reg.c

   1/*
   2 * Copyright 2002-2005, Instant802 Networks, Inc.
   3 * Copyright 2005-2006, Devicescape Software, Inc.
   4 * Copyright 2007	Johannes Berg <johannes@sipsolutions.net>
   5 * Copyright 2008-2011	Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
   6 * Copyright 2013-2014  Intel Mobile Communications GmbH
   7 * Copyright      2017  Intel Deutschland GmbH
   8 * Copyright (C) 2018 - 2025 Intel Corporation
   9 *
  10 * Permission to use, copy, modify, and/or distribute this software for any
  11 * purpose with or without fee is hereby granted, provided that the above
  12 * copyright notice and this permission notice appear in all copies.
  13 *
  14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  21 */
  22
  23
  24/**
  25 * DOC: Wireless regulatory infrastructure
  26 *
  27 * The usual implementation is for a driver to read a device EEPROM to
  28 * determine which regulatory domain it should be operating under, then
  29 * looking up the allowable channels in a driver-local table and finally
  30 * registering those channels in the wiphy structure.
  31 *
  32 * Another set of compliance enforcement is for drivers to use their
  33 * own compliance limits which can be stored on the EEPROM. The host
  34 * driver or firmware may ensure these are used.
  35 *
  36 * In addition to all this we provide an extra layer of regulatory
  37 * conformance. For drivers which do not have any regulatory
  38 * information CRDA provides the complete regulatory solution.
  39 * For others it provides a community effort on further restrictions
  40 * to enhance compliance.
  41 *
  42 * Note: When number of rules --> infinity we will not be able to
  43 * index on alpha2 any more, instead we'll probably have to
  44 * rely on some SHA1 checksum of the regdomain for example.
  45 *
  46 */
  47
  48#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  49
  50#include <linux/kernel.h>
  51#include <linux/export.h>
  52#include <linux/slab.h>
  53#include <linux/list.h>
  54#include <linux/ctype.h>
  55#include <linux/nl80211.h>
  56#include <linux/device/faux.h>
  57#include <linux/verification.h>
  58#include <linux/moduleparam.h>
  59#include <linux/firmware.h>
  60#include <linux/units.h>
  61
  62#include <net/cfg80211.h>
  63#include "core.h"
  64#include "reg.h"
  65#include "rdev-ops.h"
  66#include "nl80211.h"
  67
  68/*
  69 * Grace period we give before making sure all current interfaces reside on
  70 * channels allowed by the current regulatory domain.
  71 */
  72#define REG_ENFORCE_GRACE_MS 60000
  73
  74/**
  75 * enum reg_request_treatment - regulatory request treatment
  76 *
  77 * @REG_REQ_OK: continue processing the regulatory request
  78 * @REG_REQ_IGNORE: ignore the regulatory request
  79 * @REG_REQ_INTERSECT: the regulatory domain resulting from this request should
  80 *	be intersected with the current one.
  81 * @REG_REQ_ALREADY_SET: the regulatory request will not change the current
  82 *	regulatory settings, and no further processing is required.
  83 */
  84enum reg_request_treatment {
  85	REG_REQ_OK,
  86	REG_REQ_IGNORE,
  87	REG_REQ_INTERSECT,
  88	REG_REQ_ALREADY_SET,
  89};
  90
  91static struct regulatory_request core_request_world = {
  92	.initiator = NL80211_REGDOM_SET_BY_CORE,
  93	.alpha2[0] = '0',
  94	.alpha2[1] = '0',
  95	.intersect = false,
  96	.processed = true,
  97	.country_ie_env = ENVIRON_ANY,
  98};
  99
 100/*
 101 * Receipt of information from last regulatory request,
 102 * protected by RTNL (and can be accessed with RCU protection)
 103 */
 104static struct regulatory_request __rcu *last_request =
 105	(void __force __rcu *)&core_request_world;
 106
 107/* To trigger userspace events and load firmware */
 108static struct faux_device *reg_fdev;
 109
 110/*
 111 * Central wireless core regulatory domains, we only need two,
 112 * the current one and a world regulatory domain in case we have no
 113 * information to give us an alpha2.
 114 * (protected by RTNL, can be read under RCU)
 115 */
 116const struct ieee80211_regdomain __rcu *cfg80211_regdomain;
 117
 118/*
 119 * Number of devices that registered to the core
 120 * that support cellular base station regulatory hints
 121 * (protected by RTNL)
 122 */
 123static int reg_num_devs_support_basehint;
 124
 125/*
 126 * State variable indicating if the platform on which the devices
 127 * are attached is operating in an indoor environment. The state variable
 128 * is relevant for all registered devices.
 129 */
 130static bool reg_is_indoor;
 131static DEFINE_SPINLOCK(reg_indoor_lock);
 132
 133/* Used to track the userspace process controlling the indoor setting */
 134static u32 reg_is_indoor_portid;
 135
 136static void restore_regulatory_settings(bool reset_user, bool cached);
 137static void print_regdomain(const struct ieee80211_regdomain *rd);
 138static void reg_process_hint(struct regulatory_request *reg_request);
 139
 140static const struct ieee80211_regdomain *get_cfg80211_regdom(void)
 141{
 142	return rcu_dereference_rtnl(cfg80211_regdomain);
 143}
 144
 145/*
 146 * Returns the regulatory domain associated with the wiphy.
 147 *
 148 * Requires any of RTNL, wiphy mutex or RCU protection.
 149 */
 150const struct ieee80211_regdomain *get_wiphy_regdom(struct wiphy *wiphy)
 151{
 152	return rcu_dereference_check(wiphy->regd,
 153				     lockdep_is_held(&wiphy->mtx) ||
 154				     lockdep_rtnl_is_held());
 155}
 156EXPORT_SYMBOL(get_wiphy_regdom);
 157
 158static const char *reg_dfs_region_str(enum nl80211_dfs_regions dfs_region)
 159{
 160	switch (dfs_region) {
 161	case NL80211_DFS_UNSET:
 162		return "unset";
 163	case NL80211_DFS_FCC:
 164		return "FCC";
 165	case NL80211_DFS_ETSI:
 166		return "ETSI";
 167	case NL80211_DFS_JP:
 168		return "JP";
 169	}
 170	return "Unknown";
 171}
 172
 173enum nl80211_dfs_regions reg_get_dfs_region(struct wiphy *wiphy)
 174{
 175	const struct ieee80211_regdomain *regd = NULL;
 176	const struct ieee80211_regdomain *wiphy_regd = NULL;
 177	enum nl80211_dfs_regions dfs_region;
 178
 179	rcu_read_lock();
 180	regd = get_cfg80211_regdom();
 181	dfs_region = regd->dfs_region;
 182
 183	if (!wiphy)
 184		goto out;
 185
 186	wiphy_regd = get_wiphy_regdom(wiphy);
 187	if (!wiphy_regd)
 188		goto out;
 189
 190	if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED) {
 191		dfs_region = wiphy_regd->dfs_region;
 192		goto out;
 193	}
 194
 195	if (wiphy_regd->dfs_region == regd->dfs_region)
 196		goto out;
 197
 198	pr_debug("%s: device specific dfs_region (%s) disagrees with cfg80211's central dfs_region (%s)\n",
 199		 dev_name(&wiphy->dev),
 200		 reg_dfs_region_str(wiphy_regd->dfs_region),
 201		 reg_dfs_region_str(regd->dfs_region));
 202
 203out:
 204	rcu_read_unlock();
 205
 206	return dfs_region;
 207}
 208
 209static void rcu_free_regdom(const struct ieee80211_regdomain *r)
 210{
 211	if (!r)
 212		return;
 213	kfree_rcu((struct ieee80211_regdomain *)r, rcu_head);
 214}
 215
 216static struct regulatory_request *get_last_request(void)
 217{
 218	return rcu_dereference_rtnl(last_request);
 219}
 220
 221/* Used to queue up regulatory hints */
 222static LIST_HEAD(reg_requests_list);
 223static DEFINE_SPINLOCK(reg_requests_lock);
 224
 225/* Used to queue up beacon hints for review */
 226static LIST_HEAD(reg_pending_beacons);
 227static DEFINE_SPINLOCK(reg_pending_beacons_lock);
 228
 229/* Used to keep track of processed beacon hints */
 230static LIST_HEAD(reg_beacon_list);
 231
 232struct reg_beacon {
 233	struct list_head list;
 234	struct ieee80211_channel chan;
 235};
 236
 237static void reg_check_chans_work(struct work_struct *work);
 238static DECLARE_DELAYED_WORK(reg_check_chans, reg_check_chans_work);
 239
 240static void reg_todo(struct work_struct *work);
 241static DECLARE_WORK(reg_work, reg_todo);
 242
 243/* We keep a static world regulatory domain in case of the absence of CRDA */
 244static const struct ieee80211_regdomain world_regdom = {
 245	.n_reg_rules = 8,
 246	.alpha2 =  "00",
 247	.reg_rules = {
 248		/* IEEE 802.11b/g, channels 1..11 */
 249		REG_RULE(2412-10, 2462+10, 40, 6, 20, 0),
 250		/* IEEE 802.11b/g, channels 12..13. */
 251		REG_RULE(2467-10, 2472+10, 20, 6, 20,
 252			NL80211_RRF_NO_IR | NL80211_RRF_AUTO_BW),
 253		/* IEEE 802.11 channel 14 - Only JP enables
 254		 * this and for 802.11b only */
 255		REG_RULE(2484-10, 2484+10, 20, 6, 20,
 256			NL80211_RRF_NO_IR |
 257			NL80211_RRF_NO_OFDM),
 258		/* IEEE 802.11a, channel 36..48 */
 259		REG_RULE(5180-10, 5240+10, 80, 6, 20,
 260                        NL80211_RRF_NO_IR |
 261                        NL80211_RRF_AUTO_BW),
 262
 263		/* IEEE 802.11a, channel 52..64 - DFS required */
 264		REG_RULE(5260-10, 5320+10, 80, 6, 20,
 265			NL80211_RRF_NO_IR |
 266			NL80211_RRF_AUTO_BW |
 267			NL80211_RRF_DFS),
 268
 269		/* IEEE 802.11a, channel 100..144 - DFS required */
 270		REG_RULE(5500-10, 5720+10, 160, 6, 20,
 271			NL80211_RRF_NO_IR |
 272			NL80211_RRF_DFS),
 273
 274		/* IEEE 802.11a, channel 149..165 */
 275		REG_RULE(5745-10, 5825+10, 80, 6, 20,
 276			NL80211_RRF_NO_IR),
 277
 278		/* IEEE 802.11ad (60GHz), channels 1..3 */
 279		REG_RULE(56160+2160*1-1080, 56160+2160*3+1080, 2160, 0, 0, 0),
 280	}
 281};
 282
 283/* protected by RTNL */
 284static const struct ieee80211_regdomain *cfg80211_world_regdom =
 285	&world_regdom;
 286
 287static char *ieee80211_regdom = "00";
 288static char user_alpha2[2];
 289static const struct ieee80211_regdomain *cfg80211_user_regdom;
 290
 291module_param(ieee80211_regdom, charp, 0444);
 292MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
 293
 294static void reg_free_request(struct regulatory_request *request)
 295{
 296	if (request == &core_request_world)
 297		return;
 298
 299	if (request != get_last_request())
 300		kfree(request);
 301}
 302
 303static void reg_free_last_request(void)
 304{
 305	struct regulatory_request *lr = get_last_request();
 306
 307	if (lr != &core_request_world && lr)
 308		kfree_rcu(lr, rcu_head);
 309}
 310
 311static void reg_update_last_request(struct regulatory_request *request)
 312{
 313	struct regulatory_request *lr;
 314
 315	lr = get_last_request();
 316	if (lr == request)
 317		return;
 318
 319	reg_free_last_request();
 320	rcu_assign_pointer(last_request, request);
 321}
 322
 323static void reset_regdomains(bool full_reset,
 324			     const struct ieee80211_regdomain *new_regdom)
 325{
 326	const struct ieee80211_regdomain *r;
 327
 328	ASSERT_RTNL();
 329
 330	r = get_cfg80211_regdom();
 331
 332	/* avoid freeing static information or freeing something twice */
 333	if (r == cfg80211_world_regdom)
 334		r = NULL;
 335	if (cfg80211_world_regdom == &world_regdom)
 336		cfg80211_world_regdom = NULL;
 337	if (r == &world_regdom)
 338		r = NULL;
 339
 340	rcu_free_regdom(r);
 341	rcu_free_regdom(cfg80211_world_regdom);
 342
 343	cfg80211_world_regdom = &world_regdom;
 344	rcu_assign_pointer(cfg80211_regdomain, new_regdom);
 345
 346	if (!full_reset)
 347		return;
 348
 349	reg_update_last_request(&core_request_world);
 350}
 351
 352/*
 353 * Dynamic world regulatory domain requested by the wireless
 354 * core upon initialization
 355 */
 356static void update_world_regdomain(const struct ieee80211_regdomain *rd)
 357{
 358	struct regulatory_request *lr;
 359
 360	lr = get_last_request();
 361
 362	WARN_ON(!lr);
 363
 364	reset_regdomains(false, rd);
 365
 366	cfg80211_world_regdom = rd;
 367}
 368
 369bool is_world_regdom(const char *alpha2)
 370{
 371	if (!alpha2)
 372		return false;
 373	return alpha2[0] == '0' && alpha2[1] == '0';
 374}
 375
 376static bool is_alpha2_set(const char *alpha2)
 377{
 378	if (!alpha2)
 379		return false;
 380	return alpha2[0] && alpha2[1];
 381}
 382
 383static bool is_unknown_alpha2(const char *alpha2)
 384{
 385	if (!alpha2)
 386		return false;
 387	/*
 388	 * Special case where regulatory domain was built by driver
 389	 * but a specific alpha2 cannot be determined
 390	 */
 391	return alpha2[0] == '9' && alpha2[1] == '9';
 392}
 393
 394static bool is_intersected_alpha2(const char *alpha2)
 395{
 396	if (!alpha2)
 397		return false;
 398	/*
 399	 * Special case where regulatory domain is the
 400	 * result of an intersection between two regulatory domain
 401	 * structures
 402	 */
 403	return alpha2[0] == '9' && alpha2[1] == '8';
 404}
 405
 406static bool is_an_alpha2(const char *alpha2)
 407{
 408	if (!alpha2)
 409		return false;
 410	return isascii(alpha2[0]) && isalpha(alpha2[0]) &&
 411	       isascii(alpha2[1]) && isalpha(alpha2[1]);
 412}
 413
 414static bool alpha2_equal(const char *alpha2_x, const char *alpha2_y)
 415{
 416	if (!alpha2_x || !alpha2_y)
 417		return false;
 418	return alpha2_x[0] == alpha2_y[0] && alpha2_x[1] == alpha2_y[1];
 419}
 420
 421static bool regdom_changes(const char *alpha2)
 422{
 423	const struct ieee80211_regdomain *r = get_cfg80211_regdom();
 424
 425	if (!r)
 426		return true;
 427	return !alpha2_equal(r->alpha2, alpha2);
 428}
 429
 430/*
 431 * The NL80211_REGDOM_SET_BY_USER regdom alpha2 is cached, this lets
 432 * you know if a valid regulatory hint with NL80211_REGDOM_SET_BY_USER
 433 * has ever been issued.
 434 */
 435static bool is_user_regdom_saved(void)
 436{
 437	if (user_alpha2[0] == '9' && user_alpha2[1] == '7')
 438		return false;
 439
 440	/* This would indicate a mistake on the design */
 441	if (WARN(!is_world_regdom(user_alpha2) && !is_an_alpha2(user_alpha2),
 442		 "Unexpected user alpha2: %c%c\n",
 443		 user_alpha2[0], user_alpha2[1]))
 444		return false;
 445
 446	return true;
 447}
 448
 449static const struct ieee80211_regdomain *
 450reg_copy_regd(const struct ieee80211_regdomain *src_regd)
 451{
 452	struct ieee80211_regdomain *regd;
 453	unsigned int i;
 454
 455	regd = kzalloc(struct_size(regd, reg_rules, src_regd->n_reg_rules),
 456		       GFP_KERNEL);
 457	if (!regd)
 458		return ERR_PTR(-ENOMEM);
 459
 460	memcpy(regd, src_regd, sizeof(struct ieee80211_regdomain));
 461
 462	for (i = 0; i < src_regd->n_reg_rules; i++)
 463		memcpy(&regd->reg_rules[i], &src_regd->reg_rules[i],
 464		       sizeof(struct ieee80211_reg_rule));
 465
 466	return regd;
 467}
 468
 469static void cfg80211_save_user_regdom(const struct ieee80211_regdomain *rd)
 470{
 471	ASSERT_RTNL();
 472
 473	if (!IS_ERR(cfg80211_user_regdom))
 474		kfree(cfg80211_user_regdom);
 475	cfg80211_user_regdom = reg_copy_regd(rd);
 476}
 477
 478struct reg_regdb_apply_request {
 479	struct list_head list;
 480	const struct ieee80211_regdomain *regdom;
 481};
 482
 483static LIST_HEAD(reg_regdb_apply_list);
 484static DEFINE_MUTEX(reg_regdb_apply_mutex);
 485
 486static void reg_regdb_apply(struct work_struct *work)
 487{
 488	struct reg_regdb_apply_request *request;
 489
 490	rtnl_lock();
 491
 492	mutex_lock(&reg_regdb_apply_mutex);
 493	while (!list_empty(&reg_regdb_apply_list)) {
 494		request = list_first_entry(&reg_regdb_apply_list,
 495					   struct reg_regdb_apply_request,
 496					   list);
 497		list_del(&request->list);
 498
 499		set_regdom(request->regdom, REGD_SOURCE_INTERNAL_DB);
 500		kfree(request);
 501	}
 502	mutex_unlock(&reg_regdb_apply_mutex);
 503
 504	rtnl_unlock();
 505}
 506
 507static DECLARE_WORK(reg_regdb_work, reg_regdb_apply);
 508
 509static int reg_schedule_apply(const struct ieee80211_regdomain *regdom)
 510{
 511	struct reg_regdb_apply_request *request;
 512
 513	request = kzalloc(sizeof(struct reg_regdb_apply_request), GFP_KERNEL);
 514	if (!request) {
 515		kfree(regdom);
 516		return -ENOMEM;
 517	}
 518
 519	request->regdom = regdom;
 520
 521	mutex_lock(&reg_regdb_apply_mutex);
 522	list_add_tail(&request->list, &reg_regdb_apply_list);
 523	mutex_unlock(&reg_regdb_apply_mutex);
 524
 525	schedule_work(&reg_regdb_work);
 526	return 0;
 527}
 528
 529#ifdef CONFIG_CFG80211_CRDA_SUPPORT
 530/* Max number of consecutive attempts to communicate with CRDA  */
 531#define REG_MAX_CRDA_TIMEOUTS 10
 532
 533static u32 reg_crda_timeouts;
 534
 535static void crda_timeout_work(struct work_struct *work);
 536static DECLARE_DELAYED_WORK(crda_timeout, crda_timeout_work);
 537
 538static void crda_timeout_work(struct work_struct *work)
 539{
 540	pr_debug("Timeout while waiting for CRDA to reply, restoring regulatory settings\n");
 541	rtnl_lock();
 542	reg_crda_timeouts++;
 543	restore_regulatory_settings(true, false);
 544	rtnl_unlock();
 545}
 546
 547static void cancel_crda_timeout(void)
 548{
 549	cancel_delayed_work(&crda_timeout);
 550}
 551
 552static void cancel_crda_timeout_sync(void)
 553{
 554	cancel_delayed_work_sync(&crda_timeout);
 555}
 556
 557static void reset_crda_timeouts(void)
 558{
 559	reg_crda_timeouts = 0;
 560}
 561
 562/*
 563 * This lets us keep regulatory code which is updated on a regulatory
 564 * basis in userspace.
 565 */
 566static int call_crda(const char *alpha2)
 567{
 568	char country[12];
 569	char *env[] = { country, NULL };
 570	int ret;
 571
 572	snprintf(country, sizeof(country), "COUNTRY=%c%c",
 573		 alpha2[0], alpha2[1]);
 574
 575	if (reg_crda_timeouts > REG_MAX_CRDA_TIMEOUTS) {
 576		pr_debug("Exceeded CRDA call max attempts. Not calling CRDA\n");
 577		return -EINVAL;
 578	}
 579
 580	if (!is_world_regdom((char *) alpha2))
 581		pr_debug("Calling CRDA for country: %c%c\n",
 582			 alpha2[0], alpha2[1]);
 583	else
 584		pr_debug("Calling CRDA to update world regulatory domain\n");
 585
 586	ret = kobject_uevent_env(&reg_fdev->dev.kobj, KOBJ_CHANGE, env);
 587	if (ret)
 588		return ret;
 589
 590	queue_delayed_work(system_power_efficient_wq,
 591			   &crda_timeout, msecs_to_jiffies(3142));
 592	return 0;
 593}
 594#else
 595static inline void cancel_crda_timeout(void) {}
 596static inline void cancel_crda_timeout_sync(void) {}
 597static inline void reset_crda_timeouts(void) {}
 598static inline int call_crda(const char *alpha2)
 599{
 600	return -ENODATA;
 601}
 602#endif /* CONFIG_CFG80211_CRDA_SUPPORT */
 603
 604/* code to directly load a firmware database through request_firmware */
 605static const struct fwdb_header *regdb;
 606
 607struct fwdb_country {
 608	u8 alpha2[2];
 609	__be16 coll_ptr;
 610	/* this struct cannot be extended */
 611} __packed __aligned(4);
 612
 613struct fwdb_collection {
 614	u8 len;
 615	u8 n_rules;
 616	u8 dfs_region;
 617	/* no optional data yet */
 618	/* aligned to 2, then followed by __be16 array of rule pointers */
 619} __packed __aligned(4);
 620
 621enum fwdb_flags {
 622	FWDB_FLAG_NO_OFDM	= BIT(0),
 623	FWDB_FLAG_NO_OUTDOOR	= BIT(1),
 624	FWDB_FLAG_DFS		= BIT(2),
 625	FWDB_FLAG_NO_IR		= BIT(3),
 626	FWDB_FLAG_AUTO_BW	= BIT(4),
 627};
 628
 629struct fwdb_wmm_ac {
 630	u8 ecw;
 631	u8 aifsn;
 632	__be16 cot;
 633} __packed;
 634
 635struct fwdb_wmm_rule {
 636	struct fwdb_wmm_ac client[IEEE80211_NUM_ACS];
 637	struct fwdb_wmm_ac ap[IEEE80211_NUM_ACS];
 638} __packed;
 639
 640struct fwdb_rule {
 641	u8 len;
 642	u8 flags;
 643	__be16 max_eirp;
 644	__be32 start, end, max_bw;
 645	/* start of optional data */
 646	__be16 cac_timeout;
 647	__be16 wmm_ptr;
 648} __packed __aligned(4);
 649
 650#define FWDB_MAGIC 0x52474442
 651#define FWDB_VERSION 20
 652
 653struct fwdb_header {
 654	__be32 magic;
 655	__be32 version;
 656	struct fwdb_country country[];
 657} __packed __aligned(4);
 658
 659static int ecw2cw(int ecw)
 660{
 661	return (1 << ecw) - 1;
 662}
 663
 664static bool valid_wmm(struct fwdb_wmm_rule *rule)
 665{
 666	struct fwdb_wmm_ac *ac = (struct fwdb_wmm_ac *)rule;
 667	int i;
 668
 669	for (i = 0; i < IEEE80211_NUM_ACS * 2; i++) {
 670		u16 cw_min = ecw2cw((ac[i].ecw & 0xf0) >> 4);
 671		u16 cw_max = ecw2cw(ac[i].ecw & 0x0f);
 672		u8 aifsn = ac[i].aifsn;
 673
 674		if (cw_min >= cw_max)
 675			return false;
 676
 677		if (aifsn < 1)
 678			return false;
 679	}
 680
 681	return true;
 682}
 683
 684static bool valid_rule(const u8 *data, unsigned int size, u16 rule_ptr)
 685{
 686	struct fwdb_rule *rule = (void *)(data + (rule_ptr << 2));
 687
 688	if ((u8 *)rule + sizeof(rule->len) > data + size)
 689		return false;
 690
 691	/* mandatory fields */
 692	if (rule->len < offsetofend(struct fwdb_rule, max_bw))
 693		return false;
 694	if (rule->len >= offsetofend(struct fwdb_rule, wmm_ptr)) {
 695		u32 wmm_ptr = be16_to_cpu(rule->wmm_ptr) << 2;
 696		struct fwdb_wmm_rule *wmm;
 697
 698		if (wmm_ptr + sizeof(struct fwdb_wmm_rule) > size)
 699			return false;
 700
 701		wmm = (void *)(data + wmm_ptr);
 702
 703		if (!valid_wmm(wmm))
 704			return false;
 705	}
 706	return true;
 707}
 708
 709static bool valid_country(const u8 *data, unsigned int size,
 710			  const struct fwdb_country *country)
 711{
 712	unsigned int ptr = be16_to_cpu(country->coll_ptr) << 2;
 713	struct fwdb_collection *coll = (void *)(data + ptr);
 714	__be16 *rules_ptr;
 715	unsigned int i;
 716
 717	/* make sure we can read len/n_rules */
 718	if ((u8 *)coll + offsetofend(typeof(*coll), n_rules) > data + size)
 719		return false;
 720
 721	/* make sure base struct and all rules fit */
 722	if ((u8 *)coll + ALIGN(coll->len, 2) +
 723	    (coll->n_rules * 2) > data + size)
 724		return false;
 725
 726	/* mandatory fields must exist */
 727	if (coll->len < offsetofend(struct fwdb_collection, dfs_region))
 728		return false;
 729
 730	rules_ptr = (void *)((u8 *)coll + ALIGN(coll->len, 2));
 731
 732	for (i = 0; i < coll->n_rules; i++) {
 733		u16 rule_ptr = be16_to_cpu(rules_ptr[i]);
 734
 735		if (!valid_rule(data, size, rule_ptr))
 736			return false;
 737	}
 738
 739	return true;
 740}
 741
 742#ifdef CONFIG_CFG80211_REQUIRE_SIGNED_REGDB
 743#include <keys/asymmetric-type.h>
 744
 745static struct key *builtin_regdb_keys;
 746
 747static int __init load_builtin_regdb_keys(void)
 748{
 749	builtin_regdb_keys =
 750		keyring_alloc(".builtin_regdb_keys",
 751			      KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
 752			      ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
 753			      KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH),
 754			      KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
 755	if (IS_ERR(builtin_regdb_keys))
 756		return PTR_ERR(builtin_regdb_keys);
 757
 758	pr_notice("Loading compiled-in X.509 certificates for regulatory database\n");
 759
 760#ifdef CONFIG_CFG80211_USE_KERNEL_REGDB_KEYS
 761	x509_load_certificate_list(shipped_regdb_certs,
 762				   shipped_regdb_certs_len,
 763				   builtin_regdb_keys);
 764#endif
 765#ifdef CONFIG_CFG80211_EXTRA_REGDB_KEYDIR
 766	if (CONFIG_CFG80211_EXTRA_REGDB_KEYDIR[0] != '\0')
 767		x509_load_certificate_list(extra_regdb_certs,
 768					   extra_regdb_certs_len,
 769					   builtin_regdb_keys);
 770#endif
 771
 772	return 0;
 773}
 774
 775MODULE_FIRMWARE("regulatory.db.p7s");
 776
 777static bool regdb_has_valid_signature(const u8 *data, unsigned int size)
 778{
 779	const struct firmware *sig;
 780	bool result;
 781
 782	if (request_firmware(&sig, "regulatory.db.p7s", &reg_fdev->dev))
 783		return false;
 784
 785	result = verify_pkcs7_signature(data, size, sig->data, sig->size,
 786					builtin_regdb_keys,
 787					VERIFYING_UNSPECIFIED_SIGNATURE,
 788					NULL, NULL) == 0;
 789
 790	release_firmware(sig);
 791
 792	return result;
 793}
 794
 795static void free_regdb_keyring(void)
 796{
 797	key_put(builtin_regdb_keys);
 798}
 799#else
 800static int load_builtin_regdb_keys(void)
 801{
 802	return 0;
 803}
 804
 805static bool regdb_has_valid_signature(const u8 *data, unsigned int size)
 806{
 807	return true;
 808}
 809
 810static void free_regdb_keyring(void)
 811{
 812}
 813#endif /* CONFIG_CFG80211_REQUIRE_SIGNED_REGDB */
 814
 815static bool valid_regdb(const u8 *data, unsigned int size)
 816{
 817	const struct fwdb_header *hdr = (void *)data;
 818	const struct fwdb_country *country;
 819
 820	if (size < sizeof(*hdr))
 821		return false;
 822
 823	if (hdr->magic != cpu_to_be32(FWDB_MAGIC))
 824		return false;
 825
 826	if (hdr->version != cpu_to_be32(FWDB_VERSION))
 827		return false;
 828
 829	if (!regdb_has_valid_signature(data, size))
 830		return false;
 831
 832	country = &hdr->country[0];
 833	while ((u8 *)(country + 1) <= data + size) {
 834		if (!country->coll_ptr)
 835			break;
 836		if (!valid_country(data, size, country))
 837			return false;
 838		country++;
 839	}
 840
 841	return true;
 842}
 843
 844static void set_wmm_rule(const struct fwdb_header *db,
 845			 const struct fwdb_country *country,
 846			 const struct fwdb_rule *rule,
 847			 struct ieee80211_reg_rule *rrule)
 848{
 849	struct ieee80211_wmm_rule *wmm_rule = &rrule->wmm_rule;
 850	struct fwdb_wmm_rule *wmm;
 851	unsigned int i, wmm_ptr;
 852
 853	wmm_ptr = be16_to_cpu(rule->wmm_ptr) << 2;
 854	wmm = (void *)((u8 *)db + wmm_ptr);
 855
 856	if (!valid_wmm(wmm)) {
 857		pr_err("Invalid regulatory WMM rule %u-%u in domain %c%c\n",
 858		       be32_to_cpu(rule->start), be32_to_cpu(rule->end),
 859		       country->alpha2[0], country->alpha2[1]);
 860		return;
 861	}
 862
 863	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
 864		wmm_rule->client[i].cw_min =
 865			ecw2cw((wmm->client[i].ecw & 0xf0) >> 4);
 866		wmm_rule->client[i].cw_max = ecw2cw(wmm->client[i].ecw & 0x0f);
 867		wmm_rule->client[i].aifsn =  wmm->client[i].aifsn;
 868		wmm_rule->client[i].cot =
 869			1000 * be16_to_cpu(wmm->client[i].cot);
 870		wmm_rule->ap[i].cw_min = ecw2cw((wmm->ap[i].ecw & 0xf0) >> 4);
 871		wmm_rule->ap[i].cw_max = ecw2cw(wmm->ap[i].ecw & 0x0f);
 872		wmm_rule->ap[i].aifsn = wmm->ap[i].aifsn;
 873		wmm_rule->ap[i].cot = 1000 * be16_to_cpu(wmm->ap[i].cot);
 874	}
 875
 876	rrule->has_wmm = true;
 877}
 878
 879static int __regdb_query_wmm(const struct fwdb_header *db,
 880			     const struct fwdb_country *country, int freq,
 881			     struct ieee80211_reg_rule *rrule)
 882{
 883	unsigned int ptr = be16_to_cpu(country->coll_ptr) << 2;
 884	struct fwdb_collection *coll = (void *)((u8 *)db + ptr);
 885	int i;
 886
 887	for (i = 0; i < coll->n_rules; i++) {
 888		__be16 *rules_ptr = (void *)((u8 *)coll + ALIGN(coll->len, 2));
 889		unsigned int rule_ptr = be16_to_cpu(rules_ptr[i]) << 2;
 890		struct fwdb_rule *rule = (void *)((u8 *)db + rule_ptr);
 891
 892		if (rule->len < offsetofend(struct fwdb_rule, wmm_ptr))
 893			continue;
 894
 895		if (freq >= KHZ_TO_MHZ(be32_to_cpu(rule->start)) &&
 896		    freq <= KHZ_TO_MHZ(be32_to_cpu(rule->end))) {
 897			set_wmm_rule(db, country, rule, rrule);
 898			return 0;
 899		}
 900	}
 901
 902	return -ENODATA;
 903}
 904
 905int reg_query_regdb_wmm(char *alpha2, int freq, struct ieee80211_reg_rule *rule)
 906{
 907	const struct fwdb_header *hdr = regdb;
 908	const struct fwdb_country *country;
 909
 910	if (!regdb)
 911		return -ENODATA;
 912
 913	if (IS_ERR(regdb))
 914		return PTR_ERR(regdb);
 915
 916	country = &hdr->country[0];
 917	while (country->coll_ptr) {
 918		if (alpha2_equal(alpha2, country->alpha2))
 919			return __regdb_query_wmm(regdb, country, freq, rule);
 920
 921		country++;
 922	}
 923
 924	return -ENODATA;
 925}
 926EXPORT_SYMBOL(reg_query_regdb_wmm);
 927
 928static int regdb_query_country(const struct fwdb_header *db,
 929			       const struct fwdb_country *country)
 930{
 931	unsigned int ptr = be16_to_cpu(country->coll_ptr) << 2;
 932	struct fwdb_collection *coll = (void *)((u8 *)db + ptr);
 933	struct ieee80211_regdomain *regdom;
 934	unsigned int i;
 935
 936	regdom = kzalloc(struct_size(regdom, reg_rules, coll->n_rules),
 937			 GFP_KERNEL);
 938	if (!regdom)
 939		return -ENOMEM;
 940
 941	regdom->n_reg_rules = coll->n_rules;
 942	regdom->alpha2[0] = country->alpha2[0];
 943	regdom->alpha2[1] = country->alpha2[1];
 944	regdom->dfs_region = coll->dfs_region;
 945
 946	for (i = 0; i < regdom->n_reg_rules; i++) {
 947		__be16 *rules_ptr = (void *)((u8 *)coll + ALIGN(coll->len, 2));
 948		unsigned int rule_ptr = be16_to_cpu(rules_ptr[i]) << 2;
 949		struct fwdb_rule *rule = (void *)((u8 *)db + rule_ptr);
 950		struct ieee80211_reg_rule *rrule = &regdom->reg_rules[i];
 951
 952		rrule->freq_range.start_freq_khz = be32_to_cpu(rule->start);
 953		rrule->freq_range.end_freq_khz = be32_to_cpu(rule->end);
 954		rrule->freq_range.max_bandwidth_khz = be32_to_cpu(rule->max_bw);
 955
 956		rrule->power_rule.max_antenna_gain = 0;
 957		rrule->power_rule.max_eirp = be16_to_cpu(rule->max_eirp);
 958
 959		rrule->flags = 0;
 960		if (rule->flags & FWDB_FLAG_NO_OFDM)
 961			rrule->flags |= NL80211_RRF_NO_OFDM;
 962		if (rule->flags & FWDB_FLAG_NO_OUTDOOR)
 963			rrule->flags |= NL80211_RRF_NO_OUTDOOR;
 964		if (rule->flags & FWDB_FLAG_DFS)
 965			rrule->flags |= NL80211_RRF_DFS;
 966		if (rule->flags & FWDB_FLAG_NO_IR)
 967			rrule->flags |= NL80211_RRF_NO_IR;
 968		if (rule->flags & FWDB_FLAG_AUTO_BW)
 969			rrule->flags |= NL80211_RRF_AUTO_BW;
 970
 971		rrule->dfs_cac_ms = 0;
 972
 973		/* handle optional data */
 974		if (rule->len >= offsetofend(struct fwdb_rule, cac_timeout))
 975			rrule->dfs_cac_ms =
 976				1000 * be16_to_cpu(rule->cac_timeout);
 977		if (rule->len >= offsetofend(struct fwdb_rule, wmm_ptr))
 978			set_wmm_rule(db, country, rule, rrule);
 979	}
 980
 981	return reg_schedule_apply(regdom);
 982}
 983
 984static int query_regdb(const char *alpha2)
 985{
 986	const struct fwdb_header *hdr = regdb;
 987	const struct fwdb_country *country;
 988
 989	ASSERT_RTNL();
 990
 991	if (IS_ERR(regdb))
 992		return PTR_ERR(regdb);
 993
 994	country = &hdr->country[0];
 995	while (country->coll_ptr) {
 996		if (alpha2_equal(alpha2, country->alpha2))
 997			return regdb_query_country(regdb, country);
 998		country++;
 999	}
1000
1001	return -ENODATA;
1002}
1003
1004static void regdb_fw_cb(const struct firmware *fw, void *context)
1005{
1006	int set_error = 0;
1007	bool restore = true;
1008	void *db;
1009
1010	if (!fw) {
1011		pr_info("failed to load regulatory.db\n");
1012		set_error = -ENODATA;
1013	} else if (!valid_regdb(fw->data, fw->size)) {
1014		pr_info("loaded regulatory.db is malformed or signature is missing/invalid\n");
1015		set_error = -EINVAL;
1016	}
1017
1018	rtnl_lock();
1019	if (regdb && !IS_ERR(regdb)) {
1020		/* negative case - a bug
1021		 * positive case - can happen due to race in case of multiple cb's in
1022		 * queue, due to usage of asynchronous callback
1023		 *
1024		 * Either case, just restore and free new db.
1025		 */
1026	} else if (set_error) {
1027		regdb = ERR_PTR(set_error);
1028	} else if (fw) {
1029		db = kmemdup(fw->data, fw->size, GFP_KERNEL);
1030		if (db) {
1031			regdb = db;
1032			restore = context && query_regdb(context);
1033		} else {
1034			restore = true;
1035		}
1036	}
1037
1038	if (restore)
1039		restore_regulatory_settings(true, false);
1040
1041	rtnl_unlock();
1042
1043	kfree(context);
1044
1045	release_firmware(fw);
1046}
1047
1048MODULE_FIRMWARE("regulatory.db");
1049
1050static int query_regdb_file(const char *alpha2)
1051{
1052	int err;
1053
1054	ASSERT_RTNL();
1055
1056	if (regdb)
1057		return query_regdb(alpha2);
1058
1059	alpha2 = kmemdup(alpha2, 2, GFP_KERNEL);
1060	if (!alpha2)
1061		return -ENOMEM;
1062
1063	err = request_firmware_nowait(THIS_MODULE, true, "regulatory.db",
1064				      &reg_fdev->dev, GFP_KERNEL,
1065				      (void *)alpha2, regdb_fw_cb);
1066	if (err)
1067		kfree(alpha2);
1068
1069	return err;
1070}
1071
1072int reg_reload_regdb(void)
1073{
1074	const struct firmware *fw;
1075	void *db;
1076	int err;
1077	const struct ieee80211_regdomain *current_regdomain;
1078	struct regulatory_request *request;
1079
1080	err = request_firmware(&fw, "regulatory.db", &reg_fdev->dev);
1081	if (err)
1082		return err;
1083
1084	if (!valid_regdb(fw->data, fw->size)) {
1085		err = -ENODATA;
1086		goto out;
1087	}
1088
1089	db = kmemdup(fw->data, fw->size, GFP_KERNEL);
1090	if (!db) {
1091		err = -ENOMEM;
1092		goto out;
1093	}
1094
1095	rtnl_lock();
1096	if (!IS_ERR_OR_NULL(regdb))
1097		kfree(regdb);
1098	regdb = db;
1099
1100	/* reset regulatory domain */
1101	current_regdomain = get_cfg80211_regdom();
1102
1103	request = kzalloc(sizeof(*request), GFP_KERNEL);
1104	if (!request) {
1105		err = -ENOMEM;
1106		goto out_unlock;
1107	}
1108
1109	request->wiphy_idx = WIPHY_IDX_INVALID;
1110	request->alpha2[0] = current_regdomain->alpha2[0];
1111	request->alpha2[1] = current_regdomain->alpha2[1];
1112	request->initiator = NL80211_REGDOM_SET_BY_CORE;
1113	request->user_reg_hint_type = NL80211_USER_REG_HINT_USER;
1114
1115	reg_process_hint(request);
1116
1117out_unlock:
1118	rtnl_unlock();
1119 out:
1120	release_firmware(fw);
1121	return err;
1122}
1123
1124static bool reg_query_database(struct regulatory_request *request)
1125{
1126	if (query_regdb_file(request->alpha2) == 0)
1127		return true;
1128
1129	if (call_crda(request->alpha2) == 0)
1130		return true;
1131
1132	return false;
1133}
1134
1135bool reg_is_valid_request(const char *alpha2)
1136{
1137	struct regulatory_request *lr = get_last_request();
1138
1139	if (!lr || lr->processed)
1140		return false;
1141
1142	return alpha2_equal(lr->alpha2, alpha2);
1143}
1144
1145static const struct ieee80211_regdomain *reg_get_regdomain(struct wiphy *wiphy)
1146{
1147	struct regulatory_request *lr = get_last_request();
1148
1149	/*
1150	 * Follow the driver's regulatory domain, if present, unless a country
1151	 * IE has been processed or a user wants to help compliance further
1152	 */
1153	if (lr->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
1154	    lr->initiator != NL80211_REGDOM_SET_BY_USER &&
1155	    wiphy->regd)
1156		return get_wiphy_regdom(wiphy);
1157
1158	return get_cfg80211_regdom();
1159}
1160
1161static unsigned int
1162reg_get_max_bandwidth_from_range(const struct ieee80211_regdomain *rd,
1163				 const struct ieee80211_reg_rule *rule)
1164{
1165	const struct ieee80211_freq_range *freq_range = &rule->freq_range;
1166	const struct ieee80211_freq_range *freq_range_tmp;
1167	const struct ieee80211_reg_rule *tmp;
1168	u32 start_freq, end_freq, idx, no;
1169
1170	for (idx = 0; idx < rd->n_reg_rules; idx++)
1171		if (rule == &rd->reg_rules[idx])
1172			break;
1173
1174	if (idx == rd->n_reg_rules)
1175		return 0;
1176
1177	/* get start_freq */
1178	no = idx;
1179
1180	while (no) {
1181		tmp = &rd->reg_rules[--no];
1182		freq_range_tmp = &tmp->freq_range;
1183
1184		if (freq_range_tmp->end_freq_khz < freq_range->start_freq_khz)
1185			break;
1186
1187		freq_range = freq_range_tmp;
1188	}
1189
1190	start_freq = freq_range->start_freq_khz;
1191
1192	/* get end_freq */
1193	freq_range = &rule->freq_range;
1194	no = idx;
1195
1196	while (no < rd->n_reg_rules - 1) {
1197		tmp = &rd->reg_rules[++no];
1198		freq_range_tmp = &tmp->freq_range;
1199
1200		if (freq_range_tmp->start_freq_khz > freq_range->end_freq_khz)
1201			break;
1202
1203		freq_range = freq_range_tmp;
1204	}
1205
1206	end_freq = freq_range->end_freq_khz;
1207
1208	return end_freq - start_freq;
1209}
1210
1211unsigned int reg_get_max_bandwidth(const struct ieee80211_regdomain *rd,
1212				   const struct ieee80211_reg_rule *rule)
1213{
1214	unsigned int bw = reg_get_max_bandwidth_from_range(rd, rule);
1215
1216	if (rule->flags & NL80211_RRF_NO_320MHZ)
1217		bw = min_t(unsigned int, bw, MHZ_TO_KHZ(160));
1218	if (rule->flags & NL80211_RRF_NO_160MHZ)
1219		bw = min_t(unsigned int, bw, MHZ_TO_KHZ(80));
1220	if (rule->flags & NL80211_RRF_NO_80MHZ)
1221		bw = min_t(unsigned int, bw, MHZ_TO_KHZ(40));
1222
1223	/*
1224	 * HT40+/HT40- limits are handled per-channel. Only limit BW if both
1225	 * are not allowed.
1226	 */
1227	if (rule->flags & NL80211_RRF_NO_HT40MINUS &&
1228	    rule->flags & NL80211_RRF_NO_HT40PLUS)
1229		bw = min_t(unsigned int, bw, MHZ_TO_KHZ(20));
1230
1231	return bw;
1232}
1233
1234/* Sanity check on a regulatory rule */
1235static bool is_valid_reg_rule(const struct ieee80211_reg_rule *rule)
1236{
1237	const struct ieee80211_freq_range *freq_range = &rule->freq_range;
1238	u32 freq_diff;
1239
1240	if (freq_range->start_freq_khz <= 0 || freq_range->end_freq_khz <= 0)
1241		return false;
1242
1243	if (freq_range->start_freq_khz > freq_range->end_freq_khz)
1244		return false;
1245
1246	freq_diff = freq_range->end_freq_khz - freq_range->start_freq_khz;
1247
1248	if (freq_range->end_freq_khz <= freq_range->start_freq_khz ||
1249	    freq_range->max_bandwidth_khz > freq_diff)
1250		return false;
1251
1252	return true;
1253}
1254
1255static bool is_valid_rd(const struct ieee80211_regdomain *rd)
1256{
1257	const struct ieee80211_reg_rule *reg_rule = NULL;
1258	unsigned int i;
1259
1260	if (!rd->n_reg_rules)
1261		return false;
1262
1263	if (WARN_ON(rd->n_reg_rules > NL80211_MAX_SUPP_REG_RULES))
1264		return false;
1265
1266	for (i = 0; i < rd->n_reg_rules; i++) {
1267		reg_rule = &rd->reg_rules[i];
1268		if (!is_valid_reg_rule(reg_rule))
1269			return false;
1270	}
1271
1272	return true;
1273}
1274
1275/**
1276 * freq_in_rule_band - tells us if a frequency is in a frequency band
1277 * @freq_range: frequency rule we want to query
1278 * @freq_khz: frequency we are inquiring about
1279 *
1280 * This lets us know if a specific frequency rule is or is not relevant to
1281 * a specific frequency's band. Bands are device specific and artificial
1282 * definitions (the "2.4 GHz band", the "5 GHz band" and the "60GHz band"),
1283 * however it is safe for now to assume that a frequency rule should not be
1284 * part of a frequency's band if the start freq or end freq are off by more
1285 * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 20 GHz for the
1286 * 60 GHz band.
1287 * This resolution can be lowered and should be considered as we add
1288 * regulatory rule support for other "bands".
1289 *
1290 * Returns: whether or not the frequency is in the range
1291 */
1292static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,
1293			      u32 freq_khz)
1294{
1295	/*
1296	 * From 802.11ad: directional multi-gigabit (DMG):
1297	 * Pertaining to operation in a frequency band containing a channel
1298	 * with the Channel starting frequency above 45 GHz.
1299	 */
1300	u32 limit = freq_khz > 45 * KHZ_PER_GHZ ? 20 * KHZ_PER_GHZ : 2 * KHZ_PER_GHZ;
1301	if (abs(freq_khz - freq_range->start_freq_khz) <= limit)
1302		return true;
1303	if (abs(freq_khz - freq_range->end_freq_khz) <= limit)
1304		return true;
1305	return false;
1306}
1307
1308/*
1309 * Later on we can perhaps use the more restrictive DFS
1310 * region but we don't have information for that yet so
1311 * for now simply disallow conflicts.
1312 */
1313static enum nl80211_dfs_regions
1314reg_intersect_dfs_region(const enum nl80211_dfs_regions dfs_region1,
1315			 const enum nl80211_dfs_regions dfs_region2)
1316{
1317	if (dfs_region1 != dfs_region2)
1318		return NL80211_DFS_UNSET;
1319	return dfs_region1;
1320}
1321
1322static void reg_wmm_rules_intersect(const struct ieee80211_wmm_ac *wmm_ac1,
1323				    const struct ieee80211_wmm_ac *wmm_ac2,
1324				    struct ieee80211_wmm_ac *intersect)
1325{
1326	intersect->cw_min = max_t(u16, wmm_ac1->cw_min, wmm_ac2->cw_min);
1327	intersect->cw_max = max_t(u16, wmm_ac1->cw_max, wmm_ac2->cw_max);
1328	intersect->cot = min_t(u16, wmm_ac1->cot, wmm_ac2->cot);
1329	intersect->aifsn = max_t(u8, wmm_ac1->aifsn, wmm_ac2->aifsn);
1330}
1331
1332/*
1333 * Helper for regdom_intersect(), this does the real
1334 * mathematical intersection fun
1335 */
1336static int reg_rules_intersect(const struct ieee80211_regdomain *rd1,
1337			       const struct ieee80211_regdomain *rd2,
1338			       const struct ieee80211_reg_rule *rule1,
1339			       const struct ieee80211_reg_rule *rule2,
1340			       struct ieee80211_reg_rule *intersected_rule)
1341{
1342	const struct ieee80211_freq_range *freq_range1, *freq_range2;
1343	struct ieee80211_freq_range *freq_range;
1344	const struct ieee80211_power_rule *power_rule1, *power_rule2;
1345	struct ieee80211_power_rule *power_rule;
1346	const struct ieee80211_wmm_rule *wmm_rule1, *wmm_rule2;
1347	struct ieee80211_wmm_rule *wmm_rule;
1348	u32 freq_diff, max_bandwidth1, max_bandwidth2;
1349
1350	freq_range1 = &rule1->freq_range;
1351	freq_range2 = &rule2->freq_range;
1352	freq_range = &intersected_rule->freq_range;
1353
1354	power_rule1 = &rule1->power_rule;
1355	power_rule2 = &rule2->power_rule;
1356	power_rule = &intersected_rule->power_rule;
1357
1358	wmm_rule1 = &rule1->wmm_rule;
1359	wmm_rule2 = &rule2->wmm_rule;
1360	wmm_rule = &intersected_rule->wmm_rule;
1361
1362	freq_range->start_freq_khz = max(freq_range1->start_freq_khz,
1363					 freq_range2->start_freq_khz);
1364	freq_range->end_freq_khz = min(freq_range1->end_freq_khz,
1365				       freq_range2->end_freq_khz);
1366
1367	max_bandwidth1 = freq_range1->max_bandwidth_khz;
1368	max_bandwidth2 = freq_range2->max_bandwidth_khz;
1369
1370	if (rule1->flags & NL80211_RRF_AUTO_BW)
1371		max_bandwidth1 = reg_get_max_bandwidth(rd1, rule1);
1372	if (rule2->flags & NL80211_RRF_AUTO_BW)
1373		max_bandwidth2 = reg_get_max_bandwidth(rd2, rule2);
1374
1375	freq_range->max_bandwidth_khz = min(max_bandwidth1, max_bandwidth2);
1376
1377	intersected_rule->flags = rule1->flags | rule2->flags;
1378
1379	/*
1380	 * In case NL80211_RRF_AUTO_BW requested for both rules
1381	 * set AUTO_BW in intersected rule also. Next we will
1382	 * calculate BW correctly in handle_channel function.
1383	 * In other case remove AUTO_BW flag while we calculate
1384	 * maximum bandwidth correctly and auto calculation is
1385	 * not required.
1386	 */
1387	if ((rule1->flags & NL80211_RRF_AUTO_BW) &&
1388	    (rule2->flags & NL80211_RRF_AUTO_BW))
1389		intersected_rule->flags |= NL80211_RRF_AUTO_BW;
1390	else
1391		intersected_rule->flags &= ~NL80211_RRF_AUTO_BW;
1392
1393	freq_diff = freq_range->end_freq_khz - freq_range->start_freq_khz;
1394	if (freq_range->max_bandwidth_khz > freq_diff)
1395		freq_range->max_bandwidth_khz = freq_diff;
1396
1397	power_rule->max_eirp = min(power_rule1->max_eirp,
1398		power_rule2->max_eirp);
1399	power_rule->max_antenna_gain = min(power_rule1->max_antenna_gain,
1400		power_rule2->max_antenna_gain);
1401
1402	intersected_rule->dfs_cac_ms = max(rule1->dfs_cac_ms,
1403					   rule2->dfs_cac_ms);
1404
1405	if (rule1->has_wmm && rule2->has_wmm) {
1406		u8 ac;
1407
1408		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1409			reg_wmm_rules_intersect(&wmm_rule1->client[ac],
1410						&wmm_rule2->client[ac],
1411						&wmm_rule->client[ac]);
1412			reg_wmm_rules_intersect(&wmm_rule1->ap[ac],
1413						&wmm_rule2->ap[ac],
1414						&wmm_rule->ap[ac]);
1415		}
1416
1417		intersected_rule->has_wmm = true;
1418	} else if (rule1->has_wmm) {
1419		*wmm_rule = *wmm_rule1;
1420		intersected_rule->has_wmm = true;
1421	} else if (rule2->has_wmm) {
1422		*wmm_rule = *wmm_rule2;
1423		intersected_rule->has_wmm = true;
1424	} else {
1425		intersected_rule->has_wmm = false;
1426	}
1427
1428	if (!is_valid_reg_rule(intersected_rule))
1429		return -EINVAL;
1430
1431	return 0;
1432}
1433
1434/* check whether old rule contains new rule */
1435static bool rule_contains(struct ieee80211_reg_rule *r1,
1436			  struct ieee80211_reg_rule *r2)
1437{
1438	/* for simplicity, currently consider only same flags */
1439	if (r1->flags != r2->flags)
1440		return false;
1441
1442	/* verify r1 is more restrictive */
1443	if ((r1->power_rule.max_antenna_gain >
1444	     r2->power_rule.max_antenna_gain) ||
1445	    r1->power_rule.max_eirp > r2->power_rule.max_eirp)
1446		return false;
1447
1448	/* make sure r2's range is contained within r1 */
1449	if (r1->freq_range.start_freq_khz > r2->freq_range.start_freq_khz ||
1450	    r1->freq_range.end_freq_khz < r2->freq_range.end_freq_khz)
1451		return false;
1452
1453	/* and finally verify that r1.max_bw >= r2.max_bw */
1454	if (r1->freq_range.max_bandwidth_khz <
1455	    r2->freq_range.max_bandwidth_khz)
1456		return false;
1457
1458	return true;
1459}
1460
1461/* add or extend current rules. do nothing if rule is already contained */
1462static void add_rule(struct ieee80211_reg_rule *rule,
1463		     struct ieee80211_reg_rule *reg_rules, u32 *n_rules)
1464{
1465	struct ieee80211_reg_rule *tmp_rule;
1466	int i;
1467
1468	for (i = 0; i < *n_rules; i++) {
1469		tmp_rule = &reg_rules[i];
1470		/* rule is already contained - do nothing */
1471		if (rule_contains(tmp_rule, rule))
1472			return;
1473
1474		/* extend rule if possible */
1475		if (rule_contains(rule, tmp_rule)) {
1476			memcpy(tmp_rule, rule, sizeof(*rule));
1477			return;
1478		}
1479	}
1480
1481	memcpy(&reg_rules[*n_rules], rule, sizeof(*rule));
1482	(*n_rules)++;
1483}
1484
1485/**
1486 * regdom_intersect - do the intersection between two regulatory domains
1487 * @rd1: first regulatory domain
1488 * @rd2: second regulatory domain
1489 *
1490 * Use this function to get the intersection between two regulatory domains.
1491 * Once completed we will mark the alpha2 for the rd as intersected, "98",
1492 * as no one single alpha2 can represent this regulatory domain.
1493 *
1494 * Returns a pointer to the regulatory domain structure which will hold the
1495 * resulting intersection of rules between rd1 and rd2. We will
1496 * kzalloc() this structure for you.
1497 *
1498 * Returns: the intersected regdomain
1499 */
1500static struct ieee80211_regdomain *
1501regdom_intersect(const struct ieee80211_regdomain *rd1,
1502		 const struct ieee80211_regdomain *rd2)
1503{
1504	int r;
1505	unsigned int x, y;
1506	unsigned int num_rules = 0;
1507	const struct ieee80211_reg_rule *rule1, *rule2;
1508	struct ieee80211_reg_rule intersected_rule;
1509	struct ieee80211_regdomain *rd;
1510
1511	if (!rd1 || !rd2)
1512		return NULL;
1513
1514	/*
1515	 * First we get a count of the rules we'll need, then we actually
1516	 * build them. This is to so we can malloc() and free() a
1517	 * regdomain once. The reason we use reg_rules_intersect() here
1518	 * is it will return -EINVAL if the rule computed makes no sense.
1519	 * All rules that do check out OK are valid.
1520	 */
1521
1522	for (x = 0; x < rd1->n_reg_rules; x++) {
1523		rule1 = &rd1->reg_rules[x];
1524		for (y = 0; y < rd2->n_reg_rules; y++) {
1525			rule2 = &rd2->reg_rules[y];
1526			if (!reg_rules_intersect(rd1, rd2, rule1, rule2,
1527						 &intersected_rule))
1528				num_rules++;
1529		}
1530	}
1531
1532	if (!num_rules)
1533		return NULL;
1534
1535	rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
1536	if (!rd)
1537		return NULL;
1538
1539	for (x = 0; x < rd1->n_reg_rules; x++) {
1540		rule1 = &rd1->reg_rules[x];
1541		for (y = 0; y < rd2->n_reg_rules; y++) {
1542			rule2 = &rd2->reg_rules[y];
1543			r = reg_rules_intersect(rd1, rd2, rule1, rule2,
1544						&intersected_rule);
1545			/*
1546			 * No need to memset here the intersected rule here as
1547			 * we're not using the stack anymore
1548			 */
1549			if (r)
1550				continue;
1551
1552			add_rule(&intersected_rule, rd->reg_rules,
1553				 &rd->n_reg_rules);
1554		}
1555	}
1556
1557	rd->alpha2[0] = '9';
1558	rd->alpha2[1] = '8';
1559	rd->dfs_region = reg_intersect_dfs_region(rd1->dfs_region,
1560						  rd2->dfs_region);
1561
1562	return rd;
1563}
1564
1565/*
1566 * XXX: add support for the rest of enum nl80211_reg_rule_flags, we may
1567 * want to just have the channel structure use these
1568 */
1569static u32 map_regdom_flags(u32 rd_flags)
1570{
1571	u32 channel_flags = 0;
1572	if (rd_flags & NL80211_RRF_NO_IR_ALL)
1573		channel_flags |= IEEE80211_CHAN_NO_IR;
1574	if (rd_flags & NL80211_RRF_DFS)
1575		channel_flags |= IEEE80211_CHAN_RADAR;
1576	if (rd_flags & NL80211_RRF_NO_OFDM)
1577		channel_flags |= IEEE80211_CHAN_NO_OFDM;
1578	if (rd_flags & NL80211_RRF_NO_OUTDOOR)
1579		channel_flags |= IEEE80211_CHAN_INDOOR_ONLY;
1580	if (rd_flags & NL80211_RRF_IR_CONCURRENT)
1581		channel_flags |= IEEE80211_CHAN_IR_CONCURRENT;
1582	if (rd_flags & NL80211_RRF_NO_HT40MINUS)
1583		channel_flags |= IEEE80211_CHAN_NO_HT40MINUS;
1584	if (rd_flags & NL80211_RRF_NO_HT40PLUS)
1585		channel_flags |= IEEE80211_CHAN_NO_HT40PLUS;
1586	if (rd_flags & NL80211_RRF_NO_80MHZ)
1587		channel_flags |= IEEE80211_CHAN_NO_80MHZ;
1588	if (rd_flags & NL80211_RRF_NO_160MHZ)
1589		channel_flags |= IEEE80211_CHAN_NO_160MHZ;
1590	if (rd_flags & NL80211_RRF_NO_HE)
1591		channel_flags |= IEEE80211_CHAN_NO_HE;
1592	if (rd_flags & NL80211_RRF_NO_320MHZ)
1593		channel_flags |= IEEE80211_CHAN_NO_320MHZ;
1594	if (rd_flags & NL80211_RRF_NO_EHT)
1595		channel_flags |= IEEE80211_CHAN_NO_EHT;
1596	if (rd_flags & NL80211_RRF_DFS_CONCURRENT)
1597		channel_flags |= IEEE80211_CHAN_DFS_CONCURRENT;
1598	if (rd_flags & NL80211_RRF_NO_6GHZ_VLP_CLIENT)
1599		channel_flags |= IEEE80211_CHAN_NO_6GHZ_VLP_CLIENT;
1600	if (rd_flags & NL80211_RRF_NO_6GHZ_AFC_CLIENT)
1601		channel_flags |= IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT;
1602	if (rd_flags & NL80211_RRF_PSD)
1603		channel_flags |= IEEE80211_CHAN_PSD;
1604	if (rd_flags & NL80211_RRF_ALLOW_6GHZ_VLP_AP)
1605		channel_flags |= IEEE80211_CHAN_ALLOW_6GHZ_VLP_AP;
1606	if (rd_flags & NL80211_RRF_ALLOW_20MHZ_ACTIVITY)
1607		channel_flags |= IEEE80211_CHAN_ALLOW_20MHZ_ACTIVITY;
1608	return channel_flags;
1609}
1610
1611static const struct ieee80211_reg_rule *
1612freq_reg_info_regd(u32 center_freq,
1613		   const struct ieee80211_regdomain *regd, u32 bw)
1614{
1615	int i;
1616	bool band_rule_found = false;
1617	bool bw_fits = false;
1618
1619	if (!regd)
1620		return ERR_PTR(-EINVAL);
1621
1622	for (i = 0; i < regd->n_reg_rules; i++) {
1623		const struct ieee80211_reg_rule *rr;
1624		const struct ieee80211_freq_range *fr = NULL;
1625
1626		rr = &regd->reg_rules[i];
1627		fr = &rr->freq_range;
1628
1629		/*
1630		 * We only need to know if one frequency rule was
1631		 * in center_freq's band, that's enough, so let's
1632		 * not overwrite it once found
1633		 */
1634		if (!band_rule_found)
1635			band_rule_found = freq_in_rule_band(fr, center_freq);
1636
1637		bw_fits = cfg80211_does_bw_fit_range(fr, center_freq, bw);
1638
1639		if (band_rule_found && bw_fits)
1640			return rr;
1641	}
1642
1643	if (!band_rule_found)
1644		return ERR_PTR(-ERANGE);
1645
1646	return ERR_PTR(-EINVAL);
1647}
1648
1649static const struct ieee80211_reg_rule *
1650__freq_reg_info(struct wiphy *wiphy, u32 center_freq, u32 min_bw)
1651{
1652	const struct ieee80211_regdomain *regd = reg_get_regdomain(wiphy);
1653	static const u32 bws[] = {0, 1, 2, 4, 5, 8, 10, 16, 20};
1654	const struct ieee80211_reg_rule *reg_rule = ERR_PTR(-ERANGE);
1655	int i = ARRAY_SIZE(bws) - 1;
1656	u32 bw;
1657
1658	for (bw = MHZ_TO_KHZ(bws[i]); bw >= min_bw; bw = MHZ_TO_KHZ(bws[i--])) {
1659		reg_rule = freq_reg_info_regd(center_freq, regd, bw);
1660		if (!IS_ERR(reg_rule))
1661			return reg_rule;
1662	}
1663
1664	return reg_rule;
1665}
1666
1667const struct ieee80211_reg_rule *freq_reg_info(struct wiphy *wiphy,
1668					       u32 center_freq)
1669{
1670	u32 min_bw = center_freq < MHZ_TO_KHZ(1000) ? 1 : 20;
1671
1672	return __freq_reg_info(wiphy, center_freq, MHZ_TO_KHZ(min_bw));
1673}
1674EXPORT_SYMBOL(freq_reg_info);
1675
1676const char *reg_initiator_name(enum nl80211_reg_initiator initiator)
1677{
1678	switch (initiator) {
1679	case NL80211_REGDOM_SET_BY_CORE:
1680		return "core";
1681	case NL80211_REGDOM_SET_BY_USER:
1682		return "user";
1683	case NL80211_REGDOM_SET_BY_DRIVER:
1684		return "driver";
1685	case NL80211_REGDOM_SET_BY_COUNTRY_IE:
1686		return "country element";
1687	default:
1688		WARN_ON(1);
1689		return "bug";
1690	}
1691}
1692EXPORT_SYMBOL(reg_initiator_name);
1693
1694static uint32_t reg_rule_to_chan_bw_flags(const struct ieee80211_regdomain *regd,
1695					  const struct ieee80211_reg_rule *reg_rule,
1696					  const struct ieee80211_channel *chan)
1697{
1698	const struct ieee80211_freq_range *freq_range = NULL;
1699	u32 max_bandwidth_khz, center_freq_khz, bw_flags = 0;
1700	bool is_s1g = chan->band == NL80211_BAND_S1GHZ;
1701
1702	freq_range = &reg_rule->freq_range;
1703
1704	max_bandwidth_khz = freq_range->max_bandwidth_khz;
1705	center_freq_khz = ieee80211_channel_to_khz(chan);
1706	/* Check if auto calculation requested */
1707	if (reg_rule->flags & NL80211_RRF_AUTO_BW)
1708		max_bandwidth_khz = reg_get_max_bandwidth(regd, reg_rule);
1709
1710	if (is_s1g) {
1711		if (max_bandwidth_khz < MHZ_TO_KHZ(16))
1712			bw_flags |= IEEE80211_CHAN_NO_16MHZ;
1713		if (max_bandwidth_khz < MHZ_TO_KHZ(8))
1714			bw_flags |= IEEE80211_CHAN_NO_8MHZ;
1715		if (max_bandwidth_khz < MHZ_TO_KHZ(4))
1716			bw_flags |= IEEE80211_CHAN_NO_4MHZ;
1717		return bw_flags;
1718	}
1719
1720	/* If we get a reg_rule we can assume that at least 5Mhz fit */
1721	if (!cfg80211_does_bw_fit_range(freq_range,
1722					center_freq_khz,
1723					MHZ_TO_KHZ(10)))
1724		bw_flags |= IEEE80211_CHAN_NO_10MHZ;
1725	if (!cfg80211_does_bw_fit_range(freq_range,
1726					center_freq_khz,
1727					MHZ_TO_KHZ(20)))
1728		bw_flags |= IEEE80211_CHAN_NO_20MHZ;
1729
1730	if (max_bandwidth_khz < MHZ_TO_KHZ(10))
1731		bw_flags |= IEEE80211_CHAN_NO_10MHZ;
1732	if (max_bandwidth_khz < MHZ_TO_KHZ(20))
1733		bw_flags |= IEEE80211_CHAN_NO_20MHZ;
1734	if (max_bandwidth_khz < MHZ_TO_KHZ(40))
1735		bw_flags |= IEEE80211_CHAN_NO_HT40;
1736	if (max_bandwidth_khz < MHZ_TO_KHZ(80))
1737		bw_flags |= IEEE80211_CHAN_NO_80MHZ;
1738	if (max_bandwidth_khz < MHZ_TO_KHZ(160))
1739		bw_flags |= IEEE80211_CHAN_NO_160MHZ;
1740	if (max_bandwidth_khz < MHZ_TO_KHZ(320))
1741		bw_flags |= IEEE80211_CHAN_NO_320MHZ;
1742
1743	return bw_flags;
1744}
1745
1746static void handle_channel_single_rule(struct wiphy *wiphy,
1747				       enum nl80211_reg_initiator initiator,
1748				       struct ieee80211_channel *chan,
1749				       u32 flags,
1750				       struct regulatory_request *lr,
1751				       struct wiphy *request_wiphy,
1752				       const struct ieee80211_reg_rule *reg_rule)
1753{
1754	u32 bw_flags = 0;
1755	const struct ieee80211_power_rule *power_rule = NULL;
1756	const struct ieee80211_regdomain *regd;
1757
1758	regd = reg_get_regdomain(wiphy);
1759
1760	power_rule = &reg_rule->power_rule;
1761	bw_flags = reg_rule_to_chan_bw_flags(regd, reg_rule, chan);
1762
1763	if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
1764	    request_wiphy && request_wiphy == wiphy &&
1765	    request_wiphy->regulatory_flags & REGULATORY_STRICT_REG) {
1766		/*
1767		 * This guarantees the driver's requested regulatory domain
1768		 * will always be used as a base for further regulatory
1769		 * settings
1770		 */
1771		chan->flags = chan->orig_flags =
1772			map_regdom_flags(reg_rule->flags) | bw_flags;
1773		chan->max_antenna_gain = chan->orig_mag =
1774			(int) MBI_TO_DBI(power_rule->max_antenna_gain);
1775		chan->max_reg_power = chan->max_power = chan->orig_mpwr =
1776			(int) MBM_TO_DBM(power_rule->max_eirp);
1777
1778		if (chan->flags & IEEE80211_CHAN_RADAR) {
1779			chan->dfs_cac_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
1780			if (reg_rule->dfs_cac_ms)
1781				chan->dfs_cac_ms = reg_rule->dfs_cac_ms;
1782		}
1783
1784		if (chan->flags & IEEE80211_CHAN_PSD)
1785			chan->psd = reg_rule->psd;
1786
1787		return;
1788	}
1789
1790	chan->dfs_state = NL80211_DFS_USABLE;
1791	chan->dfs_state_entered = jiffies;
1792
1793	chan->beacon_found = false;
1794	chan->flags = flags | bw_flags | map_regdom_flags(reg_rule->flags);
1795	chan->max_antenna_gain =
1796		min_t(int, chan->orig_mag,
1797		      MBI_TO_DBI(power_rule->max_antenna_gain));
1798	chan->max_reg_power = (int) MBM_TO_DBM(power_rule->max_eirp);
1799
1800	if (chan->flags & IEEE80211_CHAN_RADAR) {
1801		if (reg_rule->dfs_cac_ms)
1802			chan->dfs_cac_ms = reg_rule->dfs_cac_ms;
1803		else
1804			chan->dfs_cac_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
1805	}
1806
1807	if (chan->flags & IEEE80211_CHAN_PSD)
1808		chan->psd = reg_rule->psd;
1809
1810	if (chan->orig_mpwr) {
1811		/*
1812		 * Devices that use REGULATORY_COUNTRY_IE_FOLLOW_POWER
1813		 * will always follow the passed country IE power settings.
1814		 */
1815		if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
1816		    wiphy->regulatory_flags & REGULATORY_COUNTRY_IE_FOLLOW_POWER)
1817			chan->max_power = chan->max_reg_power;
1818		else
1819			chan->max_power = min(chan->orig_mpwr,
1820					      chan->max_reg_power);
1821	} else
1822		chan->max_power = chan->max_reg_power;
1823}
1824
1825static void handle_channel_adjacent_rules(struct wiphy *wiphy,
1826					  enum nl80211_reg_initiator initiator,
1827					  struct ieee80211_channel *chan,
1828					  u32 flags,
1829					  struct regulatory_request *lr,
1830					  struct wiphy *request_wiphy,
1831					  const struct ieee80211_reg_rule *rrule1,
1832					  const struct ieee80211_reg_rule *rrule2,
1833					  struct ieee80211_freq_range *comb_range)
1834{
1835	u32 bw_flags1 = 0;
1836	u32 bw_flags2 = 0;
1837	const struct ieee80211_power_rule *power_rule1 = NULL;
1838	const struct ieee80211_power_rule *power_rule2 = NULL;
1839	const struct ieee80211_regdomain *regd;
1840
1841	regd = reg_get_regdomain(wiphy);
1842
1843	power_rule1 = &rrule1->power_rule;
1844	power_rule2 = &rrule2->power_rule;
1845	bw_flags1 = reg_rule_to_chan_bw_flags(regd, rrule1, chan);
1846	bw_flags2 = reg_rule_to_chan_bw_flags(regd, rrule2, chan);
1847
1848	if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
1849	    request_wiphy && request_wiphy == wiphy &&
1850	    request_wiphy->regulatory_flags & REGULATORY_STRICT_REG) {
1851		/* This guarantees the driver's requested regulatory domain
1852		 * will always be used as a base for further regulatory
1853		 * settings
1854		 */
1855		chan->flags =
1856			map_regdom_flags(rrule1->flags) |
1857			map_regdom_flags(rrule2->flags) |
1858			bw_flags1 |
1859			bw_flags2;
1860		chan->orig_flags = chan->flags;
1861		chan->max_antenna_gain =
1862			min_t(int, MBI_TO_DBI(power_rule1->max_antenna_gain),
1863			      MBI_TO_DBI(power_rule2->max_antenna_gain));
1864		chan->orig_mag = chan->max_antenna_gain;
1865		chan->max_reg_power =
1866			min_t(int, MBM_TO_DBM(power_rule1->max_eirp),
1867			      MBM_TO_DBM(power_rule2->max_eirp));
1868		chan->max_power = chan->max_reg_power;
1869		chan->orig_mpwr = chan->max_reg_power;
1870
1871		if (chan->flags & IEEE80211_CHAN_RADAR) {
1872			chan->dfs_cac_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
1873			if (rrule1->dfs_cac_ms || rrule2->dfs_cac_ms)
1874				chan->dfs_cac_ms = max_t(unsigned int,
1875							 rrule1->dfs_cac_ms,
1876							 rrule2->dfs_cac_ms);
1877		}
1878
1879		if ((rrule1->flags & NL80211_RRF_PSD) &&
1880		    (rrule2->flags & NL80211_RRF_PSD))
1881			chan->psd = min_t(s8, rrule1->psd, rrule2->psd);
1882		else
1883			chan->flags &= ~NL80211_RRF_PSD;
1884
1885		return;
1886	}
1887
1888	chan->dfs_state = NL80211_DFS_USABLE;
1889	chan->dfs_state_entered = jiffies;
1890
1891	chan->beacon_found = false;
1892	chan->flags = flags | bw_flags1 | bw_flags2 |
1893		      map_regdom_flags(rrule1->flags) |
1894		      map_regdom_flags(rrule2->flags);
1895
1896	/* reg_rule_to_chan_bw_flags may forbids 10 and forbids 20 MHz
1897	 * (otherwise no adj. rule case), recheck therefore
1898	 */
1899	if (cfg80211_does_bw_fit_range(comb_range,
1900				       ieee80211_channel_to_khz(chan),
1901				       MHZ_TO_KHZ(10)))
1902		chan->flags &= ~IEEE80211_CHAN_NO_10MHZ;
1903	if (cfg80211_does_bw_fit_range(comb_range,
1904				       ieee80211_channel_to_khz(chan),
1905				       MHZ_TO_KHZ(20)))
1906		chan->flags &= ~IEEE80211_CHAN_NO_20MHZ;
1907
1908	chan->max_antenna_gain =
1909		min_t(int, chan->orig_mag,
1910		      min_t(int,
1911			    MBI_TO_DBI(power_rule1->max_antenna_gain),
1912			    MBI_TO_DBI(power_rule2->max_antenna_gain)));
1913	chan->max_reg_power = min_t(int,
1914				    MBM_TO_DBM(power_rule1->max_eirp),
1915				    MBM_TO_DBM(power_rule2->max_eirp));
1916
1917	if (chan->flags & IEEE80211_CHAN_RADAR) {
1918		if (rrule1->dfs_cac_ms || rrule2->dfs_cac_ms)
1919			chan->dfs_cac_ms = max_t(unsigned int,
1920						 rrule1->dfs_cac_ms,
1921						 rrule2->dfs_cac_ms);
1922		else
1923			chan->dfs_cac_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
1924	}
1925
1926	if (chan->orig_mpwr) {
1927		/* Devices that use REGULATORY_COUNTRY_IE_FOLLOW_POWER
1928		 * will always follow the passed country IE power settings.
1929		 */
1930		if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
1931		    wiphy->regulatory_flags & REGULATORY_COUNTRY_IE_FOLLOW_POWER)
1932			chan->max_power = chan->max_reg_power;
1933		else
1934			chan->max_power = min(chan->orig_mpwr,
1935					      chan->max_reg_power);
1936	} else {
1937		chan->max_power = chan->max_reg_power;
1938	}
1939}
1940
1941/* Note that right now we assume the desired channel bandwidth
1942 * is always 20 MHz for each individual channel (HT40 uses 20 MHz
1943 * per channel, the primary and the extension channel).
1944 */
1945static void handle_channel(struct wiphy *wiphy,
1946			   enum nl80211_reg_initiator initiator,
1947			   struct ieee80211_channel *chan)
1948{
1949	const u32 orig_chan_freq = ieee80211_channel_to_khz(chan);
1950	struct regulatory_request *lr = get_last_request();
1951	struct wiphy *request_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
1952	const struct ieee80211_reg_rule *rrule = NULL;
1953	const struct ieee80211_reg_rule *rrule1 = NULL;
1954	const struct ieee80211_reg_rule *rrule2 = NULL;
1955
1956	u32 flags = chan->orig_flags;
1957
1958	rrule = freq_reg_info(wiphy, orig_chan_freq);
1959	if (IS_ERR(rrule)) {
1960		/* check for adjacent match, therefore get rules for
1961		 * chan - 20 MHz and chan + 20 MHz and test
1962		 * if reg rules are adjacent
1963		 */
1964		rrule1 = freq_reg_info(wiphy,
1965				       orig_chan_freq - MHZ_TO_KHZ(20));
1966		rrule2 = freq_reg_info(wiphy,
1967				       orig_chan_freq + MHZ_TO_KHZ(20));
1968		if (!IS_ERR(rrule1) && !IS_ERR(rrule2)) {
1969			struct ieee80211_freq_range comb_range;
1970
1971			if (rrule1->freq_range.end_freq_khz !=
1972			    rrule2->freq_range.start_freq_khz)
1973				goto disable_chan;
1974
1975			comb_range.start_freq_khz =
1976				rrule1->freq_range.start_freq_khz;
1977			comb_range.end_freq_khz =
1978				rrule2->freq_range.end_freq_khz;
1979			comb_range.max_bandwidth_khz =
1980				min_t(u32,
1981				      rrule1->freq_range.max_bandwidth_khz,
1982				      rrule2->freq_range.max_bandwidth_khz);
1983
1984			if (!cfg80211_does_bw_fit_range(&comb_range,
1985							orig_chan_freq,
1986							MHZ_TO_KHZ(20)))
1987				goto disable_chan;
1988
1989			handle_channel_adjacent_rules(wiphy, initiator, chan,
1990						      flags, lr, request_wiphy,
1991						      rrule1, rrule2,
1992						      &comb_range);
1993			return;
1994		}
1995
1996disable_chan:
1997		/* We will disable all channels that do not match our
1998		 * received regulatory rule unless the hint is coming
1999		 * from a Country IE and the Country IE had no information
2000		 * about a band. The IEEE 802.11 spec allows for an AP
2001		 * to send only a subset of the regulatory rules allowed,
2002		 * so an AP in the US that only supports 2.4 GHz may only send
2003		 * a country IE with information for the 2.4 GHz band
2004		 * while 5 GHz is still supported.
2005		 */
2006		if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
2007		    PTR_ERR(rrule) == -ERANGE)
2008			return;
2009
2010		if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
2011		    request_wiphy && request_wiphy == wiphy &&
2012		    request_wiphy->regulatory_flags & REGULATORY_STRICT_REG) {
2013			pr_debug("Disabling freq %d.%03d MHz for good\n",
2014				 chan->center_freq, chan->freq_offset);
2015			chan->orig_flags |= IEEE80211_CHAN_DISABLED;
2016			chan->flags = chan->orig_flags;
2017		} else {
2018			pr_debug("Disabling freq %d.%03d MHz\n",
2019				 chan->center_freq, chan->freq_offset);
2020			chan->flags |= IEEE80211_CHAN_DISABLED;
2021		}
2022		return;
2023	}
2024
2025	handle_channel_single_rule(wiphy, initiator, chan, flags, lr,
2026				   request_wiphy, rrule);
2027}
2028
2029static void handle_band(struct wiphy *wiphy,
2030			enum nl80211_reg_initiator initiator,
2031			struct ieee80211_supported_band *sband)
2032{
2033	unsigned int i;
2034
2035	if (!sband)
2036		return;
2037
2038	for (i = 0; i < sband->n_channels; i++)
2039		handle_channel(wiphy, initiator, &sband->channels[i]);
2040}
2041
2042static bool reg_request_cell_base(struct regulatory_request *request)
2043{
2044	if (request->initiator != NL80211_REGDOM_SET_BY_USER)
2045		return false;
2046	return request->user_reg_hint_type == NL80211_USER_REG_HINT_CELL_BASE;
2047}
2048
2049bool reg_last_request_cell_base(void)
2050{
2051	return reg_request_cell_base(get_last_request());
2052}
2053
2054#ifdef CONFIG_CFG80211_REG_CELLULAR_HINTS
2055/* Core specific check */
2056static enum reg_request_treatment
2057reg_ignore_cell_hint(struct regulatory_request *pending_request)
2058{
2059	struct regulatory_request *lr = get_last_request();
2060
2061	if (!reg_num_devs_support_basehint)
2062		return REG_REQ_IGNORE;
2063
2064	if (reg_request_cell_base(lr) &&
2065	    !regdom_changes(pending_request->alpha2))
2066		return REG_REQ_ALREADY_SET;
2067
2068	return REG_REQ_OK;
2069}
2070
2071/* Device specific check */
2072static bool reg_dev_ignore_cell_hint(struct wiphy *wiphy)
2073{
2074	return !(wiphy->features & NL80211_FEATURE_CELL_BASE_REG_HINTS);
2075}
2076#else
2077static enum reg_request_treatment
2078reg_ignore_cell_hint(struct regulatory_request *pending_request)
2079{
2080	return REG_REQ_IGNORE;
2081}
2082
2083static bool reg_dev_ignore_cell_hint(struct wiphy *wiphy)
2084{
2085	return true;
2086}
2087#endif
2088
2089static bool wiphy_strict_alpha2_regd(struct wiphy *wiphy)
2090{
2091	if (wiphy->regulatory_flags & REGULATORY_STRICT_REG &&
2092	    !(wiphy->regulatory_flags & REGULATORY_CUSTOM_REG))
2093		return true;
2094	return false;
2095}
2096
2097static bool ignore_reg_update(struct wiphy *wiphy,
2098			      enum nl80211_reg_initiator initiator)
2099{
2100	struct regulatory_request *lr = get_last_request();
2101
2102	if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED)
2103		return true;
2104
2105	if (!lr) {
2106		pr_debug("Ignoring regulatory request set by %s since last_request is not set\n",
2107			 reg_initiator_name(initiator));
2108		return true;
2109	}
2110
2111	if (initiator == NL80211_REGDOM_SET_BY_CORE &&
2112	    wiphy->regulatory_flags & REGULATORY_CUSTOM_REG) {
2113		pr_debug("Ignoring regulatory request set by %s since the driver uses its own custom regulatory domain\n",
2114			 reg_initiator_name(initiator));
2115		return true;
2116	}
2117
2118	/*
2119	 * wiphy->regd will be set once the device has its own
2120	 * desired regulatory domain set
2121	 */
2122	if (wiphy_strict_alpha2_regd(wiphy) && !wiphy->regd &&
2123	    initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
2124	    !is_world_regdom(lr->alpha2)) {
2125		pr_debug("Ignoring regulatory request set by %s since the driver requires its own regulatory domain to be set first\n",
2126			 reg_initiator_name(initiator));
2127		return true;
2128	}
2129
2130	if (reg_request_cell_base(lr))
2131		return reg_dev_ignore_cell_hint(wiphy);
2132
2133	return false;
2134}
2135
2136static bool reg_is_world_roaming(struct wiphy *wiphy)
2137{
2138	const struct ieee80211_regdomain *cr = get_cfg80211_regdom();
2139	const struct ieee80211_regdomain *wr = get_wiphy_regdom(wiphy);
2140	struct regulatory_request *lr = get_last_request();
2141
2142	if (is_world_regdom(cr->alpha2) || (wr && is_world_regdom(wr->alpha2)))
2143		return true;
2144
2145	if (lr && lr->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
2146	    wiphy->regulatory_flags & REGULATORY_CUSTOM_REG)
2147		return true;
2148
2149	return false;
2150}
2151
2152static void reg_call_notifier(struct wiphy *wiphy,
2153			      struct regulatory_request *request)
2154{
2155	if (wiphy->reg_notifier)
2156		wiphy->reg_notifier(wiphy, request);
2157}
2158
2159static void handle_reg_beacon(struct wiphy *wiphy, unsigned int chan_idx,
2160			      struct reg_beacon *reg_beacon)
2161{
2162	struct ieee80211_supported_band *sband;
2163	struct ieee80211_channel *chan;
2164	bool channel_changed = false;
2165	struct ieee80211_channel chan_before;
2166	struct regulatory_request *lr = get_last_request();
2167
2168	sband = wiphy->bands[reg_beacon->chan.band];
2169	chan = &sband->channels[chan_idx];
2170
2171	if (likely(!ieee80211_channel_equal(chan, &reg_beacon->chan)))
2172		return;
2173
2174	if (chan->beacon_found)
2175		return;
2176
2177	chan->beacon_found = true;
2178
2179	if (!reg_is_world_roaming(wiphy))
2180		return;
2181
2182	if (wiphy->regulatory_flags & REGULATORY_DISABLE_BEACON_HINTS)
2183		return;
2184
2185	chan_before = *chan;
2186
2187	if (chan->flags & IEEE80211_CHAN_NO_IR) {
2188		chan->flags &= ~IEEE80211_CHAN_NO_IR;
2189		channel_changed = true;
2190	}
2191
2192	if (channel_changed) {
2193		nl80211_send_beacon_hint_event(wiphy, &chan_before, chan);
2194		if (wiphy->flags & WIPHY_FLAG_CHANNEL_CHANGE_ON_BEACON)
2195			reg_call_notifier(wiphy, lr);
2196	}
2197}
2198
2199/*
2200 * Called when a scan on a wiphy finds a beacon on
2201 * new channel
2202 */
2203static void wiphy_update_new_beacon(struct wiphy *wiphy,
2204				    struct reg_beacon *reg_beacon)
2205{
2206	unsigned int i;
2207	struct ieee80211_supported_band *sband;
2208
2209	if (!wiphy->bands[reg_beacon->chan.band])
2210		return;
2211
2212	sband = wiphy->bands[reg_beacon->chan.band];
2213
2214	for (i = 0; i < sband->n_channels; i++)
2215		handle_reg_beacon(wiphy, i, reg_beacon);
2216}
2217
2218/*
2219 * Called upon reg changes or a new wiphy is added
2220 */
2221static void wiphy_update_beacon_reg(struct wiphy *wiphy)
2222{
2223	unsigned int i;
2224	struct ieee80211_supported_band *sband;
2225	struct reg_beacon *reg_beacon;
2226
2227	list_for_each_entry(reg_beacon, &reg_beacon_list, list) {
2228		if (!wiphy->bands[reg_beacon->chan.band])
2229			continue;
2230		sband = wiphy->bands[reg_beacon->chan.band];
2231		for (i = 0; i < sband->n_channels; i++)
2232			handle_reg_beacon(wiphy, i, reg_beacon);
2233	}
2234}
2235
2236/* Reap the advantages of previously found beacons */
2237static void reg_process_beacons(struct wiphy *wiphy)
2238{
2239	/*
2240	 * Means we are just firing up cfg80211, so no beacons would
2241	 * have been processed yet.
2242	 */
2243	if (!last_request)
2244		return;
2245	wiphy_update_beacon_reg(wiphy);
2246}
2247
2248static bool is_ht40_allowed(struct ieee80211_channel *chan)
2249{
2250	if (!chan)
2251		return false;
2252	if (chan->flags & IEEE80211_CHAN_DISABLED)
2253		return false;
2254	/* This would happen when regulatory rules disallow HT40 completely */
2255	if ((chan->flags & IEEE80211_CHAN_NO_HT40) == IEEE80211_CHAN_NO_HT40)
2256		return false;
2257	return true;
2258}
2259
2260static void reg_process_ht_flags_channel(struct wiphy *wiphy,
2261					 struct ieee80211_channel *channel)
2262{
2263	struct ieee80211_supported_band *sband = wiphy->bands[channel->band];
2264	struct ieee80211_channel *channel_before = NULL, *channel_after = NULL;
2265	const struct ieee80211_regdomain *regd;
2266	unsigned int i;
2267	u32 flags;
2268
2269	if (!is_ht40_allowed(channel)) {
2270		channel->flags |= IEEE80211_CHAN_NO_HT40;
2271		return;
2272	}
2273
2274	/*
2275	 * We need to ensure the extension channels exist to
2276	 * be able to use HT40- or HT40+, this finds them (or not)
2277	 */
2278	for (i = 0; i < sband->n_channels; i++) {
2279		struct ieee80211_channel *c = &sband->channels[i];
2280
2281		if (c->center_freq == (channel->center_freq - 20))
2282			channel_before = c;
2283		if (c->center_freq == (channel->center_freq + 20))
2284			channel_after = c;
2285	}
2286
2287	flags = 0;
2288	regd = get_wiphy_regdom(wiphy);
2289	if (regd) {
2290		const struct ieee80211_reg_rule *reg_rule =
2291			freq_reg_info_regd(MHZ_TO_KHZ(channel->center_freq),
2292					   regd, MHZ_TO_KHZ(20));
2293
2294		if (!IS_ERR(reg_rule))
2295			flags = reg_rule->flags;
2296	}
2297
2298	/*
2299	 * Please note that this assumes target bandwidth is 20 MHz,
2300	 * if that ever changes we also need to change the below logic
2301	 * to include that as well.
2302	 */
2303	if (!is_ht40_allowed(channel_before) ||
2304	    flags & NL80211_RRF_NO_HT40MINUS)
2305		channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
2306	else
2307		channel->flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
2308
2309	if (!is_ht40_allowed(channel_after) ||
2310	    flags & NL80211_RRF_NO_HT40PLUS)
2311		channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
2312	else
2313		channel->flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
2314}
2315
2316static void reg_process_ht_flags_band(struct wiphy *wiphy,
2317				      struct ieee80211_supported_band *sband)
2318{
2319	unsigned int i;
2320
2321	if (!sband)
2322		return;
2323
2324	for (i = 0; i < sband->n_channels; i++)
2325		reg_process_ht_flags_channel(wiphy, &sband->channels[i]);
2326}
2327
2328static void reg_process_ht_flags(struct wiphy *wiphy)
2329{
2330	enum nl80211_band band;
2331
2332	if (!wiphy)
2333		return;
2334
2335	for (band = 0; band < NUM_NL80211_BANDS; band++)
2336		reg_process_ht_flags_band(wiphy, wiphy->bands[band]);
2337}
2338
2339static bool reg_wdev_chan_valid(struct wiphy *wiphy, struct wireless_dev *wdev)
2340{
2341	struct cfg80211_chan_def chandef = {};
2342	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2343	enum nl80211_iftype iftype;
2344	bool ret;
2345	int link;
2346
2347	iftype = wdev->iftype;
2348
2349	/* make sure the interface is active */
2350	if (!wdev->netdev || !netif_running(wdev->netdev))
2351		return true;
2352
2353	for (link = 0; link < ARRAY_SIZE(wdev->links); link++) {
2354		struct ieee80211_channel *chan;
2355
2356		if (!wdev->valid_links && link > 0)
2357			break;
2358		if (wdev->valid_links && !(wdev->valid_links & BIT(link)))
2359			continue;
2360		switch (iftype) {
2361		case NL80211_IFTYPE_AP:
2362		case NL80211_IFTYPE_P2P_GO:
2363			if (!wdev->links[link].ap.beacon_interval)
2364				continue;
2365			chandef = wdev->links[link].ap.chandef;
2366			break;
2367		case NL80211_IFTYPE_MESH_POINT:
2368			if (!wdev->u.mesh.beacon_interval)
2369				continue;
2370			chandef = wdev->u.mesh.chandef;
2371			break;
2372		case NL80211_IFTYPE_ADHOC:
2373			if (!wdev->u.ibss.ssid_len)
2374				continue;
2375			chandef = wdev->u.ibss.chandef;
2376			break;
2377		case NL80211_IFTYPE_STATION:
2378		case NL80211_IFTYPE_P2P_CLIENT:
2379			/* Maybe we could consider disabling that link only? */
2380			if (!wdev->links[link].client.current_bss)
2381				continue;
2382
2383			chan = wdev->links[link].client.current_bss->pub.channel;
2384			if (!chan)
2385				continue;
2386
2387			if (!rdev->ops->get_channel ||
2388			    rdev_get_channel(rdev, wdev, link, &chandef))
2389				cfg80211_chandef_create(&chandef, chan,
2390							NL80211_CHAN_NO_HT);
2391			break;
2392		case NL80211_IFTYPE_MONITOR:
2393		case NL80211_IFTYPE_AP_VLAN:
2394		case NL80211_IFTYPE_P2P_DEVICE:
2395			/* no enforcement required */
2396			break;
2397		case NL80211_IFTYPE_OCB:
2398			if (!wdev->u.ocb.chandef.chan)
2399				continue;
2400			chandef = wdev->u.ocb.chandef;
2401			break;
2402		case NL80211_IFTYPE_NAN:
2403			/* we have no info, but NAN is also pretty universal */
2404			continue;
2405		default:
2406			/* others not implemented for now */
2407			WARN_ON_ONCE(1);
2408			break;
2409		}
2410
2411		switch (iftype) {
2412		case NL80211_IFTYPE_AP:
2413		case NL80211_IFTYPE_P2P_GO:
2414		case NL80211_IFTYPE_ADHOC:
2415		case NL80211_IFTYPE_MESH_POINT:
2416			ret = cfg80211_reg_can_beacon_relax(wiphy, &chandef,
2417							    iftype);
2418			if (!ret)
2419				return ret;
2420			break;
2421		case NL80211_IFTYPE_STATION:
2422		case NL80211_IFTYPE_P2P_CLIENT:
2423			ret = cfg80211_chandef_usable(wiphy, &chandef,
2424						      IEEE80211_CHAN_DISABLED);
2425			if (!ret)
2426				return ret;
2427			break;
2428		default:
2429			break;
2430		}
2431	}
2432
2433	return true;
2434}
2435
2436static void reg_leave_invalid_chans(struct wiphy *wiphy)
2437{
2438	struct wireless_dev *wdev;
2439	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2440
2441	guard(wiphy)(wiphy);
2442
2443	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list)
2444		if (!reg_wdev_chan_valid(wiphy, wdev))
2445			cfg80211_leave(rdev, wdev);
2446}
2447
2448static void reg_check_chans_work(struct work_struct *work)
2449{
2450	struct cfg80211_registered_device *rdev;
2451
2452	pr_debug("Verifying active interfaces after reg change\n");
2453	rtnl_lock();
2454
2455	for_each_rdev(rdev)
2456		reg_leave_invalid_chans(&rdev->wiphy);
2457
2458	rtnl_unlock();
2459}
2460
2461void reg_check_channels(void)
2462{
2463	/*
2464	 * Give usermode a chance to do something nicer (move to another
2465	 * channel, orderly disconnection), before forcing a disconnection.
2466	 */
2467	mod_delayed_work(system_power_efficient_wq,
2468			 &reg_check_chans,
2469			 msecs_to_jiffies(REG_ENFORCE_GRACE_MS));
2470}
2471
2472static void wiphy_update_regulatory(struct wiphy *wiphy,
2473				    enum nl80211_reg_initiator initiator)
2474{
2475	enum nl80211_band band;
2476	struct regulatory_request *lr = get_last_request();
2477
2478	if (ignore_reg_update(wiphy, initiator)) {
2479		/*
2480		 * Regulatory updates set by CORE are ignored for custom
2481		 * regulatory cards. Let us notify the changes to the driver,
2482		 * as some drivers used this to restore its orig_* reg domain.
2483		 */
2484		if (initiator == NL80211_REGDOM_SET_BY_CORE &&
2485		    wiphy->regulatory_flags & REGULATORY_CUSTOM_REG &&
2486		    !(wiphy->regulatory_flags &
2487		      REGULATORY_WIPHY_SELF_MANAGED))
2488			reg_call_notifier(wiphy, lr);
2489		return;
2490	}
2491
2492	lr->dfs_region = get_cfg80211_regdom()->dfs_region;
2493
2494	for (band = 0; band < NUM_NL80211_BANDS; band++)
2495		handle_band(wiphy, initiator, wiphy->bands[band]);
2496
2497	reg_process_beacons(wiphy);
2498	reg_process_ht_flags(wiphy);
2499	reg_call_notifier(wiphy, lr);
2500}
2501
2502static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)
2503{
2504	struct cfg80211_registered_device *rdev;
2505	struct wiphy *wiphy;
2506
2507	ASSERT_RTNL();
2508
2509	for_each_rdev(rdev) {
2510		wiphy = &rdev->wiphy;
2511		wiphy_update_regulatory(wiphy, initiator);
2512	}
2513
2514	reg_check_channels();
2515}
2516
2517static void handle_channel_custom(struct wiphy *wiphy,
2518				  struct ieee80211_channel *chan,
2519				  const struct ieee80211_regdomain *regd,
2520				  u32 min_bw)
2521{
2522	u32 bw_flags = 0;
2523	const struct ieee80211_reg_rule *reg_rule = NULL;
2524	const struct ieee80211_power_rule *power_rule = NULL;
2525	u32 bw, center_freq_khz;
2526
2527	center_freq_khz = ieee80211_channel_to_khz(chan);
2528	for (bw = MHZ_TO_KHZ(20); bw >= min_bw; bw = bw / 2) {
2529		reg_rule = freq_reg_info_regd(center_freq_khz, regd, bw);
2530		if (!IS_ERR(reg_rule))
2531			break;
2532	}
2533
2534	if (IS_ERR_OR_NULL(reg_rule)) {
2535		pr_debug("Disabling freq %d.%03d MHz as custom regd has no rule that fits it\n",
2536			 chan->center_freq, chan->freq_offset);
2537		if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED) {
2538			chan->flags |= IEEE80211_CHAN_DISABLED;
2539		} else {
2540			chan->orig_flags |= IEEE80211_CHAN_DISABLED;
2541			chan->flags = chan->orig_flags;
2542		}
2543		return;
2544	}
2545
2546	power_rule = &reg_rule->power_rule;
2547	bw_flags = reg_rule_to_chan_bw_flags(regd, reg_rule, chan);
2548
2549	chan->dfs_state_entered = jiffies;
2550	chan->dfs_state = NL80211_DFS_USABLE;
2551
2552	chan->beacon_found = false;
2553
2554	if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED)
2555		chan->flags = chan->orig_flags | bw_flags |
2556			      map_regdom_flags(reg_rule->flags);
2557	else
2558		chan->flags |= map_regdom_flags(reg_rule->flags) | bw_flags;
2559
2560	chan->max_antenna_gain = (int) MBI_TO_DBI(power_rule->max_antenna_gain);
2561	chan->max_reg_power = chan->max_power =
2562		(int) MBM_TO_DBM(power_rule->max_eirp);
2563
2564	if (chan->flags & IEEE80211_CHAN_RADAR) {
2565		if (reg_rule->dfs_cac_ms)
2566			chan->dfs_cac_ms = reg_rule->dfs_cac_ms;
2567		else
2568			chan->dfs_cac_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
2569	}
2570
2571	if (chan->flags & IEEE80211_CHAN_PSD)
2572		chan->psd = reg_rule->psd;
2573
2574	chan->max_power = chan->max_reg_power;
2575}
2576
2577static void handle_band_custom(struct wiphy *wiphy,
2578			       struct ieee80211_supported_band *sband,
2579			       const struct ieee80211_regdomain *regd)
2580{
2581	unsigned int i;
2582
2583	if (!sband)
2584		return;
2585
2586	/*
2587	 * We currently assume that you always want at least 20 MHz,
2588	 * otherwise channel 12 might get enabled if this rule is
2589	 * compatible to US, which permits 2402 - 2472 MHz.
2590	 */
2591	for (i = 0; i < sband->n_channels; i++)
2592		handle_channel_custom(wiphy, &sband->channels[i], regd,
2593				      MHZ_TO_KHZ(20));
2594}
2595
2596/* Used by drivers prior to wiphy registration */
2597void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
2598				   const struct ieee80211_regdomain *regd)
2599{
2600	const struct ieee80211_regdomain *new_regd, *tmp;
2601	enum nl80211_band band;
2602	unsigned int bands_set = 0;
2603
2604	WARN(!(wiphy->regulatory_flags & REGULATORY_CUSTOM_REG),
2605	     "wiphy should have REGULATORY_CUSTOM_REG\n");
2606	wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
2607
2608	for (band = 0; band < NUM_NL80211_BANDS; band++) {
2609		if (!wiphy->bands[band])
2610			continue;
2611		handle_band_custom(wiphy, wiphy->bands[band], regd);
2612		bands_set++;
2613	}
2614
2615	/*
2616	 * no point in calling this if it won't have any effect
2617	 * on your device's supported bands.
2618	 */
2619	WARN_ON(!bands_set);
2620	new_regd = reg_copy_regd(regd);
2621	if (IS_ERR(new_regd))
2622		return;
2623
2624	rtnl_lock();
2625	scoped_guard(wiphy, wiphy) {
2626		tmp = get_wiphy_regdom(wiphy);
2627		rcu_assign_pointer(wiphy->regd, new_regd);
2628		rcu_free_regdom(tmp);
2629	}
2630	rtnl_unlock();
2631}
2632EXPORT_SYMBOL(wiphy_apply_custom_regulatory);
2633
2634static void reg_set_request_processed(void)
2635{
2636	bool need_more_processing = false;
2637	struct regulatory_request *lr = get_last_request();
2638
2639	lr->processed = true;
2640
2641	spin_lock(&reg_requests_lock);
2642	if (!list_empty(&reg_requests_list))
2643		need_more_processing = true;
2644	spin_unlock(&reg_requests_lock);
2645
2646	cancel_crda_timeout();
2647
2648	if (need_more_processing)
2649		schedule_work(&reg_work);
2650}
2651
2652/**
2653 * reg_process_hint_core - process core regulatory requests
2654 * @core_request: a pending core regulatory request
2655 *
2656 * The wireless subsystem can use this function to process
2657 * a regulatory request issued by the regulatory core.
2658 *
2659 * Returns: %REG_REQ_OK or %REG_REQ_IGNORE, indicating if the
2660 *	hint was processed or ignored
2661 */
2662static enum reg_request_treatment
2663reg_process_hint_core(struct regulatory_request *core_request)
2664{
2665	if (reg_query_database(core_request)) {
2666		core_request->intersect = false;
2667		core_request->processed = false;
2668		reg_update_last_request(core_request);
2669		return REG_REQ_OK;
2670	}
2671
2672	return REG_REQ_IGNORE;
2673}
2674
2675static enum reg_request_treatment
2676__reg_process_hint_user(struct regulatory_request *user_request)
2677{
2678	struct regulatory_request *lr = get_last_request();
2679
2680	if (reg_request_cell_base(user_request))
2681		return reg_ignore_cell_hint(user_request);
2682
2683	if (reg_request_cell_base(lr))
2684		return REG_REQ_IGNORE;
2685
2686	if (lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE)
2687		return REG_REQ_INTERSECT;
2688	/*
2689	 * If the user knows better the user should set the regdom
2690	 * to their country before the IE is picked up
2691	 */
2692	if (lr->initiator == NL80211_REGDOM_SET_BY_USER &&
2693	    lr->intersect)
2694		return REG_REQ_IGNORE;
2695	/*
2696	 * Process user requests only after previous user/driver/core
2697	 * requests have been processed
2698	 */
2699	if ((lr->initiator == NL80211_REGDOM_SET_BY_CORE ||
2700	     lr->initiator == NL80211_REGDOM_SET_BY_DRIVER ||
2701	     lr->initiator == NL80211_REGDOM_SET_BY_USER) &&
2702	    regdom_changes(lr->alpha2))
2703		return REG_REQ_IGNORE;
2704
2705	if (!regdom_changes(user_request->alpha2))
2706		return REG_REQ_ALREADY_SET;
2707
2708	return REG_REQ_OK;
2709}
2710
2711/**
2712 * reg_process_hint_user - process user regulatory requests
2713 * @user_request: a pending user regulatory request
2714 *
2715 * The wireless subsystem can use this function to process
2716 * a regulatory request initiated by userspace.
2717 *
2718 * Returns: %REG_REQ_OK or %REG_REQ_IGNORE, indicating if the
2719 *	hint was processed or ignored
2720 */
2721static enum reg_request_treatment
2722reg_process_hint_user(struct regulatory_request *user_request)
2723{
2724	enum reg_request_treatment treatment;
2725
2726	treatment = __reg_process_hint_user(user_request);
2727	if (treatment == REG_REQ_IGNORE ||
2728	    treatment == REG_REQ_ALREADY_SET)
2729		return REG_REQ_IGNORE;
2730
2731	user_request->intersect = treatment == REG_REQ_INTERSECT;
2732	user_request->processed = false;
2733
2734	if (reg_query_database(user_request)) {
2735		reg_update_last_request(user_request);
2736		user_alpha2[0] = user_request->alpha2[0];
2737		user_alpha2[1] = user_request->alpha2[1];
2738		return REG_REQ_OK;
2739	}
2740
2741	return REG_REQ_IGNORE;
2742}
2743
2744static enum reg_request_treatment
2745__reg_process_hint_driver(struct regulatory_request *driver_request)
2746{
2747	struct regulatory_request *lr = get_last_request();
2748
2749	if (lr->initiator == NL80211_REGDOM_SET_BY_CORE) {
2750		if (regdom_changes(driver_request->alpha2))
2751			return REG_REQ_OK;
2752		return REG_REQ_ALREADY_SET;
2753	}
2754
2755	/*
2756	 * This would happen if you unplug and plug your card
2757	 * back in or if you add a new device for which the previously
2758	 * loaded card also agrees on the regulatory domain.
2759	 */
2760	if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
2761	    !regdom_changes(driver_request->alpha2))
2762		return REG_REQ_ALREADY_SET;
2763
2764	return REG_REQ_INTERSECT;
2765}
2766
2767/**
2768 * reg_process_hint_driver - process driver regulatory requests
2769 * @wiphy: the wireless device for the regulatory request
2770 * @driver_request: a pending driver regulatory request
2771 *
2772 * The wireless subsystem can use this function to process
2773 * a regulatory request issued by an 802.11 driver.
2774 *
2775 * Returns: one of the different reg request treatment values.
2776 */
2777static enum reg_request_treatment
2778reg_process_hint_driver(struct wiphy *wiphy,
2779			struct regulatory_request *driver_request)
2780{
2781	const struct ieee80211_regdomain *regd, *tmp;
2782	enum reg_request_treatment treatment;
2783
2784	treatment = __reg_process_hint_driver(driver_request);
2785
2786	switch (treatment) {
2787	case REG_REQ_OK:
2788		break;
2789	case REG_REQ_IGNORE:
2790		return REG_REQ_IGNORE;
2791	case REG_REQ_INTERSECT:
2792	case REG_REQ_ALREADY_SET:
2793		regd = reg_copy_regd(get_cfg80211_regdom());
2794		if (IS_ERR(regd))
2795			return REG_REQ_IGNORE;
2796
2797		tmp = get_wiphy_regdom(wiphy);
2798		ASSERT_RTNL();
2799		scoped_guard(wiphy, wiphy) {
2800			rcu_assign_pointer(wiphy->regd, regd);
2801		}
2802		rcu_free_regdom(tmp);
2803	}
2804
2805
2806	driver_request->intersect = treatment == REG_REQ_INTERSECT;
2807	driver_request->processed = false;
2808
2809	/*
2810	 * Since CRDA will not be called in this case as we already
2811	 * have applied the requested regulatory domain before we just
2812	 * inform userspace we have processed the request
2813	 */
2814	if (treatment == REG_REQ_ALREADY_SET) {
2815		nl80211_send_reg_change_event(driver_request);
2816		reg_update_last_request(driver_request);
2817		reg_set_request_processed();
2818		return REG_REQ_ALREADY_SET;
2819	}
2820
2821	if (reg_query_database(driver_request)) {
2822		reg_update_last_request(driver_request);
2823		return REG_REQ_OK;
2824	}
2825
2826	return REG_REQ_IGNORE;
2827}
2828
2829static enum reg_request_treatment
2830__reg_process_hint_country_ie(struct wiphy *wiphy,
2831			      struct regulatory_request *country_ie_request)
2832{
2833	struct wiphy *last_wiphy = NULL;
2834	struct regulatory_request *lr = get_last_request();
2835
2836	if (reg_request_cell_base(lr)) {
2837		/* Trust a Cell base station over the AP's country IE */
2838		if (regdom_changes(country_ie_request->alpha2))
2839			return REG_REQ_IGNORE;
2840		return REG_REQ_ALREADY_SET;
2841	} else {
2842		if (wiphy->regulatory_flags & REGULATORY_COUNTRY_IE_IGNORE)
2843			return REG_REQ_IGNORE;
2844	}
2845
2846	if (unlikely(!is_an_alpha2(country_ie_request->alpha2)))
2847		return -EINVAL;
2848
2849	if (lr->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE)
2850		return REG_REQ_OK;
2851
2852	last_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
2853
2854	if (last_wiphy != wiphy) {
2855		/*
2856		 * Two cards with two APs claiming different
2857		 * Country IE alpha2s. We could
2858		 * intersect them, but that seems unlikely
2859		 * to be correct. Reject second one for now.
2860		 */
2861		if (regdom_changes(country_ie_request->alpha2))
2862			return REG_REQ_IGNORE;
2863		return REG_REQ_ALREADY_SET;
2864	}
2865
2866	if (regdom_changes(country_ie_request->alpha2))
2867		return REG_REQ_OK;
2868	return REG_REQ_ALREADY_SET;
2869}
2870
2871/**
2872 * reg_process_hint_country_ie - process regulatory requests from country IEs
2873 * @wiphy: the wireless device for the regulatory request
2874 * @country_ie_request: a regulatory request from a country IE
2875 *
2876 * The wireless subsystem can use this function to process
2877 * a regulatory request issued by a country Information Element.
2878 *
2879 * Returns: one of the different reg request treatment values.
2880 */
2881static enum reg_request_treatment
2882reg_process_hint_country_ie(struct wiphy *wiphy,
2883			    struct regulatory_request *country_ie_request)
2884{
2885	enum reg_request_treatment treatment;
2886
2887	treatment = __reg_process_hint_country_ie(wiphy, country_ie_request);
2888
2889	switch (treatment) {
2890	case REG_REQ_OK:
2891		break;
2892	case REG_REQ_IGNORE:
2893		return REG_REQ_IGNORE;
2894	case REG_REQ_ALREADY_SET:
2895		reg_free_request(country_ie_request);
2896		return REG_REQ_ALREADY_SET;
2897	case REG_REQ_INTERSECT:
2898		/*
2899		 * This doesn't happen yet, not sure we
2900		 * ever want to support it for this case.
2901		 */
2902		WARN_ONCE(1, "Unexpected intersection for country elements");
2903		return REG_REQ_IGNORE;
2904	}
2905
2906	country_ie_request->intersect = false;
2907	country_ie_request->processed = false;
2908
2909	if (reg_query_database(country_ie_request)) {
2910		reg_update_last_request(country_ie_request);
2911		return REG_REQ_OK;
2912	}
2913
2914	return REG_REQ_IGNORE;
2915}
2916
2917bool reg_dfs_domain_same(struct wiphy *wiphy1, struct wiphy *wiphy2)
2918{
2919	const struct ieee80211_regdomain *wiphy1_regd = NULL;
2920	const struct ieee80211_regdomain *wiphy2_regd = NULL;
2921	const struct ieee80211_regdomain *cfg80211_regd = NULL;
2922	bool dfs_domain_same;
2923
2924	rcu_read_lock();
2925
2926	cfg80211_regd = rcu_dereference(cfg80211_regdomain);
2927	wiphy1_regd = rcu_dereference(wiphy1->regd);
2928	if (!wiphy1_regd)
2929		wiphy1_regd = cfg80211_regd;
2930
2931	wiphy2_regd = rcu_dereference(wiphy2->regd);
2932	if (!wiphy2_regd)
2933		wiphy2_regd = cfg80211_regd;
2934
2935	dfs_domain_same = wiphy1_regd->dfs_region == wiphy2_regd->dfs_region;
2936
2937	rcu_read_unlock();
2938
2939	return dfs_domain_same;
2940}
2941
2942static void reg_copy_dfs_chan_state(struct ieee80211_channel *dst_chan,
2943				    struct ieee80211_channel *src_chan)
2944{
2945	if (!(dst_chan->flags & IEEE80211_CHAN_RADAR) ||
2946	    !(src_chan->flags & IEEE80211_CHAN_RADAR))
2947		return;
2948
2949	if (dst_chan->flags & IEEE80211_CHAN_DISABLED ||
2950	    src_chan->flags & IEEE80211_CHAN_DISABLED)
2951		return;
2952
2953	if (src_chan->center_freq == dst_chan->center_freq &&
2954	    dst_chan->dfs_state == NL80211_DFS_USABLE) {
2955		dst_chan->dfs_state = src_chan->dfs_state;
2956		dst_chan->dfs_state_entered = src_chan->dfs_state_entered;
2957	}
2958}
2959
2960static void wiphy_share_dfs_chan_state(struct wiphy *dst_wiphy,
2961				       struct wiphy *src_wiphy)
2962{
2963	struct ieee80211_supported_band *src_sband, *dst_sband;
2964	struct ieee80211_channel *src_chan, *dst_chan;
2965	int i, j, band;
2966
2967	if (!reg_dfs_domain_same(dst_wiphy, src_wiphy))
2968		return;
2969
2970	for (band = 0; band < NUM_NL80211_BANDS; band++) {
2971		dst_sband = dst_wiphy->bands[band];
2972		src_sband = src_wiphy->bands[band];
2973		if (!dst_sband || !src_sband)
2974			continue;
2975
2976		for (i = 0; i < dst_sband->n_channels; i++) {
2977			dst_chan = &dst_sband->channels[i];
2978			for (j = 0; j < src_sband->n_channels; j++) {
2979				src_chan = &src_sband->channels[j];
2980				reg_copy_dfs_chan_state(dst_chan, src_chan);
2981			}
2982		}
2983	}
2984}
2985
2986static void wiphy_all_share_dfs_chan_state(struct wiphy *wiphy)
2987{
2988	struct cfg80211_registered_device *rdev;
2989
2990	ASSERT_RTNL();
2991
2992	for_each_rdev(rdev) {
2993		if (wiphy == &rdev->wiphy)
2994			continue;
2995		wiphy_share_dfs_chan_state(wiphy, &rdev->wiphy);
2996	}
2997}
2998
2999/* This processes *all* regulatory hints */
3000static void reg_process_hint(struct regulatory_request *reg_request)
3001{
3002	struct wiphy *wiphy = NULL;
3003	enum reg_request_treatment treatment;
3004	enum nl80211_reg_initiator initiator = reg_request->initiator;
3005
3006	if (reg_request->wiphy_idx != WIPHY_IDX_INVALID)
3007		wiphy = wiphy_idx_to_wiphy(reg_request->wiphy_idx);
3008
3009	switch (initiator) {
3010	case NL80211_REGDOM_SET_BY_CORE:
3011		treatment = reg_process_hint_core(reg_request);
3012		break;
3013	case NL80211_REGDOM_SET_BY_USER:
3014		treatment = reg_process_hint_user(reg_request);
3015		break;
3016	case NL80211_REGDOM_SET_BY_DRIVER:
3017		if (!wiphy)
3018			goto out_free;
3019		treatment = reg_process_hint_driver(wiphy, reg_request);
3020		break;
3021	case NL80211_REGDOM_SET_BY_COUNTRY_IE:
3022		if (!wiphy)
3023			goto out_free;
3024		treatment = reg_process_hint_country_ie(wiphy, reg_request);
3025		break;
3026	default:
3027		WARN(1, "invalid initiator %d\n", initiator);
3028		goto out_free;
3029	}
3030
3031	if (treatment == REG_REQ_IGNORE)
3032		goto out_free;
3033
3034	WARN(treatment != REG_REQ_OK && treatment != REG_REQ_ALREADY_SET,
3035	     "unexpected treatment value %d\n", treatment);
3036
3037	/* This is required so that the orig_* parameters are saved.
3038	 * NOTE: treatment must be set for any case that reaches here!
3039	 */
3040	if (treatment == REG_REQ_ALREADY_SET && wiphy &&
3041	    wiphy->regulatory_flags & REGULATORY_STRICT_REG) {
3042		wiphy_update_regulatory(wiphy, initiator);
3043		wiphy_all_share_dfs_chan_state(wiphy);
3044		reg_check_channels();
3045	}
3046
3047	return;
3048
3049out_free:
3050	reg_free_request(reg_request);
3051}
3052
3053static void notify_self_managed_wiphys(struct regulatory_request *request)
3054{
3055	struct cfg80211_registered_device *rdev;
3056	struct wiphy *wiphy;
3057
3058	for_each_rdev(rdev) {
3059		wiphy = &rdev->wiphy;
3060		if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
3061		    request->initiator == NL80211_REGDOM_SET_BY_USER)
3062			reg_call_notifier(wiphy, request);
3063	}
3064}
3065
3066/*
3067 * Processes regulatory hints, this is all the NL80211_REGDOM_SET_BY_*
3068 * Regulatory hints come on a first come first serve basis and we
3069 * must process each one atomically.
3070 */
3071static void reg_process_pending_hints(void)
3072{
3073	struct regulatory_request *reg_request, *lr;
3074
3075	lr = get_last_request();
3076
3077	/* When last_request->processed becomes true this will be rescheduled */
3078	if (lr && !lr->processed) {
3079		pr_debug("Pending regulatory request, waiting for it to be processed...\n");
3080		return;
3081	}
3082
3083	spin_lock(&reg_requests_lock);
3084
3085	if (list_empty(&reg_requests_list)) {
3086		spin_unlock(&reg_requests_lock);
3087		return;
3088	}
3089
3090	reg_request = list_first_entry(&reg_requests_list,
3091				       struct regulatory_request,
3092				       list);
3093	list_del_init(&reg_request->list);
3094
3095	spin_unlock(&reg_requests_lock);
3096
3097	notify_self_managed_wiphys(reg_request);
3098
3099	reg_process_hint(reg_request);
3100
3101	lr = get_last_request();
3102
3103	spin_lock(&reg_requests_lock);
3104	if (!list_empty(&reg_requests_list) && lr && lr->processed)
3105		schedule_work(&reg_work);
3106	spin_unlock(&reg_requests_lock);
3107}
3108
3109/* Processes beacon hints -- this has nothing to do with country IEs */
3110static void reg_process_pending_beacon_hints(void)
3111{
3112	struct cfg80211_registered_device *rdev;
3113	struct reg_beacon *pending_beacon, *tmp;
3114
3115	/* This goes through the _pending_ beacon list */
3116	spin_lock_bh(&reg_pending_beacons_lock);
3117
3118	list_for_each_entry_safe(pending_beacon, tmp,
3119				 &reg_pending_beacons, list) {
3120		list_del_init(&pending_beacon->list);
3121
3122		/* Applies the beacon hint to current wiphys */
3123		for_each_rdev(rdev)
3124			wiphy_update_new_beacon(&rdev->wiphy, pending_beacon);
3125
3126		/* Remembers the beacon hint for new wiphys or reg changes */
3127		list_add_tail(&pending_beacon->list, &reg_beacon_list);
3128	}
3129
3130	spin_unlock_bh(&reg_pending_beacons_lock);
3131}
3132
3133static void reg_process_self_managed_hint(struct wiphy *wiphy)
3134{
3135	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
3136	const struct ieee80211_regdomain *tmp;
3137	const struct ieee80211_regdomain *regd;
3138	enum nl80211_band band;
3139	struct regulatory_request request = {};
3140
3141	ASSERT_RTNL();
3142	lockdep_assert_wiphy(wiphy);
3143
3144	spin_lock(&reg_requests_lock);
3145	regd = rdev->requested_regd;
3146	rdev->requested_regd = NULL;
3147	spin_unlock(&reg_requests_lock);
3148
3149	if (!regd)
3150		return;
3151
3152	tmp = get_wiphy_regdom(wiphy);
3153	rcu_assign_pointer(wiphy->regd, regd);
3154	rcu_free_regdom(tmp);
3155
3156	for (band = 0; band < NUM_NL80211_BANDS; band++)
3157		handle_band_custom(wiphy, wiphy->bands[band], regd);
3158
3159	reg_process_ht_flags(wiphy);
3160
3161	request.wiphy_idx = get_wiphy_idx(wiphy);
3162	request.alpha2[0] = regd->alpha2[0];
3163	request.alpha2[1] = regd->alpha2[1];
3164	request.initiator = NL80211_REGDOM_SET_BY_DRIVER;
3165
3166	if (wiphy->flags & WIPHY_FLAG_NOTIFY_REGDOM_BY_DRIVER)
3167		reg_call_notifier(wiphy, &request);
3168
3169	nl80211_send_wiphy_reg_change_event(&request);
3170}
3171
3172static void reg_process_self_managed_hints(void)
3173{
3174	struct cfg80211_registered_device *rdev;
3175
3176	ASSERT_RTNL();
3177
3178	for_each_rdev(rdev) {
3179		guard(wiphy)(&rdev->wiphy);
3180
3181		reg_process_self_managed_hint(&rdev->wiphy);
3182	}
3183
3184	reg_check_channels();
3185}
3186
3187static void reg_todo(struct work_struct *work)
3188{
3189	rtnl_lock();
3190	reg_process_pending_hints();
3191	reg_process_pending_beacon_hints();
3192	reg_process_self_managed_hints();
3193	rtnl_unlock();
3194}
3195
3196static void queue_regulatory_request(struct regulatory_request *request)
3197{
3198	request->alpha2[0] = toupper(request->alpha2[0]);
3199	request->alpha2[1] = toupper(request->alpha2[1]);
3200
3201	spin_lock(&reg_requests_lock);
3202	list_add_tail(&request->list, &reg_requests_list);
3203	spin_unlock(&reg_requests_lock);
3204
3205	schedule_work(&reg_work);
3206}
3207
3208/*
3209 * Core regulatory hint -- happens during cfg80211_init()
3210 * and when we restore regulatory settings.
3211 */
3212static int regulatory_hint_core(const char *alpha2)
3213{
3214	struct regulatory_request *request;
3215
3216	request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
3217	if (!request)
3218		return -ENOMEM;
3219
3220	request->alpha2[0] = alpha2[0];
3221	request->alpha2[1] = alpha2[1];
3222	request->initiator = NL80211_REGDOM_SET_BY_CORE;
3223	request->wiphy_idx = WIPHY_IDX_INVALID;
3224
3225	queue_regulatory_request(request);
3226
3227	return 0;
3228}
3229
3230/* User hints */
3231int regulatory_hint_user(const char *alpha2,
3232			 enum nl80211_user_reg_hint_type user_reg_hint_type)
3233{
3234	struct regulatory_request *request;
3235
3236	if (WARN_ON(!alpha2))
3237		return -EINVAL;
3238
3239	if (!is_world_regdom(alpha2) && !is_an_alpha2(alpha2))
3240		return -EINVAL;
3241
3242	request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
3243	if (!request)
3244		return -ENOMEM;
3245
3246	request->wiphy_idx = WIPHY_IDX_INVALID;
3247	request->alpha2[0] = alpha2[0];
3248	request->alpha2[1] = alpha2[1];
3249	request->initiator = NL80211_REGDOM_SET_BY_USER;
3250	request->user_reg_hint_type = user_reg_hint_type;
3251
3252	/* Allow calling CRDA again */
3253	reset_crda_timeouts();
3254
3255	queue_regulatory_request(request);
3256
3257	return 0;
3258}
3259
3260void regulatory_hint_indoor(bool is_indoor, u32 portid)
3261{
3262	spin_lock(&reg_indoor_lock);
3263
3264	/* It is possible that more than one user space process is trying to
3265	 * configure the indoor setting. To handle such cases, clear the indoor
3266	 * setting in case that some process does not think that the device
3267	 * is operating in an indoor environment. In addition, if a user space
3268	 * process indicates that it is controlling the indoor setting, save its
3269	 * portid, i.e., make it the owner.
3270	 */
3271	reg_is_indoor = is_indoor;
3272	if (reg_is_indoor) {
3273		if (!reg_is_indoor_portid)
3274			reg_is_indoor_portid = portid;
3275	} else {
3276		reg_is_indoor_portid = 0;
3277	}
3278
3279	spin_unlock(&reg_indoor_lock);
3280
3281	if (!is_indoor)
3282		reg_check_channels();
3283}
3284
3285void regulatory_netlink_notify(u32 portid)
3286{
3287	spin_lock(&reg_indoor_lock);
3288
3289	if (reg_is_indoor_portid != portid) {
3290		spin_unlock(&reg_indoor_lock);
3291		return;
3292	}
3293
3294	reg_is_indoor = false;
3295	reg_is_indoor_portid = 0;
3296
3297	spin_unlock(&reg_indoor_lock);
3298
3299	reg_check_channels();
3300}
3301
3302/* Driver hints */
3303int regulatory_hint(struct wiphy *wiphy, const char *alpha2)
3304{
3305	struct regulatory_request *request;
3306
3307	if (WARN_ON(!alpha2 || !wiphy))
3308		return -EINVAL;
3309
3310	wiphy->regulatory_flags &= ~REGULATORY_CUSTOM_REG;
3311
3312	request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
3313	if (!request)
3314		return -ENOMEM;
3315
3316	request->wiphy_idx = get_wiphy_idx(wiphy);
3317
3318	request->alpha2[0] = alpha2[0];
3319	request->alpha2[1] = alpha2[1];
3320	request->initiator = NL80211_REGDOM_SET_BY_DRIVER;
3321
3322	/* Allow calling CRDA again */
3323	reset_crda_timeouts();
3324
3325	queue_regulatory_request(request);
3326
3327	return 0;
3328}
3329EXPORT_SYMBOL(regulatory_hint);
3330
3331void regulatory_hint_country_ie(struct wiphy *wiphy, enum nl80211_band band,
3332				const u8 *country_ie, u8 country_ie_len)
3333{
3334	char alpha2[2];
3335	enum environment_cap env = ENVIRON_ANY;
3336	struct regulatory_request *request = NULL, *lr;
3337
3338	/* IE len must be evenly divisible by 2 */
3339	if (country_ie_len & 0x01)
3340		return;
3341
3342	if (country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
3343		return;
3344
3345	request = kzalloc(sizeof(*request), GFP_KERNEL);
3346	if (!request)
3347		return;
3348
3349	alpha2[0] = country_ie[0];
3350	alpha2[1] = country_ie[1];
3351
3352	if (country_ie[2] == 'I')
3353		env = ENVIRON_INDOOR;
3354	else if (country_ie[2] == 'O')
3355		env = ENVIRON_OUTDOOR;
3356
3357	rcu_read_lock();
3358	lr = get_last_request();
3359
3360	if (unlikely(!lr))
3361		goto out;
3362
3363	/*
3364	 * We will run this only upon a successful connection on cfg80211.
3365	 * We leave conflict resolution to the workqueue, where can hold
3366	 * the RTNL.
3367	 */
3368	if (lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
3369	    lr->wiphy_idx != WIPHY_IDX_INVALID)
3370		goto out;
3371
3372	request->wiphy_idx = get_wiphy_idx(wiphy);
3373	request->alpha2[0] = alpha2[0];
3374	request->alpha2[1] = alpha2[1];
3375	request->initiator = NL80211_REGDOM_SET_BY_COUNTRY_IE;
3376	request->country_ie_env = env;
3377
3378	/* Allow calling CRDA again */
3379	reset_crda_timeouts();
3380
3381	queue_regulatory_request(request);
3382	request = NULL;
3383out:
3384	kfree(request);
3385	rcu_read_unlock();
3386}
3387
3388static void restore_alpha2(char *alpha2, bool reset_user)
3389{
3390	/* indicates there is no alpha2 to consider for restoration */
3391	alpha2[0] = '9';
3392	alpha2[1] = '7';
3393
3394	/* The user setting has precedence over the module parameter */
3395	if (is_user_regdom_saved()) {
3396		/* Unless we're asked to ignore it and reset it */
3397		if (reset_user) {
3398			pr_debug("Restoring regulatory settings including user preference\n");
3399			user_alpha2[0] = '9';
3400			user_alpha2[1] = '7';
3401
3402			/*
3403			 * If we're ignoring user settings, we still need to
3404			 * check the module parameter to ensure we put things
3405			 * back as they were for a full restore.
3406			 */
3407			if (!is_world_regdom(ieee80211_regdom)) {
3408				pr_debug("Keeping preference on module parameter ieee80211_regdom: %c%c\n",
3409					 ieee80211_regdom[0], ieee80211_regdom[1]);
3410				alpha2[0] = ieee80211_regdom[0];
3411				alpha2[1] = ieee80211_regdom[1];
3412			}
3413		} else {
3414			pr_debug("Restoring regulatory settings while preserving user preference for: %c%c\n",
3415				 user_alpha2[0], user_alpha2[1]);
3416			alpha2[0] = user_alpha2[0];
3417			alpha2[1] = user_alpha2[1];
3418		}
3419	} else if (!is_world_regdom(ieee80211_regdom)) {
3420		pr_debug("Keeping preference on module parameter ieee80211_regdom: %c%c\n",
3421			 ieee80211_regdom[0], ieee80211_regdom[1]);
3422		alpha2[0] = ieee80211_regdom[0];
3423		alpha2[1] = ieee80211_regdom[1];
3424	} else
3425		pr_debug("Restoring regulatory settings\n");
3426}
3427
3428static void restore_custom_reg_settings(struct wiphy *wiphy)
3429{
3430	struct ieee80211_supported_band *sband;
3431	enum nl80211_band band;
3432	struct ieee80211_channel *chan;
3433	int i;
3434
3435	for (band = 0; band < NUM_NL80211_BANDS; band++) {
3436		sband = wiphy->bands[band];
3437		if (!sband)
3438			continue;
3439		for (i = 0; i < sband->n_channels; i++) {
3440			chan = &sband->channels[i];
3441			chan->flags = chan->orig_flags;
3442			chan->max_antenna_gain = chan->orig_mag;
3443			chan->max_power = chan->orig_mpwr;
3444			chan->beacon_found = false;
3445		}
3446	}
3447}
3448
3449/*
3450 * Restoring regulatory settings involves ignoring any
3451 * possibly stale country IE information and user regulatory
3452 * settings if so desired, this includes any beacon hints
3453 * learned as we could have traveled outside to another country
3454 * after disconnection. To restore regulatory settings we do
3455 * exactly what we did at bootup:
3456 *
3457 *   - send a core regulatory hint
3458 *   - send a user regulatory hint if applicable
3459 *
3460 * Device drivers that send a regulatory hint for a specific country
3461 * keep their own regulatory domain on wiphy->regd so that does
3462 * not need to be remembered.
3463 */
3464static void restore_regulatory_settings(bool reset_user, bool cached)
3465{
3466	char alpha2[2];
3467	char world_alpha2[2];
3468	struct reg_beacon *reg_beacon, *btmp;
3469	LIST_HEAD(tmp_reg_req_list);
3470	struct cfg80211_registered_device *rdev;
3471
3472	ASSERT_RTNL();
3473
3474	/*
3475	 * Clear the indoor setting in case that it is not controlled by user
3476	 * space, as otherwise there is no guarantee that the device is still
3477	 * operating in an indoor environment.
3478	 */
3479	spin_lock(&reg_indoor_lock);
3480	if (reg_is_indoor && !reg_is_indoor_portid) {
3481		reg_is_indoor = false;
3482		reg_check_channels();
3483	}
3484	spin_unlock(&reg_indoor_lock);
3485
3486	reset_regdomains(true, &world_regdom);
3487	restore_alpha2(alpha2, reset_user);
3488
3489	/*
3490	 * If there's any pending requests we simply
3491	 * stash them to a temporary pending queue and
3492	 * add then after we've restored regulatory
3493	 * settings.
3494	 */
3495	spin_lock(&reg_requests_lock);
3496	list_splice_tail_init(&reg_requests_list, &tmp_reg_req_list);
3497	spin_unlock(&reg_requests_lock);
3498
3499	/* Clear beacon hints */
3500	spin_lock_bh(&reg_pending_beacons_lock);
3501	list_for_each_entry_safe(reg_beacon, btmp, &reg_pending_beacons, list) {
3502		list_del(&reg_beacon->list);
3503		kfree(reg_beacon);
3504	}
3505	spin_unlock_bh(&reg_pending_beacons_lock);
3506
3507	list_for_each_entry_safe(reg_beacon, btmp, &reg_beacon_list, list) {
3508		list_del(&reg_beacon->list);
3509		kfree(reg_beacon);
3510	}
3511
3512	/* First restore to the basic regulatory settings */
3513	world_alpha2[0] = cfg80211_world_regdom->alpha2[0];
3514	world_alpha2[1] = cfg80211_world_regdom->alpha2[1];
3515
3516	for_each_rdev(rdev) {
3517		if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED)
3518			continue;
3519		if (rdev->wiphy.regulatory_flags & REGULATORY_CUSTOM_REG)
3520			restore_custom_reg_settings(&rdev->wiphy);
3521	}
3522
3523	if (cached && (!is_an_alpha2(alpha2) ||
3524		       !IS_ERR_OR_NULL(cfg80211_user_regdom))) {
3525		reset_regdomains(false, cfg80211_world_regdom);
3526		update_all_wiphy_regulatory(NL80211_REGDOM_SET_BY_CORE);
3527		print_regdomain(get_cfg80211_regdom());
3528		nl80211_send_reg_change_event(&core_request_world);
3529		reg_set_request_processed();
3530
3531		if (is_an_alpha2(alpha2) &&
3532		    !regulatory_hint_user(alpha2, NL80211_USER_REG_HINT_USER)) {
3533			struct regulatory_request *ureq;
3534
3535			spin_lock(&reg_requests_lock);
3536			ureq = list_last_entry(&reg_requests_list,
3537					       struct regulatory_request,
3538					       list);
3539			list_del(&ureq->list);
3540			spin_unlock(&reg_requests_lock);
3541
3542			notify_self_managed_wiphys(ureq);
3543			reg_update_last_request(ureq);
3544			set_regdom(reg_copy_regd(cfg80211_user_regdom),
3545				   REGD_SOURCE_CACHED);
3546		}
3547	} else {
3548		regulatory_hint_core(world_alpha2);
3549
3550		/*
3551		 * This restores the ieee80211_regdom module parameter
3552		 * preference or the last user requested regulatory
3553		 * settings, user regulatory settings takes precedence.
3554		 */
3555		if (is_an_alpha2(alpha2))
3556			regulatory_hint_user(alpha2, NL80211_USER_REG_HINT_USER);
3557	}
3558
3559	spin_lock(&reg_requests_lock);
3560	list_splice_tail_init(&tmp_reg_req_list, &reg_requests_list);
3561	spin_unlock(&reg_requests_lock);
3562
3563	pr_debug("Kicking the queue\n");
3564
3565	schedule_work(&reg_work);
3566}
3567
3568static bool is_wiphy_all_set_reg_flag(enum ieee80211_regulatory_flags flag)
3569{
3570	struct cfg80211_registered_device *rdev;
3571	struct wireless_dev *wdev;
3572
3573	for_each_rdev(rdev) {
3574		guard(wiphy)(&rdev->wiphy);
3575
3576		list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3577			if (!(wdev->wiphy->regulatory_flags & flag))
3578				return false;
3579		}
3580	}
3581
3582	return true;
3583}
3584
3585void regulatory_hint_disconnect(void)
3586{
3587	/* Restore of regulatory settings is not required when wiphy(s)
3588	 * ignore IE from connected access point but clearance of beacon hints
3589	 * is required when wiphy(s) supports beacon hints.
3590	 */
3591	if (is_wiphy_all_set_reg_flag(REGULATORY_COUNTRY_IE_IGNORE)) {
3592		struct reg_beacon *reg_beacon, *btmp;
3593
3594		if (is_wiphy_all_set_reg_flag(REGULATORY_DISABLE_BEACON_HINTS))
3595			return;
3596
3597		spin_lock_bh(&reg_pending_beacons_lock);
3598		list_for_each_entry_safe(reg_beacon, btmp,
3599					 &reg_pending_beacons, list) {
3600			list_del(&reg_beacon->list);
3601			kfree(reg_beacon);
3602		}
3603		spin_unlock_bh(&reg_pending_beacons_lock);
3604
3605		list_for_each_entry_safe(reg_beacon, btmp,
3606					 &reg_beacon_list, list) {
3607			list_del(&reg_beacon->list);
3608			kfree(reg_beacon);
3609		}
3610
3611		return;
3612	}
3613
3614	pr_debug("All devices are disconnected, going to restore regulatory settings\n");
3615	restore_regulatory_settings(false, true);
3616}
3617
3618static bool freq_is_chan_12_13_14(u32 freq)
3619{
3620	if (freq == ieee80211_channel_to_frequency(12, NL80211_BAND_2GHZ) ||
3621	    freq == ieee80211_channel_to_frequency(13, NL80211_BAND_2GHZ) ||
3622	    freq == ieee80211_channel_to_frequency(14, NL80211_BAND_2GHZ))
3623		return true;
3624	return false;
3625}
3626
3627static bool pending_reg_beacon(struct ieee80211_channel *beacon_chan)
3628{
3629	struct reg_beacon *pending_beacon;
3630
3631	list_for_each_entry(pending_beacon, &reg_pending_beacons, list)
3632		if (ieee80211_channel_equal(beacon_chan,
3633					    &pending_beacon->chan))
3634			return true;
3635	return false;
3636}
3637
3638void regulatory_hint_found_beacon(struct wiphy *wiphy,
3639				  struct ieee80211_channel *beacon_chan,
3640				  gfp_t gfp)
3641{
3642	struct reg_beacon *reg_beacon;
3643	bool processing;
3644
3645	if (beacon_chan->beacon_found ||
3646	    beacon_chan->flags & IEEE80211_CHAN_RADAR ||
3647	    (beacon_chan->band == NL80211_BAND_2GHZ &&
3648	     !freq_is_chan_12_13_14(beacon_chan->center_freq)))
3649		return;
3650
3651	spin_lock_bh(&reg_pending_beacons_lock);
3652	processing = pending_reg_beacon(beacon_chan);
3653	spin_unlock_bh(&reg_pending_beacons_lock);
3654
3655	if (processing)
3656		return;
3657
3658	reg_beacon = kzalloc(sizeof(struct reg_beacon), gfp);
3659	if (!reg_beacon)
3660		return;
3661
3662	pr_debug("Found new beacon on frequency: %d.%03d MHz (Ch %d) on %s\n",
3663		 beacon_chan->center_freq, beacon_chan->freq_offset,
3664		 ieee80211_freq_khz_to_channel(
3665			 ieee80211_channel_to_khz(beacon_chan)),
3666		 wiphy_name(wiphy));
3667
3668	memcpy(&reg_beacon->chan, beacon_chan,
3669	       sizeof(struct ieee80211_channel));
3670
3671	/*
3672	 * Since we can be called from BH or and non-BH context
3673	 * we must use spin_lock_bh()
3674	 */
3675	spin_lock_bh(&reg_pending_beacons_lock);
3676	list_add_tail(&reg_beacon->list, &reg_pending_beacons);
3677	spin_unlock_bh(&reg_pending_beacons_lock);
3678
3679	schedule_work(&reg_work);
3680}
3681
3682static void print_rd_rules(const struct ieee80211_regdomain *rd)
3683{
3684	unsigned int i;
3685	const struct ieee80211_reg_rule *reg_rule = NULL;
3686	const struct ieee80211_freq_range *freq_range = NULL;
3687	const struct ieee80211_power_rule *power_rule = NULL;
3688	char bw[32], cac_time[32];
3689
3690	pr_debug("  (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)\n");
3691
3692	for (i = 0; i < rd->n_reg_rules; i++) {
3693		reg_rule = &rd->reg_rules[i];
3694		freq_range = &reg_rule->freq_range;
3695		power_rule = &reg_rule->power_rule;
3696
3697		if (reg_rule->flags & NL80211_RRF_AUTO_BW)
3698			snprintf(bw, sizeof(bw), "%d KHz, %u KHz AUTO",
3699				 freq_range->max_bandwidth_khz,
3700				 reg_get_max_bandwidth(rd, reg_rule));
3701		else
3702			snprintf(bw, sizeof(bw), "%d KHz",
3703				 freq_range->max_bandwidth_khz);
3704
3705		if (reg_rule->flags & NL80211_RRF_DFS)
3706			scnprintf(cac_time, sizeof(cac_time), "%u s",
3707				  reg_rule->dfs_cac_ms/1000);
3708		else
3709			scnprintf(cac_time, sizeof(cac_time), "N/A");
3710
3711
3712		/*
3713		 * There may not be documentation for max antenna gain
3714		 * in certain regions
3715		 */
3716		if (power_rule->max_antenna_gain)
3717			pr_debug("  (%d KHz - %d KHz @ %s), (%d mBi, %d mBm), (%s)\n",
3718				freq_range->start_freq_khz,
3719				freq_range->end_freq_khz,
3720				bw,
3721				power_rule->max_antenna_gain,
3722				power_rule->max_eirp,
3723				cac_time);
3724		else
3725			pr_debug("  (%d KHz - %d KHz @ %s), (N/A, %d mBm), (%s)\n",
3726				freq_range->start_freq_khz,
3727				freq_range->end_freq_khz,
3728				bw,
3729				power_rule->max_eirp,
3730				cac_time);
3731	}
3732}
3733
3734bool reg_supported_dfs_region(enum nl80211_dfs_regions dfs_region)
3735{
3736	switch (dfs_region) {
3737	case NL80211_DFS_UNSET:
3738	case NL80211_DFS_FCC:
3739	case NL80211_DFS_ETSI:
3740	case NL80211_DFS_JP:
3741		return true;
3742	default:
3743		pr_debug("Ignoring unknown DFS master region: %d\n", dfs_region);
3744		return false;
3745	}
3746}
3747
3748static void print_regdomain(const struct ieee80211_regdomain *rd)
3749{
3750	struct regulatory_request *lr = get_last_request();
3751
3752	if (is_intersected_alpha2(rd->alpha2)) {
3753		if (lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE) {
3754			struct cfg80211_registered_device *rdev;
3755			rdev = cfg80211_rdev_by_wiphy_idx(lr->wiphy_idx);
3756			if (rdev) {
3757				pr_debug("Current regulatory domain updated by AP to: %c%c\n",
3758					rdev->country_ie_alpha2[0],
3759					rdev->country_ie_alpha2[1]);
3760			} else
3761				pr_debug("Current regulatory domain intersected:\n");
3762		} else
3763			pr_debug("Current regulatory domain intersected:\n");
3764	} else if (is_world_regdom(rd->alpha2)) {
3765		pr_debug("World regulatory domain updated:\n");
3766	} else {
3767		if (is_unknown_alpha2(rd->alpha2))
3768			pr_debug("Regulatory domain changed to driver built-in settings (unknown country)\n");
3769		else {
3770			if (reg_request_cell_base(lr))
3771				pr_debug("Regulatory domain changed to country: %c%c by Cell Station\n",
3772					rd->alpha2[0], rd->alpha2[1]);
3773			else
3774				pr_debug("Regulatory domain changed to country: %c%c\n",
3775					rd->alpha2[0], rd->alpha2[1]);
3776		}
3777	}
3778
3779	pr_debug(" DFS Master region: %s", reg_dfs_region_str(rd->dfs_region));
3780	print_rd_rules(rd);
3781}
3782
3783static void print_regdomain_info(const struct ieee80211_regdomain *rd)
3784{
3785	pr_debug("Regulatory domain: %c%c\n", rd->alpha2[0], rd->alpha2[1]);
3786	print_rd_rules(rd);
3787}
3788
3789static int reg_set_rd_core(const struct ieee80211_regdomain *rd)
3790{
3791	if (!is_world_regdom(rd->alpha2))
3792		return -EINVAL;
3793	update_world_regdomain(rd);
3794	return 0;
3795}
3796
3797static int reg_set_rd_user(const struct ieee80211_regdomain *rd,
3798			   struct regulatory_request *user_request)
3799{
3800	const struct ieee80211_regdomain *intersected_rd = NULL;
3801
3802	if (!regdom_changes(rd->alpha2))
3803		return -EALREADY;
3804
3805	if (!is_valid_rd(rd)) {
3806		pr_err("Invalid regulatory domain detected: %c%c\n",
3807		       rd->alpha2[0], rd->alpha2[1]);
3808		print_regdomain_info(rd);
3809		return -EINVAL;
3810	}
3811
3812	if (!user_request->intersect) {
3813		reset_regdomains(false, rd);
3814		return 0;
3815	}
3816
3817	intersected_rd = regdom_intersect(rd, get_cfg80211_regdom());
3818	if (!intersected_rd)
3819		return -EINVAL;
3820
3821	kfree(rd);
3822	rd = NULL;
3823	reset_regdomains(false, intersected_rd);
3824
3825	return 0;
3826}
3827
3828static int reg_set_rd_driver(const struct ieee80211_regdomain *rd,
3829			     struct regulatory_request *driver_request)
3830{
3831	const struct ieee80211_regdomain *regd;
3832	const struct ieee80211_regdomain *intersected_rd = NULL;
3833	const struct ieee80211_regdomain *tmp = NULL;
3834	struct wiphy *request_wiphy;
3835
3836	if (is_world_regdom(rd->alpha2))
3837		return -EINVAL;
3838
3839	if (!regdom_changes(rd->alpha2))
3840		return -EALREADY;
3841
3842	if (!is_valid_rd(rd)) {
3843		pr_err("Invalid regulatory domain detected: %c%c\n",
3844		       rd->alpha2[0], rd->alpha2[1]);
3845		print_regdomain_info(rd);
3846		return -EINVAL;
3847	}
3848
3849	request_wiphy = wiphy_idx_to_wiphy(driver_request->wiphy_idx);
3850	if (!request_wiphy)
3851		return -ENODEV;
3852
3853	if (!driver_request->intersect) {
3854		ASSERT_RTNL();
3855		scoped_guard(wiphy, request_wiphy) {
3856			if (request_wiphy->regd)
3857				tmp = get_wiphy_regdom(request_wiphy);
3858
3859			regd = reg_copy_regd(rd);
3860			if (IS_ERR(regd))
3861				return PTR_ERR(regd);
3862
3863			rcu_assign_pointer(request_wiphy->regd, regd);
3864			rcu_free_regdom(tmp);
3865		}
3866
3867		reset_regdomains(false, rd);
3868		return 0;
3869	}
3870
3871	intersected_rd = regdom_intersect(rd, get_cfg80211_regdom());
3872	if (!intersected_rd)
3873		return -EINVAL;
3874
3875	/*
3876	 * We can trash what CRDA provided now.
3877	 * However if a driver requested this specific regulatory
3878	 * domain we keep it for its private use
3879	 */
3880	tmp = get_wiphy_regdom(request_wiphy);
3881	rcu_assign_pointer(request_wiphy->regd, rd);
3882	rcu_free_regdom(tmp);
3883
3884	rd = NULL;
3885
3886	reset_regdomains(false, intersected_rd);
3887
3888	return 0;
3889}
3890
3891static int reg_set_rd_country_ie(const struct ieee80211_regdomain *rd,
3892				 struct regulatory_request *country_ie_request)
3893{
3894	struct wiphy *request_wiphy;
3895
3896	if (!is_alpha2_set(rd->alpha2) && !is_an_alpha2(rd->alpha2) &&
3897	    !is_unknown_alpha2(rd->alpha2))
3898		return -EINVAL;
3899
3900	/*
3901	 * Lets only bother proceeding on the same alpha2 if the current
3902	 * rd is non static (it means CRDA was present and was used last)
3903	 * and the pending request came in from a country IE
3904	 */
3905
3906	if (!is_valid_rd(rd)) {
3907		pr_err("Invalid regulatory domain detected: %c%c\n",
3908		       rd->alpha2[0], rd->alpha2[1]);
3909		print_regdomain_info(rd);
3910		return -EINVAL;
3911	}
3912
3913	request_wiphy = wiphy_idx_to_wiphy(country_ie_request->wiphy_idx);
3914	if (!request_wiphy)
3915		return -ENODEV;
3916
3917	if (country_ie_request->intersect)
3918		return -EINVAL;
3919
3920	reset_regdomains(false, rd);
3921	return 0;
3922}
3923
3924/*
3925 * Use this call to set the current regulatory domain. Conflicts with
3926 * multiple drivers can be ironed out later. Caller must've already
3927 * kmalloc'd the rd structure.
3928 */
3929int set_regdom(const struct ieee80211_regdomain *rd,
3930	       enum ieee80211_regd_source regd_src)
3931{
3932	struct regulatory_request *lr;
3933	bool user_reset = false;
3934	int r;
3935
3936	if (IS_ERR_OR_NULL(rd))
3937		return -ENODATA;
3938
3939	if (!reg_is_valid_request(rd->alpha2)) {
3940		kfree(rd);
3941		return -EINVAL;
3942	}
3943
3944	if (regd_src == REGD_SOURCE_CRDA)
3945		reset_crda_timeouts();
3946
3947	lr = get_last_request();
3948
3949	/* Note that this doesn't update the wiphys, this is done below */
3950	switch (lr->initiator) {
3951	case NL80211_REGDOM_SET_BY_CORE:
3952		r = reg_set_rd_core(rd);
3953		break;
3954	case NL80211_REGDOM_SET_BY_USER:
3955		cfg80211_save_user_regdom(rd);
3956		r = reg_set_rd_user(rd, lr);
3957		user_reset = true;
3958		break;
3959	case NL80211_REGDOM_SET_BY_DRIVER:
3960		r = reg_set_rd_driver(rd, lr);
3961		break;
3962	case NL80211_REGDOM_SET_BY_COUNTRY_IE:
3963		r = reg_set_rd_country_ie(rd, lr);
3964		break;
3965	default:
3966		WARN(1, "invalid initiator %d\n", lr->initiator);
3967		kfree(rd);
3968		return -EINVAL;
3969	}
3970
3971	if (r) {
3972		switch (r) {
3973		case -EALREADY:
3974			reg_set_request_processed();
3975			break;
3976		default:
3977			/* Back to world regulatory in case of errors */
3978			restore_regulatory_settings(user_reset, false);
3979		}
3980
3981		kfree(rd);
3982		return r;
3983	}
3984
3985	/* This would make this whole thing pointless */
3986	if (WARN_ON(!lr->intersect && rd != get_cfg80211_regdom()))
3987		return -EINVAL;
3988
3989	/* update all wiphys now with the new established regulatory domain */
3990	update_all_wiphy_regulatory(lr->initiator);
3991
3992	print_regdomain(get_cfg80211_regdom());
3993
3994	nl80211_send_reg_change_event(lr);
3995
3996	reg_set_request_processed();
3997
3998	return 0;
3999}
4000
4001static int __regulatory_set_wiphy_regd(struct wiphy *wiphy,
4002				       struct ieee80211_regdomain *rd)
4003{
4004	const struct ieee80211_regdomain *regd;
4005	const struct ieee80211_regdomain *prev_regd;
4006	struct cfg80211_registered_device *rdev;
4007
4008	if (WARN_ON(!wiphy || !rd))
4009		return -EINVAL;
4010
4011	if (WARN(!(wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED),
4012		 "wiphy should have REGULATORY_WIPHY_SELF_MANAGED\n"))
4013		return -EPERM;
4014
4015	if (WARN(!is_valid_rd(rd),
4016		 "Invalid regulatory domain detected: %c%c\n",
4017		 rd->alpha2[0], rd->alpha2[1])) {
4018		print_regdomain_info(rd);
4019		return -EINVAL;
4020	}
4021
4022	regd = reg_copy_regd(rd);
4023	if (IS_ERR(regd))
4024		return PTR_ERR(regd);
4025
4026	rdev = wiphy_to_rdev(wiphy);
4027
4028	spin_lock(&reg_requests_lock);
4029	prev_regd = rdev->requested_regd;
4030	rdev->requested_regd = regd;
4031	spin_unlock(&reg_requests_lock);
4032
4033	kfree(prev_regd);
4034	return 0;
4035}
4036
4037int regulatory_set_wiphy_regd(struct wiphy *wiphy,
4038			      struct ieee80211_regdomain *rd)
4039{
4040	int ret = __regulatory_set_wiphy_regd(wiphy, rd);
4041
4042	if (ret)
4043		return ret;
4044
4045	schedule_work(&reg_work);
4046	return 0;
4047}
4048EXPORT_SYMBOL(regulatory_set_wiphy_regd);
4049
4050int regulatory_set_wiphy_regd_sync(struct wiphy *wiphy,
4051				   struct ieee80211_regdomain *rd)
4052{
4053	int ret;
4054
4055	ASSERT_RTNL();
4056
4057	ret = __regulatory_set_wiphy_regd(wiphy, rd);
4058	if (ret)
4059		return ret;
4060
4061	/* process the request immediately */
4062	reg_process_self_managed_hint(wiphy);
4063	reg_check_channels();
4064	return 0;
4065}
4066EXPORT_SYMBOL(regulatory_set_wiphy_regd_sync);
4067
4068void wiphy_regulatory_register(struct wiphy *wiphy)
4069{
4070	struct regulatory_request *lr = get_last_request();
4071
4072	/* self-managed devices ignore beacon hints and country IE */
4073	if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED) {
4074		wiphy->regulatory_flags |= REGULATORY_DISABLE_BEACON_HINTS |
4075					   REGULATORY_COUNTRY_IE_IGNORE;
4076
4077		/*
4078		 * The last request may have been received before this
4079		 * registration call. Call the driver notifier if
4080		 * initiator is USER.
4081		 */
4082		if (lr->initiator == NL80211_REGDOM_SET_BY_USER)
4083			reg_call_notifier(wiphy, lr);
4084	}
4085
4086	if (!reg_dev_ignore_cell_hint(wiphy))
4087		reg_num_devs_support_basehint++;
4088
4089	wiphy_update_regulatory(wiphy, lr->initiator);
4090	wiphy_all_share_dfs_chan_state(wiphy);
4091	reg_process_self_managed_hints();
4092}
4093
4094void wiphy_regulatory_deregister(struct wiphy *wiphy)
4095{
4096	struct wiphy *request_wiphy = NULL;
4097	struct regulatory_request *lr;
4098
4099	lr = get_last_request();
4100
4101	if (!reg_dev_ignore_cell_hint(wiphy))
4102		reg_num_devs_support_basehint--;
4103
4104	rcu_free_regdom(get_wiphy_regdom(wiphy));
4105	RCU_INIT_POINTER(wiphy->regd, NULL);
4106
4107	if (lr)
4108		request_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
4109
4110	if (!request_wiphy || request_wiphy != wiphy)
4111		return;
4112
4113	lr->wiphy_idx = WIPHY_IDX_INVALID;
4114	lr->country_ie_env = ENVIRON_ANY;
4115}
4116
4117/*
4118 * See FCC notices for UNII band definitions
4119 *  5GHz: https://www.fcc.gov/document/5-ghz-unlicensed-spectrum-unii
4120 *  6GHz: https://www.fcc.gov/document/fcc-proposes-more-spectrum-unlicensed-use-0
4121 */
4122int cfg80211_get_unii(int freq)
4123{
4124	/* UNII-1 */
4125	if (freq >= 5150 && freq <= 5250)
4126		return 0;
4127
4128	/* UNII-2A */
4129	if (freq > 5250 && freq <= 5350)
4130		return 1;
4131
4132	/* UNII-2B */
4133	if (freq > 5350 && freq <= 5470)
4134		return 2;
4135
4136	/* UNII-2C */
4137	if (freq > 5470 && freq <= 5725)
4138		return 3;
4139
4140	/* UNII-3 */
4141	if (freq > 5725 && freq <= 5825)
4142		return 4;
4143
4144	/* UNII-5 */
4145	if (freq > 5925 && freq <= 6425)
4146		return 5;
4147
4148	/* UNII-6 */
4149	if (freq > 6425 && freq <= 6525)
4150		return 6;
4151
4152	/* UNII-7 */
4153	if (freq > 6525 && freq <= 6875)
4154		return 7;
4155
4156	/* UNII-8 */
4157	if (freq > 6875 && freq <= 7125)
4158		return 8;
4159
4160	return -EINVAL;
4161}
4162
4163bool regulatory_indoor_allowed(void)
4164{
4165	return reg_is_indoor;
4166}
4167
4168bool regulatory_pre_cac_allowed(struct wiphy *wiphy)
4169{
4170	const struct ieee80211_regdomain *regd = NULL;
4171	const struct ieee80211_regdomain *wiphy_regd = NULL;
4172	bool pre_cac_allowed = false;
4173
4174	rcu_read_lock();
4175
4176	regd = rcu_dereference(cfg80211_regdomain);
4177	wiphy_regd = rcu_dereference(wiphy->regd);
4178	if (!wiphy_regd) {
4179		if (regd->dfs_region == NL80211_DFS_ETSI)
4180			pre_cac_allowed = true;
4181
4182		rcu_read_unlock();
4183
4184		return pre_cac_allowed;
4185	}
4186
4187	if (regd->dfs_region == wiphy_regd->dfs_region &&
4188	    wiphy_regd->dfs_region == NL80211_DFS_ETSI)
4189		pre_cac_allowed = true;
4190
4191	rcu_read_unlock();
4192
4193	return pre_cac_allowed;
4194}
4195EXPORT_SYMBOL(regulatory_pre_cac_allowed);
4196
4197static void cfg80211_check_and_end_cac(struct cfg80211_registered_device *rdev)
4198{
4199	struct wireless_dev *wdev;
4200	unsigned int link_id;
4201
4202	guard(wiphy)(&rdev->wiphy);
4203
4204	/* If we finished CAC or received radar, we should end any
4205	 * CAC running on the same channels.
4206	 * the check !cfg80211_chandef_dfs_usable contain 2 options:
4207	 * either all channels are available - those the CAC_FINISHED
4208	 * event has effected another wdev state, or there is a channel
4209	 * in unavailable state in wdev chandef - those the RADAR_DETECTED
4210	 * event has effected another wdev state.
4211	 * In both cases we should end the CAC on the wdev.
4212	 */
4213	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4214		struct cfg80211_chan_def *chandef;
4215
4216		for_each_valid_link(wdev, link_id) {
4217			if (!wdev->links[link_id].cac_started)
4218				continue;
4219
4220			chandef = wdev_chandef(wdev, link_id);
4221			if (!chandef)
4222				continue;
4223
4224			if (!cfg80211_chandef_dfs_usable(&rdev->wiphy, chandef))
4225				rdev_end_cac(rdev, wdev->netdev, link_id);
4226		}
4227	}
4228}
4229
4230void regulatory_propagate_dfs_state(struct wiphy *wiphy,
4231				    struct cfg80211_chan_def *chandef,
4232				    enum nl80211_dfs_state dfs_state,
4233				    enum nl80211_radar_event event)
4234{
4235	struct cfg80211_registered_device *rdev;
4236
4237	ASSERT_RTNL();
4238
4239	if (WARN_ON(!cfg80211_chandef_valid(chandef)))
4240		return;
4241
4242	for_each_rdev(rdev) {
4243		if (wiphy == &rdev->wiphy)
4244			continue;
4245
4246		if (!reg_dfs_domain_same(wiphy, &rdev->wiphy))
4247			continue;
4248
4249		if (!ieee80211_get_channel(&rdev->wiphy,
4250					   chandef->chan->center_freq))
4251			continue;
4252
4253		cfg80211_set_dfs_state(&rdev->wiphy, chandef, dfs_state);
4254
4255		if (event == NL80211_RADAR_DETECTED ||
4256		    event == NL80211_RADAR_CAC_FINISHED) {
4257			cfg80211_sched_dfs_chan_update(rdev);
4258			cfg80211_check_and_end_cac(rdev);
4259		}
4260
4261		nl80211_radar_notify(rdev, chandef, event, NULL, GFP_KERNEL);
4262	}
4263}
4264
4265static int __init regulatory_init_db(void)
4266{
4267	int err;
4268
4269	/*
4270	 * It's possible that - due to other bugs/issues - cfg80211
4271	 * never called regulatory_init() below, or that it failed;
4272	 * in that case, don't try to do any further work here as
4273	 * it's doomed to lead to crashes.
4274	 */
4275	if (!reg_fdev)
4276		return -EINVAL;
4277
4278	err = load_builtin_regdb_keys();
4279	if (err) {
4280		faux_device_destroy(reg_fdev);
4281		return err;
4282	}
4283
4284	/* We always try to get an update for the static regdomain */
4285	err = regulatory_hint_core(cfg80211_world_regdom->alpha2);
4286	if (err) {
4287		if (err == -ENOMEM) {
4288			faux_device_destroy(reg_fdev);
4289			return err;
4290		}
4291		/*
4292		 * N.B. kobject_uevent_env() can fail mainly for when we're out
4293		 * memory which is handled and propagated appropriately above
4294		 * but it can also fail during a netlink_broadcast() or during
4295		 * early boot for call_usermodehelper(). For now treat these
4296		 * errors as non-fatal.
4297		 */
4298		pr_err("kobject_uevent_env() was unable to call CRDA during init\n");
4299	}
4300
4301	/*
4302	 * Finally, if the user set the module parameter treat it
4303	 * as a user hint.
4304	 */
4305	if (!is_world_regdom(ieee80211_regdom))
4306		regulatory_hint_user(ieee80211_regdom,
4307				     NL80211_USER_REG_HINT_USER);
4308
4309	return 0;
4310}
4311#ifndef MODULE
4312late_initcall(regulatory_init_db);
4313#endif
4314
4315int __init regulatory_init(void)
4316{
4317	reg_fdev = faux_device_create("regulatory", NULL, NULL);
4318	if (!reg_fdev)
4319		return -ENODEV;
4320
4321	rcu_assign_pointer(cfg80211_regdomain, cfg80211_world_regdom);
4322
4323	user_alpha2[0] = '9';
4324	user_alpha2[1] = '7';
4325
4326#ifdef MODULE
4327	return regulatory_init_db();
4328#else
4329	return 0;
4330#endif
4331}
4332
4333void regulatory_exit(void)
4334{
4335	struct regulatory_request *reg_request, *tmp;
4336	struct reg_beacon *reg_beacon, *btmp;
4337
4338	cancel_work_sync(&reg_work);
4339	cancel_crda_timeout_sync();
4340	cancel_delayed_work_sync(&reg_check_chans);
4341
4342	/* Lock to suppress warnings */
4343	rtnl_lock();
4344	reset_regdomains(true, NULL);
4345	rtnl_unlock();
4346
4347	dev_set_uevent_suppress(&reg_fdev->dev, true);
4348
4349	faux_device_destroy(reg_fdev);
4350
4351	list_for_each_entry_safe(reg_beacon, btmp, &reg_pending_beacons, list) {
4352		list_del(&reg_beacon->list);
4353		kfree(reg_beacon);
4354	}
4355
4356	list_for_each_entry_safe(reg_beacon, btmp, &reg_beacon_list, list) {
4357		list_del(&reg_beacon->list);
4358		kfree(reg_beacon);
4359	}
4360
4361	list_for_each_entry_safe(reg_request, tmp, &reg_requests_list, list) {
4362		list_del(&reg_request->list);
4363		kfree(reg_request);
4364	}
4365
4366	if (!IS_ERR_OR_NULL(regdb))
4367		kfree(regdb);
4368	if (!IS_ERR_OR_NULL(cfg80211_user_regdom))
4369		kfree(cfg80211_user_regdom);
4370
4371	free_regdb_keyring();
4372}