tasklet_schedule(&local->wake_txqs_tasklet);
 482         else
 483                 _ieee80211_wake_txqs(local, flags);
 484 }
 485
 486 void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
 487                                     enum queue_stop_reason reason,
 488                                     bool refcounted)
 489 {
 490         struct ieee80211_local *local = hw_to_local(hw);
 491         unsigned long flags;
 492
 493         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 494         __ieee80211_wake_queue(hw, queue, reason, refcounted, &flags);
 495         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 496 }
 497
 498 void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue)
 499 {
 500         ieee80211_wake_queue_by_reason(hw, queue,
 501                                        IEEE80211_QUEUE_STOP_REASON_DRIVER,
 502                                        false);
 503 }
 504 EXPORT_SYMBOL(ieee80211_wake_queue);
 505
 506 static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
 507                                    enum queue_stop_reason reason,
 508                                    bool refcounted)
 509 {
 510         struct ieee80211_local *local = hw_to_local(hw);
 511
 512         trace_stop_queue(local, queue, reason);
 513
 514         if (WARN_ON(queue >= hw->queues))
 515                 return;
 516
 517         if (!refcounted)
 518                 local->q_stop_reasons[queue][reason] = 1;
 519         else
 520                 local->q_stop_reasons[queue][reason]++;
 521
 522         set_bit(reason, &local->queue_stop_reasons[queue]);
 523 }
 524
 525 void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
 526                                     enum queue_stop_reason reason,
 527                                     bool refcounted)
 528 {
 529         struct ieee80211_local *local = hw_to_local(hw);
 530         unsigned long flags;
 531
 532         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 533         __ieee80211_stop_queue(hw, queue, reason, refcounted);
 534         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 535 }
 536
 537 void ieee80211_stop_queue(struct ieee80211_hw *hw, int queue)
 538 {
 539         ieee80211_stop_queue_by_reason(hw, queue,
 540                                        IEEE80211_QUEUE_STOP_REASON_DRIVER,
 541                                        false);
 542 }
 543 EXPORT_SYMBOL(ieee80211_stop_queue);
 544
 545 void ieee80211_add_pending_skb(struct ieee80211_local *local,
 546                                struct sk_buff *skb)
 547 {
 548         struct ieee80211_hw *hw = &local->hw;
 549         unsigned long flags;
 550         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 551         int queue = info->hw_queue;
 552
 553         if (WARN_ON(!info->control.vif)) {
 554                 ieee80211_free_txskb(&local->hw, skb);
 555                 return;
 556         }
 557
 558         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 559         __ieee80211_stop_queue(hw, queue, IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
 560                                false);
 561         __skb_queue_tail(&local->pending[queue], skb);
 562         __ieee80211_wake_queue(hw, queue, IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
 563                                false, &flags);
 564         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 565 }
 566
 567 void ieee80211_add_pending_skbs(struct ieee80211_local *local,
 568                                 struct sk_buff_head *skbs)
 569 {
 570         struct ieee80211_hw *hw = &local->hw;
 571         struct sk_buff *skb;
 572         unsigned long flags;
 573         int queue, i;
 574
 575         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 576         while ((skb = skb_dequeue(skbs))) {
 577                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 578
 579                 if (WARN_ON(!info->control.vif)) {
 580                         ieee80211_free_txskb(&local->hw, skb);
 581                         continue;
 582                 }
 583
 584                 queue = info->hw_queue;
 585
 586                 __ieee80211_stop_queue(hw, queue,
 587                                 IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
 588                                 false);
 589
 590                 __skb_queue_tail(&local->pending[queue], skb);
 591         }
 592
 593         for (i = 0; i < hw->queues; i++)
 594                 __ieee80211_wake_queue(hw, i,
 595                         IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
 596                         false, &flags);
 597         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 598 }
 599
 600 void ieee80211_stop_queues_by_reason(struct ieee80211_hw *hw,
 601                                      unsigned long queues,
 602                                      enum queue_stop_reason reason,
 603                                      bool refcounted)
 604 {
 605         struct ieee80211_local *local = hw_to_local(hw);
 606         unsigned long flags;
 607         int i;
 608
 609         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 610
 611         for_each_set_bit(i, &queues, hw->queues)
 612                 __ieee80211_stop_queue(hw, i, reason, refcounted);
 613
 614         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 615 }
 616
 617 void ieee80211_stop_queues(struct ieee80211_hw *hw)
 618 {
 619         ieee80211_stop_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP,
 620                                         IEEE80211_QUEUE_STOP_REASON_DRIVER,
 621                                         false);
 622 }
 623 EXPORT_SYMBOL(ieee80211_stop_queues);
 624
 625 int ieee80211_queue_stopped(struct ieee80211_hw *hw, int queue)
 626 {
 627         struct ieee80211_local *local = hw_to_local(hw);
 628         unsigned long flags;
 629         int ret;
 630
 631         if (WARN_ON(queue >= hw->queues))
 632                 return true;
 633
 634         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 635         ret = test_bit(IEEE80211_QUEUE_STOP_REASON_DRIVER,
 636                        &local->queue_stop_reasons[queue]);
 637         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 638         return ret;
 639 }
 640 EXPORT_SYMBOL(ieee80211_queue_stopped);
 641
 642 void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
 643                                      unsigned long queues,
 644                                      enum queue_stop_reason reason,
 645                                      bool refcounted)
 646 {
 647         struct ieee80211_local *local = hw_to_local(hw);
 648         unsigned long flags;
 649         int i;
 650
 651         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 652
 653         for_each_set_bit(i, &queues, hw->queues)
 654                 __ieee80211_wake_queue(hw, i, reason, refcounted, &flags);
 655
 656         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 657 }
 658
 659 void ieee80211_wake_queues(struct ieee80211_hw *hw)
 660 {
 661         ieee80211_wake_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP,
 662                                         IEEE80211_QUEUE_STOP_REASON_DRIVER,
 663                                         false);
 664 }
 665 EXPORT_SYMBOL(ieee80211_wake_queues);
 666
 667 static unsigned int
 668 ieee80211_get_vif_queues(struct ieee80211_local *local,
 669                          struct ieee80211_sub_if_data *sdata)
 670 {
 671         unsigned int queues;
 672
 673         if (sdata && ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) {
 674                 int ac;
 675
 676                 queues = 0;
 677
 678                 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
 679                         queues |= BIT(sdata->vif.hw_queue[ac]);
 680                 if (sdata->vif.cab_queue != IEEE80211_INVAL_HW_QUEUE)
 681                         queues |= BIT(sdata->vif.cab_queue);
 682         } else {
 683                 /* all queues */
 684                 queues = BIT(local->hw.queues) - 1;
 685         }
 686
 687         return queues;
 688 }
 689
 690 void __ieee80211_flush_queues(struct ieee80211_local *local,
 691                               struct ieee80211_sub_if_data *sdata,
 692                               unsigned int queues, bool drop)
 693 {
 694         if (!local->ops->flush)
 695                 return;
 696
 697         /*
 698          * If no queue was set, or if the HW doesn't support
 699          * IEEE80211_HW_QUEUE_CONTROL - flush all queues
 700          */
 701         if (!queues || !ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
 702                 queues = ieee80211_get_vif_queues(local, sdata);
 703
 704         ieee80211_stop_queues_by_reason(&local->hw, queues,
 705                                         IEEE80211_QUEUE_STOP_REASON_FLUSH,
 706                                         false);
 707
 708         drv_flush(local, sdata, queues, drop);
 709
 710         ieee80211_wake_queues_by_reason(&local->hw, queues,
 711                                         IEEE80211_QUEUE_STOP_REASON_FLUSH,
 712                                         false);
 713 }
 714
 715 void ieee80211_flush_queues(struct ieee80211_local *local,
 716                             struct ieee80211_sub_if_data *sdata, bool drop)
 717 {
 718         __ieee80211_flush_queues(local, sdata, 0, drop);
 719 }
 720
 721 void ieee80211_stop_vif_queues(struct ieee80211_local *local,
 722                                struct ieee80211_sub_if_data *sdata,
 723                                enum queue_stop_reason reason)
 724 {
 725         ieee80211_stop_queues_by_reason(&local->hw,
 726                                         ieee80211_get_vif_queues(local, sdata),
 727                                         reason, true);
 728 }
 729
 730 void ieee80211_wake_vif_queues(struct ieee80211_local *local,
 731                                struct ieee80211_sub_if_data *sdata,
 732                                enum queue_stop_reason reason)
 733 {
 734         ieee80211_wake_queues_by_reason(&local->hw,
 735                                         ieee80211_get_vif_queues(local, sdata),
 736                                         reason, true);
 737 }
 738
 739 static void __iterate_interfaces(struct ieee80211_local *local,
 740                                  u32 iter_flags,
 741                                  void (*iterator)(void *data, u8 *mac,
 742                                                   struct ieee80211_vif *vif),
 743                                  void *data)
 744 {
 745         struct ieee80211_sub_if_data *sdata;
 746         bool active_only = iter_flags & IEEE80211_IFACE_ITER_ACTIVE;
 747
 748         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
 749                 switch (sdata->vif.type) {
 750                 case NL80211_IFTYPE_MONITOR:
 751                         if (!(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE))
 752                                 continue;
 753                         break;
 754                 case NL80211_IFTYPE_AP_VLAN:
 755                         continue;
 756                 default:
 757                         break;
 758                 }
 759                 if (!(iter_flags & IEEE80211_IFACE_ITER_RESUME_ALL) &&
 760                     active_only && !(sdata->flags & IEEE80211_SDATA_IN_DRIVER))
 761                         continue;
 762                 if ((iter_flags & IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER) &&
 763                     !(sdata->flags & IEEE80211_SDATA_IN_DRIVER))
 764                         continue;
 765                 if (ieee80211_sdata_running(sdata) || !active_only)
 766                         iterator(data, sdata->vif.addr,
 767                                  &sdata->vif);
 768         }
 769
 770         sdata = rcu_dereference_check(local->monitor_sdata,
 771                                       lockdep_is_held(&local->iflist_mtx) ||
 772                                       lockdep_is_held(&local->hw.wiphy->mtx));
 773         if (sdata &&
 774             (iter_flags & IEEE80211_IFACE_ITER_RESUME_ALL || !active_only ||
 775              sdata->flags & IEEE80211_SDATA_IN_DRIVER))
 776                 iterator(data, sdata->vif.addr, &sdata->vif);
 777 }
 778
 779 void ieee80211_iterate_interfaces(
 780         struct ieee80211_hw *hw, u32 iter_flags,
 781         void (*iterator)(void *data, u8 *mac,
 782                          struct ieee80211_vif *vif),
 783         void *data)
 784 {
 785         struct ieee80211_local *local = hw_to_local(hw);
 786
 787         mutex_lock(&local->iflist_mtx);
 788         __iterate_interfaces(local, iter_flags, iterator, data);
 789         mutex_unlock(&local->iflist_mtx);
 790 }
 791 EXPORT_SYMBOL_GPL(ieee80211_iterate_interfaces);
 792
 793 void ieee80211_iterate_active_interfaces_atomic(
 794         struct ieee80211_hw *hw, u32 iter_flags,
 795         void (*iterator)(void *data, u8 *mac,
 796                          struct ieee80211_vif *vif),
 797         void *data)
 798 {
 799         struct ieee80211_local *local = hw_to_local(hw);
 800
 801         rcu_read_lock();
 802         __iterate_interfaces(local, iter_flags | IEEE80211_IFACE_ITER_ACTIVE,
 803                              iterator, data);
 804         rcu_read_unlock();
 805 }
 806 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
 807
 808 void ieee80211_iterate_active_interfaces_mtx(
 809         struct ieee80211_hw *hw, u32 iter_flags,
 810         void (*iterator)(void *data, u8 *mac,
 811                          struct ieee80211_vif *vif),
 812         void *data)
 813 {
 814         struct ieee80211_local *local = hw_to_local(hw);
 815
 816         lockdep_assert_wiphy(hw->wiphy);
 817
 818         __iterate_interfaces(local, iter_flags | IEEE80211_IFACE_ITER_ACTIVE,
 819                              iterator, data);
 820 }
 821 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_mtx);
 822
 823 static void __iterate_stations(struct ieee80211_local *local,
 824                                void (*iterator)(void *data,
 825                                                 struct ieee80211_sta *sta),
 826                                void *data)
 827 {
 828         struct sta_info *sta;
 829
 830         list_for_each_entry_rcu(sta, &local->sta_list, list) {
 831                 if (!sta->uploaded)
 832                         continue;
 833
 834                 iterator(data, &sta->sta);
 835         }
 836 }
 837
 838 void ieee80211_iterate_stations_atomic(struct ieee80211_hw *hw,
 839                         void (*iterator)(void *data,
 840                                          struct ieee80211_sta *sta),
 841                         void *data)
 842 {
 843         struct ieee80211_local *local = hw_to_local(hw);
 844
 845         rcu_read_lock();
 846         __iterate_stations(local, iterator, data);
 847         rcu_read_unlock();
 848 }
 849 EXPORT_SYMBOL_GPL(ieee80211_iterate_stations_atomic);
 850
 851 struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev)
 852 {
 853         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 854
 855         if (!ieee80211_sdata_running(sdata) ||
 856             !(sdata->flags & IEEE80211_SDATA_IN_DRIVER))
 857                 return NULL;
 858         return &sdata->vif;
 859 }
 860 EXPORT_SYMBOL_GPL(wdev_to_ieee80211_vif);
 861
 862 struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
 863 {
 864         if (!vif)
 865                 return NULL;
 866
 867         return &vif_to_sdata(vif)->wdev;
 868 }
 869 EXPORT_SYMBOL_GPL(ieee80211_vif_to_wdev);
 870
 871 /*
 872  * Nothing should have been stuffed into the workqueue during
 873  * the suspend->resume cycle. Since we can't check each caller
 874  * of this function if we are already quiescing / suspended,
 875  * check here and don't WARN since this can actually happen when
 876  * the rx path (for example) is racing against __ieee80211_suspend
 877  * and suspending / quiescing was set after the rx path checked
 878  * them.
 879  */
 880 static bool ieee80211_can_queue_work(struct ieee80211_local *local)
 881 {
 882         if (local->quiescing || (local->suspended && !local->resuming)) {
 883                 pr_warn("queueing ieee80211 work while going to suspend\n");
 884                 return false;
 885         }
 886
 887         return true;
 888 }
 889
 890 void ieee80211_queue_work(struct ieee80211_hw *hw, struct work_struct *work)
 891 {
 892         struct ieee80211_local *local = hw_to_local(hw);
 893
 894         if (!ieee80211_can_queue_work(local))
 895                 return;
 896
 897         queue_work(local->workqueue, work);
 898 }
 899 EXPORT_SYMBOL(ieee80211_queue_work);
 900
 901 void ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
 902                                   struct delayed_work *dwork,
 903                                   unsigned long delay)
 904 {
 905         struct ieee80211_local *local = hw_to_local(hw);
 906
 907         if (!ieee80211_can_queue_work(local))
 908                 return;
 909
 910         queue_delayed_work(local->workqueue, dwork, delay);
 911 }
 912 EXPORT_SYMBOL(ieee80211_queue_delayed_work);
 913
 914 static void
 915 ieee80211_parse_extension_element(u32 *crc,
 916                                   const struct element *elem,
 917                                   struct ieee802_11_elems *elems,
 918                                   struct ieee80211_elems_parse_params *params)
 919 {
 920         const void *data = elem->data + 1;
 921         bool calc_crc = false;
 922         u8 len;
 923
 924         if (!elem->datalen)
 925                 return;
 926
 927         len = elem->datalen - 1;
 928
 929         switch (elem->data[0]) {
 930         case WLAN_EID_EXT_HE_MU_EDCA:
 931                 calc_crc = true;
 932                 if (len >= sizeof(*elems->mu_edca_param_set))
 933                         elems->mu_edca_param_set = data;
 934                 break;
 935         case WLAN_EID_EXT_HE_CAPABILITY:
 936                 if (ieee80211_he_capa_size_ok(data, len)) {
 937                         elems->he_cap = data;
 938                         elems->he_cap_len = len;
 939                 }
 940                 break;
 941         case WLAN_EID_EXT_HE_OPERATION:
 942                 calc_crc = true;
 943                 if (len >= sizeof(*elems->he_operation) &&
 944                     len >= ieee80211_he_oper_size(data) - 1)
 945                         elems->he_operation = data;
 946                 break;
 947         case WLAN_EID_EXT_UORA:
 948                 if (len >= 1)
 949                         elems->uora_element = data;
 950                 break;
 951         case WLAN_EID_EXT_MAX_CHANNEL_SWITCH_TIME:
 952                 if (len == 3)
 953                         elems->max_channel_switch_time = data;
 954                 break;
 955         case WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION:
 956                 if (len >= sizeof(*elems->mbssid_config_ie))
 957                         elems->mbssid_config_ie = data;
 958                 break;
 959         case WLAN_EID_EXT_HE_SPR:
 960                 if (len >= sizeof(*elems->he_spr) &&
 961                     len >= ieee80211_he_spr_size(data))
 962                         elems->he_spr = data;
 963                 break;
 964         case WLAN_EID_EXT_HE_6GHZ_CAPA:
 965                 if (len >= sizeof(*elems->he_6ghz_capa))
 966                         elems->he_6ghz_capa = data;
 967                 break;
 968         case WLAN_EID_EXT_EHT_CAPABILITY:
 969                 if (ieee80211_eht_capa_size_ok(elems->he_cap,
 970                                                data, len,
 971                                                params->from_ap)) {
 972                         elems->eht_cap = data;
 973                         elems->eht_cap_len = len;
 974                 }
 975                 break;
 976         case WLAN_EID_EXT_EHT_OPERATION:
 977                 if (ieee80211_eht_oper_size_ok(data, len))
 978                         elems->eht_operation = data;
 979                 calc_crc = true;
 980                 break;
 981         case WLAN_EID_EXT_EHT_MULTI_LINK:
 982                 calc_crc = true;
 983
 984                 if (ieee80211_mle_size_ok(data, len)) {
 985                         const struct ieee80211_multi_link_elem *mle =
 986                                 (void *)data;
 987
 988                         switch (le16_get_bits(mle->control,
 989                                               IEEE80211_ML_CONTROL_TYPE)) {
 990                         case IEEE80211_ML_CONTROL_TYPE_BASIC:
 991                                 elems->ml_basic_elem = (void *)elem;
 992                                 elems->ml_basic = data;
 993                                 elems->ml_basic_len = len;
 994                                 break;
 995                         case IEEE80211_ML_CONTROL_TYPE_RECONF:
 996                                 elems->ml_reconf_elem = (void *)elem;
 997                                 elems->ml_reconf = data;
 998                                 elems->ml_reconf_len = len;
 999                                 break;
1000                         default:
1001                                 break;
1002                         }
1003                 }
1004                 break;
1005         }
1006
1007         if (crc && calc_crc)
1008                 *crc = crc32_be(*crc, (void *)elem, elem->datalen + 2);
1009 }
1010
1011 static u32
1012 _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params,
1013                              struct ieee802_11_elems *elems,
1014                              const struct element *check_inherit)
1015 {
1016         const struct element *elem;
1017         bool calc_crc = params->filter != 0;
1018         DECLARE_BITMAP(seen_elems, 256);
1019         u32 crc = params->crc;
1020         const u8 *ie;
1021
1022         bitmap_zero(seen_elems, 256);
1023
1024         for_each_element(elem, params->start, params->len) {
1025                 bool elem_parse_failed;
1026                 u8 id = elem->id;
1027                 u8 elen = elem->datalen;
1028                 const u8 *pos = elem->data;
1029
1030                 if (check_inherit &&
1031                     !cfg80211_is_element_inherited(elem,
1032                                                    check_inherit))
1033                         continue;
1034
1035                 switch (id) {
1036                 case WLAN_EID_SSID:
1037                 case WLAN_EID_SUPP_RATES:
1038                 case WLAN_EID_FH_PARAMS:
1039                 case WLAN_EID_DS_PARAMS:
1040                 case WLAN_EID_CF_PARAMS:
1041                 case WLAN_EID_TIM:
1042                 case WLAN_EID_IBSS_PARAMS:
1043                 case WLAN_EID_CHALLENGE:
1044                 case WLAN_EID_RSN:
1045                 case WLAN_EID_ERP_INFO:
1046                 case WLAN_EID_EXT_SUPP_RATES:
1047                 case WLAN_EID_HT_CAPABILITY:
1048                 case WLAN_EID_HT_OPERATION:
1049                 case WLAN_EID_VHT_CAPABILITY:
1050                 case WLAN_EID_VHT_OPERATION:
1051                 case WLAN_EID_MESH_ID:
1052                 case WLAN_EID_MESH_CONFIG:
1053                 case WLAN_EID_PEER_MGMT:
1054                 case WLAN_EID_PREQ:
1055                 case WLAN_EID_PREP:
1056                 case WLAN_EID_PERR:
1057                 case WLAN_EID_RANN:
1058                 case WLAN_EID_CHANNEL_SWITCH:
1059                 case WLAN_EID_EXT_CHANSWITCH_ANN:
1060                 case WLAN_EID_COUNTRY:
1061                 case WLAN_EID_PWR_CONSTRAINT:
1062                 case WLAN_EID_TIMEOUT_INTERVAL:
1063                 case WLAN_EID_SECONDARY_CHANNEL_OFFSET:
1064                 case WLAN_EID_WIDE_BW_CHANNEL_SWITCH:
1065                 case WLAN_EID_CHAN_SWITCH_PARAM:
1066                 case WLAN_EID_EXT_CAPABILITY:
1067                 case WLAN_EID_CHAN_SWITCH_TIMING:
1068                 case WLAN_EID_LINK_ID:
1069                 case WLAN_EID_BSS_MAX_IDLE_PERIOD:
1070                 case WLAN_EID_RSNX:
1071                 case WLAN_EID_S1G_BCN_COMPAT:
1072                 case WLAN_EID_S1G_CAPABILITIES:
1073                 case WLAN_EID_S1G_OPERATION:
1074                 case WLAN_EID_AID_RESPONSE:
1075                 case WLAN_EID_S1G_SHORT_BCN_INTERVAL:
1076                 /*
1077                  * not listing WLAN_EID_CHANNEL_SWITCH_WRAPPER -- it seems possible
1078                  * that if the content gets bigger it might be needed more than once
1079                  */
1080                         if (test_bit(id, seen_elems)) {
1081                                 elems->parse_error = true;
1082                                 continue;
1083                         }
1084                         break;
1085                 }
1086
1087                 if (calc_crc && id < 64 && (params->filter & (1ULL << id)))
1088                         crc = crc32_be(crc, pos - 2, elen + 2);
1089
1090                 elem_parse_failed = false;
1091
1092                 switch (id) {
1093                 case WLAN_EID_LINK_ID:
1094                         if (elen + 2 < sizeof(struct ieee80211_tdls_lnkie)) {
1095                                 elem_parse_failed = true;
1096                                 break;
1097                         }
1098                         elems->lnk_id = (void *)(pos - 2);
1099                         break;
1100                 case WLAN_EID_CHAN_SWITCH_TIMING:
1101                         if (elen < sizeof(struct ieee80211_ch_switch_timing)) {
1102                                 elem_parse_failed = true;
1103                                 break;
1104                         }
1105                         elems->ch_sw_timing = (void *)pos;
1106                         break;
1107                 case WLAN_EID_EXT_CAPABILITY:
1108                         elems->ext_capab = pos;
1109                         elems->ext_capab_len = elen;
1110                         break;
1111                 case WLAN_EID_SSID:
1112                         elems->ssid = pos;
1113                         elems->ssid_len = elen;
1114                         break;
1115                 case WLAN_EID_SUPP_RATES:
1116                         elems->supp_rates = pos;
1117                         elems->supp_rates_len = elen;
1118                         break;
1119                 case WLAN_EID_DS_PARAMS:
1120                         if (elen >= 1)
1121                                 elems->ds_params = pos;
1122                         else
1123                                 elem_parse_failed = true;
1124                         break;
1125                 case WLAN_EID_TIM:
1126                         if (elen >= sizeof(struct ieee80211_tim_ie)) {
1127                                 elems->tim = (void *)pos;
1128                                 elems->tim_len = elen;
1129                         } else
1130                                 elem_parse_failed = true;
1131                         break;
1132                 case WLAN_EID_VENDOR_SPECIFIC:
1133                         if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
1134                             pos[2] == 0xf2) {
1135                                 /* Microsoft OUI (00:50:F2) */
1136
1137                                 if (calc_crc)
1138                                         crc = crc32_be(crc, pos - 2, elen + 2);
1139
1140                                 if (elen >= 5 && pos[3] == 2) {
1141                                         /* OUI Type 2 - WMM IE */
1142                                         if (pos[4] == 0) {
1143                                                 elems->wmm_info = pos;
1144                                                 elems->wmm_info_len = elen;
1145                                         } else if (pos[4] == 1) {
1146                                                 elems->wmm_param = pos;
1147                                                 elems->wmm_param_len = elen;
1148                                         }
1149                                 }
1150                         }
1151                         break;
1152                 case WLAN_EID_RSN:
1153                         elems->rsn = pos;
1154                         elems->rsn_len = elen;
1155                         break;
1156                 case WLAN_EID_ERP_INFO:
1157                         if (elen >= 1)
1158                                 elems->erp_info = pos;
1159                         else
1160                                 elem_parse_failed = true;
1161                         break;
1162                 case WLAN_EID_EXT_SUPP_RATES:
1163                         elems->ext_supp_rates = pos;
1164                         elems->ext_supp_rates_len = elen;
1165                         break;
1166                 case WLAN_EID_HT_CAPABILITY:
1167                         if (elen >= sizeof(struct ieee80211_ht_cap))
1168                                 elems->ht_cap_elem = (void *)pos;
1169                         else
1170                                 elem_parse_failed = true;
1171                         break;
1172                 case WLAN_EID_HT_OPERATION:
1173                         if (elen >= sizeof(struct ieee80211_ht_operation))
1174                                 elems->ht_operation = (void *)pos;
1175                         else
1176                                 elem_parse_failed = true;
1177                         break;
1178                 case WLAN_EID_VHT_CAPABILITY:
1179                         if (elen >= sizeof(struct ieee80211_vht_cap))
1180                                 elems->vht_cap_elem = (void *)pos;
1181                         else
1182                                 elem_parse_failed = true;
1183                         break;
1184                 case WLAN_EID_VHT_OPERATION:
1185                         if (elen >= sizeof(struct ieee80211_vht_operation)) {
1186                                 elems->vht_operation = (void *)pos;
1187                                 if (calc_crc)
1188                                         crc = crc32_be(crc, pos - 2, elen + 2);
1189                                 break;
1190                         }
1191                         elem_parse_failed = true;
1192                         break;
1193                 case WLAN_EID_OPMODE_NOTIF:
1194                         if (elen > 0) {
1195                                 elems->opmode_notif = pos;
1196                                 if (calc_crc)
1197                                         crc = crc32_be(crc, pos - 2, elen + 2);
1198                                 break;
1199                         }
1200                         elem_parse_failed = true;
1201                         break;
1202                 case WLAN_EID_MESH_ID:
1203                         elems->mesh_id = pos;
1204                         elems->mesh_id_len = elen;
1205                         break;
1206                 case WLAN_EID_MESH_CONFIG:
1207                         if (elen >= sizeof(struct ieee80211_meshconf_ie))
1208                                 elems->mesh_config = (void *)pos;
1209                         else
1210                                 elem_parse_failed = true;
1211                         break;
1212                 case WLAN_EID_PEER_MGMT:
1213                         elems->peering = pos;
1214                         elems->peering_len = elen;
1215                         break;
1216                 case WLAN_EID_MESH_AWAKE_WINDOW:
1217                         if (elen >= 2)
1218                                 elems->awake_window = (void *)pos;
1219                         break;
1220                 case WLAN_EID_PREQ:
1221                         elems->preq = pos;
1222                         elems->preq_len = elen;
1223                         break;
1224                 case WLAN_EID_PREP:
1225                         elems->prep = pos;
1226                         elems->prep_len = elen;
1227                         break;
1228                 case WLAN_EID_PERR:
1229                         elems->perr = pos;
1230                         elems->perr_len = elen;
1231                         break;
1232                 case WLAN_EID_RANN:
1233                         if (elen >= sizeof(struct ieee80211_rann_ie))
1234                                 elems->rann = (void *)pos;
1235                         else
1236                                 elem_parse_failed = true;
1237                         break;
1238                 case WLAN_EID_CHANNEL_SWITCH:
1239                         if (elen != sizeof(struct ieee80211_channel_sw_ie)) {
1240                                 elem_parse_failed = true;
1241                                 break;
1242                         }
1243                         elems->ch_switch_ie = (void *)pos;
1244                         break;
1245                 case WLAN_EID_EXT_CHANSWITCH_ANN:
1246                         if (elen != sizeof(struct ieee80211_ext_chansw_ie)) {
1247                                 elem_parse_failed = true;
1248                                 break;
1249                         }
1250                         elems->ext_chansw_ie = (void *)pos;
1251                         break;
1252                 case WLAN_EID_SECONDARY_CHANNEL_OFFSET:
1253                         if (elen != sizeof(struct ieee80211_sec_chan_offs_ie)) {
1254                                 elem_parse_failed = true;
1255                                 break;
1256                         }
1257                         elems->sec_chan_offs = (void *)pos;
1258                         break;
1259                 case WLAN_EID_CHAN_SWITCH_PARAM:
1260                         if (elen <
1261                             sizeof(*elems->mesh_chansw_params_ie)) {
1262                                 elem_parse_failed = true;
1263                                 break;
1264                         }
1265                         elems->mesh_chansw_params_ie = (void *)pos;
1266                         break;
1267                 case WLAN_EID_WIDE_BW_CHANNEL_SWITCH:
1268                         if (!params->action ||
1269                             elen < sizeof(*elems->wide_bw_chansw_ie)) {
1270                                 elem_parse_failed = true;
1271                                 break;
1272                         }
1273                         elems->wide_bw_chansw_ie = (void *)pos;
1274                         break;
1275                 case WLAN_EID_CHANNEL_SWITCH_WRAPPER:
1276                         if (params->action) {
1277                                 elem_parse_failed = true;
1278                                 break;
1279                         }
1280                         /*
1281                          * This is a bit tricky, but as we only care about
1282                          * the wide bandwidth channel switch element, so
1283                          * just parse it out manually.
1284                          */
1285                         ie = cfg80211_find_ie(WLAN_EID_WIDE_BW_CHANNEL_SWITCH,
1286                                               pos, elen);
1287                         if (ie) {
1288                                 if (ie[1] >= sizeof(*elems->wide_bw_chansw_ie))
1289                                         elems->wide_bw_chansw_ie =
1290                                                 (void *)(ie + 2);
1291                                 else
1292                                         elem_parse_failed = true;
1293                         }
1294                         break;
1295                 case WLAN_EID_COUNTRY:
1296                         elems->country_elem = pos;
1297                         elems->country_elem_len = elen;
1298                         break;
1299                 case WLAN_EID_PWR_CONSTRAINT:
1300                         if (elen != 1) {
1301                                 elem_parse_failed = true;
1302                                 break;
1303                         }
1304                         elems->pwr_constr_elem = pos;
1305                         break;
1306                 case WLAN_EID_CISCO_VENDOR_SPECIFIC:
1307                         /* Lots of different options exist, but we only care
1308                          * about the Dynamic Transmit Power Control element.
1309                          * First check for the Cisco OUI, then for the DTPC
1310                          * tag (0x00).
1311                          */
1312                         if (elen < 4) {
1313                                 elem_parse_failed = true;
1314                                 break;
1315                         }
1316
1317                         if (pos[0] != 0x00 || pos[1] != 0x40 ||
1318                             pos[2] != 0x96 || pos[3] != 0x00)
1319                                 break;
1320
1321                         if (elen != 6) {
1322                                 elem_parse_failed = true;
1323                                 break;
1324                         }
1325
1326                         if (calc_crc)
1327                                 crc = crc32_be(crc, pos - 2, elen + 2);
1328
1329                         elems->cisco_dtpc_elem = pos;
1330                         break;
1331                 case WLAN_EID_ADDBA_EXT:
1332                         if (elen < sizeof(struct ieee80211_addba_ext_ie)) {
1333                                 elem_parse_failed = true;
1334                                 break;
1335                         }
1336                         elems->addba_ext_ie = (void *)pos;
1337                         break;
1338                 case WLAN_EID_TIMEOUT_INTERVAL:
1339                         if (elen >= sizeof(struct ieee80211_timeout_interval_ie))
1340                                 elems->timeout_int = (void *)pos;
1341                         else
1342                                 elem_parse_failed = true;
1343                         break;
1344                 case WLAN_EID_BSS_MAX_IDLE_PERIOD:
1345                         if (elen >= sizeof(*elems->max_idle_period_ie))
1346                                 elems->max_idle_period_ie = (void *)pos;
1347                         break;
1348                 case WLAN_EID_RSNX:
1349                         elems->rsnx = pos;
1350                         elems->rsnx_len = elen;
1351                         break;
1352                 case WLAN_EID_TX_POWER_ENVELOPE:
1353                         if (elen < 1 ||
1354                             elen > sizeof(struct ieee80211_tx_pwr_env))
1355                                 break;
1356
1357                         if (elems->tx_pwr_env_num >= ARRAY_SIZE(elems->tx_pwr_env))
1358                                 break;
1359
1360                         elems->tx_pwr_env[elems->tx_pwr_env_num] = (void *)pos;
1361                         elems->tx_pwr_env_len[elems->tx_pwr_env_num] = elen;
1362                         elems->tx_pwr_env_num++;
1363                         break;
1364                 case WLAN_EID_EXTENSION:
1365                         ieee80211_parse_extension_element(calc_crc ?
1366                                                                 &crc : NULL,
1367                                                           elem, elems, params);
1368                         break;
1369                 case WLAN_EID_S1G_CAPABILITIES:
1370                         if (elen >= sizeof(*elems->s1g_capab))
1371                                 elems->s1g_capab = (void *)pos;
1372                         else
1373                                 elem_parse_failed = true;
1374                         break;
1375                 case WLAN_EID_S1G_OPERATION:
1376                         if (elen == sizeof(*elems->s1g_oper))
1377                                 elems->s1g_oper = (void *)pos;
1378                         else
1379                                 elem_parse_failed = true;
1380                         break;
1381                 case WLAN_EID_S1G_BCN_COMPAT:
1382                         if (elen == sizeof(*elems->s1g_bcn_compat))
1383                                 elems->s1g_bcn_compat = (void *)pos;
1384                         else
1385                                 elem_parse_failed = true;
1386                         break;
1387                 case WLAN_EID_AID_RESPONSE:
1388                         if (elen == sizeof(struct ieee80211_aid_response_ie))
1389                                 elems->aid_resp = (void *)pos;
1390                         else
1391                                 elem_parse_failed = true;
1392                         break;
1393                 default:
1394                         break;
1395                 }
1396
1397                 if (elem_parse_failed)
1398                         elems->parse_error = true;
1399                 else
1400                         __set_bit(id, seen_elems);
1401         }
1402
1403         if (!for_each_element_completed(elem, params->start, params->len))
1404                 elems->parse_error = true;
1405
1406         return crc;
1407 }
1408
1409 static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len,
1410                                             struct ieee802_11_elems *elems,
1411                                             struct cfg80211_bss *bss,
1412                                             u8 *nontransmitted_profile)
1413 {
1414         const struct element *elem, *sub;
1415         size_t profile_len = 0;
1416         bool found = false;
1417
1418         if (!bss || !bss->transmitted_bss)
1419                 return profile_len;
1420
1421         for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, start, len) {
1422                 if (elem->datalen < 2)
1423                         continue;
1424                 if (elem->data[0] < 1 || elem->data[0] > 8)
1425                         continue;
1426
1427                 for_each_element(sub, elem->data + 1, elem->datalen - 1) {
1428                         u8 new_bssid[ETH_ALEN];
1429                         const u8 *index;
1430
1431                         if (sub->id != 0 || sub->datalen < 4) {
1432                                 /* not a valid BSS profile */
1433                                 continue;
1434                         }
1435
1436                         if (sub->data[0] != WLAN_EID_NON_TX_BSSID_CAP ||
1437                             sub->data[1] != 2) {
1438                                 /* The first element of the
1439                                  * Nontransmitted BSSID Profile is not
1440                                  * the Nontransmitted BSSID Capability
1441                                  * element.
1442                                  */
1443                                 continue;
1444                         }
1445
1446                         memset(nontransmitted_profile, 0, len);
1447                         profile_len = cfg80211_merge_profile(start, len,
1448                                                              elem,
1449                                                              sub,
1450                                                              nontransmitted_profile,
1451                                                              len);
1452
1453                         /* found a Nontransmitted BSSID Profile */
1454                         index = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1455                                                  nontransmitted_profile,
1456                                                  profile_len);
1457                         if (!index || index[1] < 1 || index[2] == 0) {
1458                                 /* Invalid MBSSID Index element */
1459                                 continue;
1460                         }
1461
1462                         cfg80211_gen_new_bssid(bss->transmitted_bss->bssid,
1463                                                elem->data[0],
1464                                                index[2],
1465                                                new_bssid);
1466                         if (ether_addr_equal(new_bssid, bss->bssid)) {
1467                                 found = true;
1468                                 elems->bssid_index_len = index[1];
1469                                 elems->bssid_index = (void *)&index[2];
1470                                 break;
1471                         }
1472                 }
1473         }
1474
1475         return found ? profile_len : 0;
1476 }
1477
1478 static void ieee80211_mle_get_sta_prof(struct ieee802_11_elems *elems,
1479                                        u8 link_id)
1480 {
1481         const struct ieee80211_multi_link_elem *ml = elems->ml_basic;
1482         ssize_t ml_len = elems->ml_basic_len;
1483         const struct element *sub;
1484
1485         if (!ml || !ml_len)
1486                 return;
1487
1488         if (le16_get_bits(ml->control, IEEE80211_ML_CONTROL_TYPE) !=
1489             IEEE80211_ML_CONTROL_TYPE_BASIC)
1490                 return;
1491
1492         for_each_mle_subelement(sub, (u8 *)ml, ml_len) {
1493                 struct ieee80211_mle_per_sta_profile *prof = (void *)sub->data;
1494                 ssize_t sta_prof_len;
1495                 u16 control;
1496
1497                 if (sub->id != IEEE80211_MLE_SUBELEM_PER_STA_PROFILE)
1498                         continue;
1499
1500                 if (!ieee80211_mle_basic_sta_prof_size_ok(sub->data,
1501                                                           sub->datalen))
1502                         return;
1503
1504                 control = le16_to_cpu(prof->control);
1505
1506                 if (link_id != u16_get_bits(control,
1507                                             IEEE80211_MLE_STA_CONTROL_LINK_ID))
1508                         continue;
1509
1510                 if (!(control & IEEE80211_MLE_STA_CONTROL_COMPLETE_PROFILE))
1511                         return;
1512
1513                 /* the sub element can be fragmented */
1514                 sta_prof_len =
1515                         cfg80211_defragment_element(sub,
1516                                                     (u8 *)ml, ml_len,
1517                                                     elems->scratch_pos,
1518                                                     elems->scratch +
1519                                                         elems->scratch_len -
1520                                                         elems->scratch_pos,
1521                                                     IEEE80211_MLE_SUBELEM_FRAGMENT);
1522
1523                 if (sta_prof_len < 0)
1524                         return;
1525
1526                 elems->prof = (void *)elems->scratch_pos;
1527                 elems->sta_prof_len = sta_prof_len;
1528                 elems->scratch_pos += sta_prof_len;
1529
1530                 return;
1531         }
1532 }
1533
1534 static void ieee80211_mle_parse_link(struct ieee802_11_elems *elems,
1535                                      struct ieee80211_elems_parse_params *params)
1536 {
1537         struct ieee80211_mle_per_sta_profile *prof;
1538         struct ieee80211_elems_parse_params sub = {
1539                 .action = params->action,
1540                 .from_ap = params->from_ap,
1541                 .link_id = -1,
1542         };
1543         ssize_t ml_len = elems->ml_basic_len;
1544         const struct element *non_inherit = NULL;
1545         const u8 *end;
1546
1547         if (params->link_id == -1)
1548                 return;
1549
1550         ml_len = cfg80211_defragment_element(elems->ml_basic_elem,
1551                                              elems->ie_start,
1552                                              elems->total_len,
1553                                              elems->scratch_pos,
1554                                              elems->scratch +
1555                                                 elems->scratch_len -
1556                                                 elems->scratch_pos,
1557                                              WLAN_EID_FRAGMENT);
1558
1559         if (ml_len < 0)
1560                 return;
1561
1562         elems->ml_basic = (const void *)elems->scratch_pos;
1563         elems->ml_basic_len = ml_len;
1564
1565         ieee80211_mle_get_sta_prof(elems, params->link_id);
1566         prof = elems->prof;
1567
1568         if (!prof)
1569                 return;
1570
1571         /* check if we have the 4 bytes for the fixed part in assoc response */
1572         if (elems->sta_prof_len < sizeof(*prof) + prof->sta_info_len - 1 + 4) {
1573                 elems->prof = NULL;
1574                 elems->sta_prof_len = 0;
1575                 return;
1576         }
1577
1578         /*
1579          * Skip the capability information and the status code that are expected
1580          * as part of the station profile in association response frames. Note
1581          * the -1 is because the 'sta_info_len' is accounted to as part of the
1582          * per-STA profile, but not part of the 'u8 variable[]' portion.
1583          */
1584         sub.start = prof->variable + prof->sta_info_len - 1 + 4;
1585         end = (const u8 *)prof + elems->sta_prof_len;
1586         sub.len = end - sub.start;
1587
1588         non_inherit = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
1589                                              sub.start, sub.len);
1590         _ieee802_11_parse_elems_full(&sub, elems, non_inherit);
1591 }
1592
1593 struct ieee802_11_elems *
1594 ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params)
1595 {
1596         struct ieee802_11_elems *elems;
1597         const struct element *non_inherit = NULL;
1598         u8 *nontransmitted_profile;
1599         int nontransmitted_profile_len = 0;
1600         size_t scratch_len = 3 * params->len;
1601
1602         elems = kzalloc(sizeof(*elems) + scratch_len, GFP_ATOMIC);
1603         if (!elems)
1604                 return NULL;
1605         elems->ie_start = params->start;
1606         elems->total_len = params->len;
1607         elems->scratch_len = scratch_len;
1608         elems->scratch_pos = elems->scratch;
1609
1610         nontransmitted_profile = elems->scratch_pos;
1611         nontransmitted_profile_len =
1612                 ieee802_11_find_bssid_profile(params->start, params->len,
1613                                               elems, params->bss,
1614                                               nontransmitted_profile);
1615         elems->scratch_pos += nontransmitted_profile_len;
1616         elems->scratch_len -= nontransmitted_profile_len;
1617         non_inherit = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
1618                                              nontransmitted_profile,
1619                                              nontransmitted_profile_len);
1620
1621         elems->crc = _ieee802_11_parse_elems_full(params, elems, non_inherit);
1622
1623         /* Override with nontransmitted profile, if found */
1624         if (nontransmitted_profile_len) {
1625                 struct ieee80211_elems_parse_params sub = {
1626                         .start = nontransmitted_profile,
1627                         .len = nontransmitted_profile_len,
1628                         .action = params->action,
1629                         .link_id = params->link_id,
1630                 };
1631
1632                 _ieee802_11_parse_elems_full(&sub, elems, NULL);
1633         }
1634
1635         ieee80211_mle_parse_link(elems, params);
1636
1637         if (elems->tim && !elems->parse_error) {
1638                 const struct ieee80211_tim_ie *tim_ie = elems->tim;
1639
1640                 elems->dtim_period = tim_ie->dtim_period;
1641                 elems->dtim_count = tim_ie->dtim_count;
1642         }
1643
1644         /* Override DTIM period and count if needed */
1645         if (elems->bssid_index &&
1646             elems->bssid_index_len >=
1647             offsetofend(struct ieee80211_bssid_index, dtim_period))
1648                 elems->dtim_period = elems->bssid_index->dtim_period;
1649
1650         if (elems->bssid_index &&
1651             elems->bssid_index_len >=
1652             offsetofend(struct ieee80211_bssid_index, dtim_count))
1653                 elems->dtim_count = elems->bssid_index->dtim_count;
1654
1655         return elems;
1656 }
1657
1658 void ieee80211_regulatory_limit_wmm_params(struct ieee80211_sub_if_data *sdata,
1659                                            struct ieee80211_tx_queue_params
1660                                            *qparam, int ac)
1661 {
1662         struct ieee80211_chanctx_conf *chanctx_conf;
1663         const struct ieee80211_reg_rule *rrule;
1664         const struct ieee80211_wmm_ac *wmm_ac;
1665         u16 center_freq = 0;
1666
1667         if (sdata->vif.type != NL80211_IFTYPE_AP &&
1668             sdata->vif.type != NL80211_IFTYPE_STATION)
1669                 return;
1670
1671         rcu_read_lock();
1672         chanctx_conf = rcu_dereference(sdata->vif.bss_conf.chanctx_conf);
1673         if (chanctx_conf)
1674                 center_freq = chanctx_conf->def.chan->center_freq;
1675
1676         if (!center_freq) {
1677                 rcu_read_unlock();
1678                 return;
1679         }
1680
1681         rrule = freq_reg_info(sdata->wdev.wiphy, MHZ_TO_KHZ(center_freq));
1682
1683         if (IS_ERR_OR_NULL(rrule) || !rrule->has_wmm) {
1684                 rcu_read_unlock();
1685                 return;
1686         }
1687
1688         if (sdata->vif.type == NL80211_IFTYPE_AP)
1689                 wmm_ac = &rrule->wmm_rule.ap[ac];
1690         else
1691                 wmm_ac = &rrule->wmm_rule.client[ac];
1692         qparam->cw_min = max_t(u16, qparam->cw_min, wmm_ac->cw_min);
1693         qparam->cw_max = max_t(u16, qparam->cw_max, wmm_ac->cw_max);
1694         qparam->aifs = max_t(u8, qparam->aifs, wmm_ac->aifsn);
1695         qparam->txop = min_t(u16, qparam->txop, wmm_ac->cot / 32);
1696         rcu_read_unlock();
1697 }
1698
1699 void ieee80211_set_wmm_default(struct ieee80211_link_data *link,
1700                                bool bss_notify, bool enable_qos)
1701 {
1702         struct ieee80211_sub_if_data *sdata = link->sdata;
1703         struct ieee80211_local *local = sdata->local;
1704         struct ieee80211_tx_queue_params qparam;
1705         struct ieee80211_chanctx_conf *chanctx_conf;
1706         int ac;
1707         bool use_11b;
1708         bool is_ocb; /* Use another EDCA parameters if dot11OCBActivated=true */
1709         int aCWmin, aCWmax;
1710
1711         if (!local->ops->conf_tx)
1712                 return;
1713
1714         if (local->hw.queues < IEEE80211_NUM_ACS)
1715                 return;
1716
1717         memset(&qparam, 0, sizeof(qparam));
1718
1719         rcu_read_lock();
1720         chanctx_conf = rcu_dereference(link->conf->chanctx_conf);
1721         use_11b = (chanctx_conf &&
1722                    chanctx_conf->def.chan->band == NL80211_BAND_2GHZ) &&
1723                  !link->operating_11g_mode;
1724         rcu_read_unlock();
1725
1726         is_ocb = (sdata->vif.type == NL80211_IFTYPE_OCB);
1727
1728         /* Set defaults according to 802.11-2007 Table 7-37 */
1729         aCWmax = 1023;
1730         if (use_11b)
1731                 aCWmin = 31;
1732         else
1733                 aCWmin = 15;
1734
1735         /* Confiure old 802.11b/g medium access rules. */
1736         qparam.cw_max = aCWmax;
1737         qparam.cw_min = aCWmin;
1738         qparam.txop = 0;
1739         qparam.aifs = 2;
1740
1741         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1742                 /* Update if QoS is enabled. */
1743                 if (enable_qos) {
1744                         switch (ac) {
1745                         case IEEE80211_AC_BK:
1746                                 qparam.cw_max = aCWmax;
1747                                 qparam.cw_min = aCWmin;
1748                                 qparam.txop = 0;
1749                                 if (is_ocb)
1750                                         qparam.aifs = 9;
1751                                 else
1752                                         qparam.aifs = 7;
1753                                 break;
1754                         /* never happens but let's not leave undefined */
1755                         default:
1756                         case IEEE80211_AC_BE:
1757                                 qparam.cw_max = aCWmax;
1758                                 qparam.cw_min = aCWmin;
1759                                 qparam.txop = 0;
1760                                 if (is_ocb)
1761                                         qparam.aifs = 6;
1762                                 else
1763                                         qparam.aifs = 3;
1764                                 break;
1765                         case IEEE80211_AC_VI:
1766                                 qparam.cw_max = aCWmin;
1767                                 qparam.cw_min = (aCWmin + 1) / 2 - 1;
1768                                 if (is_ocb)
1769                                         qparam.txop = 0;
1770                                 else if (use_11b)
1771                                         qparam.txop = 6016/32;
1772                                 else
1773                                         qparam.txop = 3008/32;
1774
1775                                 if (is_ocb)
1776                                         qparam.aifs = 3;
1777                                 else
1778                                         qparam.aifs = 2;
1779                                 break;
1780                         case IEEE80211_AC_VO:
1781                                 qparam.cw_max = (aCWmin + 1) / 2 - 1;
1782                                 qparam.cw_min = (aCWmin + 1) / 4 - 1;
1783                                 if (is_ocb)
1784                                         qparam.txop = 0;
1785                                 else if (use_11b)
1786                                         qparam.txop = 3264/32;
1787                                 else
1788                                         qparam.txop = 1504/32;
1789                                 qparam.aifs = 2;
1790                                 break;
1791                         }
1792                 }
1793                 ieee80211_regulatory_limit_wmm_params(sdata, &qparam, ac);
1794
1795                 qparam.uapsd = false;
1796
1797                 link->tx_conf[ac] = qparam;
1798                 drv_conf_tx(local, link, ac, &qparam);
1799         }
1800
1801         if (sdata->vif.type != NL80211_IFTYPE_MONITOR &&
1802             sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
1803             sdata->vif.type != NL80211_IFTYPE_NAN) {
1804                 link->conf->qos = enable_qos;
1805                 if (bss_notify)
1806                         ieee80211_link_info_change_notify(sdata, link,
1807                                                           BSS_CHANGED_QOS);
1808         }
1809 }
1810
1811 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
1812                          u16 transaction, u16 auth_alg, u16 status,
1813                          const u8 *extra, size_t extra_len, const u8 *da,
1814                          const u8 *bssid, const u8 *key, u8 key_len, u8 key_idx,
1815                          u32 tx_flags)
1816 {
1817         struct ieee80211_local *local = sdata->local;
1818         struct sk_buff *skb;
1819         struct ieee80211_mgmt *mgmt;
1820         bool multi_link = ieee80211_vif_is_mld(&sdata->vif);
1821         struct {
1822                 u8 id;
1823                 u8 len;
1824                 u8 ext_id;
1825                 struct ieee80211_multi_link_elem ml;
1826                 struct ieee80211_mle_basic_common_info basic;
1827         } __packed mle = {
1828                 .id = WLAN_EID_EXTENSION,
1829                 .len = sizeof(mle) - 2,
1830                 .ext_id = WLAN_EID_EXT_EHT_MULTI_LINK,
1831                 .ml.control = cpu_to_le16(IEEE80211_ML_CONTROL_TYPE_BASIC),
1832                 .basic.len = sizeof(mle.basic),
1833         };
1834         int err;
1835
1836         memcpy(mle.basic.mld_mac_addr, sdata->vif.addr, ETH_ALEN);
1837
1838         /* 24 + 6 = header + auth_algo + auth_transaction + status_code */
1839         skb = dev_alloc_skb(local->hw.extra_tx_headroom + IEEE80211_WEP_IV_LEN +
1840                             24 + 6 + extra_len + IEEE80211_WEP_ICV_LEN +
1841                             multi_link * sizeof(mle));
1842         if (!skb)
1843                 return;
1844
1845         skb_reserve(skb, local->hw.extra_tx_headroom + IEEE80211_WEP_IV_LEN);
1846
1847         mgmt = skb_put_zero(skb, 24 + 6);
1848         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1849                                           IEEE80211_STYPE_AUTH);
1850         memcpy(mgmt->da, da, ETH_ALEN);
1851         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
1852         memcpy(mgmt->bssid, bssid, ETH_ALEN);
1853         mgmt->u.auth.auth_alg = cpu_to_le16(auth_alg);
1854         mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
1855         mgmt->u.auth.status_code = cpu_to_le16(status);
1856         if (extra)
1857                 skb_put_data(skb, extra, extra_len);
1858         if (multi_link)
1859                 skb_put_data(skb, &mle, sizeof(mle));
1860
1861         if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) {
1862                 mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
1863                 err = ieee80211_wep_encrypt(local, skb, key, key_len, key_idx);
1864                 if (WARN_ON(err)) {
1865                         kfree_skb(skb);
1866                         return;
1867                 }
1868         }
1869
1870         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
1871                                         tx_flags;
1872         ieee80211_tx_skb(sdata, skb);
1873 }
1874
1875 void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
1876                                     const u8 *da, const u8 *bssid,
1877                                     u16 stype, u16 reason,
1878                                     bool send_frame, u8 *frame_buf)
1879 {
1880         struct ieee80211_local *local = sdata->local;
1881         struct sk_buff *skb;
1882         struct ieee80211_mgmt *mgmt = (void *)frame_buf;
1883
1884         /* build frame */
1885         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype);
1886         mgmt->duration = 0; /* initialize only */
1887         mgmt->seq_ctrl = 0; /* initialize only */
1888         memcpy(mgmt->da, da, ETH_ALEN);
1889         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
1890         memcpy(mgmt->bssid, bssid, ETH_ALEN);
1891         /* u.deauth.reason_code == u.disassoc.reason_code */
1892         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
1893
1894         if (send_frame) {
1895                 skb = dev_alloc_skb(local->hw.extra_tx_headroom +
1896                                     IEEE80211_DEAUTH_FRAME_LEN);
1897                 if (!skb)
1898                         return;
1899
1900                 skb_reserve(skb, local->hw.extra_tx_headroom);
1901
1902                 /* copy in frame */
1903                 skb_put_data(skb, mgmt, IEEE80211_DEAUTH_FRAME_LEN);
1904
1905                 if (sdata->vif.type != NL80211_IFTYPE_STATION ||
1906                     !(sdata->u.mgd.flags & IEEE80211_STA_MFP_ENABLED))
1907                         IEEE80211_SKB_CB(skb)->flags |=
1908                                 IEEE80211_TX_INTFL_DONT_ENCRYPT;
1909
1910                 ieee80211_tx_skb(sdata, skb);
1911         }
1912 }
1913
1914 u8 *ieee80211_write_he_6ghz_cap(u8 *pos, __le16 cap, u8 *end)
1915 {
1916         if ((end - pos) < 5)
1917                 return pos;
1918
1919         *pos++ = WLAN_EID_EXTENSION;
1920         *pos++ = 1 + sizeof(cap);
1921         *pos++ = WLAN_EID_EXT_HE_6GHZ_CAPA;
1922         memcpy(pos, &cap, sizeof(cap));
1923
1924         return pos + 2;
1925 }
1926
1927 static int ieee80211_build_preq_ies_band(struct ieee80211_sub_if_data *sdata,
1928                                          u8 *buffer, size_t buffer_len,
1929                                          const u8 *ie, size_t ie_len,
1930                                          enum nl80211_band band,
1931                                          u32 rate_mask,
1932                                          struct cfg80211_chan_def *chandef,
1933                                          size_t *offset, u32 flags)
1934 {
1935         struct ieee80211_local *local = sdata->local;
1936         struct ieee80211_supported_band *sband;
1937         const struct ieee80211_sta_he_cap *he_cap;
1938         const struct ieee80211_sta_eht_cap *eht_cap;
1939         u8 *pos = buffer, *end = buffer + buffer_len;
1940         size_t noffset;
1941         int supp_rates_len, i;
1942         u8 rates[32];
1943         int num_rates;
1944         int ext_rates_len;
1945         int shift;
1946         u32 rate_flags;
1947         bool have_80mhz = false;
1948
1949         *offset = 0;
1950
1951         sband = local->hw.wiphy->bands[band];
1952         if (WARN_ON_ONCE(!sband))
1953                 return 0;
1954
1955         rate_flags = ieee80211_chandef_rate_flags(chandef);
1956         shift = ieee80211_chandef_get_shift(chandef);
1957
1958         /* For direct scan add S1G IE and consider its override bits */
1959         if (band == NL80211_BAND_S1GHZ) {
1960                 if (end - pos < 2 + sizeof(struct ieee80211_s1g_cap))
1961                         goto out_err;
1962                 pos = ieee80211_ie_build_s1g_cap(pos, &sband->s1g_cap);
1963                 goto done;
1964         }
1965
1966         num_rates = 0;
1967         for (i = 0; i < sband->n_bitrates; i++) {
1968                 if ((BIT(i) & rate_mask) == 0)
1969                         continue; /* skip rate */
1970                 if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
1971                         continue;
1972
1973                 rates[num_rates++] =
1974                         (u8) DIV_ROUND_UP(sband->bitrates[i].bitrate,
1975                                           (1 << shift) * 5);
1976         }
1977
1978         supp_rates_len = min_t(int, num_rates, 8);
1979
1980         if (end - pos < 2 + supp_rates_len)
1981                 goto out_err;
1982         *pos++ = WLAN_EID_SUPP_RATES;
1983         *pos++ = supp_rates_len;
1984         memcpy(pos, rates, supp_rates_len);
1985         pos += supp_rates_len;
1986
1987         /* insert "request information" if in custom IEs */
1988         if (ie && ie_len) {
1989                 static const u8 before_extrates[] = {
1990                         WLAN_EID_SSID,
1991                         WLAN_EID_SUPP_RATES,
1992                         WLAN_EID_REQUEST,
1993                 };
1994                 noffset = ieee80211_ie_split(ie, ie_len,
1995                                              before_extrates,
1996                                              ARRAY_SIZE(before_extrates),
1997                                              *offset);
1998                 if (end - pos < noffset - *offset)
1999                         goto out_err;
2000                 memcpy(pos, ie + *offset, noffset - *offset);
2001                 pos += noffset - *offset;
2002                 *offset = noffset;
2003         }
2004
2005         ext_rates_len = num_rates - supp_rates_len;
2006         if (ext_rates_len > 0) {
2007                 if (end - pos < 2 + ext_rates_len)
2008                         goto out_err;
2009                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
2010                 *pos++ = ext_rates_len;
2011                 memcpy(pos, rates + supp_rates_len, ext_rates_len);
2012                 pos += ext_rates_len;
2013         }
2014
2015         if (chandef->chan && sband->band == NL80211_BAND_2GHZ) {
2016                 if (end - pos < 3)
2017                         goto out_err;
2018                 *pos++ = WLAN_EID_DS_PARAMS;
2019                 *pos++ = 1;
2020                 *pos++ = ieee80211_frequency_to_channel(
2021                                 chandef->chan->center_freq);
2022         }
2023
2024         if (flags & IEEE80211_PROBE_FLAG_MIN_CONTENT)
2025                 goto done;
2026
2027         /* insert custom IEs that go before HT */
2028         if (ie && ie_len) {
2029                 static const u8 before_ht[] = {
2030                         /*
2031                          * no need to list the ones split off already
2032                          * (or generated here)
2033                          */
2034                         WLAN_EID_DS_PARAMS,
2035                         WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
2036                 };
2037                 noffset = ieee80211_ie_split(ie, ie_len,
2038                                              before_ht, ARRAY_SIZE(before_ht),
2039                                              *offset);
2040                 if (end - pos < noffset - *offset)
2041                         goto out_err;
2042                 memcpy(pos, ie + *offset, noffset - *offset);
2043                 pos += noffset - *offset;
2044                 *offset = noffset;
2045         }
2046
2047         if (sband->ht_cap.ht_supported) {
2048                 if (end - pos < 2 + sizeof(struct ieee80211_ht_cap))
2049                         goto out_err;
2050                 pos = ieee80211_ie_build_ht_cap(pos, &sband->ht_cap,
2051                                                 sband->ht_cap.cap);
2052         }
2053
2054         /* insert custom IEs that go before VHT */
2055         if (ie && ie_len) {
2056                 static const u8 before_vht[] = {
2057                         /*
2058                          * no need to list the ones split off already
2059                          * (or generated here)
2060                          */
2061                         WLAN_EID_BSS_COEX_2040,
2062                         WLAN_EID_EXT_CAPABILITY,
2063                         WLAN_EID_SSID_LIST,
2064                         WLAN_EID_CHANNEL_USAGE,
2065                         WLAN_EID_INTERWORKING,
2066                         WLAN_EID_MESH_ID,
2067                         /* 60 GHz (Multi-band, DMG, MMS) can't happen */
2068                 };
2069                 noffset = ieee80211_ie_split(ie, ie_len,
2070                                              before_vht, ARRAY_SIZE(before_vht),
2071                                              *offset);
2072                 if (end - pos < noffset - *offset)
2073                         goto out_err;
2074                 memcpy(pos, ie + *offset, noffset - *offset);
2075                 pos += noffset - *offset;
2076                 *offset = noffset;
2077         }
2078
2079         /* Check if any channel in this sband supports at least 80 MHz */
2080         for (i = 0; i < sband->n_channels; i++) {
2081                 if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
2082                                                 IEEE80211_CHAN_NO_80MHZ))
2083                         continue;
2084
2085                 have_80mhz = true;
2086                 break;
2087         }
2088
2089         if (sband->vht_cap.vht_supported && have_80mhz) {
2090                 if (end - pos < 2 + sizeof(struct ieee80211_vht_cap))
2091                         goto out_err;
2092                 pos = ieee80211_ie_build_vht_cap(pos, &sband->vht_cap,
2093                                                  sband->vht_cap.cap);
2094         }
2095
2096         /* insert custom IEs that go before HE */
2097         if (ie && ie_len) {
2098                 static const u8 before_he[] = {
2099                         /*
2100                          * no need to list the ones split off before VHT
2101                          * or generated here
2102                          */
2103                         WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_REQ_PARAMS,
2104                         WLAN_EID_AP_CSN,
2105                         /* TODO: add 11ah/11aj/11ak elements */
2106                 };
2107                 noffset = ieee80211_ie_split(ie, ie_len,
2108                                              before_he, ARRAY_SIZE(before_he),
2109                                              *offset);
2110                 if (end - pos < noffset - *offset)
2111                         goto out_err;
2112                 memcpy(pos, ie + *offset, noffset - *offset);
2113                 pos += noffset - *offset;
2114                 *offset = noffset;
2115         }
2116
2117         he_cap = ieee80211_get_he_iftype_cap_vif(sband, &sdata->vif);
2118         if (he_cap &&
2119             cfg80211_any_usable_channels(local->hw.wiphy, BIT(sband->band),
2120                                          IEEE80211_CHAN_NO_HE)) {
2121                 pos = ieee80211_ie_build_he_cap(0, pos, he_cap, end);
2122                 if (!pos)
2123                         goto out_err;
2124         }
2125
2126         eht_cap = ieee80211_get_eht_iftype_cap_vif(sband, &sdata->vif);
2127
2128         if (eht_cap &&
2129             cfg80211_any_usable_channels(local->hw.wiphy, BIT(sband->band),
2130                                          IEEE80211_CHAN_NO_HE |
2131                                          IEEE80211_CHAN_NO_EHT)) {
2132                 pos = ieee80211_ie_build_eht_cap(pos, he_cap, eht_cap, end,
2133                                                  sdata->vif.type == NL80211_IFTYPE_AP);
2134                 if (!pos)
2135                         goto out_err;
2136         }
2137
2138         if (cfg80211_any_usable_channels(local->hw.wiphy,
2139                                          BIT(NL80211_BAND_6GHZ),
2140                                          IEEE80211_CHAN_NO_HE)) {
2141                 struct ieee80211_supported_band *sband6;
2142
2143                 sband6 = local->hw.wiphy->bands[NL80211_BAND_6GHZ];
2144                 he_cap = ieee80211_get_he_iftype_cap_vif(sband6, &sdata->vif);
2145
2146                 if (he_cap) {
2147                         enum nl80211_iftype iftype =
2148                                 ieee80211_vif_type_p2p(&sdata->vif);
2149                         __le16 cap = ieee80211_get_he_6ghz_capa(sband6, iftype);
2150
2151                         pos = ieee80211_write_he_6ghz_cap(pos, cap, end);
2152                 }
2153         }
2154
2155         /*
2156          * If adding more here, adjust code in main.c
2157          * that calculates local->scan_ies_len.
2158          */
2159
2160         return pos - buffer;
2161  out_err:
2162         WARN_ONCE(1, "not enough space for preq IEs\n");
2163  done:
2164         return pos - buffer;
2165 }
2166
2167 int ieee80211_build_preq_ies(struct ieee80211_sub_if_data *sdata, u8 *buffer,
2168                              size_t buffer_len,
2169                              struct ieee80211_scan_ies *ie_desc,
2170                              const u8 *ie, size_t ie_len,
2171                              u8 bands_used, u32 *rate_masks,
2172                              struct cfg80211_chan_def *chandef,
2173                              u32 flags)
2174 {
2175         size_t pos = 0, old_pos = 0, custom_ie_offset = 0;
2176         int i;
2177
2178         memset(ie_desc, 0, sizeof(*ie_desc));
2179
2180         for (i = 0; i < NUM_NL80211_BANDS; i++) {
2181                 if (bands_used & BIT(i)) {
2182                         pos += ieee80211_build_preq_ies_band(sdata,
2183                                                              buffer + pos,
2184                                                              buffer_len - pos,
2185                                                              ie, ie_len, i,
2186                                                              rate_masks[i],
2187                                                              chandef,
2188                                                              &custom_ie_offset,
2189                                                              flags);
2190                         ie_desc->ies[i] = buffer + old_pos;
2191                         ie_desc->len[i] = pos - old_pos;
2192                         old_pos = pos;
2193                 }
2194         }
2195
2196         /* add any remaining custom IEs */
2197         if (ie && ie_len) {
2198                 if (WARN_ONCE(buffer_len - pos < ie_len - custom_ie_offset,
2199                               "not enough space for preq custom IEs\n"))
2200                         return pos;
2201                 memcpy(buffer + pos, ie + custom_ie_offset,
2202                        ie_len - custom_ie_offset);
2203                 ie_desc->common_ies = buffer + pos;
2204                 ie_desc->common_ie_len = ie_len - custom_ie_offset;
2205                 pos += ie_len - custom_ie_offset;
2206         }
2207
2208         return pos;
2209 };
2210
2211 struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
2212                                           const u8 *src, const u8 *dst,
2213                                           u32 ratemask,
2214                                           struct ieee80211_channel *chan,
2215                                           const u8 *ssid, size_t ssid_len,
2216                                           const u8 *ie, size_t ie_len,
2217                                           u32 flags)
2218 {
2219         struct ieee80211_local *local = sdata->local;
2220         struct cfg80211_chan_def chandef;
2221         struct sk_buff *skb;
2222         struct ieee80211_mgmt *mgmt;
2223         int ies_len;
2224         u32 rate_masks[NUM_NL80211_BANDS] = {};
2225         struct ieee80211_scan_ies dummy_ie_desc;
2226
2227         /*
2228          * Do not send DS Channel parameter for directed probe requests
2229          * in order to maximize the chance that we get a response.  Some
2230          * badly-behaved APs don't respond when this parameter is included.
2231          */
2232         chandef.width = sdata->vif.bss_conf.chandef.width;
2233         if (flags & IEEE80211_PROBE_FLAG_DIRECTED)
2234                 chandef.chan = NULL;
2235         else
2236                 chandef.chan = chan;
2237
2238         skb = ieee80211_probereq_get(&local->hw, src, ssid, ssid_len,
2239                                      local->scan_ies_len + ie_len);
2240         if (!skb)
2241                 return NULL;
2242
2243         rate_masks[chan->band] = ratemask;
2244         ies_len = ieee80211_build_preq_ies(sdata, skb_tail_pointer(skb),
2245                                            skb_tailroom(skb), &dummy_ie_desc,
2246                                            ie, ie_len, BIT(chan->band),
2247                                            rate_masks, &chandef, flags);
2248         skb_put(skb, ies_len);
2249
2250         if (dst) {
2251                 mgmt = (struct ieee80211_mgmt *) skb->data;
2252                 memcpy(mgmt->da, dst, ETH_ALEN);
2253                 memcpy(mgmt->bssid, dst, ETH_ALEN);
2254         }
2255
2256         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
2257
2258         return skb;
2259 }
2260
2261 u32 ieee80211_sta_get_rates(struct ieee80211_sub_if_data *sdata,
2262                             struct ieee802_11_elems *elems,
2263                             enum nl80211_band band, u32 *basic_rates)
2264 {
2265         struct ieee80211_supported_band *sband;
2266         size_t num_rates;
2267         u32 supp_rates, rate_flags;
2268         int i, j, shift;
2269
2270         sband = sdata->local->hw.wiphy->bands[band];
2271         if (WARN_ON(!sband))
2272                 return 1;
2273
2274         rate_flags = ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chandef);
2275         shift = ieee80211_vif_get_shift(&sdata->vif);
2276
2277         num_rates = sband->n_bitrates;
2278         supp_rates = 0;
2279         for (i = 0; i < elems->supp_rates_len +
2280                      elems->ext_supp_rates_len; i++) {
2281                 u8 rate = 0;
2282                 int own_rate;
2283                 bool is_basic;
2284                 if (i < elems->supp_rates_len)
2285                         rate = elems->supp_rates[i];
2286                 else if (elems->ext_supp_rates)
2287                         rate = elems->ext_supp_rates
2288                                 [i - elems->supp_rates_len];
2289                 own_rate = 5 * (rate & 0x7f);
2290                 is_basic = !!(rate & 0x80);
2291
2292                 if (is_basic && (rate & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
2293                         continue;
2294
2295                 for (j = 0; j < num_rates; j++) {
2296                         int brate;
2297                         if ((rate_flags & sband->bitrates[j].flags)
2298                             != rate_flags)
2299                                 continue;
2300
2301                         brate = DIV_ROUND_UP(sband->bitrates[j].bitrate,
2302                                              1 << shift);
2303
2304                         if (brate == own_rate) {
2305                                 supp_rates |= BIT(j);
2306                                 if (basic_rates && is_basic)
2307                                         *basic_rates |= BIT(j);
2308                         }
2309                 }
2310         }
2311         return supp_rates;
2312 }
2313
2314 void ieee80211_stop_device(struct ieee80211_local *local)
2315 {
2316         ieee80211_led_radio(local, false);
2317         ieee80211_mod_tpt_led_trig(local, 0, IEEE80211_TPT_LEDTRIG_FL_RADIO);
2318
2319         cancel_work_sync(&local->reconfig_filter);
2320
2321         flush_workqueue(local->workqueue);
2322         drv_stop(local);
2323 }
2324
2325 static void ieee80211_flush_completed_scan(struct ieee80211_local *local,
2326                                            bool aborted)
2327 {
2328         /* It's possible that we don't handle the scan completion in
2329          * time during suspend, so if it's still marked as completed
2330          * here, queue the work and flush it to clean things up.
2331          * Instead of calling the worker function directly here, we
2332          * really queue it to avoid potential races with other flows
2333          * scheduling the same work.
2334          */
2335         if (test_bit(SCAN_COMPLETED, &local->scanning)) {
2336                 /* If coming from reconfiguration failure, abort the scan so
2337                  * we don't attempt to continue a partial HW scan - which is
2338                  * possible otherwise if (e.g.) the 2.4 GHz portion was the
2339                  * completed scan, and a 5 GHz portion is still pending.
2340                  */
2341                 if (aborted)
2342                         set_bit(SCAN_ABORTED, &local->scanning);
2343                 wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work, 0);
2344                 wiphy_delayed_work_flush(local->hw.wiphy, &local->scan_work);
2345         }
2346 }
2347
2348 static void ieee80211_handle_reconfig_failure(struct ieee80211_local *local)
2349 {
2350         struct ieee80211_sub_if_data *sdata;
2351         struct ieee80211_chanctx *ctx;
2352
2353         /*
2354          * We get here if during resume the device can't be restarted properly.
2355          * We might also get here if this happens during HW reset, which is a
2356          * slightly different situation and we need to drop all connections in
2357          * the latter case.
2358          *
2359          * Ask cfg80211 to turn off all interfaces, this will result in more
2360          * warnings but at least we'll then get into a clean stopped state.
2361          */
2362
2363         local->resuming = false;
2364         local->suspended = false;
2365         local->in_reconfig = false;
2366         local->reconfig_failure = true;
2367
2368         ieee80211_flush_completed_scan(local, true);
2369
2370         /* scheduled scan clearly can't be running any more, but tell
2371          * cfg80211 and clear local state
2372          */
2373         ieee80211_sched_scan_end(local);
2374
2375         list_for_each_entry(sdata, &local->interfaces, list)
2376                 sdata->flags &= ~IEEE80211_SDATA_IN_DRIVER;
2377
2378         /* Mark channel contexts as not being in the driver any more to avoid
2379          * removing them from the driver during the shutdown process...
2380          */
2381         mutex_lock(&local->chanctx_mtx);
2382         list_for_each_entry(ctx, &local->chanctx_list, list)
2383                 ctx->driver_present = false;
2384         mutex_unlock(&local->chanctx_mtx);
2385 }
2386
2387 static void ieee80211_assign_chanctx(struct ieee80211_local *local,
2388                                      struct ieee80211_sub_if_data *sdata,
2389                                      struct ieee80211_link_data *link)
2390 {
2391         struct ieee80211_chanctx_conf *conf;
2392         struct ieee80211_chanctx *ctx;
2393
2394         if (!local->use_chanctx)
2395                 return;
2396
2397         mutex_lock(&local->chanctx_mtx);
2398         conf = rcu_dereference_protected(link->conf->chanctx_conf,
2399                                          lockdep_is_held(&local->chanctx_mtx));
2400         if (conf) {
2401                 ctx = container_of(conf, struct ieee80211_chanctx, conf);
2402                 drv_assign_vif_chanctx(local, sdata, link->conf, ctx);
2403         }
2404         mutex_unlock(&local->chanctx_mtx);
2405 }
2406
2407 static void ieee80211_reconfig_stations(struct ieee80211_sub_if_data *sdata)
2408 {
2409         struct ieee80211_local *local = sdata->local;
2410         struct sta_info *sta;
2411
2412         /* add STAs back */
2413         mutex_lock(&local->sta_mtx);
2414         list_for_each_entry(sta, &local->sta_list, list) {
2415                 enum ieee80211_sta_state state;
2416
2417                 if (!sta->uploaded || sta->sdata != sdata)
2418                         continue;
2419
2420                 for (state = IEEE80211_STA_NOTEXIST;
2421                      state < sta->sta_state; state++)
2422                         WARN_ON(drv_sta_state(local, sta->sdata, sta, state,
2423                                               state + 1));
2424         }
2425         mutex_unlock(&local->sta_mtx);
2426 }
2427
2428 static int ieee80211_reconfig_nan(struct ieee80211_sub_if_data *sdata)
2429 {
2430         struct cfg80211_nan_func *func, **funcs;
2431         int res, id, i = 0;
2432
2433         res = drv_start_nan(sdata->local, sdata,
2434                             &sdata->u.nan.conf);
2435         if (WARN_ON(res))
2436                 return res;
2437
2438         funcs = kcalloc(sdata->local->hw.max_nan_de_entries + 1,
2439                         sizeof(*funcs),
2440                         GFP_KERNEL);
2441         if (!funcs)
2442                 return -ENOMEM;
2443
2444         /* Add all the functions:
2445          * This is a little bit ugly. We need to call a potentially sleeping
2446          * callback for each NAN function, so we can't hold the spinlock.
2447          */
2448         spin_lock_bh(&sdata->u.nan.func_lock);
2449
2450         idr_for_each_entry(&sdata->u.nan.function_inst_ids, func, id)
2451                 funcs[i++] = func;
2452
2453         spin_unlock_bh(&sdata->u.nan.func_lock);
2454
2455         for (i = 0; funcs[i]; i++) {
2456                 res = drv_add_nan_func(sdata->local, sdata, funcs[i]);
2457                 if (WARN_ON(res))
2458                         ieee80211_nan_func_terminated(&sdata->vif,
2459                                                       funcs[i]->instance_id,
2460                                                       NL80211_NAN_FUNC_TERM_REASON_ERROR,
2461                                                       GFP_KERNEL);
2462         }
2463
2464         kfree(funcs);
2465
2466         return 0;
2467 }
2468
2469 static void ieee80211_reconfig_ap_links(struct ieee80211_local *local,
2470                                         struct ieee80211_sub_if_data *sdata,
2471                                         u64 changed)
2472 {
2473         int link_id;
2474
2475         for (link_id = 0; link_id < ARRAY_SIZE(sdata->link); link_id++) {
2476                 struct ieee80211_link_data *link;
2477
2478                 if (!(sdata->vif.active_links & BIT(link_id)))
2479                         continue;
2480
2481                 link = sdata_dereference(sdata->link[link_id], sdata);
2482                 if (!link)
2483                         continue;
2484
2485                 if (rcu_access_pointer(link->u.ap.beacon))
2486                         drv_start_ap(local, sdata, link->conf);
2487
2488                 if (!link->conf->enable_beacon)
2489                         continue;
2490
2491                 changed |= BSS_CHANGED_BEACON |
2492                            BSS_CHANGED_BEACON_ENABLED;
2493
2494                 ieee80211_link_info_change_notify(sdata, link, changed);
2495         }
2496 }
2497
2498 int ieee80211_reconfig(struct ieee80211_local *local)
2499 {
2500         struct ieee80211_hw *hw = &local->hw;
2501         struct ieee80211_sub_if_data *sdata;
2502         struct ieee80211_chanctx *ctx;
2503         struct sta_info *sta;
2504         int res, i;
2505         bool reconfig_due_to_wowlan = false;
2506         struct ieee80211_sub_if_data *sched_scan_sdata;
2507         struct cfg80211_sched_scan_request *sched_scan_req;
2508         bool sched_scan_stopped = false;
2509         bool suspended = local->suspended;
2510         bool in_reconfig = false;
2511
2512         /* nothing to do if HW shouldn't run */
2513         if (!local->open_count)
2514                 goto wake_up;
2515
2516 #ifdef CONFIG_PM
2517         if (suspended)
2518                 local->resuming = true;
2519
2520         if (local->wowlan) {
2521                 /*
2522                  * In the wowlan case, both mac80211 and the device
2523                  * are functional when the resume op is called, so
2524                  * clear local->suspended so the device could operate
2525                  * normally (e.g. pass rx frames).
2526                  */
2527                 local->suspended = false;
2528                 res = drv_resume(local);
2529                 local->wowlan = false;
2530                 if (res < 0) {
2531                         local->resuming = false;
2532                         return res;
2533                 }
2534                 if (res == 0)
2535                         goto wake_up;
2536                 WARN_ON(res > 1);
2537                 /*
2538                  * res is 1, which means the driver requested
2539                  * to go through a regular reset on wakeup.
2540                  * restore local->suspended in this case.
2541                  */
2542                 reconfig_due_to_wowlan = true;
2543                 local->suspended = true;
2544         }
2545 #endif
2546
2547         /*
2548          * In case of hw_restart during suspend (without wowlan),
2549          * cancel restart work, as we are reconfiguring the device
2550          * anyway.
2551          * Note that restart_work is scheduled on a frozen workqueue,
2552          * so we can't deadlock in this case.
2553          */
2554         if (suspended && local->in_reconfig && !reconfig_due_to_wowlan)
2555                 cancel_work_sync(&local->restart_work);
2556
2557         local->started = false;
2558
2559         /*
2560          * Upon resume hardware can sometimes be goofy due to
2561          * various platform / driver / bus issues, so restarting
2562          * the device may at times not work immediately. Propagate
2563          * the error.
2564          */
2565         res = drv_start(local);
2566         if (res) {
2567                 if (suspended)
2568                         WARN(1, "Hardware became unavailable upon resume. This could be a software issue prior to suspend or a hardware issue.\n");
2569                 else
2570                         WARN(1, "Hardware became unavailable during restart.\n");
2571                 ieee80211_handle_reconfig_failure(local);
2572                 return res;
2573         }
2574
2575         /* setup fragmentation threshold */
2576         drv_set_frag_threshold(local, hw->wiphy->frag_threshold);
2577
2578         /* setup RTS threshold */
2579         drv_set_rts_threshold(local, hw->wiphy->rts_threshold);
2580
2581         /* reset coverage class */
2582         drv_set_coverage_class(local, hw->wiphy->coverage_class);
2583
2584         ieee80211_led_radio(local, true);
2585         ieee80211_mod_tpt_led_trig(local,
2586                                    IEEE80211_TPT_LEDTRIG_FL_RADIO, 0);
2587
2588         /* add interfaces */
2589         sdata = wiphy_dereference(local->hw.wiphy, local->monitor_sdata);
2590         if (sdata) {
2591                 /* in HW restart it exists already */
2592                 WARN_ON(local->resuming);
2593                 res = drv_add_interface(local, sdata);
2594                 if (WARN_ON(res)) {
2595                         RCU_INIT_POINTER(local->monitor_sdata, NULL);
2596                         synchronize_net();
2597                         kfree(sdata);
2598                 }
2599         }
2600
2601         list_for_each_entry(sdata, &local->interfaces, list) {
2602                 if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2603                     sdata->vif.type != NL80211_IFTYPE_MONITOR &&
2604                     ieee80211_sdata_running(sdata)) {
2605                         res = drv_add_interface(local, sdata);
2606                         if (WARN_ON(res))
2607                                 break;
2608                 }
2609         }
2610
2611         /* If adding any of the interfaces failed above, roll back and
2612          * report failure.
2613          */
2614         if (res) {
2615                 list_for_each_entry_continue_reverse(sdata, &local->interfaces,
2616                                                      list)
2617                         if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2618                             sdata->vif.type != NL80211_IFTYPE_MONITOR &&
2619                             ieee80211_sdata_running(sdata))
2620                                 drv_remove_interface(local, sdata);
2621                 ieee80211_handle_reconfig_failure(local);
2622                 return res;
2623         }
2624
2625         /* add channel contexts */
2626         if (local->use_chanctx) {
2627                 mutex_lock(&local->chanctx_mtx);
2628                 list_for_each_entry(ctx, &local->chanctx_list, list)
2629                         if (ctx->replace_state !=
2630                             IEEE80211_CHANCTX_REPLACES_OTHER)
2631                                 WARN_ON(drv_add_chanctx(local, ctx));
2632                 mutex_unlock(&local->chanctx_mtx);
2633
2634                 sdata = wiphy_dereference(local->hw.wiphy,
2635                                           local->monitor_sdata);
2636                 if (sdata && ieee80211_sdata_running(sdata))
2637                         ieee80211_assign_chanctx(local, sdata, &sdata->deflink);
2638         }
2639
2640         /* reconfigure hardware */
2641         ieee80211_hw_config(local, ~0);
2642
2643         ieee80211_configure_filter(local);
2644
2645         /* Finally also reconfigure all the BSS information */
2646         list_for_each_entry(sdata, &local->interfaces, list) {
2647                 /* common change flags for all interface types - link only */
2648                 u64 changed = BSS_CHANGED_ERP_CTS_PROT |
2649                               BSS_CHANGED_ERP_PREAMBLE |
2650                               BSS_CHANGED_ERP_SLOT |
2651                               BSS_CHANGED_HT |
2652                               BSS_CHANGED_BASIC_RATES |
2653                               BSS_CHANGED_BEACON_INT |
2654                               BSS_CHANGED_BSSID |
2655                               BSS_CHANGED_CQM |
2656                               BSS_CHANGED_QOS |
2657                               BSS_CHANGED_TXPOWER |
2658                               BSS_CHANGED_MCAST_RATE;
2659                 struct ieee80211_link_data *link = NULL;
2660                 unsigned int link_id;
2661                 u32 active_links = 0;
2662
2663                 if (!ieee80211_sdata_running(sdata))
2664                         continue;
2665
2666                 sdata_lock(sdata);
2667                 if (ieee80211_vif_is_mld(&sdata->vif)) {
2668                         struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS] = {
2669                                 [0] = &sdata->vif.bss_conf,
2670                         };
2671
2672                         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
2673                                 /* start with a single active link */
2674                                 active_links = sdata->vif.active_links;
2675                                 link_id = ffs(active_links) - 1;
2676                                 sdata->vif.active_links = BIT(link_id);
2677                         }
2678
2679                         drv_change_vif_links(local, sdata, 0,
2680                                              sdata->vif.active_links,
2681                                              old);
2682                 }
2683
2684                 for (link_id = 0;
2685                      link_id < ARRAY_SIZE(sdata->vif.link_conf);
2686                      link_id++) {
2687                         if (ieee80211_vif_is_mld(&sdata->vif) &&
2688                             !(sdata->vif.active_links & BIT(link_id)))
2689                                 continue;
2690
2691                         link = sdata_dereference(sdata->link[link_id], sdata);
2692                         if (!link)
2693                                 continue;
2694
2695                         ieee80211_assign_chanctx(local, sdata, link);
2696                 }
2697
2698                 switch (sdata->vif.type) {
2699                 case NL80211_IFTYPE_AP_VLAN:
2700                 case NL80211_IFTYPE_MONITOR:
2701                         break;
2702                 case NL80211_IFTYPE_ADHOC:
2703                         if (sdata->vif.cfg.ibss_joined)
2704                                 WARN_ON(drv_join_ibss(local, sdata));
2705                         fallthrough;
2706                 default:
2707                         ieee80211_reconfig_stations(sdata);
2708                         fallthrough;
2709                 case NL80211_IFTYPE_AP: /* AP stations are handled later */
2710                         for (i = 0; i < IEEE80211_NUM_ACS; i++)
2711                                 drv_conf_tx(local, &sdata->deflink, i,
2712                                             &sdata->deflink.tx_conf[i]);
2713                         break;
2714                 }
2715
2716                 if (sdata->vif.bss_conf.mu_mimo_owner)
2717                         changed |= BSS_CHANGED_MU_GROUPS;
2718
2719                 if (!ieee80211_vif_is_mld(&sdata->vif))
2720                         changed |= BSS_CHANGED_IDLE;
2721
2722                 switch (sdata->vif.type) {
2723                 case NL80211_IFTYPE_STATION:
2724                         if (!ieee80211_vif_is_mld(&sdata->vif)) {
2725                                 changed |= BSS_CHANGED_ASSOC |
2726                                            BSS_CHANGED_ARP_FILTER |
2727                                            BSS_CHANGED_PS;
2728
2729                                 /* Re-send beacon info report to the driver */
2730                                 if (sdata->deflink.u.mgd.have_beacon)
2731                                         changed |= BSS_CHANGED_BEACON_INFO;
2732
2733                                 if (sdata->vif.bss_conf.max_idle_period ||
2734                                     sdata->vif.bss_conf.protected_keep_alive)
2735                                         changed |= BSS_CHANGED_KEEP_ALIVE;
2736
2737                                 if (sdata->vif.bss_conf.eht_puncturing)
2738                                         changed |= BSS_CHANGED_EHT_PUNCTURING;
2739
2740                                 ieee80211_bss_info_change_notify(sdata,
2741                                                                  changed);
2742                         } else if (!WARN_ON(!link)) {
2743                                 ieee80211_link_info_change_notify(sdata, link,
2744                                                                   changed);
2745                                 changed = BSS_CHANGED_ASSOC |
2746                                           BSS_CHANGED_IDLE |
2747                                           BSS_CHANGED_PS |
2748                                           BSS_CHANGED_ARP_FILTER;
2749                                 ieee80211_vif_cfg_change_notify(sdata, changed);
2750                         }
2751                         break;
2752                 case NL80211_IFTYPE_OCB:
2753                         changed |= BSS_CHANGED_OCB;
2754                         ieee80211_bss_info_change_notify(sdata, changed);
2755                         break;
2756                 case NL80211_IFTYPE_ADHOC:
2757                         changed |= BSS_CHANGED_IBSS;
2758                         fallthrough;
2759                 case NL80211_IFTYPE_AP:
2760                         changed |= BSS_CHANGED_P2P_PS;
2761
2762                         if (ieee80211_vif_is_mld(&sdata->vif))
2763                                 ieee80211_vif_cfg_change_notify(sdata,
2764                                                                 BSS_CHANGED_SSID);
2765                         else
2766                                 changed |= BSS_CHANGED_SSID;
2767
2768                         if (sdata->vif.bss_conf.ftm_responder == 1 &&
2769                             wiphy_ext_feature_isset(sdata->local->hw.wiphy,
2770                                         NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
2771                                 changed |= BSS_CHANGED_FTM_RESPONDER;
2772
2773                         if (sdata->vif.type == NL80211_IFTYPE_AP) {
2774                                 changed |= BSS_CHANGED_AP_PROBE_RESP;
2775
2776                                 if (ieee80211_vif_is_mld(&sdata->vif)) {
2777                                         ieee80211_reconfig_ap_links(local,
2778                                                                     sdata,
2779                                                                     changed);
2780                                         break;
2781                                 }
2782
2783                                 if (rcu_access_pointer(sdata->deflink.u.ap.beacon))
2784                                         drv_start_ap(local, sdata,
2785                                                      sdata->deflink.conf);
2786                         }
2787                         fallthrough;
2788                 case NL80211_IFTYPE_MESH_POINT:
2789                         if (sdata->vif.bss_conf.enable_beacon) {
2790                                 changed |= BSS_CHANGED_BEACON |
2791                                            BSS_CHANGED_BEACON_ENABLED;
2792                                 ieee80211_bss_info_change_notify(sdata, changed);
2793                         }
2794                         break;
2795                 case NL80211_IFTYPE_NAN:
2796                         res = ieee80211_reconfig_nan(sdata);
2797                         if (res < 0) {
2798                                 sdata_unlock(sdata);
2799                                 ieee80211_handle_reconfig_failure(local);
2800                                 return res;
2801                         }
2802                         break;
2803                 case NL80211_IFTYPE_AP_VLAN:
2804                 case NL80211_IFTYPE_MONITOR:
2805                 case NL80211_IFTYPE_P2P_DEVICE:
2806                         /* nothing to do */
2807                         break;
2808                 case NL80211_IFTYPE_UNSPECIFIED:
2809                 case NUM_NL80211_IFTYPES:
2810                 case NL80211_IFTYPE_P2P_CLIENT:
2811                 case NL80211_IFTYPE_P2P_GO:
2812                 case NL80211_IFTYPE_WDS:
2813                         WARN_ON(1);
2814                         break;
2815                 }
2816                 sdata_unlock(sdata);
2817
2818                 if (active_links)
2819                         ieee80211_set_active_links(&sdata->vif, active_links);
2820         }
2821
2822         ieee80211_recalc_ps(local);
2823
2824         /*
2825          * The sta might be in psm against the ap (e.g. because
2826          * this was the state before a hw restart), so we
2827          * explicitly send a null packet in order to make sure
2828          * it'll sync against the ap (and get out of psm).
2829          */
2830         if (!(local->hw.conf.flags & IEEE80211_CONF_PS)) {
2831                 list_for_each_entry(sdata, &local->interfaces, list) {
2832                         if (sdata->vif.type != NL80211_IFTYPE_STATION)
2833                                 continue;
2834                         if (!sdata->u.mgd.associated)
2835                                 continue;
2836
2837                         ieee80211_send_nullfunc(local, sdata, false);
2838                 }
2839         }
2840
2841         /* APs are now beaconing, add back stations */
2842         list_for_each_entry(sdata, &local->interfaces, list) {
2843                 if (!ieee80211_sdata_running(sdata))
2844                         continue;
2845
2846                 sdata_lock(sdata);
2847                 switch (sdata->vif.type) {
2848                 case NL80211_IFTYPE_AP_VLAN:
2849                 case NL80211_IFTYPE_AP:
2850                         ieee80211_reconfig_stations(sdata);
2851                         break;
2852                 default:
2853                         break;
2854                 }
2855                 sdata_unlock(sdata);
2856         }
2857
2858         /* add back keys */
2859         list_for_each_entry(sdata, &local->interfaces, list)
2860                 ieee80211_reenable_keys(sdata);
2861
2862         /* Reconfigure sched scan if it was interrupted by FW restart */
2863         mutex_lock(&local->mtx);
2864         sched_scan_sdata = rcu_dereference_protected(local->sched_scan_sdata,
2865                                                 lockdep_is_held(&local->mtx));
2866         sched_scan_req = rcu_dereference_protected(local->sched_scan_req,
2867                                                 lockdep_is_held(&local->mtx));
2868         if (sched_scan_sdata && sched_scan_req)
2869                 /*
2870                  * Sched scan stopped, but we don't want to report it. Instead,
2871                  * we're trying to reschedule. However, if more than one scan
2872                  * plan was set, we cannot reschedule since we don't know which
2873                  * scan plan was currently running (and some scan plans may have
2874                  * already finished).
2875                  */
2876                 if (sched_scan_req->n_scan_plans > 1 ||
2877                     __ieee80211_request_sched_scan_start(sched_scan_sdata,
2878                                                          sched_scan_req)) {
2879                         RCU_INIT_POINTER(local->sched_scan_sdata, NULL);
2880                         RCU_INIT_POINTER(local->sched_scan_req, NULL);
2881                         sched_scan_stopped = true;
2882                 }
2883         mutex_unlock(&local->mtx);
2884
2885         if (sched_scan_stopped)
2886                 cfg80211_sched_scan_stopped_locked(local->hw.wiphy, 0);
2887
2888  wake_up:
2889
2890         if (local->monitors == local->open_count && local->monitors > 0)
2891                 ieee80211_add_virtual_monitor(local);
2892
2893         /*
2894          * Clear the WLAN_STA_BLOCK_BA flag so new aggregation
2895          * sessions can be established after a resume.
2896          *
2897          * Also tear down aggregation sessions since reconfiguring
2898          * them in a hardware restart scenario is not easily done
2899          * right now, and the hardware will have lost information
2900          * about the sessions, but we and the AP still think they
2901          * are active. This is really a workaround though.
2902          */
2903         if (ieee80211_hw_check(hw, AMPDU_AGGREGATION)) {
2904                 mutex_lock(&local->sta_mtx);
2905
2906                 list_for_each_entry(sta, &local->sta_list, list) {
2907                         if (!local->resuming)
2908                                 ieee80211_sta_tear_down_BA_sessions(
2909                                                 sta, AGG_STOP_LOCAL_REQUEST);
2910                         clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
2911                 }
2912
2913                 mutex_unlock(&local->sta_mtx);
2914         }
2915
2916         /*
2917          * If this is for hw restart things are still running.
2918          * We may want to change that later, however.
2919          */
2920         if (local->open_count && (!suspended || reconfig_due_to_wowlan))
2921                 drv_reconfig_complete(local, IEEE80211_RECONFIG_TYPE_RESTART);
2922
2923         if (local->in_reconfig) {
2924                 in_reconfig = local->in_reconfig;
2925                 local->in_reconfig = false;
2926                 barrier();
2927
2928                 /* Restart deferred ROCs */
2929                 mutex_lock(&local->mtx);
2930                 ieee80211_start_next_roc(local);
2931                 mutex_unlock(&local->mtx);
2932
2933                 /* Requeue all works */
2934                 list_for_each_entry(sdata, &local->interfaces, list)
2935                         wiphy_work_queue(local->hw.wiphy, &sdata->work);
2936         }
2937
2938         ieee80211_wake_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP,
2939                                         IEEE80211_QUEUE_STOP_REASON_SUSPEND,
2940                                         false);
2941
2942         if (in_reconfig) {
2943                 list_for_each_entry(sdata, &local->interfaces, list) {
2944                         if (!ieee80211_sdata_running(sdata))
2945                                 continue;
2946                         if (sdata->vif.type == NL80211_IFTYPE_STATION)
2947                                 ieee80211_sta_restart(sdata);
2948                 }
2949         }
2950
2951         if (!suspended)
2952                 return 0;
2953
2954 #ifdef CONFIG_PM
2955         /* first set suspended false, then resuming */
2956         local->suspended = false;
2957         mb();
2958         local->resuming = false;
2959
2960         ieee80211_flush_completed_scan(local, false);
2961
2962         if (local->open_count && !reconfig_due_to_wowlan)
2963                 drv_reconfig_complete(local, IEEE80211_RECONFIG_TYPE_SUSPEND);
2964
2965         list_for_each_entry(sdata, &local->interfaces, list) {
2966                 if (!ieee80211_sdata_running(sdata))
2967                         continue;
2968                 if (sdata->vif.type == NL80211_IFTYPE_STATION)
2969                         ieee80211_sta_restart(sdata);
2970         }
2971
2972         mod_timer(&local->sta_cleanup, jiffies + 1);
2973 #else
2974         WARN_ON(1);
2975 #endif
2976
2977         return 0;
2978 }
2979
2980 static void ieee80211_reconfig_disconnect(struct ieee80211_vif *vif, u8 flag)
2981 {
2982         struct ieee80211_sub_if_data *sdata;
2983         struct ieee80211_local *local;
2984         struct ieee80211_key *key;
2985
2986         if (WARN_ON(!vif))
2987                 return;
2988
2989         sdata = vif_to_sdata(vif);
2990         local = sdata->local;
2991
2992         if (WARN_ON(flag & IEEE80211_SDATA_DISCONNECT_RESUME &&
2993                     !local->resuming))
2994                 return;
2995
2996         if (WARN_ON(flag & IEEE80211_SDATA_DISCONNECT_HW_RESTART &&
2997                     !local->in_reconfig))
2998                 return;
2999
3000         if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
3001                 return;
3002
3003         sdata->flags |= flag;
3004
3005         mutex_lock(&local->key_mtx);
3006         list_for_each_entry(key, &sdata->key_list, list)
3007                 key->flags |= KEY_FLAG_TAINTED;
3008         mutex_unlock(&local->key_mtx);
3009 }
3010
3011 void ieee80211_hw_restart_disconnect(struct ieee80211_vif *vif)
3012 {
3013         ieee80211_reconfig_disconnect(vif, IEEE80211_SDATA_DISCONNECT_HW_RESTART);
3014 }
3015 EXPORT_SYMBOL_GPL(ieee80211_hw_restart_disconnect);
3016
3017 void ieee80211_resume_disconnect(struct ieee80211_vif *vif)
3018 {
3019         ieee80211_reconfig_disconnect(vif, IEEE80211_SDATA_DISCONNECT_RESUME);
3020 }
3021 EXPORT_SYMBOL_GPL(ieee80211_resume_disconnect);
3022
3023 void ieee80211_recalc_smps(struct ieee80211_sub_if_data *sdata,
3024                            struct ieee80211_link_data *link)
3025 {
3026         struct ieee80211_local *local = sdata->local;
3027         struct ieee80211_chanctx_conf *chanctx_conf;
3028         struct ieee80211_chanctx *chanctx;
3029
3030         mutex_lock(&local->chanctx_mtx);
3031
3032         chanctx_conf = rcu_dereference_protected(link->conf->chanctx_conf,
3033                                                  lockdep_is_held(&local->chanctx_mtx));
3034
3035         /*
3036          * This function can be called from a work, thus it may be possible
3037          * that the chanctx_conf is removed (due to a disconnection, for
3038          * example).
3039          * So nothing should be done in such case.
3040          */
3041         if (!chanctx_conf)
3042                 goto unlock;
3043
3044         chanctx = container_of(chanctx_conf, struct ieee80211_chanctx, conf);
3045         ieee80211_recalc_smps_chanctx(local, chanctx);
3046  unlock:
3047         mutex_unlock(&local->chanctx_mtx);
3048 }
3049
3050 void ieee80211_recalc_min_chandef(struct ieee80211_sub_if_data *sdata,
3051                                   int link_id)
3052 {
3053         struct ieee80211_local *local = sdata->local;
3054         struct ieee80211_chanctx_conf *chanctx_conf;
3055         struct ieee80211_chanctx *chanctx;
3056         int i;
3057
3058         mutex_lock(&local->chanctx_mtx);
3059
3060         for (i = 0; i < ARRAY_SIZE(sdata->vif.link_conf); i++) {
3061                 struct ieee80211_bss_conf *bss_conf;
3062
3063                 if (link_id >= 0 && link_id != i)
3064                         continue;
3065
3066                 rcu_read_lock();
3067                 bss_conf = rcu_dereference(sdata->vif.link_conf[i]);
3068                 if (!bss_conf) {
3069                         rcu_read_unlock();
3070                         continue;
3071                 }
3072
3073                 chanctx_conf = rcu_dereference_protected(bss_conf->chanctx_conf,
3074                                                          lockdep_is_held(&local->chanctx_mtx));
3075                 /*
3076                  * Since we hold the chanctx_mtx (checked above)
3077                  * we can take the chanctx_conf pointer out of the
3078                  * RCU critical section, it cannot go away without
3079                  * the mutex. Just the way we reached it could - in
3080                  * theory - go away, but we don't really care and
3081                  * it really shouldn't happen anyway.
3082                  */
3083                 rcu_read_unlock();
3084
3085                 if (!chanctx_conf)
3086                         goto unlock;
3087
3088                 chanctx = container_of(chanctx_conf, struct ieee80211_chanctx,
3089                                        conf);
3090                 ieee80211_recalc_chanctx_min_def(local, chanctx, NULL);
3091         }
3092  unlock:
3093         mutex_unlock(&local->chanctx_mtx);
3094 }
3095
3096 size_t ieee80211_ie_split_vendor(const u8 *ies, size_t ielen, size_t offset)
3097 {
3098         size_t pos = offset;
3099
3100         while (pos < ielen && ies[pos] != WLAN_EID_VENDOR_SPECIFIC)
3101                 pos += 2 + ies[pos + 1];
3102
3103         return pos;
3104 }
3105
3106 u8 *ieee80211_ie_build_s1g_cap(u8 *pos, struct ieee80211_sta_s1g_cap *s1g_cap)
3107 {
3108         *pos++ = WLAN_EID_S1G_CAPABILITIES;
3109         *pos++ = sizeof(struct ieee80211_s1g_cap);
3110         memset(pos, 0, sizeof(struct ieee80211_s1g_cap));
3111
3112         memcpy(pos, &s1g_cap->cap, sizeof(s1g_cap->cap));
3113         pos += sizeof(s1g_cap->cap);
3114
3115         memcpy(pos, &s1g_cap->nss_mcs, sizeof(s1g_cap->nss_mcs));
3116         pos += sizeof(s1g_cap->nss_mcs);
3117
3118         return pos;
3119 }
3120
3121 u8 *ieee80211_ie_build_ht_cap(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
3122                               u16 cap)
3123 {
3124         __le16 tmp;
3125
3126         *pos++ = WLAN_EID_HT_CAPABILITY;
3127         *pos++ = sizeof(struct ieee80211_ht_cap);
3128         memset(pos, 0, sizeof(struct ieee80211_ht_cap));
3129
3130         /* capability flags */
3131         tmp = cpu_to_le16(cap);
3132         memcpy(pos, &tmp, sizeof(u16));
3133         pos += sizeof(u16);
3134
3135         /* AMPDU parameters */
3136         *pos++ = ht_cap->ampdu_factor |
3137                  (ht_cap->ampdu_density <<
3138                         IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT);
3139
3140         /* MCS set */
3141         memcpy(pos, &ht_cap->mcs, sizeof(ht_cap->mcs));
3142         pos += sizeof(ht_cap->mcs);
3143
3144         /* extended capabilities */
3145         pos += sizeof(__le16);
3146
3147         /* BF capabilities */
3148         pos += sizeof(__le32);
3149
3150         /* antenna selection */
3151         pos += sizeof(u8);
3152
3153         return pos;
3154 }
3155
3156 u8 *ieee80211_ie_build_vht_cap(u8 *pos, struct ieee80211_sta_vht_cap *vht_cap,
3157                                u32 cap)
3158 {
3159         __le32 tmp;
3160
3161         *pos++ = WLAN_EID_VHT_CAPABILITY;
3162         *pos++ = sizeof(struct ieee80211_vht_cap);
3163         memset(pos, 0, sizeof(struct ieee80211_vht_cap));
3164
3165         /* capability flags */
3166         tmp = cpu_to_le32(cap);
3167         memcpy(pos, &tmp, sizeof(u32));
3168         pos += sizeof(u32);
3169
3170         /* VHT MCS set */
3171         memcpy(pos, &vht_cap->vht_mcs, sizeof(vht_cap->vht_mcs));
3172         pos += sizeof(vht_cap->vht_mcs);
3173
3174         return pos;
3175 }
3176
3177 u8 ieee80211_ie_len_he_cap(struct ieee80211_sub_if_data *sdata, u8 iftype)
3178 {
3179         const struct ieee80211_sta_he_cap *he_cap;
3180         struct ieee80211_supported_band *sband;
3181         u8 n;
3182
3183         sband = ieee80211_get_sband(sdata);
3184         if (!sband)
3185                 return 0;
3186
3187         he_cap = ieee80211_get_he_iftype_cap(sband, iftype);
3188         if (!he_cap)
3189                 return 0;
3190
3191         n = ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem);
3192         return 2 + 1 +
3193                sizeof(he_cap->he_cap_elem) + n +
3194                ieee80211_he_ppe_size(he_cap->ppe_thres[0],
3195                                      he_cap->he_cap_elem.phy_cap_info);
3196 }
3197
3198 u8 *ieee80211_ie_build_he_cap(ieee80211_conn_flags_t disable_flags, u8 *pos,
3199                               const struct ieee80211_sta_he_cap *he_cap,
3200                               u8 *end)
3201 {
3202         struct ieee80211_he_cap_elem elem;
3203         u8 n;
3204         u8 ie_len;
3205         u8 *orig_pos = pos;
3206
3207         /* Make sure we have place for the IE */
3208         /*
3209          * TODO: the 1 added is because this temporarily is under the EXTENSION
3210          * IE. Get rid of it when it moves.
3211          */
3212         if (!he_cap)
3213                 return orig_pos;
3214
3215         /* modify on stack first to calculate 'n' and 'ie_len' correctly */
3216         elem = he_cap->he_cap_elem;
3217
3218         if (disable_flags & IEEE80211_CONN_DISABLE_40MHZ)
3219                 elem.phy_cap_info[0] &=
3220                         ~(IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
3221                           IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G);
3222
3223         if (disable_flags & IEEE80211_CONN_DISABLE_160MHZ)
3224                 elem.phy_cap_info[0] &=
3225                         ~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
3226
3227         if (disable_flags & IEEE80211_CONN_DISABLE_80P80MHZ)
3228                 elem.phy_cap_info[0] &=
3229                         ~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G;
3230
3231         n = ieee80211_he_mcs_nss_size(&elem);
3232         ie_len = 2 + 1 +
3233                  sizeof(he_cap->he_cap_elem) + n +
3234                  ieee80211_he_ppe_size(he_cap->ppe_thres[0],
3235                                        he_cap->he_cap_elem.phy_cap_info);
3236
3237         if ((end - pos) < ie_len)
3238                 return orig_pos;
3239
3240         *pos++ = WLAN_EID_EXTENSION;
3241         pos++; /* We'll set the size later below */
3242         *pos++ = WLAN_EID_EXT_HE_CAPABILITY;
3243
3244         /* Fixed data */
3245         memcpy(pos, &elem, sizeof(elem));
3246         pos += sizeof(elem);
3247
3248         memcpy(pos, &he_cap->he_mcs_nss_supp, n);
3249         pos += n;
3250
3251         /* Check if PPE Threshold should be present */
3252         if ((he_cap->he_cap_elem.phy_cap_info[6] &
3253              IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) == 0)
3254                 goto end;
3255
3256         /*
3257          * Calculate how many PPET16/PPET8 pairs are to come. Algorithm:
3258          * (NSS_M1 + 1) x (num of 1 bits in RU_INDEX_BITMASK)
3259          */
3260         n = hweight8(he_cap->ppe_thres[0] &
3261                      IEEE80211_PPE_THRES_RU_INDEX_BITMASK_MASK);
3262         n *= (1 + ((he_cap->ppe_thres[0] & IEEE80211_PPE_THRES_NSS_MASK) >>
3263                    IEEE80211_PPE_THRES_NSS_POS));
3264
3265         /*
3266          * Each pair is 6 bits, and we need to add the 7 "header" bits to the
3267          * total size.
3268          */
3269         n = (n * IEEE80211_PPE_THRES_INFO_PPET_SIZE * 2) + 7;
3270         n = DIV_ROUND_UP(n, 8);
3271
3272         /* Copy PPE Thresholds */
3273         memcpy(pos, &he_cap->ppe_thres, n);
3274         pos += n;
3275
3276 end:
3277         orig_pos[1] = (pos - orig_pos) - 2;
3278         return pos;
3279 }
3280
3281 void ieee80211_ie_build_he_6ghz_cap(struct ieee80211_sub_if_data *sdata,
3282                                     enum ieee80211_smps_mode smps_mode,
3283                                     struct sk_buff *skb)
3284 {
3285         struct ieee80211_supported_band *sband;
3286         const struct ieee80211_sband_iftype_data *iftd;
3287         enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
3288         u8 *pos;
3289         u16 cap;
3290
3291         if (!cfg80211_any_usable_channels(sdata->local->hw.wiphy,
3292                                           BIT(NL80211_BAND_6GHZ),
3293                                           IEEE80211_CHAN_NO_HE))
3294                 return;
3295
3296         sband = sdata->local->hw.wiphy->bands[NL80211_BAND_6GHZ];
3297
3298         iftd = ieee80211_get_sband_iftype_data(sband, iftype);
3299         if (!iftd)
3300                 return;
3301
3302         /* Check for device HE 6 GHz capability before adding element */
3303         if (!iftd->he_6ghz_capa.capa)
3304                 return;
3305
3306         cap = le16_to_cpu(iftd->he_6ghz_capa.capa);
3307         cap &= ~IEEE80211_HE_6GHZ_CAP_SM_PS;
3308
3309         switch (smps_mode) {
3310         case IEEE80211_SMPS_AUTOMATIC:
3311         case IEEE80211_SMPS_NUM_MODES:
3312                 WARN_ON(1);
3313                 fallthrough;
3314         case IEEE80211_SMPS_OFF:
3315                 cap |= u16_encode_bits(WLAN_HT_CAP_SM_PS_DISABLED,
3316                                        IEEE80211_HE_6GHZ_CAP_SM_PS);
3317                 break;
3318         case IEEE80211_SMPS_STATIC:
3319                 cap |= u16_encode_bits(WLAN_HT_CAP_SM_PS_STATIC,
3320                                        IEEE80211_HE_6GHZ_CAP_SM_PS);
3321                 break;
3322         case IEEE80211_SMPS_DYNAMIC:
3323                 cap |= u16_encode_bits(WLAN_HT_CAP_SM_PS_DYNAMIC,
3324                                        IEEE80211_HE_6GHZ_CAP_SM_PS);
3325                 break;
3326         }
3327
3328         pos = skb_put(skb, 2 + 1 + sizeof(cap));
3329         ieee80211_write_he_6ghz_cap(pos, cpu_to_le16(cap),
3330                                     pos + 2 + 1 + sizeof(cap));
3331 }
3332
3333 u8 *ieee80211_ie_build_ht_oper(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
3334                                const struct cfg80211_chan_def *chandef,
3335                                u16 prot_mode, bool rifs_mode)
3336 {
3337         struct ieee80211_ht_operation *ht_oper;
3338         /* Build HT Information */
3339         *pos++ = WLAN_EID_HT_OPERATION;
3340         *pos++ = sizeof(struct ieee80211_ht_operation);
3341         ht_oper = (struct ieee80211_ht_operation *)pos;
3342         ht_oper->primary_chan = ieee80211_frequency_to_channel(
3343                                         chandef->chan->center_freq);
3344         switch (chandef->width) {
3345         case NL80211_CHAN_WIDTH_160:
3346         case NL80211_CHAN_WIDTH_80P80:
3347         case NL80211_CHAN_WIDTH_80:
3348         case NL80211_CHAN_WIDTH_40:
3349                 if (chandef->center_freq1 > chandef->chan->center_freq)
3350                         ht_oper->ht_param = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
3351                 else
3352                         ht_oper->ht_param = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
3353                 break;
3354         case NL80211_CHAN_WIDTH_320:
3355                 /* HT information element should not be included on 6GHz */
3356                 WARN_ON(1);
3357                 return pos;
3358         default:
3359                 ht_oper->ht_param = IEEE80211_HT_PARAM_CHA_SEC_NONE;
3360                 break;
3361         }
3362         if (ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 &&
3363             chandef->width != NL80211_CHAN_WIDTH_20_NOHT &&
3364             chandef->width != NL80211_CHAN_WIDTH_20)
3365                 ht_oper->ht_param |= IEEE80211_HT_PARAM_CHAN_WIDTH_ANY;
3366
3367         if (rifs_mode)
3368                 ht_oper->ht_param |= IEEE80211_HT_PARAM_RIFS_MODE;
3369
3370         ht_oper->operation_mode = cpu_to_le16(prot_mode);
3371         ht_oper->stbc_param = 0x0000;
3372
3373         /* It seems that Basic MCS set and Supported MCS set
3374            are identical for the first 10 bytes */
3375         memset(&ht_oper->basic_set, 0, 16);
3376         memcpy(&ht_oper->basic_set, &ht_cap->mcs, 10);
3377
3378         return pos + sizeof(struct ieee80211_ht_operation);
3379 }
3380
3381 void ieee80211_ie_build_wide_bw_cs(u8 *pos,
3382                                    const struct cfg80211_chan_def *chandef)
3383 {
3384         *pos++ = WLAN_EID_WIDE_BW_CHANNEL_SWITCH;       /* EID */
3385         *pos++ = 3;                                     /* IE length */
3386         /* New channel width */
3387         switch (chandef->width) {
3388         case NL80211_CHAN_WIDTH_80:
3389                 *pos++ = IEEE80211_VHT_CHANWIDTH_80MHZ;
3390                 break;
3391         case NL80211_CHAN_WIDTH_160:
3392                 *pos++ = IEEE80211_VHT_CHANWIDTH_160MHZ;
3393                 break;
3394         case NL80211_CHAN_WIDTH_80P80:
3395                 *pos++ = IEEE80211_VHT_CHANWIDTH_80P80MHZ;
3396                 break;
3397         case NL80211_CHAN_WIDTH_320:
3398                 /* The behavior is not defined for 320 MHz channels */
3399                 WARN_ON(1);
3400                 fallthrough;
3401         default:
3402                 *pos++ = IEEE80211_VHT_CHANWIDTH_USE_HT;
3403         }
3404
3405         /* new center frequency segment 0 */
3406         *pos++ = ieee80211_frequency_to_channel(chandef->center_freq1);
3407         /* new center frequency segment 1 */
3408         if (chandef->center_freq2)
3409                 *pos++ = ieee80211_frequency_to_channel(chandef->center_freq2);
3410         else
3411                 *pos++ = 0;
3412 }
3413
3414 u8 *ieee80211_ie_build_vht_oper(u8 *pos, struct ieee80211_sta_vht_cap *vht_cap,
3415                                 const struct cfg80211_chan_def *chandef)
3416 {
3417         struct ieee80211_vht_operation *vht_oper;
3418
3419         *pos++ = WLAN_EID_VHT_OPERATION;
3420         *pos++ = sizeof(struct ieee80211_vht_operation);
3421         vht_oper = (struct ieee80211_vht_operation *)pos;
3422         vht_oper->center_freq_seg0_idx = ieee80211_frequency_to_channel(
3423                                                         chandef->center_freq1);
3424         if (chandef->center_freq2)
3425                 vht_oper->center_freq_seg1_idx =
3426                         ieee80211_frequency_to_channel(chandef->center_freq2);
3427         else
3428                 vht_oper->center_freq_seg1_idx = 0x00;
3429
3430         switch (chandef->width) {
3431         case NL80211_CHAN_WIDTH_160:
3432                 /*
3433                  * Convert 160 MHz channel width to new style as interop
3434                  * workaround.
3435                  */
3436                 vht_oper->chan_width = IEEE80211_VHT_CHANWIDTH_80MHZ;
3437                 vht_oper->center_freq_seg1_idx = vht_oper->center_freq_seg0_idx;
3438                 if (chandef->chan->center_freq < chandef->center_freq1)
3439                         vht_oper->center_freq_seg0_idx -= 8;
3440                 else
3441                         vht_oper->center_freq_seg0_idx += 8;
3442                 break;
3443         case NL80211_CHAN_WIDTH_80P80:
3444                 /*
3445                  * Convert 80+80 MHz channel width to new style as interop
3446                  * workaround.
3447                  */
3448                 vht_oper->chan_width = IEEE80211_VHT_CHANWIDTH_80MHZ;
3449                 break;
3450         case NL80211_CHAN_WIDTH_80:
3451                 vht_oper->chan_width = IEEE80211_VHT_CHANWIDTH_80MHZ;
3452                 break;
3453         case NL80211_CHAN_WIDTH_320:
3454                 /* VHT information element should not be included on 6GHz */
3455                 WARN_ON(1);
3456                 return pos;
3457         default:
3458                 vht_oper->chan_width = IEEE80211_VHT_CHANWIDTH_USE_HT;
3459                 break;
3460         }
3461
3462         /* don't require special VHT peer rates */
3463         vht_oper->basic_mcs_set = cpu_to_le16(0xffff);
3464
3465         return pos + sizeof(struct ieee80211_vht_operation);
3466 }
3467
3468 u8 *ieee80211_ie_build_he_oper(u8 *pos, struct cfg80211_chan_def *chandef)
3469 {
3470         struct ieee80211_he_operation *he_oper;
3471         struct ieee80211_he_6ghz_oper *he_6ghz_op;
3472         u32 he_oper_params;
3473         u8 ie_len = 1 + sizeof(struct ieee80211_he_operation);
3474
3475         if (chandef->chan->band == NL80211_BAND_6GHZ)
3476                 ie_len += sizeof(struct ieee80211_he_6ghz_oper);
3477
3478         *pos++ = WLAN_EID_EXTENSION;
3479         *pos++ = ie_len;
3480         *pos++ = WLAN_EID_EXT_HE_OPERATION;
3481
3482         he_oper_params = 0;
3483         he_oper_params |= u32_encode_bits(1023, /* disabled */
3484                                 IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
3485         he_oper_params |= u32_encode_bits(1,
3486                                 IEEE80211_HE_OPERATION_ER_SU_DISABLE);
3487         he_oper_params |= u32_encode_bits(1,
3488                                 IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED);
3489         if (chandef->chan->band == NL80211_BAND_6GHZ)
3490                 he_oper_params |= u32_encode_bits(1,
3491                                 IEEE80211_HE_OPERATION_6GHZ_OP_INFO);
3492
3493         he_oper = (struct ieee80211_he_operation *)pos;
3494         he_oper->he_oper_params = cpu_to_le32(he_oper_params);
3495
3496         /* don't require special HE peer rates */
3497         he_oper->he_mcs_nss_set = cpu_to_le16(0xffff);
3498         pos += sizeof(struct ieee80211_he_operation);
3499
3500         if (chandef->chan->band != NL80211_BAND_6GHZ)
3501                 goto out;
3502
3503         /* TODO add VHT operational */
3504         he_6ghz_op = (struct ieee80211_he_6ghz_oper *)pos;
3505         he_6ghz_op->minrate = 6; /* 6 Mbps */
3506         he_6ghz_op->primary =
3507                 ieee80211_frequency_to_channel(chandef->chan->center_freq);
3508         he_6ghz_op->ccfs0 =
3509                 ieee80211_frequency_to_channel(chandef->center_freq1);
3510         if (chandef->center_freq2)
3511                 he_6ghz_op->ccfs1 =
3512                         ieee80211_frequency_to_channel(chandef->center_freq2);
3513         else
3514                 he_6ghz_op->ccfs1 = 0;
3515
3516         switch (chandef->width) {
3517         case NL80211_CHAN_WIDTH_320:
3518                 /*
3519                  * TODO: mesh operation is not defined over 6GHz 320 MHz
3520                  * channels.
3521                  */
3522                 WARN_ON(1);
3523                 break;
3524         case NL80211_CHAN_WIDTH_160:
3525                 /* Convert 160 MHz channel width to new style as interop
3526                  * workaround.
3527                  */
3528                 he_6ghz_op->control =
3529                         IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_160MHZ;
3530                 he_6ghz_op->ccfs1 = he_6ghz_op->ccfs0;
3531                 if (chandef->chan->center_freq < chandef->center_freq1)
3532                         he_6ghz_op->ccfs0 -= 8;
3533                 else
3534                         he_6ghz_op->ccfs0 += 8;
3535                 fallthrough;
3536         case NL80211_CHAN_WIDTH_80P80:
3537                 he_6ghz_op->control =
3538                         IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_160MHZ;
3539                 break;
3540         case NL80211_CHAN_WIDTH_80:
3541                 he_6ghz_op->control =
3542                         IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_80MHZ;
3543                 break;
3544         case NL80211_CHAN_WIDTH_40:
3545                 he_6ghz_op->control =
3546                         IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_40MHZ;
3547                 break;
3548         default:
3549                 he_6ghz_op->control =
3550                         IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_20MHZ;
3551                 break;
3552         }
3553
3554         pos += sizeof(struct ieee80211_he_6ghz_oper);
3555
3556 out:
3557         return pos;
3558 }
3559
3560 u8 *ieee80211_ie_build_eht_oper(u8 *pos, struct cfg80211_chan_def *chandef,
3561                                 const struct ieee80211_sta_eht_cap *eht_cap)
3562
3563 {
3564         const struct ieee80211_eht_mcs_nss_supp_20mhz_only *eht_mcs_nss =
3565                                         &eht_cap->eht_mcs_nss_supp.only_20mhz;
3566         struct ieee80211_eht_operation *eht_oper;
3567         struct ieee80211_eht_operation_info *eht_oper_info;
3568         u8 eht_oper_len = offsetof(struct ieee80211_eht_operation, optional);
3569         u8 eht_oper_info_len =
3570                 offsetof(struct ieee80211_eht_operation_info, optional);
3571         u8 chan_width = 0;
3572
3573         *pos++ = WLAN_EID_EXTENSION;
3574         *pos++ = 1 + eht_oper_len + eht_oper_info_len;
3575         *pos++ = WLAN_EID_EXT_EHT_OPERATION;
3576
3577         eht_oper = (struct ieee80211_eht_operation *)pos;
3578
3579         memcpy(&eht_oper->basic_mcs_nss, eht_mcs_nss, sizeof(*eht_mcs_nss));
3580         eht_oper->params |= IEEE80211_EHT_OPER_INFO_PRESENT;
3581         pos += eht_oper_len;
3582
3583         eht_oper_info =
3584                 (struct ieee80211_eht_operation_info *)eht_oper->optional;
3585
3586         eht_oper_info->ccfs0 =
3587                 ieee80211_frequency_to_channel(chandef->center_freq1);
3588         if (chandef->center_freq2)
3589                 eht_oper_info->ccfs1 =
3590                         ieee80211_frequency_to_channel(chandef->center_freq2);
3591         else
3592                 eht_oper_info->ccfs1 = 0;
3593
3594         switch (chandef->width) {
3595         case NL80211_CHAN_WIDTH_320:
3596                 chan_width = IEEE80211_EHT_OPER_CHAN_WIDTH_320MHZ;
3597                 eht_oper_info->ccfs1 = eht_oper_info->ccfs0;
3598                 if (chandef->chan->center_freq < chandef->center_freq1)
3599                         eht_oper_info->ccfs0 -= 16;
3600                 else
3601                         eht_oper_info->ccfs0 += 16;
3602                 break;
3603         case NL80211_CHAN_WIDTH_160:
3604                 eht_oper_info->ccfs1 = eht_oper_info->ccfs0;
3605                 if (chandef->chan->center_freq < chandef->center_freq1)
3606                         eht_oper_info->ccfs0 -= 8;
3607                 else
3608                         eht_oper_info->ccfs0 += 8;
3609                 fallthrough;
3610         case NL80211_CHAN_WIDTH_80P80:
3611                 chan_width = IEEE80211_EHT_OPER_CHAN_WIDTH_160MHZ;
3612                 break;
3613         case NL80211_CHAN_WIDTH_80:
3614                 chan_width = IEEE80211_EHT_OPER_CHAN_WIDTH_80MHZ;
3615                 break;
3616         case NL80211_CHAN_WIDTH_40:
3617                 chan_width = IEEE80211_EHT_OPER_CHAN_WIDTH_40MHZ;
3618                 break;
3619         default:
3620                 chan_width = IEEE80211_EHT_OPER_CHAN_WIDTH_20MHZ;
3621                 break;
3622         }
3623         eht_oper_info->control = chan_width;
3624         pos += eht_oper_info_len;
3625
3626         /* TODO: eht_oper_info->optional */
3627
3628         return pos;
3629 }
3630
3631 bool ieee80211_chandef_ht_oper(const struct ieee80211_ht_operation *ht_oper,
3632                                struct cfg80211_chan_def *chandef)
3633 {
3634         enum nl80211_channel_type channel_type;
3635
3636         if (!ht_oper)
3637                 return false;
3638
3639         switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
3640         case IEEE80211_HT_PARAM_CHA_SEC_NONE:
3641                 channel_type = NL80211_CHAN_HT20;
3642                 break;
3643         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
3644                 channel_type = NL80211_CHAN_HT40PLUS;
3645                 break;
3646         case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
3647                 channel_type = NL80211_CHAN_HT40MINUS;
3648                 break;
3649         default:
3650                 return false;
3651         }
3652
3653         cfg80211_chandef_create(chandef, chandef->chan, channel_type);
3654         return true;
3655 }
3656
3657 bool ieee80211_chandef_vht_oper(struct ieee80211_hw *hw, u32 vht_cap_info,
3658                                 const struct ieee80211_vht_operation *oper,
3659                                 const struct ieee80211_ht_operation *htop,
3660                                 struct cfg80211_chan_def *chandef)
3661 {
3662         struct cfg80211_chan_def new = *chandef;
3663         int cf0, cf1;
3664         int ccfs0, ccfs1, ccfs2;
3665         int ccf0, ccf1;
3666         u32 vht_cap;
3667         bool support_80_80 = false;
3668         bool support_160 = false;
3669         u8 ext_nss_bw_supp = u32_get_bits(vht_cap_info,
3670                                           IEEE80211_VHT_CAP_EXT_NSS_BW_MASK);
3671         u8 supp_chwidth = u32_get_bits(vht_cap_info,
3672                                        IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK);
3673
3674         if (!oper || !htop)
3675                 return false;
3676
3677         vht_cap = hw->wiphy->bands[chandef->chan->band]->vht_cap.cap;
3678         support_160 = (vht_cap & (IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK |
3679                                   IEEE80211_VHT_CAP_EXT_NSS_BW_MASK));
3680         support_80_80 = ((vht_cap &
3681                          IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ) ||
3682                         (vht_cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ &&
3683                          vht_cap & IEEE80211_VHT_CAP_EXT_NSS_BW_MASK) ||
3684                         ((vht_cap & IEEE80211_VHT_CAP_EXT_NSS_BW_MASK) >>
3685                                     IEEE80211_VHT_CAP_EXT_NSS_BW_SHIFT > 1));
3686         ccfs0 = oper->center_freq_seg0_idx;
3687         ccfs1 = oper->center_freq_seg1_idx;
3688         ccfs2 = (le16_to_cpu(htop->operation_mode) &
3689                                 IEEE80211_HT_OP_MODE_CCFS2_MASK)
3690                         >> IEEE80211_HT_OP_MODE_CCFS2_SHIFT;
3691
3692         ccf0 = ccfs0;
3693
3694         /* if not supported, parse as though we didn't understand it */
3695         if (!ieee80211_hw_check(hw, SUPPORTS_VHT_EXT_NSS_BW))
3696                 ext_nss_bw_supp = 0;
3697
3698         /*
3699          * Cf. IEEE 802.11 Table 9-250
3700          *
3701          * We really just consider that because it's inefficient to connect
3702          * at a higher bandwidth than we'll actually be able to use.
3703          */
3704         switch ((supp_chwidth << 4) | ext_nss_bw_supp) {
3705         default:
3706         case 0x00:
3707                 ccf1 = 0;
3708                 support_160 = false;
3709                 support_80_80 = false;
3710                 break;
3711         case 0x01:
3712                 support_80_80 = false;
3713                 fallthrough;
3714         case 0x02:
3715         case 0x03:
3716                 ccf1 = ccfs2;
3717                 break;
3718         case 0x10:
3719                 ccf1 = ccfs1;
3720                 break;
3721         case 0x11:
3722         case 0x12:
3723                 if (!ccfs1)
3724                         ccf1 = ccfs2;
3725                 else
3726                         ccf1 = ccfs1;
3727                 break;
3728         case 0x13:
3729         case 0x20:
3730         case 0x23:
3731                 ccf1 = ccfs1;
3732                 break;
3733         }
3734
3735         cf0 = ieee80211_channel_to_frequency(ccf0, chandef->chan->band);
3736         cf1 = ieee80211_channel_to_frequency(ccf1, chandef->chan->band);
3737
3738         switch (oper->chan_width) {
3739         case IEEE80211_VHT_CHANWIDTH_USE_HT:
3740                 /* just use HT information directly */
3741                 break;
3742         case IEEE80211_VHT_CHANWIDTH_80MHZ:
3743                 new.width = NL80211_CHAN_WIDTH_80;
3744                 new.center_freq1 = cf0;
3745                 /* If needed, adjust based on the newer interop workaround. */
3746                 if (ccf1) {
3747                         unsigned int diff;
3748
3749                         diff = abs(ccf1 - ccf0);
3750                         if ((diff == 8) && support_160) {
3751                                 new.width = NL80211_CHAN_WIDTH_160;
3752                                 new.center_freq1 = cf1;
3753                         } else if ((diff > 8) && support_80_80) {
3754                                 new.width = NL80211_CHAN_WIDTH_80P80;
3755                                 new.center_freq2 = cf1;
3756                         }
3757                 }
3758                 break;
3759         case IEEE80211_VHT_CHANWIDTH_160MHZ:
3760                 /* deprecated encoding */
3761                 new.width = NL80211_CHAN_WIDTH_160;
3762                 new.center_freq1 = cf0;
3763                 break;
3764         case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
3765                 /* deprecated encoding */
3766                 new.width = NL80211_CHAN_WIDTH_80P80;
3767                 new.center_freq1 = cf0;
3768                 new.center_freq2 = cf1;
3769                 break;
3770         default:
3771                 return false;
3772         }
3773
3774         if (!cfg80211_chandef_valid(&new))
3775                 return false;
3776
3777         *chandef = new;
3778         return true;
3779 }
3780
3781 void ieee80211_chandef_eht_oper(const struct ieee80211_eht_operation *eht_oper,
3782                                 bool support_160, bool support_320,
3783                                 struct cfg80211_chan_def *chandef)
3784 {
3785         struct ieee80211_eht_operation_info *info = (void *)eht_oper->optional;
3786
3787         chandef->center_freq1 =
3788                 ieee80211_channel_to_frequency(info->ccfs0,
3789                                                chandef->chan->band);
3790
3791         switch (u8_get_bits(info->control,
3792                             IEEE80211_EHT_OPER_CHAN_WIDTH)) {
3793         case IEEE80211_EHT_OPER_CHAN_WIDTH_20MHZ:
3794                 chandef->width = NL80211_CHAN_WIDTH_20;
3795                 break;
3796         case IEEE80211_EHT_OPER_CHAN_WIDTH_40MHZ:
3797                 chandef->width = NL80211_CHAN_WIDTH_40;
3798                 break;
3799         case IEEE80211_EHT_OPER_CHAN_WIDTH_80MHZ:
3800                 chandef->width = NL80211_CHAN_WIDTH_80;
3801                 break;
3802         case IEEE80211_EHT_OPER_CHAN_WIDTH_160MHZ:
3803                 if (support_160) {
3804                         chandef->width = NL80211_CHAN_WIDTH_160;
3805                         chandef->center_freq1 =
3806                                 ieee80211_channel_to_frequency(info->ccfs1,
3807                                                                chandef->chan->band);
3808                 } else {
3809                         chandef->width = NL80211_CHAN_WIDTH_80;
3810                 }
3811                 break;
3812         case IEEE80211_EHT_OPER_CHAN_WIDTH_320MHZ:
3813                 if (support_320) {
3814                         chandef->width = NL80211_CHAN_WIDTH_320;
3815                         chandef->center_freq1 =
3816                                 ieee80211_channel_to_frequency(info->ccfs1,
3817                                                                chandef->chan->band);
3818                 } else if (support_160) {
3819                         chandef->width = NL80211_CHAN_WIDTH_160;
3820                 } else {
3821                         chandef->width = NL80211_CHAN_WIDTH_80;
3822
3823                         if (chandef->center_freq1 > chandef->chan->center_freq)
3824                                 chandef->center_freq1 -= 40;
3825                         else
3826                                 chandef->center_freq1 += 40;
3827                 }
3828                 break;
3829         }
3830 }
3831
3832 bool ieee80211_chandef_he_6ghz_oper(struct ieee80211_sub_if_data *sdata,
3833                                     const struct ieee80211_he_operation *he_oper,
3834                                     const struct ieee80211_eht_operation *eht_oper,
3835                                     struct cfg80211_chan_def *chandef)
3836 {
3837         struct ieee80211_local *local = sdata->local;
3838         struct ieee80211_supported_band *sband;
3839         enum nl80211_iftype iftype = ieee80211_vif_type_p2p(&sdata->vif);
3840         const struct ieee80211_sta_he_cap *he_cap;
3841         const struct ieee80211_sta_eht_cap *eht_cap;
3842         struct cfg80211_chan_def he_chandef = *chandef;
3843         const struct ieee80211_he_6ghz_oper *he_6ghz_oper;
3844         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3845         bool support_80_80, support_160, support_320;
3846         u8 he_phy_cap, eht_phy_cap;
3847         u32 freq;
3848
3849         if (chandef->chan->band != NL80211_BAND_6GHZ)
3850                 return true;
3851
3852         sband = local->hw.wiphy->bands[NL80211_BAND_6GHZ];
3853
3854         he_cap = ieee80211_get_he_iftype_cap(sband, iftype);
3855         if (!he_cap) {
3856                 sdata_info(sdata, "Missing iftype sband data/HE cap");
3857                 return false;
3858         }
3859
3860         he_phy_cap = he_cap->he_cap_elem.phy_cap_info[0];
3861         support_160 =
3862                 he_phy_cap &
3863                 IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
3864         support_80_80 =
3865                 he_phy_cap &
3866                 IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G;
3867
3868         if (!he_oper) {
3869                 sdata_info(sdata,
3870                            "HE is not advertised on (on %d MHz), expect issues\n",
3871                            chandef->chan->center_freq);
3872                 return false;
3873         }
3874
3875         eht_cap = ieee80211_get_eht_iftype_cap(sband, iftype);
3876         if (!eht_cap)
3877                 eht_oper = NULL;
3878
3879         he_6ghz_oper = ieee80211_he_6ghz_oper(he_oper);
3880
3881         if (!he_6ghz_oper) {
3882                 sdata_info(sdata,
3883                            "HE 6GHz operation missing (on %d MHz), expect issues\n",
3884                            chandef->chan->center_freq);
3885                 return false;
3886         }
3887
3888         /*
3889          * The EHT operation IE does not contain the primary channel so the
3890          * primary channel frequency should be taken from the 6 GHz operation
3891          * information.
3892          */
3893         freq = ieee80211_channel_to_frequency(he_6ghz_oper->primary,
3894                                               NL80211_BAND_6GHZ);
3895         he_chandef.chan = ieee80211_get_channel(sdata->local->hw.wiphy, freq);
3896
3897         switch (u8_get_bits(he_6ghz_oper->control,
3898                             IEEE80211_HE_6GHZ_OPER_CTRL_REG_INFO)) {
3899         case IEEE80211_6GHZ_CTRL_REG_LPI_AP:
3900                 bss_conf->power_type = IEEE80211_REG_LPI_AP;
3901                 break;
3902         case IEEE80211_6GHZ_CTRL_REG_SP_AP:
3903                 bss_conf->power_type = IEEE80211_REG_SP_AP;
3904                 break;
3905         default:
3906                 bss_conf->power_type = IEEE80211_REG_UNSET_AP;
3907                 break;
3908         }
3909
3910         if (!eht_oper ||
3911             !(eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT)) {
3912                 switch (u8_get_bits(he_6ghz_oper->control,
3913                                     IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH)) {
3914                 case IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_20MHZ:
3915                         he_chandef.width = NL80211_CHAN_WIDTH_20;
3916                         break;
3917                 case IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_40MHZ:
3918                         he_chandef.width = NL80211_CHAN_WIDTH_40;
3919                         break;
3920                 case IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_80MHZ:
3921                         he_chandef.width = NL80211_CHAN_WIDTH_80;
3922                         break;
3923                 case IEEE80211_HE_6GHZ_OPER_CTRL_CHANWIDTH_160MHZ:
3924                         he_chandef.width = NL80211_CHAN_WIDTH_80;
3925                         if (!he_6ghz_oper->ccfs1)
3926                                 break;
3927                         if (abs(he_6ghz_oper->ccfs1 - he_6ghz_oper->ccfs0) == 8) {
3928                                 if (support_160)
3929                                         he_chandef.width = NL80211_CHAN_WIDTH_160;
3930                         } else {
3931                                 if (support_80_80)
3932                                         he_chandef.width = NL80211_CHAN_WIDTH_80P80;
3933                         }
3934                         break;
3935                 }
3936
3937                 if (he_chandef.width == NL80211_CHAN_WIDTH_160) {
3938                         he_chandef.center_freq1 =
3939                                 ieee80211_channel_to_frequency(he_6ghz_oper->ccfs1,
3940                                                                NL80211_BAND_6GHZ);
3941                 } else {
3942                         he_chandef.center_freq1 =
3943                                 ieee80211_channel_to_frequency(he_6ghz_oper->ccfs0,
3944                                                                NL80211_BAND_6GHZ);
3945                         if (support_80_80 || support_160)
3946                                 he_chandef.center_freq2 =
3947                                         ieee80211_channel_to_frequency(he_6ghz_oper->ccfs1,
3948                                                                        NL80211_BAND_6GHZ);
3949                 }
3950         } else {
3951                 eht_phy_cap = eht_cap->eht_cap_elem.phy_cap_info[0];
3952                 support_320 =
3953                         eht_phy_cap & IEEE80211_EHT_PHY_CAP0_320MHZ_IN_6GHZ;
3954
3955                 ieee80211_chandef_eht_oper(eht_oper, support_160,
3956                                            support_320, &he_chandef);
3957         }
3958
3959         if (!cfg80211_chandef_valid(&he_chandef)) {
3960                 sdata_info(sdata,
3961                            "HE 6GHz operation resulted in invalid chandef: %d MHz/%d/%d MHz/%d MHz\n",
3962                            he_chandef.chan ? he_chandef.chan->center_freq : 0,
3963                            he_chandef.width,
3964                            he_chandef.center_freq1,
3965                            he_chandef.center_freq2);
3966                 return false;
3967         }
3968
3969         *chandef = he_chandef;
3970
3971         return true;
3972 }
3973
3974 bool ieee80211_chandef_s1g_oper(const struct ieee80211_s1g_oper_ie *oper,
3975                                 struct cfg80211_chan_def *chandef)
3976 {
3977         u32 oper_freq;
3978
3979         if (!oper)
3980                 return false;
3981
3982         switch (FIELD_GET(S1G_OPER_CH_WIDTH_OPER, oper->ch_width)) {
3983         case IEEE80211_S1G_CHANWIDTH_1MHZ:
3984                 chandef->width = NL80211_CHAN_WIDTH_1;
3985                 break;
3986         case IEEE80211_S1G_CHANWIDTH_2MHZ:
3987                 chandef->width = NL80211_CHAN_WIDTH_2;
3988                 break;
3989         case IEEE80211_S1G_CHANWIDTH_4MHZ:
3990                 chandef->width = NL80211_CHAN_WIDTH_4;
3991                 break;
3992         case IEEE80211_S1G_CHANWIDTH_8MHZ:
3993                 chandef->width = NL80211_CHAN_WIDTH_8;
3994                 break;
3995         case IEEE80211_S1G_CHANWIDTH_16MHZ:
3996                 chandef->width = NL80211_CHAN_WIDTH_16;
3997                 break;
3998         default:
3999                 return false;
4000         }
4001
4002         oper_freq = ieee80211_channel_to_freq_khz(oper->oper_ch,
4003                                                   NL80211_BAND_S1GHZ);
4004         chandef->center_freq1 = KHZ_TO_MHZ(oper_freq);
4005         chandef->freq1_offset = oper_freq % 1000;
4006
4007         return true;
4008 }
4009
4010 int ieee80211_parse_bitrates(enum nl80211_chan_width width,
4011                              const struct ieee80211_supported_band *sband,
4012                              const u8 *srates, int srates_len, u32 *rates)
4013 {
4014         u32 rate_flags = ieee80211_chanwidth_rate_flags(width);
4015         int shift = ieee80211_chanwidth_get_shift(width);
4016         struct ieee80211_rate *br;
4017         int brate, rate, i, j, count = 0;
4018
4019         *rates = 0;
4020
4021         for (i = 0; i < srates_len; i++) {
4022                 rate = srates[i] & 0x7f;
4023
4024                 for (j = 0; j < sband->n_bitrates; j++) {
4025                         br = &sband->bitrates[j];
4026                         if ((rate_flags & br->flags) != rate_flags)
4027                                 continue;
4028
4029                         brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
4030                         if (brate == rate) {
4031                                 *rates |= BIT(j);
4032                                 count++;
4033                                 break;
4034                         }
4035                 }
4036         }
4037         return count;
4038 }
4039
4040 int ieee80211_add_srates_ie(struct ieee80211_sub_if_data *sdata,
4041                             struct sk_buff *skb, bool need_basic,
4042                             enum nl80211_band band)
4043 {
4044         struct ieee80211_local *local = sdata->local;
4045         struct ieee80211_supported_band *sband;
4046         int rate, shift;
4047         u8 i, rates, *pos;
4048         u32 basic_rates = sdata->vif.bss_conf.basic_rates;
4049         u32 rate_flags;
4050
4051         shift = ieee80211_vif_get_shift(&sdata->vif);
4052         rate_flags = ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chandef);
4053         sband = local->hw.wiphy->bands[band];
4054         rates = 0;
4055         for (i = 0; i < sband->n_bitrates; i++) {
4056                 if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
4057                         continue;
4058                 rates++;
4059         }
4060         if (rates > 8)
4061                 rates = 8;
4062
4063         if (skb_tailroom(skb) < rates + 2)
4064                 return -ENOMEM;
4065
4066         pos = skb_put(skb, rates + 2);
4067         *pos++ = WLAN_EID_SUPP_RATES;
4068         *pos++ = rates;
4069         for (i = 0; i < rates; i++) {
4070                 u8 basic = 0;
4071                 if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
4072                         continue;
4073
4074                 if (need_basic && basic_rates & BIT(i))
4075                         basic = 0x80;
4076                 rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
4077                                     5 * (1 << shift));
4078                 *pos++ = basic | (u8) rate;
4079         }
4080
4081         return 0;
4082 }
4083
4084 int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
4085                                 struct sk_buff *skb, bool need_basic,
4086                                 enum nl80211_band band)
4087 {
4088         struct ieee80211_local *local = sdata->local;
4089         struct ieee80211_supported_band *sband;
4090         int rate, shift;
4091         u8 i, exrates, *pos;
4092         u32 basic_rates = sdata->vif.bss_conf.basic_rates;
4093         u32 rate_flags;
4094
4095         rate_flags = ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chandef);
4096         shift = ieee80211_vif_get_shift(&sdata->vif);
4097
4098         sband = local->hw.wiphy->bands[band];
4099         exrates = 0;
4100         for (i = 0; i < sband->n_bitrates; i++) {
4101                 if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
4102                         continue;
4103                 exrates++;
4104         }
4105
4106         if (exrates > 8)
4107                 exrates -= 8;
4108         else
4109                 exrates = 0;
4110
4111         if (skb_tailroom(skb) < exrates + 2)
4112                 return -ENOMEM;
4113
4114         if (exrates) {
4115                 pos = skb_put(skb, exrates + 2);
4116                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
4117                 *pos++ = exrates;
4118                 for (i = 8; i < sband->n_bitrates; i++) {
4119                         u8 basic = 0;
4120                         if ((rate_flags & sband->bitrates[i].flags)
4121                             != rate_flags)
4122                                 continue;
4123                         if (need_basic && basic_rates & BIT(i))
4124                                 basic = 0x80;
4125                         rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
4126                                             5 * (1 << shift));
4127                         *pos++ = basic | (u8) rate;
4128                 }
4129         }
4130         return 0;
4131 }
4132
4133 int ieee80211_ave_rssi(struct ieee80211_vif *vif)
4134 {
4135         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
4136
4137         if (WARN_ON_ONCE(sdata->vif.type != NL80211_IFTYPE_STATION))
4138                 return 0;
4139
4140         return -ewma_beacon_signal_read(&sdata->deflink.u.mgd.ave_beacon_signal);
4141 }
4142 EXPORT_SYMBOL_GPL(ieee80211_ave_rssi);
4143
4144 u8 ieee80211_mcs_to_chains(const struct ieee80211_mcs_info *mcs)
4145 {
4146         if (!mcs)
4147                 return 1;
4148
4149         /* TODO: consider rx_highest */
4150
4151         if (mcs->rx_mask[3])
4152                 return 4;
4153         if (mcs->rx_mask[2])
4154                 return 3;
4155         if (mcs->rx_mask[1])
4156                 return 2;
4157         return 1;
4158 }
4159
4160 /**
4161  * ieee80211_calculate_rx_timestamp - calculate timestamp in frame
4162  * @local: mac80211 hw info struct
4163  * @status: RX status
4164  * @mpdu_len: total MPDU length (including FCS)
4165  * @mpdu_offset: offset into MPDU to calculate timestamp at
4166  *
4167  * This function calculates the RX timestamp at the given MPDU offset, taking
4168  * into account what the RX timestamp was. An offset of 0 will just normalize
4169  * the timestamp to TSF at beginning of MPDU reception.
4170  */
4171 u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
4172                                      struct ieee80211_rx_status *status,
4173                                      unsigned int mpdu_len,
4174                                      unsigned int mpdu_offset)
4175 {
4176         u64 ts = status->mactime;
4177         struct rate_info ri;
4178         u16 rate;
4179         u8 n_ltf;
4180
4181         if (WARN_ON(!ieee80211_have_rx_timestamp(status)))
4182                 return 0;
4183
4184         memset(&ri, 0, sizeof(ri));
4185
4186         ri.bw = status->bw;
4187
4188         /* Fill cfg80211 rate info */
4189         switch (status->encoding) {
4190         case RX_ENC_EHT:
4191                 ri.flags |= RATE_INFO_FLAGS_EHT_MCS;
4192                 ri.mcs = status->rate_idx;
4193                 ri.nss = status->nss;
4194                 ri.eht_ru_alloc = status->eht.ru;
4195                 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
4196                         ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
4197                 /* TODO/FIXME: is this right? handle other PPDUs */
4198                 if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
4199                         mpdu_offset += 2;
4200                         ts += 36;
4201                 }
4202                 break;
4203         case RX_ENC_HE:
4204                 ri.flags |= RATE_INFO_FLAGS_HE_MCS;
4205                 ri.mcs = status->rate_idx;
4206                 ri.nss = status->nss;
4207                 ri.he_ru_alloc = status->he_ru;
4208                 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
4209                         ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
4210
4211                 /*
4212                  * See P802.11ax_D6.0, section 27.3.4 for
4213                  * VHT PPDU format.
4214                  */
4215                 if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
4216                         mpdu_offset += 2;
4217                         ts += 36;
4218
4219                         /*
4220                          * TODO:
4221                          * For HE MU PPDU, add the HE-SIG-B.
4222                          * For HE ER PPDU, add 8us for the HE-SIG-A.
4223                          * For HE TB PPDU, add 4us for the HE-STF.
4224                          * Add the HE-LTF durations - variable.
4225                          */
4226                 }
4227
4228                 break;
4229         case RX_ENC_HT:
4230                 ri.mcs = status->rate_idx;
4231                 ri.flags |= RATE_INFO_FLAGS_MCS;
4232                 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
4233                         ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
4234
4235                 /*
4236                  * See P802.11REVmd_D3.0, section 19.3.2 for
4237                  * HT PPDU format.
4238                  */
4239                 if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
4240                         mpdu_offset += 2;
4241                         if (status->enc_flags & RX_ENC_FLAG_HT_GF)
4242                                 ts += 24;
4243                         else
4244                                 ts += 32;
4245
4246                         /*
4247                          * Add Data HT-LTFs per streams
4248                          * TODO: add Extension HT-LTFs, 4us per LTF
4249                          */
4250                         n_ltf = ((ri.mcs >> 3) & 3) + 1;
4251                         n_ltf = n_ltf == 3 ? 4 : n_ltf;
4252                         ts += n_ltf * 4;
4253                 }
4254
4255                 break;
4256         case RX_ENC_VHT:
4257                 ri.flags |= RATE_INFO_FLAGS_VHT_MCS;
4258                 ri.mcs = status->rate_idx;
4259                 ri.nss = status->nss;
4260                 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
4261                         ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
4262
4263                 /*
4264                  * See P802.11REVmd_D3.0, section 21.3.2 for
4265                  * VHT PPDU format.
4266                  */
4267                 if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
4268                         mpdu_offset += 2;
4269                         ts += 36;
4270
4271                         /*
4272                          * Add VHT-LTFs per streams
4273                          */
4274                         n_ltf = (ri.nss != 1) && (ri.nss % 2) ?
4275                                 ri.nss + 1 : ri.nss;
4276                         ts += 4 * n_ltf;
4277                 }
4278
4279                 break;
4280         default:
4281                 WARN_ON(1);
4282                 fallthrough;
4283         case RX_ENC_LEGACY: {
4284                 struct ieee80211_supported_band *sband;
4285                 int shift = 0;
4286                 int bitrate;
4287
4288                 switch (status->bw) {
4289                 case RATE_INFO_BW_10:
4290                         shift = 1;
4291                         break;
4292                 case RATE_INFO_BW_5:
4293                         shift = 2;
4294                         break;
4295                 }
4296
4297                 sband = local->hw.wiphy->bands[status->band];
4298                 bitrate = sband->bitrates[status->rate_idx].bitrate;
4299                 ri.legacy = DIV_ROUND_UP(bitrate, (1 << shift));
4300
4301                 if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
4302                         if (status->band == NL80211_BAND_5GHZ) {
4303                                 ts += 20 << shift;
4304                                 mpdu_offset += 2;
4305                         } else if (status->enc_flags & RX_ENC_FLAG_SHORTPRE) {
4306                                 ts += 96;
4307                         } else {
4308                                 ts += 192;
4309                         }
4310                 }
4311                 break;
4312                 }
4313         }
4314
4315         rate = cfg80211_calculate_bitrate(&ri);
4316         if (WARN_ONCE(!rate,
4317                       "Invalid bitrate: flags=0x%llx, idx=%d, vht_nss=%d\n",
4318                       (unsigned long long)status->flag, status->rate_idx,
4319                       status->nss))
4320                 return 0;
4321
4322         /* rewind from end of MPDU */
4323         if (status->flag & RX_FLAG_MACTIME_END)
4324                 ts -= mpdu_len * 8 * 10 / rate;
4325
4326         ts += mpdu_offset * 8 * 10 / rate;
4327
4328         return ts;
4329 }
4330
4331 void ieee80211_dfs_cac_cancel(struct ieee80211_local *local)
4332 {
4333         struct ieee80211_sub_if_data *sdata;
4334         struct cfg80211_chan_def chandef;
4335
4336         /* for interface list, to avoid linking iflist_mtx and chanctx_mtx */
4337         lockdep_assert_wiphy(local->hw.wiphy);
4338
4339         mutex_lock(&local->mtx);
4340         list_for_each_entry(sdata, &local->interfaces, list) {
4341                 /* it might be waiting for the local->mtx, but then
4342                  * by the time it gets it, sdata->wdev.cac_started
4343                  * will no longer be true
4344                  */
4345                 cancel_delayed_work(&sdata->deflink.dfs_cac_timer_work);
4346
4347                 if (sdata->wdev.cac_started) {
4348                         chandef = sdata->vif.bss_conf.chandef;
4349                         ieee80211_link_release_channel(&sdata->deflink);
4350                         cfg80211_cac_event(sdata->dev,
4351                                            &chandef,
4352                                            NL80211_RADAR_CAC_ABORTED,
4353                                            GFP_KERNEL);
4354                 }
4355         }
4356         mutex_unlock(&local->mtx);
4357 }
4358
4359 void ieee80211_dfs_radar_detected_work(struct wiphy *wiphy,
4360                                        struct wiphy_work *work)
4361 {
4362         struct ieee80211_local *local =
4363                 container_of(work, struct ieee80211_local, radar_detected_work);
4364         struct cfg80211_chan_def chandef = local->hw.conf.chandef;
4365         struct ieee80211_chanctx *ctx;
4366         int num_chanctx = 0;
4367
4368         mutex_lock(&local->chanctx_mtx);
4369         list_for_each_entry(ctx, &local->chanctx_list, list) {
4370                 if (ctx->replace_state == IEEE80211_CHANCTX_REPLACES_OTHER)
4371                         continue;
4372
4373                 num_chanctx++;
4374                 chandef = ctx->conf.def;
4375         }
4376         mutex_unlock(&local->chanctx_mtx);
4377
4378         ieee80211_dfs_cac_cancel(local);
4379
4380         if (num_chanctx > 1)
4381                 /* XXX: multi-channel is not supported yet */
4382                 WARN_ON(1);
4383         else
4384                 cfg80211_radar_event(local->hw.wiphy, &chandef, GFP_KERNEL);
4385 }
4386
4387 void ieee80211_radar_detected(struct ieee80211_hw *hw)
4388 {
4389         struct ieee80211_local *local = hw_to_local(hw);
4390
4391         trace_api_radar_detected(local);
4392
4393         wiphy_work_queue(hw->wiphy, &local->radar_detected_work);
4394 }
4395 EXPORT_SYMBOL(ieee80211_radar_detected);
4396
4397 ieee80211_conn_flags_t ieee80211_chandef_downgrade(struct cfg80211_chan_def *c)
4398 {
4399         ieee80211_conn_flags_t ret;
4400         int tmp;
4401
4402         switch (c->width) {
4403         case NL80211_CHAN_WIDTH_20:
4404                 c->width = NL80211_CHAN_WIDTH_20_NOHT;
4405                 ret = IEEE80211_CONN_DISABLE_HT | IEEE80211_CONN_DISABLE_VHT;
4406                 break;
4407         case NL80211_CHAN_WIDTH_40:
4408                 c->width = NL80211_CHAN_WIDTH_20;
4409                 c->center_freq1 = c->chan->center_freq;
4410                 ret = IEEE80211_CONN_DISABLE_40MHZ |
4411                       IEEE80211_CONN_DISABLE_VHT;
4412                 break;
4413         case NL80211_CHAN_WIDTH_80:
4414                 tmp = (30 + c->chan->center_freq - c->center_freq1)/20;
4415                 /* n_P40 */
4416                 tmp /= 2;
4417                 /* freq_P40 */
4418                 c->center_freq1 = c->center_freq1 - 20 + 40 * tmp;
4419                 c->width = NL80211_CHAN_WIDTH_40;
4420                 ret = IEEE80211_CONN_DISABLE_VHT;
4421                 break;
4422         case NL80211_CHAN_WIDTH_80P80:
4423                 c->center_freq2 = 0;
4424                 c->width = NL80211_CHAN_WIDTH_80;
4425                 ret = IEEE80211_CONN_DISABLE_80P80MHZ |
4426                       IEEE80211_CONN_DISABLE_160MHZ;
4427                 break;
4428         case NL80211_CHAN_WIDTH_160:
4429                 /* n_P20 */
4430                 tmp = (70 + c->chan->center_freq - c->center_freq1)/20;
4431                 /* n_P80 */
4432                 tmp /= 4;
4433                 c->center_freq1 = c->center_freq1 - 40 + 80 * tmp;
4434                 c->width = NL80211_CHAN_WIDTH_80;
4435                 ret = IEEE80211_CONN_DISABLE_80P80MHZ |
4436                       IEEE80211_CONN_DISABLE_160MHZ;
4437                 break;
4438         case NL80211_CHAN_WIDTH_320:
4439                 /* n_P20 */
4440                 tmp = (150 + c->chan->center_freq - c->center_freq1) / 20;
4441                 /* n_P160 */
4442                 tmp /= 8;
4443                 c->center_freq1 = c->center_freq1 - 80 + 160 * tmp;
4444                 c->width = NL80211_CHAN_WIDTH_160;
4445                 ret = IEEE80211_CONN_DISABLE_320MHZ;
4446                 break;
4447         default:
4448         case NL80211_CHAN_WIDTH_20_NOHT:
4449                 WARN_ON_ONCE(1);
4450                 c->width = NL80211_CHAN_WIDTH_20_NOHT;
4451                 ret = IEEE80211_CONN_DISABLE_HT | IEEE80211_CONN_DISABLE_VHT;
4452                 break;
4453         case NL80211_CHAN_WIDTH_1:
4454         case NL80211_CHAN_WIDTH_2:
4455         case NL80211_CHAN_WIDTH_4:
4456         case NL80211_CHAN_WIDTH_8:
4457         case NL80211_CHAN_WIDTH_16:
4458         case NL80211_CHAN_WIDTH_5:
4459         case NL80211_CHAN_WIDTH_10:
4460                 WARN_ON_ONCE(1);
4461                 /* keep c->width */
4462                 ret = IEEE80211_CONN_DISABLE_HT | IEEE80211_CONN_DISABLE_VHT;
4463                 break;
4464         }
4465
4466         WARN_ON_ONCE(!cfg80211_chandef_valid(c));
4467
4468         return ret;
4469 }
4470
4471 /*
4472  * Returns true if smps_mode_new is strictly more restrictive than
4473  * smps_mode_old.
4474  */
4475 bool ieee80211_smps_is_restrictive(enum ieee80211_smps_mode smps_mode_old,
4476                                    enum ieee80211_smps_mode smps_mode_new)
4477 {
4478         if (WARN_ON_ONCE(smps_mode_old == IEEE80211_SMPS_AUTOMATIC ||
4479                          smps_mode_new == IEEE80211_SMPS_AUTOMATIC))
4480                 return false;
4481
4482         switch (smps_mode_old) {
4483         case IEEE80211_SMPS_STATIC:
4484                 return false;
4485         case IEEE80211_SMPS_DYNAMIC:
4486                 return smps_mode_new == IEEE80211_SMPS_STATIC;
4487         case IEEE80211_SMPS_OFF:
4488                 return smps_mode_new != IEEE80211_SMPS_OFF;
4489         default:
4490                 WARN_ON(1);
4491         }
4492
4493         return false;
4494 }
4495
4496 int ieee80211_send_action_csa(struct ieee80211_sub_if_data *sdata,
4497                               struct cfg80211_csa_settings *csa_settings)
4498 {
4499         struct sk_buff *skb;
4500         struct ieee80211_mgmt *mgmt;
4501         struct ieee80211_local *local = sdata->local;
4502         int freq;
4503         int hdr_len = offsetofend(struct ieee80211_mgmt,
4504                                   u.action.u.chan_switch);
4505         u8 *pos;
4506
4507         if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
4508             sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
4509                 return -EOPNOTSUPP;
4510
4511         skb = dev_alloc_skb(local->tx_headroom + hdr_len +
4512                             5 + /* channel switch announcement element */
4513                             3 + /* secondary channel offset element */
4514                             5 + /* wide bandwidth channel switch announcement */
4515                             8); /* mesh channel switch parameters element */
4516         if (!skb)
4517                 return -ENOMEM;
4518
4519         skb_reserve(skb, local->tx_headroom);
4520         mgmt = skb_put_zero(skb, hdr_len);
4521         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
4522                                           IEEE80211_STYPE_ACTION);
4523
4524         eth_broadcast_addr(mgmt->da);
4525         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
4526         if (ieee80211_vif_is_mesh(&sdata->vif)) {
4527                 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
4528         } else {
4529                 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
4530                 memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
4531         }
4532         mgmt->u.action.category = WLAN_CATEGORY_SPECTRUM_MGMT;
4533         mgmt->u.action.u.chan_switch.action_code = WLAN_ACTION_SPCT_CHL_SWITCH;
4534         pos = skb_put(skb, 5);
4535         *pos++ = WLAN_EID_CHANNEL_SWITCH;                       /* EID */
4536         *pos++ = 3;                                             /* IE length */
4537         *pos++ = csa_settings->block_tx ? 1 : 0;                /* CSA mode */
4538         freq = csa_settings->chandef.chan->center_freq;
4539         *pos++ = ieee80211_frequency_to_channel(freq);          /* channel */
4540         *pos++ = csa_settings->count;                           /* count */
4541
4542         if (csa_settings->chandef.width == NL80211_CHAN_WIDTH_40) {
4543                 enum nl80211_channel_type ch_type;
4544
4545                 skb_put(skb, 3);
4546                 *pos++ = WLAN_EID_SECONDARY_CHANNEL_OFFSET;     /* EID */
4547                 *pos++ = 1;                                     /* IE length */
4548                 ch_type = cfg80211_get_chandef_type(&csa_settings->chandef);
4549                 if (ch_type == NL80211_CHAN_HT40PLUS)
4550                         *pos++ = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
4551                 else
4552                         *pos++ = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
4553         }
4554
4555         if (ieee80211_vif_is_mesh(&sdata->vif)) {
4556                 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
4557
4558                 skb_put(skb, 8);
4559                 *pos++ = WLAN_EID_CHAN_SWITCH_PARAM;            /* EID */
4560                 *pos++ = 6;                                     /* IE length */
4561                 *pos++ = sdata->u.mesh.mshcfg.dot11MeshTTL;     /* Mesh TTL */
4562                 *pos = 0x00;    /* Mesh Flag: Tx Restrict, Initiator, Reason */
4563                 *pos |= WLAN_EID_CHAN_SWITCH_PARAM_INITIATOR;
4564                 *pos++ |= csa_settings->block_tx ?
4565                           WLAN_EID_CHAN_SWITCH_PARAM_TX_RESTRICT : 0x00;
4566                 put_unaligned_le16(WLAN_REASON_MESH_CHAN, pos); /* Reason Cd */
4567                 pos += 2;
4568                 put_unaligned_le16(ifmsh->pre_value, pos);/* Precedence Value */
4569                 pos += 2;
4570         }
4571
4572         if (csa_settings->chandef.width == NL80211_CHAN_WIDTH_80 ||
4573             csa_settings->chandef.width == NL80211_CHAN_WIDTH_80P80 ||
4574             csa_settings->chandef.width == NL80211_CHAN_WIDTH_160) {
4575                 skb_put(skb, 5);
4576                 ieee80211_ie_build_wide_bw_cs(pos, &csa_settings->chandef);
4577         }
4578
4579         ieee80211_tx_skb(sdata, skb);
4580         return 0;
4581 }
4582
4583 static bool
4584 ieee80211_extend_noa_desc(struct ieee80211_noa_data *data, u32 tsf, int i)
4585 {
4586         s32 end = data->desc[i].start + data->desc[i].duration - (tsf + 1);
4587         int skip;
4588
4589         if (end > 0)
4590                 return false;
4591
4592         /* One shot NOA  */
4593         if (data->count[i] == 1)
4594                 return false;
4595
4596         if (data->desc[i].interval == 0)
4597                 return false;
4598
4599         /* End time is in the past, check for repetitions */
4600         skip = DIV_ROUND_UP(-end, data->desc[i].interval);
4601         if (data->count[i] < 255) {
4602                 if (data->count[i] <= skip) {
4603                         data->count[i] = 0;
4604                         return false;
4605                 }
4606
4607                 data->count[i] -= skip;
4608         }
4609
4610         data->desc[i].start += skip * data->desc[i].interval;
4611
4612         return true;
4613 }
4614
4615 static bool
4616 ieee80211_extend_absent_time(struct ieee80211_noa_data *data, u32 tsf,
4617                              s32 *offset)
4618 {
4619         bool ret = false;
4620         int i;
4621
4622         for (i = 0; i < IEEE80211_P2P_NOA_DESC_MAX; i++) {
4623                 s32 cur;
4624
4625                 if (!data->count[i])
4626                         continue;
4627
4628                 if (ieee80211_extend_noa_desc(data, tsf + *offset, i))
4629                         ret = true;
4630
4631                 cur = data->desc[i].start - tsf;
4632                 if (cur > *offset)
4633                         continue;
4634
4635                 cur = data->desc[i].start + data->desc[i].duration - tsf;
4636                 if (cur > *offset)
4637                         *offset = cur;
4638         }
4639
4640         return ret;
4641 }
4642
4643 static u32
4644 ieee80211_get_noa_absent_time(struct ieee80211_noa_data *data, u32 tsf)
4645 {
4646         s32 offset = 0;
4647         int tries = 0;
4648         /*
4649          * arbitrary limit, used to avoid infinite loops when combined NoA
4650          * descriptors cover the full time period.
4651          */
4652         int max_tries = 5;
4653
4654         ieee80211_extend_absent_time(data, tsf, &offset);
4655         do {
4656                 if (!ieee80211_extend_absent_time(data, tsf, &offset))
4657                         break;
4658
4659                 tries++;
4660         } while (tries < max_tries);
4661
4662         return offset;
4663 }
4664
4665 void ieee80211_update_p2p_noa(struct ieee80211_noa_data *data, u32 tsf)
4666 {
4667         u32 next_offset = BIT(31) - 1;
4668         int i;
4669
4670         data->absent = 0;
4671         data->has_next_tsf = false;
4672         for (i = 0; i < IEEE80211_P2P_NOA_DESC_MAX; i++) {
4673                 s32 start;
4674
4675                 if (!data->count[i])
4676                         continue;
4677
4678                 ieee80211_extend_noa_desc(data, tsf, i);
4679                 start = data->desc[i].start - tsf;
4680                 if (start <= 0)
4681                         data->absent |= BIT(i);
4682
4683                 if (next_offset > start)
4684                         next_offset = start;
4685
4686                 data->has_next_tsf = true;
4687         }
4688
4689         if (data->absent)
4690                 next_offset = ieee80211_get_noa_absent_time(data, tsf);
4691
4692         data->next_tsf = tsf + next_offset;
4693 }
4694 EXPORT_SYMBOL(ieee80211_update_p2p_noa);
4695
4696 int ieee80211_parse_p2p_noa(const struct ieee80211_p2p_noa_attr *attr,
4697                             struct ieee80211_noa_data *data, u32 tsf)
4698 {
4699         int ret = 0;
4700         int i;
4701
4702         memset(data, 0, sizeof(*data));
4703
4704         for (i = 0; i < IEEE80211_P2P_NOA_DESC_MAX; i++) {
4705                 const struct ieee80211_p2p_noa_desc *desc = &attr->desc[i];
4706
4707                 if (!desc->count || !desc->duration)
4708                         continue;
4709
4710                 data->count[i] = desc->count;
4711                 data->desc[i].start = le32_to_cpu(desc->start_time);
4712                 data->desc[i].duration = le32_to_cpu(desc->duration);
4713                 data->desc[i].interval = le32_to_cpu(desc->interval);
4714
4715                 if (data->count[i] > 1 &&
4716                     data->desc[i].interval < data->desc[i].duration)
4717                         continue;
4718
4719                 ieee80211_extend_noa_desc(data, tsf, i);
4720                 ret++;
4721         }
4722
4723         if (ret)
4724                 ieee80211_update_p2p_noa(data, tsf);
4725
4726         return ret;
4727 }
4728 EXPORT_SYMBOL(ieee80211_parse_p2p_noa);
4729
4730 void ieee80211_recalc_dtim(struct ieee80211_local *local,
4731                            struct ieee80211_sub_if_data *sdata)
4732 {
4733         u64 tsf = drv_get_tsf(local, sdata);
4734         u64 dtim_count = 0;
4735         u16 beacon_int = sdata->vif.bss_conf.beacon_int * 1024;
4736         u8 dtim_period = sdata->vif.bss_conf.dtim_period;
4737         struct ps_data *ps;
4738         u8 bcns_from_dtim;
4739
4740         if (tsf == -1ULL || !beacon_int || !dtim_period)
4741                 return;
4742
4743         if (sdata->vif.type == NL80211_IFTYPE_AP ||
4744             sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
4745                 if (!sdata->bss)
4746                         return;
4747
4748                 ps = &sdata->bss->ps;
4749         } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
4750                 ps = &sdata->u.mesh.ps;
4751         } else {
4752                 return;
4753         }
4754
4755         /*
4756          * actually finds last dtim_count, mac80211 will update in
4757          * __beacon_add_tim().
4758          * dtim_count = dtim_period - (tsf / bcn_int) % dtim_period
4759          */
4760         do_div(tsf, beacon_int);
4761         bcns_from_dtim = do_div(tsf, dtim_period);
4762         /* just had a DTIM */
4763         if (!bcns_from_dtim)
4764                 dtim_count = 0;
4765         else
4766                 dtim_count = dtim_period - bcns_from_dtim;
4767
4768         ps->dtim_count = dtim_count;
4769 }
4770
4771 static u8 ieee80211_chanctx_radar_detect(struct ieee80211_local *local,
4772                                          struct ieee80211_chanctx *ctx)
4773 {
4774         struct ieee80211_link_data *link;
4775         u8 radar_detect = 0;
4776
4777         lockdep_assert_held(&local->chanctx_mtx);
4778
4779         if (WARN_ON(ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED))
4780                 return 0;
4781
4782         list_for_each_entry(link, &ctx->reserved_links, reserved_chanctx_list)
4783                 if (link->reserved_radar_required)
4784                         radar_detect |= BIT(link->reserved_chandef.width);
4785
4786         /*
4787          * An in-place reservation context should not have any assigned vifs
4788          * until it replaces the other context.
4789          */
4790         WARN_ON(ctx->replace_state == IEEE80211_CHANCTX_REPLACES_OTHER &&
4791                 !list_empty(&ctx->assigned_links));
4792
4793         list_for_each_entry(link, &ctx->assigned_links, assigned_chanctx_list) {
4794                 if (!link->radar_required)
4795                         continue;
4796
4797                 radar_detect |=
4798                         BIT(link->conf->chandef.width);
4799         }
4800
4801         return radar_detect;
4802 }
4803
4804 int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
4805                                  const struct cfg80211_chan_def *chandef,
4806                                  enum ieee80211_chanctx_mode chanmode,
4807                                  u8 radar_detect)
4808 {
4809         struct ieee80211_local *local = sdata->local;
4810         struct ieee80211_sub_if_data *sdata_iter;
4811         enum nl80211_iftype iftype = sdata->wdev.iftype;
4812         struct ieee80211_chanctx *ctx;
4813         int total = 1;
4814         struct iface_combination_params params = {
4815                 .radar_detect = radar_detect,
4816         };
4817
4818         lockdep_assert_held(&local->chanctx_mtx);
4819
4820         if (WARN_ON(hweight32(radar_detect) > 1))
4821                 return -EINVAL;
4822
4823         if (WARN_ON(chandef && chanmode == IEEE80211_CHANCTX_SHARED &&
4824                     !chandef->chan))
4825                 return -EINVAL;
4826
4827         if (WARN_ON(iftype >= NUM_NL80211_IFTYPES))
4828                 return -EINVAL;
4829
4830         if (sdata->vif.type == NL80211_IFTYPE_AP ||
4831             sdata->vif.type == NL80211_IFTYPE_MESH_POINT) {
4832                 /*
4833                  * always passing this is harmless, since it'll be the
4834                  * same value that cfg80211 finds if it finds the same
4835                  * interface ... and that's always allowed
4836                  */
4837                 params.new_beacon_int = sdata->vif.bss_conf.beacon_int;
4838         }
4839
4840         /* Always allow software iftypes */
4841         if (cfg80211_iftype_allowed(local->hw.wiphy, iftype, 0, 1)) {
4842                 if (radar_detect)
4843                         return -EINVAL;
4844                 return 0;
4845         }
4846
4847         if (chandef)
4848                 params.num_different_channels = 1;
4849
4850         if (iftype != NL80211_IFTYPE_UNSPECIFIED)
4851                 params.iftype_num[iftype] = 1;
4852
4853         list_for_each_entry(ctx, &local->chanctx_list, list) {
4854                 if (ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
4855                         continue;
4856                 params.radar_detect |=
4857                         ieee80211_chanctx_radar_detect(local, ctx);
4858                 if (ctx->mode == IEEE80211_CHANCTX_EXCLUSIVE) {
4859                         params.num_different_channels++;
4860                         continue;
4861                 }
4862                 if (chandef && chanmode == IEEE80211_CHANCTX_SHARED &&
4863                     cfg80211_chandef_compatible(chandef,
4864                                                 &ctx->conf.def))
4865                         continue;
4866                 params.num_different_channels++;
4867         }
4868
4869         list_for_each_entry_rcu(sdata_iter, &local->interfaces, list) {
4870                 struct wireless_dev *wdev_iter;
4871
4872                 wdev_iter = &sdata_iter->wdev;
4873
4874                 if (sdata_iter == sdata ||
4875                     !ieee80211_sdata_running(sdata_iter) ||
4876                     cfg80211_iftype_allowed(local->hw.wiphy,
4877                                             wdev_iter->iftype, 0, 1))
4878                         continue;
4879
4880                 params.iftype_num[wdev_iter->iftype]++;
4881                 total++;
4882         }
4883
4884         if (total == 1 && !params.radar_detect)
4885                 return 0;
4886
4887         return cfg80211_check_combinations(local->hw.wiphy, &params);
4888 }
4889
4890 static void
4891 ieee80211_iter_max_chans(const struct ieee80211_iface_combination *c,
4892                          void *data)
4893 {
4894         u32 *max_num_different_channels = data;
4895
4896         *max_num_different_channels = max(*max_num_different_channels,
4897                                           c->num_different_channels);
4898 }
4899
4900 int ieee80211_max_num_channels(struct ieee80211_local *local)
4901 {
4902         struct ieee80211_sub_if_data *sdata;
4903         struct ieee80211_chanctx *ctx;
4904         u32 max_num_different_channels = 1;
4905         int err;
4906         struct iface_combination_params params = {0};
4907
4908         lockdep_assert_held(&local->chanctx_mtx);
4909
4910         list_for_each_entry(ctx, &local->chanctx_list, list) {
4911                 if (ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
4912                         continue;
4913
4914                 params.num_different_channels++;
4915
4916                 params.radar_detect |=
4917                         ieee80211_chanctx_radar_detect(local, ctx);
4918         }
4919
4920         list_for_each_entry_rcu(sdata, &local->interfaces, list)
4921                 params.iftype_num[sdata->wdev.iftype]++;
4922
4923         err = cfg80211_iter_combinations(local->hw.wiphy, &params,
4924                                          ieee80211_iter_max_chans,
4925                                          &max_num_different_channels);
4926         if (err < 0)
4927                 return err;
4928
4929         return max_num_different_channels;
4930 }
4931
4932 void ieee80211_add_s1g_capab_ie(struct ieee80211_sub_if_data *sdata,
4933                                 struct ieee80211_sta_s1g_cap *caps,
4934                                 struct sk_buff *skb)
4935 {
4936         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4937         struct ieee80211_s1g_cap s1g_capab;
4938         u8 *pos;
4939         int i;
4940
4941         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
4942                 return;
4943
4944         if (!caps->s1g)
4945                 return;
4946
4947         memcpy(s1g_capab.capab_info, caps->cap, sizeof(caps->cap));
4948         memcpy(s1g_capab.supp_mcs_nss, caps->nss_mcs, sizeof(caps->nss_mcs));
4949
4950         /* override the capability info */
4951         for (i = 0; i < sizeof(ifmgd->s1g_capa.capab_info); i++) {
4952                 u8 mask = ifmgd->s1g_capa_mask.capab_info[i];
4953
4954                 s1g_capab.capab_info[i] &= ~mask;
4955                 s1g_capab.capab_info[i] |= ifmgd->s1g_capa.capab_info[i] & mask;
4956         }
4957
4958         /* then MCS and NSS set */
4959         for (i = 0; i < sizeof(ifmgd->s1g_capa.supp_mcs_nss); i++) {
4960                 u8 mask = ifmgd->s1g_capa_mask.supp_mcs_nss[i];
4961
4962                 s1g_capab.supp_mcs_nss[i] &= ~mask;
4963                 s1g_capab.supp_mcs_nss[i] |=
4964                         ifmgd->s1g_capa.supp_mcs_nss[i] & mask;
4965         }
4966
4967         pos = skb_put(skb, 2 + sizeof(s1g_capab));
4968         *pos++ = WLAN_EID_S1G_CAPABILITIES;
4969         *pos++ = sizeof(s1g_capab);
4970
4971         memcpy(pos, &s1g_capab, sizeof(s1g_capab));
4972 }
4973
4974 void ieee80211_add_aid_request_ie(struct ieee80211_sub_if_data *sdata,
4975                                   struct sk_buff *skb)
4976 {
4977         u8 *pos = skb_put(skb, 3);
4978
4979         *pos++ = WLAN_EID_AID_REQUEST;
4980         *pos++ = 1;
4981         *pos++ = 0;
4982 }
4983
4984 u8 *ieee80211_add_wmm_info_ie(u8 *buf, u8 qosinfo)
4985 {
4986         *buf++ = WLAN_EID_VENDOR_SPECIFIC;
4987         *buf++ = 7; /* len */
4988         *buf++ = 0x00; /* Microsoft OUI 00:50:F2 */
4989         *buf++ = 0x50;
4990         *buf++ = 0xf2;
4991         *buf++ = 2; /* WME */
4992         *buf++ = 0; /* WME info */
4993         *buf++ = 1; /* WME ver */
4994         *buf++ = qosinfo; /* U-APSD no in use */
4995
4996         return buf;
4997 }
4998
4999 void ieee80211_txq_get_depth(struct ieee80211_txq *txq,
5000                              unsigned long *frame_cnt,
5001                              unsigned long *byte_cnt)
5002 {
5003         struct txq_info *txqi = to_txq_info(txq);
5004         u32 frag_cnt = 0, frag_bytes = 0;
5005         struct sk_buff *skb;
5006
5007         skb_queue_walk(&txqi->frags, skb) {
5008                 frag_cnt++;
5009                 frag_bytes += skb->len;
5010         }
5011
5012         if (frame_cnt)
5013                 *frame_cnt = txqi->tin.backlog_packets + frag_cnt;
5014
5015         if (byte_cnt)
5016                 *byte_cnt = txqi->tin.backlog_bytes + frag_bytes;
5017 }
5018 EXPORT_SYMBOL(ieee80211_txq_get_depth);
5019
5020 const u8 ieee80211_ac_to_qos_mask[IEEE80211_NUM_ACS] = {
5021         IEEE80211_WMM_IE_STA_QOSINFO_AC_VO,
5022         IEEE80211_WMM_IE_STA_QOSINFO_AC_VI,
5023         IEEE80211_WMM_IE_STA_QOSINFO_AC_BE,
5024         IEEE80211_WMM_IE_STA_QOSINFO_AC_BK
5025 };
5026
5027 u16 ieee80211_encode_usf(int listen_interval)
5028 {
5029         static const int listen_int_usf[] = { 1, 10, 1000, 10000 };
5030         u16 ui, usf = 0;
5031
5032         /* find greatest USF */
5033         while (usf < IEEE80211_MAX_USF) {
5034                 if (listen_interval % listen_int_usf[usf + 1])
5035                         break;
5036                 usf += 1;
5037         }
5038         ui = listen_interval / listen_int_usf[usf];
5039
5040         /* error if there is a remainder. Should've been checked by user */
5041         WARN_ON_ONCE(ui > IEEE80211_MAX_UI);
5042         listen_interval = FIELD_PREP(LISTEN_INT_USF, usf) |
5043                           FIELD_PREP(LISTEN_INT_UI, ui);
5044
5045         return (u16) listen_interval;
5046 }
5047
5048 u8 ieee80211_ie_len_eht_cap(struct ieee80211_sub_if_data *sdata, u8 iftype)
5049 {
5050         const struct ieee80211_sta_he_cap *he_cap;
5051         const struct ieee80211_sta_eht_cap *eht_cap;
5052         struct ieee80211_supported_band *sband;
5053         bool is_ap;
5054         u8 n;
5055
5056         sband = ieee80211_get_sband(sdata);
5057         if (!sband)
5058                 return 0;
5059
5060         he_cap = ieee80211_get_he_iftype_cap(sband, iftype);
5061         eht_cap = ieee80211_get_eht_iftype_cap(sband, iftype);
5062         if (!he_cap || !eht_cap)
5063                 return 0;
5064
5065         is_ap = iftype == NL80211_IFTYPE_AP ||
5066                 iftype == NL80211_IFTYPE_P2P_GO;
5067
5068         n = ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
5069                                        &eht_cap->eht_cap_elem,
5070                                        is_ap);
5071         return 2 + 1 +
5072                sizeof(eht_cap->eht_cap_elem) + n +
5073                ieee80211_eht_ppe_size(eht_cap->eht_ppe_thres[0],
5074                                       eht_cap->eht_cap_elem.phy_cap_info);
5075         return 0;
5076 }
5077
5078 u8 *ieee80211_ie_build_eht_cap(u8 *pos,
5079                                const struct ieee80211_sta_he_cap *he_cap,
5080                                const struct ieee80211_sta_eht_cap *eht_cap,
5081                                u8 *end,
5082                                bool for_ap)
5083 {
5084         u8 mcs_nss_len, ppet_len;
5085         u8 ie_len;
5086         u8 *orig_pos = pos;
5087
5088         /* Make sure we have place for the IE */
5089         if (!he_cap || !eht_cap)
5090                 return orig_pos;
5091
5092         mcs_nss_len = ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
5093                                                  &eht_cap->eht_cap_elem,
5094                                                  for_ap);
5095         ppet_len = ieee80211_eht_ppe_size(eht_cap->eht_ppe_thres[0],
5096                                           eht_cap->eht_cap_elem.phy_cap_info);
5097
5098         ie_len = 2 + 1 + sizeof(eht_cap->eht_cap_elem) + mcs_nss_len + ppet_len;
5099         if ((end - pos) < ie_len)
5100                 return orig_pos;
5101
5102         *pos++ = WLAN_EID_EXTENSION;
5103         *pos++ = ie_len - 2;
5104         *pos++ = WLAN_EID_EXT_EHT_CAPABILITY;
5105
5106         /* Fixed data */
5107         memcpy(pos, &eht_cap->eht_cap_elem, sizeof(eht_cap->eht_cap_elem));
5108         pos += sizeof(eht_cap->eht_cap_elem);
5109
5110         memcpy(pos, &eht_cap->eht_mcs_nss_supp, mcs_nss_len);
5111         pos += mcs_nss_len;
5112
5113         if (ppet_len) {
5114                 memcpy(pos, &eht_cap->eht_ppe_thres, ppet_len);
5115                 pos += ppet_len;
5116         }
5117
5118         return pos;
5119 }
5120
5121 void ieee80211_fragment_element(struct sk_buff *skb, u8 *len_pos, u8 frag_id)
5122 {
5123         unsigned int elem_len;
5124
5125         if (!len_pos)
5126                 return;
5127
5128         elem_len = skb->data + skb->len - len_pos - 1;
5129
5130         while (elem_len > 255) {
5131                 /* this one is 255 */
5132                 *len_pos = 255;
5133                 /* remaining data gets smaller */
5134                 elem_len -= 255;
5135                 /* make space for the fragment ID/len in SKB */
5136                 skb_put(skb, 2);
5137                 /* shift back the remaining data to place fragment ID/len */
5138                 memmove(len_pos + 255 + 3, len_pos + 255 + 1, elem_len);
5139                 /* place the fragment ID */
5140                 len_pos += 255 + 1;
5141                 *len_pos = frag_id;
5142                 /* and point to fragment length to update later */
5143                 len_pos++;
5144         }
5145
5146         *len_pos = elem_len;
5147 }