util.c

   1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * Wireless utility functions
   4 *
   5 * Copyright 2007-2009	Johannes Berg <johannes@sipsolutions.net>
   6 * Copyright 2013-2014  Intel Mobile Communications GmbH
   7 * Copyright 2017	Intel Deutschland GmbH
   8 * Copyright (C) 2018-2023, 2025 Intel Corporation
   9 */
  10#include <linux/export.h>
  11#include <linux/bitops.h>
  12#include <linux/etherdevice.h>
  13#include <linux/slab.h>
  14#include <linux/ieee80211.h>
  15#include <net/cfg80211.h>
  16#include <net/ip.h>
  17#include <net/dsfield.h>
  18#include <linux/if_vlan.h>
  19#include <linux/mpls.h>
  20#include <linux/gcd.h>
  21#include <linux/bitfield.h>
  22#include <linux/nospec.h>
  23#include "core.h"
  24#include "rdev-ops.h"
  25
  26
  27const struct ieee80211_rate *
  28ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
  29			    u32 basic_rates, int bitrate)
  30{
  31	struct ieee80211_rate *result = &sband->bitrates[0];
  32	int i;
  33
  34	for (i = 0; i < sband->n_bitrates; i++) {
  35		if (!(basic_rates & BIT(i)))
  36			continue;
  37		if (sband->bitrates[i].bitrate > bitrate)
  38			continue;
  39		result = &sband->bitrates[i];
  40	}
  41
  42	return result;
  43}
  44EXPORT_SYMBOL(ieee80211_get_response_rate);
  45
  46u32 ieee80211_mandatory_rates(struct ieee80211_supported_band *sband)
  47{
  48	struct ieee80211_rate *bitrates;
  49	u32 mandatory_rates = 0;
  50	enum ieee80211_rate_flags mandatory_flag;
  51	int i;
  52
  53	if (WARN_ON(!sband))
  54		return 1;
  55
  56	if (sband->band == NL80211_BAND_2GHZ)
  57		mandatory_flag = IEEE80211_RATE_MANDATORY_B;
  58	else
  59		mandatory_flag = IEEE80211_RATE_MANDATORY_A;
  60
  61	bitrates = sband->bitrates;
  62	for (i = 0; i < sband->n_bitrates; i++)
  63		if (bitrates[i].flags & mandatory_flag)
  64			mandatory_rates |= BIT(i);
  65	return mandatory_rates;
  66}
  67EXPORT_SYMBOL(ieee80211_mandatory_rates);
  68
  69u32 ieee80211_channel_to_freq_khz(int chan, enum nl80211_band band)
  70{
  71	/* see 802.11 17.3.8.3.2 and Annex J
  72	 * there are overlapping channel numbers in 5GHz and 2GHz bands */
  73	if (chan <= 0)
  74		return 0; /* not supported */
  75	switch (band) {
  76	case NL80211_BAND_2GHZ:
  77	case NL80211_BAND_LC:
  78		if (chan == 14)
  79			return MHZ_TO_KHZ(2484);
  80		else if (chan < 14)
  81			return MHZ_TO_KHZ(2407 + chan * 5);
  82		break;
  83	case NL80211_BAND_5GHZ:
  84		if (chan >= 182 && chan <= 196)
  85			return MHZ_TO_KHZ(4000 + chan * 5);
  86		else
  87			return MHZ_TO_KHZ(5000 + chan * 5);
  88		break;
  89	case NL80211_BAND_6GHZ:
  90		/* see 802.11ax D6.1 27.3.23.2 */
  91		if (chan == 2)
  92			return MHZ_TO_KHZ(5935);
  93		if (chan <= 233)
  94			return MHZ_TO_KHZ(5950 + chan * 5);
  95		break;
  96	case NL80211_BAND_60GHZ:
  97		if (chan < 7)
  98			return MHZ_TO_KHZ(56160 + chan * 2160);
  99		break;
 100	case NL80211_BAND_S1GHZ:
 101		return 902000 + chan * 500;
 102	default:
 103		;
 104	}
 105	return 0; /* not supported */
 106}
 107EXPORT_SYMBOL(ieee80211_channel_to_freq_khz);
 108
 109int ieee80211_freq_khz_to_channel(u32 freq)
 110{
 111	/* TODO: just handle MHz for now */
 112	freq = KHZ_TO_MHZ(freq);
 113
 114	/* see 802.11 17.3.8.3.2 and Annex J */
 115	if (freq == 2484)
 116		return 14;
 117	else if (freq < 2484)
 118		return (freq - 2407) / 5;
 119	else if (freq >= 4910 && freq <= 4980)
 120		return (freq - 4000) / 5;
 121	else if (freq < 5925)
 122		return (freq - 5000) / 5;
 123	else if (freq == 5935)
 124		return 2;
 125	else if (freq <= 45000) /* DMG band lower limit */
 126		/* see 802.11ax D6.1 27.3.22.2 */
 127		return (freq - 5950) / 5;
 128	else if (freq >= 58320 && freq <= 70200)
 129		return (freq - 56160) / 2160;
 130	else
 131		return 0;
 132}
 133EXPORT_SYMBOL(ieee80211_freq_khz_to_channel);
 134
 135struct ieee80211_channel *ieee80211_get_channel_khz(struct wiphy *wiphy,
 136						    u32 freq)
 137{
 138	enum nl80211_band band;
 139	struct ieee80211_supported_band *sband;
 140	int i;
 141
 142	for (band = 0; band < NUM_NL80211_BANDS; band++) {
 143		sband = wiphy->bands[band];
 144
 145		if (!sband)
 146			continue;
 147
 148		for (i = 0; i < sband->n_channels; i++) {
 149			struct ieee80211_channel *chan = &sband->channels[i];
 150
 151			if (ieee80211_channel_to_khz(chan) == freq)
 152				return chan;
 153		}
 154	}
 155
 156	return NULL;
 157}
 158EXPORT_SYMBOL(ieee80211_get_channel_khz);
 159
 160static void set_mandatory_flags_band(struct ieee80211_supported_band *sband)
 161{
 162	int i, want;
 163
 164	switch (sband->band) {
 165	case NL80211_BAND_5GHZ:
 166	case NL80211_BAND_6GHZ:
 167		want = 3;
 168		for (i = 0; i < sband->n_bitrates; i++) {
 169			if (sband->bitrates[i].bitrate == 60 ||
 170			    sband->bitrates[i].bitrate == 120 ||
 171			    sband->bitrates[i].bitrate == 240) {
 172				sband->bitrates[i].flags |=
 173					IEEE80211_RATE_MANDATORY_A;
 174				want--;
 175			}
 176		}
 177		WARN_ON(want);
 178		break;
 179	case NL80211_BAND_2GHZ:
 180	case NL80211_BAND_LC:
 181		want = 7;
 182		for (i = 0; i < sband->n_bitrates; i++) {
 183			switch (sband->bitrates[i].bitrate) {
 184			case 10:
 185			case 20:
 186			case 55:
 187			case 110:
 188				sband->bitrates[i].flags |=
 189					IEEE80211_RATE_MANDATORY_B |
 190					IEEE80211_RATE_MANDATORY_G;
 191				want--;
 192				break;
 193			case 60:
 194			case 120:
 195			case 240:
 196				sband->bitrates[i].flags |=
 197					IEEE80211_RATE_MANDATORY_G;
 198				want--;
 199				fallthrough;
 200			default:
 201				sband->bitrates[i].flags |=
 202					IEEE80211_RATE_ERP_G;
 203				break;
 204			}
 205		}
 206		WARN_ON(want != 0 && want != 3);
 207		break;
 208	case NL80211_BAND_60GHZ:
 209		/* check for mandatory HT MCS 1..4 */
 210		WARN_ON(!sband->ht_cap.ht_supported);
 211		WARN_ON((sband->ht_cap.mcs.rx_mask[0] & 0x1e) != 0x1e);
 212		break;
 213	case NL80211_BAND_S1GHZ:
 214		/* Figure 9-589bd: 3 means unsupported, so != 3 means at least
 215		 * mandatory is ok.
 216		 */
 217		WARN_ON((sband->s1g_cap.nss_mcs[0] & 0x3) == 0x3);
 218		break;
 219	case NUM_NL80211_BANDS:
 220	default:
 221		WARN_ON(1);
 222		break;
 223	}
 224}
 225
 226void ieee80211_set_bitrate_flags(struct wiphy *wiphy)
 227{
 228	enum nl80211_band band;
 229
 230	for (band = 0; band < NUM_NL80211_BANDS; band++)
 231		if (wiphy->bands[band])
 232			set_mandatory_flags_band(wiphy->bands[band]);
 233}
 234
 235bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher)
 236{
 237	int i;
 238	for (i = 0; i < wiphy->n_cipher_suites; i++)
 239		if (cipher == wiphy->cipher_suites[i])
 240			return true;
 241	return false;
 242}
 243
 244static bool
 245cfg80211_igtk_cipher_supported(struct cfg80211_registered_device *rdev)
 246{
 247	struct wiphy *wiphy = &rdev->wiphy;
 248	int i;
 249
 250	for (i = 0; i < wiphy->n_cipher_suites; i++) {
 251		switch (wiphy->cipher_suites[i]) {
 252		case WLAN_CIPHER_SUITE_AES_CMAC:
 253		case WLAN_CIPHER_SUITE_BIP_CMAC_256:
 254		case WLAN_CIPHER_SUITE_BIP_GMAC_128:
 255		case WLAN_CIPHER_SUITE_BIP_GMAC_256:
 256			return true;
 257		}
 258	}
 259
 260	return false;
 261}
 262
 263bool cfg80211_valid_key_idx(struct cfg80211_registered_device *rdev,
 264			    int key_idx, bool pairwise)
 265{
 266	int max_key_idx;
 267
 268	if (pairwise)
 269		max_key_idx = 3;
 270	else if (wiphy_ext_feature_isset(&rdev->wiphy,
 271					 NL80211_EXT_FEATURE_BEACON_PROTECTION) ||
 272		 wiphy_ext_feature_isset(&rdev->wiphy,
 273					 NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
 274		max_key_idx = 7;
 275	else if (cfg80211_igtk_cipher_supported(rdev))
 276		max_key_idx = 5;
 277	else
 278		max_key_idx = 3;
 279
 280	if (key_idx < 0 || key_idx > max_key_idx)
 281		return false;
 282
 283	return true;
 284}
 285
 286int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
 287				   struct key_params *params, int key_idx,
 288				   bool pairwise, const u8 *mac_addr)
 289{
 290	if (!cfg80211_valid_key_idx(rdev, key_idx, pairwise))
 291		return -EINVAL;
 292
 293	if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
 294		return -EINVAL;
 295
 296	if (pairwise && !mac_addr)
 297		return -EINVAL;
 298
 299	switch (params->cipher) {
 300	case WLAN_CIPHER_SUITE_TKIP:
 301		/* Extended Key ID can only be used with CCMP/GCMP ciphers */
 302		if ((pairwise && key_idx) ||
 303		    params->mode != NL80211_KEY_RX_TX)
 304			return -EINVAL;
 305		break;
 306	case WLAN_CIPHER_SUITE_CCMP:
 307	case WLAN_CIPHER_SUITE_CCMP_256:
 308	case WLAN_CIPHER_SUITE_GCMP:
 309	case WLAN_CIPHER_SUITE_GCMP_256:
 310		/* IEEE802.11-2016 allows only 0 and - when supporting
 311		 * Extended Key ID - 1 as index for pairwise keys.
 312		 * @NL80211_KEY_NO_TX is only allowed for pairwise keys when
 313		 * the driver supports Extended Key ID.
 314		 * @NL80211_KEY_SET_TX can't be set when installing and
 315		 * validating a key.
 316		 */
 317		if ((params->mode == NL80211_KEY_NO_TX && !pairwise) ||
 318		    params->mode == NL80211_KEY_SET_TX)
 319			return -EINVAL;
 320		if (wiphy_ext_feature_isset(&rdev->wiphy,
 321					    NL80211_EXT_FEATURE_EXT_KEY_ID)) {
 322			if (pairwise && (key_idx < 0 || key_idx > 1))
 323				return -EINVAL;
 324		} else if (pairwise && key_idx) {
 325			return -EINVAL;
 326		}
 327		break;
 328	case WLAN_CIPHER_SUITE_AES_CMAC:
 329	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
 330	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
 331	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
 332		/* Disallow BIP (group-only) cipher as pairwise cipher */
 333		if (pairwise)
 334			return -EINVAL;
 335		if (key_idx < 4)
 336			return -EINVAL;
 337		break;
 338	case WLAN_CIPHER_SUITE_WEP40:
 339	case WLAN_CIPHER_SUITE_WEP104:
 340		if (key_idx > 3)
 341			return -EINVAL;
 342		break;
 343	default:
 344		break;
 345	}
 346
 347	switch (params->cipher) {
 348	case WLAN_CIPHER_SUITE_WEP40:
 349		if (params->key_len != WLAN_KEY_LEN_WEP40)
 350			return -EINVAL;
 351		break;
 352	case WLAN_CIPHER_SUITE_TKIP:
 353		if (params->key_len != WLAN_KEY_LEN_TKIP)
 354			return -EINVAL;
 355		break;
 356	case WLAN_CIPHER_SUITE_CCMP:
 357		if (params->key_len != WLAN_KEY_LEN_CCMP)
 358			return -EINVAL;
 359		break;
 360	case WLAN_CIPHER_SUITE_CCMP_256:
 361		if (params->key_len != WLAN_KEY_LEN_CCMP_256)
 362			return -EINVAL;
 363		break;
 364	case WLAN_CIPHER_SUITE_GCMP:
 365		if (params->key_len != WLAN_KEY_LEN_GCMP)
 366			return -EINVAL;
 367		break;
 368	case WLAN_CIPHER_SUITE_GCMP_256:
 369		if (params->key_len != WLAN_KEY_LEN_GCMP_256)
 370			return -EINVAL;
 371		break;
 372	case WLAN_CIPHER_SUITE_WEP104:
 373		if (params->key_len != WLAN_KEY_LEN_WEP104)
 374			return -EINVAL;
 375		break;
 376	case WLAN_CIPHER_SUITE_AES_CMAC:
 377		if (params->key_len != WLAN_KEY_LEN_AES_CMAC)
 378			return -EINVAL;
 379		break;
 380	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
 381		if (params->key_len != WLAN_KEY_LEN_BIP_CMAC_256)
 382			return -EINVAL;
 383		break;
 384	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
 385		if (params->key_len != WLAN_KEY_LEN_BIP_GMAC_128)
 386			return -EINVAL;
 387		break;
 388	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
 389		if (params->key_len != WLAN_KEY_LEN_BIP_GMAC_256)
 390			return -EINVAL;
 391		break;
 392	default:
 393		/*
 394		 * We don't know anything about this algorithm,
 395		 * allow using it -- but the driver must check
 396		 * all parameters! We still check below whether
 397		 * or not the driver supports this algorithm,
 398		 * of course.
 399		 */
 400		break;
 401	}
 402
 403	if (params->seq) {
 404		switch (params->cipher) {
 405		case WLAN_CIPHER_SUITE_WEP40:
 406		case WLAN_CIPHER_SUITE_WEP104:
 407			/* These ciphers do not use key sequence */
 408			return -EINVAL;
 409		case WLAN_CIPHER_SUITE_TKIP:
 410		case WLAN_CIPHER_SUITE_CCMP:
 411		case WLAN_CIPHER_SUITE_CCMP_256:
 412		case WLAN_CIPHER_SUITE_GCMP:
 413		case WLAN_CIPHER_SUITE_GCMP_256:
 414		case WLAN_CIPHER_SUITE_AES_CMAC:
 415		case WLAN_CIPHER_SUITE_BIP_CMAC_256:
 416		case WLAN_CIPHER_SUITE_BIP_GMAC_128:
 417		case WLAN_CIPHER_SUITE_BIP_GMAC_256:
 418			if (params->seq_len != 6)
 419				return -EINVAL;
 420			break;
 421		}
 422	}
 423
 424	if (!cfg80211_supported_cipher_suite(&rdev->wiphy, params->cipher))
 425		return -EINVAL;
 426
 427	return 0;
 428}
 429
 430unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc)
 431{
 432	unsigned int hdrlen = 24;
 433
 434	if (ieee80211_is_ext(fc)) {
 435		hdrlen = 4;
 436		goto out;
 437	}
 438
 439	if (ieee80211_is_data(fc)) {
 440		if (ieee80211_has_a4(fc))
 441			hdrlen = 30;
 442		if (ieee80211_is_data_qos(fc)) {
 443			hdrlen += IEEE80211_QOS_CTL_LEN;
 444			if (ieee80211_has_order(fc))
 445				hdrlen += IEEE80211_HT_CTL_LEN;
 446		}
 447		goto out;
 448	}
 449
 450	if (ieee80211_is_mgmt(fc)) {
 451		if (ieee80211_has_order(fc))
 452			hdrlen += IEEE80211_HT_CTL_LEN;
 453		goto out;
 454	}
 455
 456	if (ieee80211_is_ctl(fc)) {
 457		/*
 458		 * ACK and CTS are 10 bytes, all others 16. To see how
 459		 * to get this condition consider
 460		 *   subtype mask:   0b0000000011110000 (0x00F0)
 461		 *   ACK subtype:    0b0000000011010000 (0x00D0)
 462		 *   CTS subtype:    0b0000000011000000 (0x00C0)
 463		 *   bits that matter:         ^^^      (0x00E0)
 464		 *   value of those: 0b0000000011000000 (0x00C0)
 465		 */
 466		if ((fc & cpu_to_le16(0x00E0)) == cpu_to_le16(0x00C0))
 467			hdrlen = 10;
 468		else
 469			hdrlen = 16;
 470	}
 471out:
 472	return hdrlen;
 473}
 474EXPORT_SYMBOL(ieee80211_hdrlen);
 475
 476unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb)
 477{
 478	const struct ieee80211_hdr *hdr =
 479			(const struct ieee80211_hdr *)skb->data;
 480	unsigned int hdrlen;
 481
 482	if (unlikely(skb->len < 10))
 483		return 0;
 484	hdrlen = ieee80211_hdrlen(hdr->frame_control);
 485	if (unlikely(hdrlen > skb->len))
 486		return 0;
 487	return hdrlen;
 488}
 489EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
 490
 491static unsigned int __ieee80211_get_mesh_hdrlen(u8 flags)
 492{
 493	int ae = flags & MESH_FLAGS_AE;
 494	/* 802.11-2012, 8.2.4.7.3 */
 495	switch (ae) {
 496	default:
 497	case 0:
 498		return 6;
 499	case MESH_FLAGS_AE_A4:
 500		return 12;
 501	case MESH_FLAGS_AE_A5_A6:
 502		return 18;
 503	}
 504}
 505
 506unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
 507{
 508	return __ieee80211_get_mesh_hdrlen(meshhdr->flags);
 509}
 510EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
 511
 512bool ieee80211_get_8023_tunnel_proto(const void *hdr, __be16 *proto)
 513{
 514	const __be16 *hdr_proto = hdr + ETH_ALEN;
 515
 516	if (!(ether_addr_equal(hdr, rfc1042_header) &&
 517	      *hdr_proto != htons(ETH_P_AARP) &&
 518	      *hdr_proto != htons(ETH_P_IPX)) &&
 519	    !ether_addr_equal(hdr, bridge_tunnel_header))
 520		return false;
 521
 522	*proto = *hdr_proto;
 523
 524	return true;
 525}
 526EXPORT_SYMBOL(ieee80211_get_8023_tunnel_proto);
 527
 528int ieee80211_strip_8023_mesh_hdr(struct sk_buff *skb)
 529{
 530	const void *mesh_addr;
 531	struct {
 532		struct ethhdr eth;
 533		u8 flags;
 534	} payload;
 535	int hdrlen;
 536	int ret;
 537
 538	ret = skb_copy_bits(skb, 0, &payload, sizeof(payload));
 539	if (ret)
 540		return ret;
 541
 542	hdrlen = sizeof(payload.eth) + __ieee80211_get_mesh_hdrlen(payload.flags);
 543
 544	if (likely(pskb_may_pull(skb, hdrlen + 8) &&
 545		   ieee80211_get_8023_tunnel_proto(skb->data + hdrlen,
 546						   &payload.eth.h_proto)))
 547		hdrlen += ETH_ALEN + 2;
 548	else if (!pskb_may_pull(skb, hdrlen))
 549		return -EINVAL;
 550	else
 551		payload.eth.h_proto = htons(skb->len - hdrlen);
 552
 553	mesh_addr = skb->data + sizeof(payload.eth) + ETH_ALEN;
 554	switch (payload.flags & MESH_FLAGS_AE) {
 555	case MESH_FLAGS_AE_A4:
 556		memcpy(&payload.eth.h_source, mesh_addr, ETH_ALEN);
 557		break;
 558	case MESH_FLAGS_AE_A5_A6:
 559		memcpy(&payload.eth, mesh_addr, 2 * ETH_ALEN);
 560		break;
 561	default:
 562		break;
 563	}
 564
 565	pskb_pull(skb, hdrlen - sizeof(payload.eth));
 566	memcpy(skb->data, &payload.eth, sizeof(payload.eth));
 567
 568	return 0;
 569}
 570EXPORT_SYMBOL(ieee80211_strip_8023_mesh_hdr);
 571
 572int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
 573				  const u8 *addr, enum nl80211_iftype iftype,
 574				  u8 data_offset, bool is_amsdu)
 575{
 576	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 577	struct {
 578		u8 hdr[ETH_ALEN] __aligned(2);
 579		__be16 proto;
 580	} payload;
 581	struct ethhdr tmp;
 582	u16 hdrlen;
 583
 584	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
 585		return -1;
 586
 587	hdrlen = ieee80211_hdrlen(hdr->frame_control) + data_offset;
 588	if (skb->len < hdrlen)
 589		return -1;
 590
 591	/* convert IEEE 802.11 header + possible LLC headers into Ethernet
 592	 * header
 593	 * IEEE 802.11 address fields:
 594	 * ToDS FromDS Addr1 Addr2 Addr3 Addr4
 595	 *   0     0   DA    SA    BSSID n/a
 596	 *   0     1   DA    BSSID SA    n/a
 597	 *   1     0   BSSID SA    DA    n/a
 598	 *   1     1   RA    TA    DA    SA
 599	 */
 600	memcpy(tmp.h_dest, ieee80211_get_DA(hdr), ETH_ALEN);
 601	memcpy(tmp.h_source, ieee80211_get_SA(hdr), ETH_ALEN);
 602
 603	switch (hdr->frame_control &
 604		cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
 605	case cpu_to_le16(IEEE80211_FCTL_TODS):
 606		if (unlikely(iftype != NL80211_IFTYPE_AP &&
 607			     iftype != NL80211_IFTYPE_AP_VLAN &&
 608			     iftype != NL80211_IFTYPE_P2P_GO))
 609			return -1;
 610		break;
 611	case cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
 612		if (unlikely(iftype != NL80211_IFTYPE_MESH_POINT &&
 613			     iftype != NL80211_IFTYPE_AP_VLAN &&
 614			     iftype != NL80211_IFTYPE_STATION))
 615			return -1;
 616		break;
 617	case cpu_to_le16(IEEE80211_FCTL_FROMDS):
 618		if ((iftype != NL80211_IFTYPE_STATION &&
 619		     iftype != NL80211_IFTYPE_P2P_CLIENT &&
 620		     iftype != NL80211_IFTYPE_MESH_POINT) ||
 621		    (is_multicast_ether_addr(tmp.h_dest) &&
 622		     ether_addr_equal(tmp.h_source, addr)))
 623			return -1;
 624		break;
 625	case cpu_to_le16(0):
 626		if (iftype != NL80211_IFTYPE_ADHOC &&
 627		    iftype != NL80211_IFTYPE_STATION &&
 628		    iftype != NL80211_IFTYPE_OCB)
 629				return -1;
 630		break;
 631	}
 632
 633	if (likely(!is_amsdu && iftype != NL80211_IFTYPE_MESH_POINT &&
 634		   skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
 635		   ieee80211_get_8023_tunnel_proto(&payload, &tmp.h_proto))) {
 636		/* remove RFC1042 or Bridge-Tunnel encapsulation */
 637		hdrlen += ETH_ALEN + 2;
 638		skb_postpull_rcsum(skb, &payload, ETH_ALEN + 2);
 639	} else {
 640		tmp.h_proto = htons(skb->len - hdrlen);
 641	}
 642
 643	pskb_pull(skb, hdrlen);
 644
 645	if (!ehdr)
 646		ehdr = skb_push(skb, sizeof(struct ethhdr));
 647	memcpy(ehdr, &tmp, sizeof(tmp));
 648
 649	return 0;
 650}
 651EXPORT_SYMBOL(ieee80211_data_to_8023_exthdr);
 652
 653static void
 654__frame_add_frag(struct sk_buff *skb, struct page *page,
 655		 void *ptr, int len, int size)
 656{
 657	struct skb_shared_info *sh = skb_shinfo(skb);
 658	int page_offset;
 659
 660	get_page(page);
 661	page_offset = ptr - page_address(page);
 662	skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size);
 663}
 664
 665static void
 666__ieee80211_amsdu_copy_frag(struct sk_buff *skb, struct sk_buff *frame,
 667			    int offset, int len)
 668{
 669	struct skb_shared_info *sh = skb_shinfo(skb);
 670	const skb_frag_t *frag = &sh->frags[0];
 671	struct page *frag_page;
 672	void *frag_ptr;
 673	int frag_len, frag_size;
 674	int head_size = skb->len - skb->data_len;
 675	int cur_len;
 676
 677	frag_page = virt_to_head_page(skb->head);
 678	frag_ptr = skb->data;
 679	frag_size = head_size;
 680
 681	while (offset >= frag_size) {
 682		offset -= frag_size;
 683		frag_page = skb_frag_page(frag);
 684		frag_ptr = skb_frag_address(frag);
 685		frag_size = skb_frag_size(frag);
 686		frag++;
 687	}
 688
 689	frag_ptr += offset;
 690	frag_len = frag_size - offset;
 691
 692	cur_len = min(len, frag_len);
 693
 694	__frame_add_frag(frame, frag_page, frag_ptr, cur_len, frag_size);
 695	len -= cur_len;
 696
 697	while (len > 0) {
 698		frag_len = skb_frag_size(frag);
 699		cur_len = min(len, frag_len);
 700		__frame_add_frag(frame, skb_frag_page(frag),
 701				 skb_frag_address(frag), cur_len, frag_len);
 702		len -= cur_len;
 703		frag++;
 704	}
 705}
 706
 707static struct sk_buff *
 708__ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen,
 709		       int offset, int len, bool reuse_frag,
 710		       int min_len)
 711{
 712	struct sk_buff *frame;
 713	int cur_len = len;
 714
 715	if (skb->len - offset < len)
 716		return NULL;
 717
 718	/*
 719	 * When reusing fragments, copy some data to the head to simplify
 720	 * ethernet header handling and speed up protocol header processing
 721	 * in the stack later.
 722	 */
 723	if (reuse_frag)
 724		cur_len = min_t(int, len, min_len);
 725
 726	/*
 727	 * Allocate and reserve two bytes more for payload
 728	 * alignment since sizeof(struct ethhdr) is 14.
 729	 */
 730	frame = dev_alloc_skb(hlen + sizeof(struct ethhdr) + 2 + cur_len);
 731	if (!frame)
 732		return NULL;
 733
 734	frame->priority = skb->priority;
 735	skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
 736	skb_copy_bits(skb, offset, skb_put(frame, cur_len), cur_len);
 737
 738	len -= cur_len;
 739	if (!len)
 740		return frame;
 741
 742	offset += cur_len;
 743	__ieee80211_amsdu_copy_frag(skb, frame, offset, len);
 744
 745	return frame;
 746}
 747
 748static u16
 749ieee80211_amsdu_subframe_length(void *field, u8 mesh_flags, u8 hdr_type)
 750{
 751	__le16 *field_le = field;
 752	__be16 *field_be = field;
 753	u16 len;
 754
 755	if (hdr_type >= 2)
 756		len = le16_to_cpu(*field_le);
 757	else
 758		len = be16_to_cpu(*field_be);
 759	if (hdr_type)
 760		len += __ieee80211_get_mesh_hdrlen(mesh_flags);
 761
 762	return len;
 763}
 764
 765bool ieee80211_is_valid_amsdu(struct sk_buff *skb, u8 mesh_hdr)
 766{
 767	int offset = 0, subframe_len, padding;
 768
 769	for (offset = 0; offset < skb->len; offset += subframe_len + padding) {
 770		int remaining = skb->len - offset;
 771		struct {
 772		    __be16 len;
 773		    u8 mesh_flags;
 774		} hdr;
 775		u16 len;
 776
 777		if (sizeof(hdr) > remaining)
 778			return false;
 779
 780		if (skb_copy_bits(skb, offset + 2 * ETH_ALEN, &hdr, sizeof(hdr)) < 0)
 781			return false;
 782
 783		len = ieee80211_amsdu_subframe_length(&hdr.len, hdr.mesh_flags,
 784						      mesh_hdr);
 785		subframe_len = sizeof(struct ethhdr) + len;
 786		padding = (4 - subframe_len) & 0x3;
 787
 788		if (subframe_len > remaining)
 789			return false;
 790	}
 791
 792	return true;
 793}
 794EXPORT_SYMBOL(ieee80211_is_valid_amsdu);
 795
 796
 797/*
 798 * Detects if an MSDU frame was maliciously converted into an A-MSDU
 799 * frame by an adversary. This is done by parsing the received frame
 800 * as if it were a regular MSDU, even though the A-MSDU flag is set.
 801 *
 802 * For non-mesh interfaces, detection involves checking whether the
 803 * payload, when interpreted as an MSDU, begins with a valid RFC1042
 804 * header. This is done by comparing the A-MSDU subheader's destination
 805 * address to the start of the RFC1042 header.
 806 *
 807 * For mesh interfaces, the MSDU includes a 6-byte Mesh Control field
 808 * and an optional variable-length Mesh Address Extension field before
 809 * the RFC1042 header. The position of the RFC1042 header must therefore
 810 * be calculated based on the mesh header length.
 811 *
 812 * Since this function intentionally parses an A-MSDU frame as an MSDU,
 813 * it only assumes that the A-MSDU subframe header is present, and
 814 * beyond this it performs its own bounds checks under the assumption
 815 * that the frame is instead parsed as a non-aggregated MSDU.
 816 */
 817static bool
 818is_amsdu_aggregation_attack(struct ethhdr *eth, struct sk_buff *skb,
 819			    enum nl80211_iftype iftype)
 820{
 821	int offset;
 822
 823	/* Non-mesh case can be directly compared */
 824	if (iftype != NL80211_IFTYPE_MESH_POINT)
 825		return ether_addr_equal(eth->h_dest, rfc1042_header);
 826
 827	offset = __ieee80211_get_mesh_hdrlen(eth->h_dest[0]);
 828	if (offset == 6) {
 829		/* Mesh case with empty address extension field */
 830		return ether_addr_equal(eth->h_source, rfc1042_header);
 831	} else if (offset + ETH_ALEN <= skb->len) {
 832		/* Mesh case with non-empty address extension field */
 833		u8 temp[ETH_ALEN];
 834
 835		skb_copy_bits(skb, offset, temp, ETH_ALEN);
 836		return ether_addr_equal(temp, rfc1042_header);
 837	}
 838
 839	return false;
 840}
 841
 842void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
 843			      const u8 *addr, enum nl80211_iftype iftype,
 844			      const unsigned int extra_headroom,
 845			      const u8 *check_da, const u8 *check_sa,
 846			      u8 mesh_control)
 847{
 848	unsigned int hlen = ALIGN(extra_headroom, 4);
 849	struct sk_buff *frame = NULL;
 850	int offset = 0;
 851	struct {
 852		struct ethhdr eth;
 853		uint8_t flags;
 854	} hdr;
 855	bool reuse_frag = skb->head_frag && !skb_has_frag_list(skb);
 856	bool reuse_skb = false;
 857	bool last = false;
 858	int copy_len = sizeof(hdr.eth);
 859
 860	if (iftype == NL80211_IFTYPE_MESH_POINT)
 861		copy_len = sizeof(hdr);
 862
 863	while (!last) {
 864		int remaining = skb->len - offset;
 865		unsigned int subframe_len;
 866		int len, mesh_len = 0;
 867		u8 padding;
 868
 869		if (copy_len > remaining)
 870			goto purge;
 871
 872		skb_copy_bits(skb, offset, &hdr, copy_len);
 873		if (iftype == NL80211_IFTYPE_MESH_POINT)
 874			mesh_len = __ieee80211_get_mesh_hdrlen(hdr.flags);
 875		len = ieee80211_amsdu_subframe_length(&hdr.eth.h_proto, hdr.flags,
 876						      mesh_control);
 877		subframe_len = sizeof(struct ethhdr) + len;
 878		padding = (4 - subframe_len) & 0x3;
 879
 880		/* the last MSDU has no padding */
 881		if (subframe_len > remaining)
 882			goto purge;
 883		/* mitigate A-MSDU aggregation injection attacks, to be
 884		 * checked when processing first subframe (offset == 0).
 885		 */
 886		if (offset == 0 && is_amsdu_aggregation_attack(&hdr.eth, skb, iftype))
 887			goto purge;
 888
 889		offset += sizeof(struct ethhdr);
 890		last = remaining <= subframe_len + padding;
 891
 892		/* FIXME: should we really accept multicast DA? */
 893		if ((check_da && !is_multicast_ether_addr(hdr.eth.h_dest) &&
 894		     !ether_addr_equal(check_da, hdr.eth.h_dest)) ||
 895		    (check_sa && !ether_addr_equal(check_sa, hdr.eth.h_source))) {
 896			offset += len + padding;
 897			continue;
 898		}
 899
 900		/* reuse skb for the last subframe */
 901		if (!skb_is_nonlinear(skb) && !reuse_frag && last) {
 902			skb_pull(skb, offset);
 903			frame = skb;
 904			reuse_skb = true;
 905		} else {
 906			frame = __ieee80211_amsdu_copy(skb, hlen, offset, len,
 907						       reuse_frag, 32 + mesh_len);
 908			if (!frame)
 909				goto purge;
 910
 911			offset += len + padding;
 912		}
 913
 914		skb_reset_network_header(frame);
 915		frame->dev = skb->dev;
 916		frame->priority = skb->priority;
 917
 918		if (likely(iftype != NL80211_IFTYPE_MESH_POINT &&
 919			   ieee80211_get_8023_tunnel_proto(frame->data, &hdr.eth.h_proto)))
 920			skb_pull(frame, ETH_ALEN + 2);
 921
 922		memcpy(skb_push(frame, sizeof(hdr.eth)), &hdr.eth, sizeof(hdr.eth));
 923		__skb_queue_tail(list, frame);
 924	}
 925
 926	if (!reuse_skb)
 927		dev_kfree_skb(skb);
 928
 929	return;
 930
 931 purge:
 932	__skb_queue_purge(list);
 933	dev_kfree_skb(skb);
 934}
 935EXPORT_SYMBOL(ieee80211_amsdu_to_8023s);
 936
 937/* Given a data frame determine the 802.1p/1d tag to use. */
 938unsigned int cfg80211_classify8021d(struct sk_buff *skb,
 939				    struct cfg80211_qos_map *qos_map)
 940{
 941	unsigned int dscp;
 942	unsigned char vlan_priority;
 943	unsigned int ret;
 944
 945	/* skb->priority values from 256->263 are magic values to
 946	 * directly indicate a specific 802.1d priority.  This is used
 947	 * to allow 802.1d priority to be passed directly in from VLAN
 948	 * tags, etc.
 949	 */
 950	if (skb->priority >= 256 && skb->priority <= 263) {
 951		ret = skb->priority - 256;
 952		goto out;
 953	}
 954
 955	if (skb_vlan_tag_present(skb)) {
 956		vlan_priority = (skb_vlan_tag_get(skb) & VLAN_PRIO_MASK)
 957			>> VLAN_PRIO_SHIFT;
 958		if (vlan_priority > 0) {
 959			ret = vlan_priority;
 960			goto out;
 961		}
 962	}
 963
 964	switch (skb->protocol) {
 965	case htons(ETH_P_IP):
 966		dscp = ipv4_get_dsfield(ip_hdr(skb)) & 0xfc;
 967		break;
 968	case htons(ETH_P_IPV6):
 969		dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & 0xfc;
 970		break;
 971	case htons(ETH_P_MPLS_UC):
 972	case htons(ETH_P_MPLS_MC): {
 973		struct mpls_label mpls_tmp, *mpls;
 974
 975		mpls = skb_header_pointer(skb, sizeof(struct ethhdr),
 976					  sizeof(*mpls), &mpls_tmp);
 977		if (!mpls)
 978			return 0;
 979
 980		ret = (ntohl(mpls->entry) & MPLS_LS_TC_MASK)
 981			>> MPLS_LS_TC_SHIFT;
 982		goto out;
 983	}
 984	case htons(ETH_P_80221):
 985		/* 802.21 is always network control traffic */
 986		return 7;
 987	default:
 988		return 0;
 989	}
 990
 991	if (qos_map) {
 992		unsigned int i, tmp_dscp = dscp >> 2;
 993
 994		for (i = 0; i < qos_map->num_des; i++) {
 995			if (tmp_dscp == qos_map->dscp_exception[i].dscp) {
 996				ret = qos_map->dscp_exception[i].up;
 997				goto out;
 998			}
 999		}
1000
1001		for (i = 0; i < 8; i++) {
1002			if (tmp_dscp >= qos_map->up[i].low &&
1003			    tmp_dscp <= qos_map->up[i].high) {
1004				ret = i;
1005				goto out;
1006			}
1007		}
1008	}
1009
1010	/* The default mapping as defined Section 2.3 in RFC8325: The three
1011	 * Most Significant Bits (MSBs) of the DSCP are used as the
1012	 * corresponding L2 markings.
1013	 */
1014	ret = dscp >> 5;
1015
1016	/* Handle specific DSCP values for which the default mapping (as
1017	 * described above) doesn't adhere to the intended usage of the DSCP
1018	 * value. See section 4 in RFC8325. Specifically, for the following
1019	 * Diffserv Service Classes no update is needed:
1020	 * - Standard: DF
1021	 * - Low Priority Data: CS1
1022	 * - Multimedia Conferencing: AF41, AF42, AF43
1023	 * - Network Control Traffic: CS7
1024	 * - Real-Time Interactive: CS4
1025	 * - Signaling: CS5
1026	 */
1027	switch (dscp >> 2) {
1028	case 10:
1029	case 12:
1030	case 14:
1031		/* High throughput data: AF11, AF12, AF13 */
1032		ret = 0;
1033		break;
1034	case 16:
1035		/* Operations, Administration, and Maintenance and Provisioning:
1036		 * CS2
1037		 */
1038		ret = 0;
1039		break;
1040	case 18:
1041	case 20:
1042	case 22:
1043		/* Low latency data: AF21, AF22, AF23 */
1044		ret = 3;
1045		break;
1046	case 24:
1047		/* Broadcasting video: CS3 */
1048		ret = 4;
1049		break;
1050	case 26:
1051	case 28:
1052	case 30:
1053		/* Multimedia Streaming: AF31, AF32, AF33 */
1054		ret = 4;
1055		break;
1056	case 44:
1057		/* Voice Admit: VA */
1058		ret = 6;
1059		break;
1060	case 46:
1061		/* Telephony traffic: EF */
1062		ret = 6;
1063		break;
1064	case 48:
1065		/* Network Control Traffic: CS6 */
1066		ret = 7;
1067		break;
1068	}
1069out:
1070	return array_index_nospec(ret, IEEE80211_NUM_TIDS);
1071}
1072EXPORT_SYMBOL(cfg80211_classify8021d);
1073
1074const struct element *ieee80211_bss_get_elem(struct cfg80211_bss *bss, u8 id)
1075{
1076	const struct cfg80211_bss_ies *ies;
1077
1078	ies = rcu_dereference(bss->ies);
1079	if (!ies)
1080		return NULL;
1081
1082	return cfg80211_find_elem(id, ies->data, ies->len);
1083}
1084EXPORT_SYMBOL(ieee80211_bss_get_elem);
1085
1086void cfg80211_upload_connect_keys(struct wireless_dev *wdev)
1087{
1088	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
1089	struct net_device *dev = wdev->netdev;
1090	int i;
1091
1092	if (!wdev->connect_keys)
1093		return;
1094
1095	for (i = 0; i < 4; i++) {
1096		if (!wdev->connect_keys->params[i].cipher)
1097			continue;
1098		if (rdev_add_key(rdev, dev, -1, i, false, NULL,
1099				 &wdev->connect_keys->params[i])) {
1100			netdev_err(dev, "failed to set key %d\n", i);
1101			continue;
1102		}
1103		if (wdev->connect_keys->def == i &&
1104		    rdev_set_default_key(rdev, dev, -1, i, true, true)) {
1105			netdev_err(dev, "failed to set defkey %d\n", i);
1106			continue;
1107		}
1108	}
1109
1110	kfree_sensitive(wdev->connect_keys);
1111	wdev->connect_keys = NULL;
1112}
1113
1114void cfg80211_process_wdev_events(struct wireless_dev *wdev)
1115{
1116	struct cfg80211_event *ev;
1117	unsigned long flags;
1118
1119	spin_lock_irqsave(&wdev->event_lock, flags);
1120	while (!list_empty(&wdev->event_list)) {
1121		ev = list_first_entry(&wdev->event_list,
1122				      struct cfg80211_event, list);
1123		list_del(&ev->list);
1124		spin_unlock_irqrestore(&wdev->event_lock, flags);
1125
1126		switch (ev->type) {
1127		case EVENT_CONNECT_RESULT:
1128			__cfg80211_connect_result(
1129				wdev->netdev,
1130				&ev->cr,
1131				ev->cr.status == WLAN_STATUS_SUCCESS);
1132			break;
1133		case EVENT_ROAMED:
1134			__cfg80211_roamed(wdev, &ev->rm);
1135			break;
1136		case EVENT_DISCONNECTED:
1137			__cfg80211_disconnected(wdev->netdev,
1138						ev->dc.ie, ev->dc.ie_len,
1139						ev->dc.reason,
1140						!ev->dc.locally_generated);
1141			break;
1142		case EVENT_IBSS_JOINED:
1143			__cfg80211_ibss_joined(wdev->netdev, ev->ij.bssid,
1144					       ev->ij.channel);
1145			break;
1146		case EVENT_STOPPED:
1147			cfg80211_leave(wiphy_to_rdev(wdev->wiphy), wdev);
1148			break;
1149		case EVENT_PORT_AUTHORIZED:
1150			__cfg80211_port_authorized(wdev, ev->pa.peer_addr,
1151						   ev->pa.td_bitmap,
1152						   ev->pa.td_bitmap_len);
1153			break;
1154		}
1155
1156		kfree(ev);
1157
1158		spin_lock_irqsave(&wdev->event_lock, flags);
1159	}
1160	spin_unlock_irqrestore(&wdev->event_lock, flags);
1161}
1162
1163void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev)
1164{
1165	struct wireless_dev *wdev;
1166
1167	lockdep_assert_held(&rdev->wiphy.mtx);
1168
1169	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list)
1170		cfg80211_process_wdev_events(wdev);
1171}
1172
1173int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
1174			  struct net_device *dev, enum nl80211_iftype ntype,
1175			  struct vif_params *params)
1176{
1177	int err;
1178	enum nl80211_iftype otype = dev->ieee80211_ptr->iftype;
1179
1180	lockdep_assert_held(&rdev->wiphy.mtx);
1181
1182	/* don't support changing VLANs, you just re-create them */
1183	if (otype == NL80211_IFTYPE_AP_VLAN)
1184		return -EOPNOTSUPP;
1185
1186	/* cannot change into P2P device or NAN */
1187	if (ntype == NL80211_IFTYPE_P2P_DEVICE ||
1188	    ntype == NL80211_IFTYPE_NAN)
1189		return -EOPNOTSUPP;
1190
1191	if (!rdev->ops->change_virtual_intf ||
1192	    !(rdev->wiphy.interface_modes & (1 << ntype)))
1193		return -EOPNOTSUPP;
1194
1195	if (ntype != otype) {
1196		/* if it's part of a bridge, reject changing type to station/ibss */
1197		if (netif_is_bridge_port(dev) &&
1198		    (ntype == NL80211_IFTYPE_ADHOC ||
1199		     ntype == NL80211_IFTYPE_STATION ||
1200		     ntype == NL80211_IFTYPE_P2P_CLIENT))
1201			return -EBUSY;
1202
1203		dev->ieee80211_ptr->use_4addr = false;
1204		rdev_set_qos_map(rdev, dev, NULL);
1205
1206		cfg80211_leave(rdev, dev->ieee80211_ptr);
1207
1208		cfg80211_process_rdev_events(rdev);
1209		cfg80211_mlme_purge_registrations(dev->ieee80211_ptr);
1210
1211		memset(&dev->ieee80211_ptr->u, 0,
1212		       sizeof(dev->ieee80211_ptr->u));
1213		memset(&dev->ieee80211_ptr->links, 0,
1214		       sizeof(dev->ieee80211_ptr->links));
1215	}
1216
1217	err = rdev_change_virtual_intf(rdev, dev, ntype, params);
1218
1219	WARN_ON(!err && dev->ieee80211_ptr->iftype != ntype);
1220
1221	if (!err && params && params->use_4addr != -1)
1222		dev->ieee80211_ptr->use_4addr = params->use_4addr;
1223
1224	if (!err) {
1225		dev->priv_flags &= ~IFF_DONT_BRIDGE;
1226		switch (ntype) {
1227		case NL80211_IFTYPE_STATION:
1228			if (dev->ieee80211_ptr->use_4addr)
1229				break;
1230			fallthrough;
1231		case NL80211_IFTYPE_OCB:
1232		case NL80211_IFTYPE_P2P_CLIENT:
1233		case NL80211_IFTYPE_ADHOC:
1234			dev->priv_flags |= IFF_DONT_BRIDGE;
1235			break;
1236		case NL80211_IFTYPE_P2P_GO:
1237		case NL80211_IFTYPE_AP:
1238		case NL80211_IFTYPE_AP_VLAN:
1239		case NL80211_IFTYPE_MESH_POINT:
1240			/* bridging OK */
1241			break;
1242		case NL80211_IFTYPE_MONITOR:
1243			/* monitor can't bridge anyway */
1244			break;
1245		case NL80211_IFTYPE_UNSPECIFIED:
1246		case NUM_NL80211_IFTYPES:
1247			/* not happening */
1248			break;
1249		case NL80211_IFTYPE_P2P_DEVICE:
1250		case NL80211_IFTYPE_WDS:
1251		case NL80211_IFTYPE_NAN:
1252			WARN_ON(1);
1253			break;
1254		}
1255	}
1256
1257	if (!err && ntype != otype && netif_running(dev)) {
1258		cfg80211_update_iface_num(rdev, ntype, 1);
1259		cfg80211_update_iface_num(rdev, otype, -1);
1260	}
1261
1262	return err;
1263}
1264
1265static u32 cfg80211_calculate_bitrate_ht(struct rate_info *rate)
1266{
1267	int modulation, streams, bitrate;
1268
1269	/* the formula below does only work for MCS values smaller than 32 */
1270	if (WARN_ON_ONCE(rate->mcs >= 32))
1271		return 0;
1272
1273	modulation = rate->mcs & 7;
1274	streams = (rate->mcs >> 3) + 1;
1275
1276	bitrate = (rate->bw == RATE_INFO_BW_40) ? 13500000 : 6500000;
1277
1278	if (modulation < 4)
1279		bitrate *= (modulation + 1);
1280	else if (modulation == 4)
1281		bitrate *= (modulation + 2);
1282	else
1283		bitrate *= (modulation + 3);
1284
1285	bitrate *= streams;
1286
1287	if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1288		bitrate = (bitrate / 9) * 10;
1289
1290	/* do NOT round down here */
1291	return (bitrate + 50000) / 100000;
1292}
1293
1294static u32 cfg80211_calculate_bitrate_dmg(struct rate_info *rate)
1295{
1296	static const u32 __mcs2bitrate[] = {
1297		/* control PHY */
1298		[0] =   275,
1299		/* SC PHY */
1300		[1] =  3850,
1301		[2] =  7700,
1302		[3] =  9625,
1303		[4] = 11550,
1304		[5] = 12512, /* 1251.25 mbps */
1305		[6] = 15400,
1306		[7] = 19250,
1307		[8] = 23100,
1308		[9] = 25025,
1309		[10] = 30800,
1310		[11] = 38500,
1311		[12] = 46200,
1312		/* OFDM PHY */
1313		[13] =  6930,
1314		[14] =  8662, /* 866.25 mbps */
1315		[15] = 13860,
1316		[16] = 17325,
1317		[17] = 20790,
1318		[18] = 27720,
1319		[19] = 34650,
1320		[20] = 41580,
1321		[21] = 45045,
1322		[22] = 51975,
1323		[23] = 62370,
1324		[24] = 67568, /* 6756.75 mbps */
1325		/* LP-SC PHY */
1326		[25] =  6260,
1327		[26] =  8340,
1328		[27] = 11120,
1329		[28] = 12510,
1330		[29] = 16680,
1331		[30] = 22240,
1332		[31] = 25030,
1333	};
1334
1335	if (WARN_ON_ONCE(rate->mcs >= ARRAY_SIZE(__mcs2bitrate)))
1336		return 0;
1337
1338	return __mcs2bitrate[rate->mcs];
1339}
1340
1341static u32 cfg80211_calculate_bitrate_extended_sc_dmg(struct rate_info *rate)
1342{
1343	static const u32 __mcs2bitrate[] = {
1344		[6 - 6] = 26950, /* MCS 9.1 : 2695.0 mbps */
1345		[7 - 6] = 50050, /* MCS 12.1 */
1346		[8 - 6] = 53900,
1347		[9 - 6] = 57750,
1348		[10 - 6] = 63900,
1349		[11 - 6] = 75075,
1350		[12 - 6] = 80850,
1351	};
1352
1353	/* Extended SC MCS not defined for base MCS below 6 or above 12 */
1354	if (WARN_ON_ONCE(rate->mcs < 6 || rate->mcs > 12))
1355		return 0;
1356
1357	return __mcs2bitrate[rate->mcs - 6];
1358}
1359
1360static u32 cfg80211_calculate_bitrate_edmg(struct rate_info *rate)
1361{
1362	static const u32 __mcs2bitrate[] = {
1363		/* control PHY */
1364		[0] =   275,
1365		/* SC PHY */
1366		[1] =  3850,
1367		[2] =  7700,
1368		[3] =  9625,
1369		[4] = 11550,
1370		[5] = 12512, /* 1251.25 mbps */
1371		[6] = 13475,
1372		[7] = 15400,
1373		[8] = 19250,
1374		[9] = 23100,
1375		[10] = 25025,
1376		[11] = 26950,
1377		[12] = 30800,
1378		[13] = 38500,
1379		[14] = 46200,
1380		[15] = 50050,
1381		[16] = 53900,
1382		[17] = 57750,
1383		[18] = 69300,
1384		[19] = 75075,
1385		[20] = 80850,
1386	};
1387
1388	if (WARN_ON_ONCE(rate->mcs >= ARRAY_SIZE(__mcs2bitrate)))
1389		return 0;
1390
1391	return __mcs2bitrate[rate->mcs] * rate->n_bonded_ch;
1392}
1393
1394static u32 cfg80211_calculate_bitrate_vht(struct rate_info *rate)
1395{
1396	static const u32 base[4][12] = {
1397		{   6500000,
1398		   13000000,
1399		   19500000,
1400		   26000000,
1401		   39000000,
1402		   52000000,
1403		   58500000,
1404		   65000000,
1405		   78000000,
1406		/* not in the spec, but some devices use this: */
1407		   86700000,
1408		   97500000,
1409		  108300000,
1410		},
1411		{  13500000,
1412		   27000000,
1413		   40500000,
1414		   54000000,
1415		   81000000,
1416		  108000000,
1417		  121500000,
1418		  135000000,
1419		  162000000,
1420		  180000000,
1421		  202500000,
1422		  225000000,
1423		},
1424		{  29300000,
1425		   58500000,
1426		   87800000,
1427		  117000000,
1428		  175500000,
1429		  234000000,
1430		  263300000,
1431		  292500000,
1432		  351000000,
1433		  390000000,
1434		  438800000,
1435		  487500000,
1436		},
1437		{  58500000,
1438		  117000000,
1439		  175500000,
1440		  234000000,
1441		  351000000,
1442		  468000000,
1443		  526500000,
1444		  585000000,
1445		  702000000,
1446		  780000000,
1447		  877500000,
1448		  975000000,
1449		},
1450	};
1451	u32 bitrate;
1452	int idx;
1453
1454	if (rate->mcs > 11)
1455		goto warn;
1456
1457	switch (rate->bw) {
1458	case RATE_INFO_BW_160:
1459		idx = 3;
1460		break;
1461	case RATE_INFO_BW_80:
1462		idx = 2;
1463		break;
1464	case RATE_INFO_BW_40:
1465		idx = 1;
1466		break;
1467	case RATE_INFO_BW_5:
1468	case RATE_INFO_BW_10:
1469	default:
1470		goto warn;
1471	case RATE_INFO_BW_20:
1472		idx = 0;
1473	}
1474
1475	bitrate = base[idx][rate->mcs];
1476	bitrate *= rate->nss;
1477
1478	if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1479		bitrate = (bitrate / 9) * 10;
1480
1481	/* do NOT round down here */
1482	return (bitrate + 50000) / 100000;
1483 warn:
1484	WARN_ONCE(1, "invalid rate bw=%d, mcs=%d, nss=%d\n",
1485		  rate->bw, rate->mcs, rate->nss);
1486	return 0;
1487}
1488
1489static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate)
1490{
1491#define SCALE 6144
1492	u32 mcs_divisors[14] = {
1493		102399, /* 16.666666... */
1494		 51201, /*  8.333333... */
1495		 34134, /*  5.555555... */
1496		 25599, /*  4.166666... */
1497		 17067, /*  2.777777... */
1498		 12801, /*  2.083333... */
1499		 11377, /*  1.851725... */
1500		 10239, /*  1.666666... */
1501		  8532, /*  1.388888... */
1502		  7680, /*  1.250000... */
1503		  6828, /*  1.111111... */
1504		  6144, /*  1.000000... */
1505		  5690, /*  0.926106... */
1506		  5120, /*  0.833333... */
1507	};
1508	u32 rates_160M[3] = { 960777777, 907400000, 816666666 };
1509	u32 rates_996[3] =  { 480388888, 453700000, 408333333 };
1510	u32 rates_484[3] =  { 229411111, 216666666, 195000000 };
1511	u32 rates_242[3] =  { 114711111, 108333333,  97500000 };
1512	u32 rates_106[3] =  {  40000000,  37777777,  34000000 };
1513	u32 rates_52[3]  =  {  18820000,  17777777,  16000000 };
1514	u32 rates_26[3]  =  {   9411111,   8888888,   8000000 };
1515	u64 tmp;
1516	u32 result;
1517
1518	if (WARN_ON_ONCE(rate->mcs > 13))
1519		return 0;
1520
1521	if (WARN_ON_ONCE(rate->he_gi > NL80211_RATE_INFO_HE_GI_3_2))
1522		return 0;
1523	if (WARN_ON_ONCE(rate->he_ru_alloc >
1524			 NL80211_RATE_INFO_HE_RU_ALLOC_2x996))
1525		return 0;
1526	if (WARN_ON_ONCE(rate->nss < 1 || rate->nss > 8))
1527		return 0;
1528
1529	if (rate->bw == RATE_INFO_BW_160 ||
1530	    (rate->bw == RATE_INFO_BW_HE_RU &&
1531	     rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_2x996))
1532		result = rates_160M[rate->he_gi];
1533	else if (rate->bw == RATE_INFO_BW_80 ||
1534		 (rate->bw == RATE_INFO_BW_HE_RU &&
1535		  rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_996))
1536		result = rates_996[rate->he_gi];
1537	else if (rate->bw == RATE_INFO_BW_40 ||
1538		 (rate->bw == RATE_INFO_BW_HE_RU &&
1539		  rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_484))
1540		result = rates_484[rate->he_gi];
1541	else if (rate->bw == RATE_INFO_BW_20 ||
1542		 (rate->bw == RATE_INFO_BW_HE_RU &&
1543		  rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_242))
1544		result = rates_242[rate->he_gi];
1545	else if (rate->bw == RATE_INFO_BW_HE_RU &&
1546		 rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_106)
1547		result = rates_106[rate->he_gi];
1548	else if (rate->bw == RATE_INFO_BW_HE_RU &&
1549		 rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_52)
1550		result = rates_52[rate->he_gi];
1551	else if (rate->bw == RATE_INFO_BW_HE_RU &&
1552		 rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_26)
1553		result = rates_26[rate->he_gi];
1554	else {
1555		WARN(1, "invalid HE MCS: bw:%d, ru:%d\n",
1556		     rate->bw, rate->he_ru_alloc);
1557		return 0;
1558	}
1559
1560	/* now scale to the appropriate MCS */
1561	tmp = result;
1562	tmp *= SCALE;
1563	do_div(tmp, mcs_divisors[rate->mcs]);
1564
1565	/* and take NSS, DCM into account */
1566	tmp *= rate->nss;
1567	do_div(tmp, 8);
1568	if (rate->he_dcm)
1569		do_div(tmp, 2);
1570
1571	result = tmp;
1572
1573	return result / 10000;
1574}
1575
1576static u32 cfg80211_calculate_bitrate_eht(struct rate_info *rate)
1577{
1578#define SCALE 6144
1579	static const u32 mcs_divisors[16] = {
1580		102399, /* 16.666666... */
1581		 51201, /*  8.333333... */
1582		 34134, /*  5.555555... */
1583		 25599, /*  4.166666... */
1584		 17067, /*  2.777777... */
1585		 12801, /*  2.083333... */
1586		 11377, /*  1.851725... */
1587		 10239, /*  1.666666... */
1588		  8532, /*  1.388888... */
1589		  7680, /*  1.250000... */
1590		  6828, /*  1.111111... */
1591		  6144, /*  1.000000... */
1592		  5690, /*  0.926106... */
1593		  5120, /*  0.833333... */
1594		409600, /* 66.666666... */
1595		204800, /* 33.333333... */
1596	};
1597	static const u32 rates_996[3] =  { 480388888, 453700000, 408333333 };
1598	static const u32 rates_484[3] =  { 229411111, 216666666, 195000000 };
1599	static const u32 rates_242[3] =  { 114711111, 108333333,  97500000 };
1600	static const u32 rates_106[3] =  {  40000000,  37777777,  34000000 };
1601	static const u32 rates_52[3]  =  {  18820000,  17777777,  16000000 };
1602	static const u32 rates_26[3]  =  {   9411111,   8888888,   8000000 };
1603	u64 tmp;
1604	u32 result;
1605
1606	if (WARN_ON_ONCE(rate->mcs > 15))
1607		return 0;
1608	if (WARN_ON_ONCE(rate->eht_gi > NL80211_RATE_INFO_EHT_GI_3_2))
1609		return 0;
1610	if (WARN_ON_ONCE(rate->eht_ru_alloc >
1611			 NL80211_RATE_INFO_EHT_RU_ALLOC_4x996))
1612		return 0;
1613	if (WARN_ON_ONCE(rate->nss < 1 || rate->nss > 8))
1614		return 0;
1615
1616	/* Bandwidth checks for MCS 14 */
1617	if (rate->mcs == 14) {
1618		if ((rate->bw != RATE_INFO_BW_EHT_RU &&
1619		     rate->bw != RATE_INFO_BW_80 &&
1620		     rate->bw != RATE_INFO_BW_160 &&
1621		     rate->bw != RATE_INFO_BW_320) ||
1622		    (rate->bw == RATE_INFO_BW_EHT_RU &&
1623		     rate->eht_ru_alloc != NL80211_RATE_INFO_EHT_RU_ALLOC_996 &&
1624		     rate->eht_ru_alloc != NL80211_RATE_INFO_EHT_RU_ALLOC_2x996 &&
1625		     rate->eht_ru_alloc != NL80211_RATE_INFO_EHT_RU_ALLOC_4x996)) {
1626			WARN(1, "invalid EHT BW for MCS 14: bw:%d, ru:%d\n",
1627			     rate->bw, rate->eht_ru_alloc);
1628			return 0;
1629		}
1630	}
1631
1632	if (rate->bw == RATE_INFO_BW_320 ||
1633	    (rate->bw == RATE_INFO_BW_EHT_RU &&
1634	     rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_4x996))
1635		result = 4 * rates_996[rate->eht_gi];
1636	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1637		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_3x996P484)
1638		result = 3 * rates_996[rate->eht_gi] + rates_484[rate->eht_gi];
1639	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1640		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_3x996)
1641		result = 3 * rates_996[rate->eht_gi];
1642	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1643		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_2x996P484)
1644		result = 2 * rates_996[rate->eht_gi] + rates_484[rate->eht_gi];
1645	else if (rate->bw == RATE_INFO_BW_160 ||
1646		 (rate->bw == RATE_INFO_BW_EHT_RU &&
1647		  rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_2x996))
1648		result = 2 * rates_996[rate->eht_gi];
1649	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1650		 rate->eht_ru_alloc ==
1651		 NL80211_RATE_INFO_EHT_RU_ALLOC_996P484P242)
1652		result = rates_996[rate->eht_gi] + rates_484[rate->eht_gi]
1653			 + rates_242[rate->eht_gi];
1654	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1655		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_996P484)
1656		result = rates_996[rate->eht_gi] + rates_484[rate->eht_gi];
1657	else if (rate->bw == RATE_INFO_BW_80 ||
1658		 (rate->bw == RATE_INFO_BW_EHT_RU &&
1659		  rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_996))
1660		result = rates_996[rate->eht_gi];
1661	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1662		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_484P242)
1663		result = rates_484[rate->eht_gi] + rates_242[rate->eht_gi];
1664	else if (rate->bw == RATE_INFO_BW_40 ||
1665		 (rate->bw == RATE_INFO_BW_EHT_RU &&
1666		  rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_484))
1667		result = rates_484[rate->eht_gi];
1668	else if (rate->bw == RATE_INFO_BW_20 ||
1669		 (rate->bw == RATE_INFO_BW_EHT_RU &&
1670		  rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_242))
1671		result = rates_242[rate->eht_gi];
1672	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1673		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_106P26)
1674		result = rates_106[rate->eht_gi] + rates_26[rate->eht_gi];
1675	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1676		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_106)
1677		result = rates_106[rate->eht_gi];
1678	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1679		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_52P26)
1680		result = rates_52[rate->eht_gi] + rates_26[rate->eht_gi];
1681	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1682		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_52)
1683		result = rates_52[rate->eht_gi];
1684	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1685		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_26)
1686		result = rates_26[rate->eht_gi];
1687	else {
1688		WARN(1, "invalid EHT MCS: bw:%d, ru:%d\n",
1689		     rate->bw, rate->eht_ru_alloc);
1690		return 0;
1691	}
1692
1693	/* now scale to the appropriate MCS */
1694	tmp = result;
1695	tmp *= SCALE;
1696	do_div(tmp, mcs_divisors[rate->mcs]);
1697
1698	/* and take NSS */
1699	tmp *= rate->nss;
1700	do_div(tmp, 8);
1701
1702	result = tmp;
1703
1704	return result / 10000;
1705}
1706
1707static u32 cfg80211_calculate_bitrate_s1g(struct rate_info *rate)
1708{
1709	/* For 1, 2, 4, 8 and 16 MHz channels */
1710	static const u32 base[5][11] = {
1711		{  300000,
1712		   600000,
1713		   900000,
1714		  1200000,
1715		  1800000,
1716		  2400000,
1717		  2700000,
1718		  3000000,
1719		  3600000,
1720		  4000000,
1721		  /* MCS 10 supported in 1 MHz only */
1722		  150000,
1723		},
1724		{  650000,
1725		  1300000,
1726		  1950000,
1727		  2600000,
1728		  3900000,
1729		  5200000,
1730		  5850000,
1731		  6500000,
1732		  7800000,
1733		  /* MCS 9 not valid */
1734		},
1735		{  1350000,
1736		   2700000,
1737		   4050000,
1738		   5400000,
1739		   8100000,
1740		  10800000,
1741		  12150000,
1742		  13500000,
1743		  16200000,
1744		  18000000,
1745		},
1746		{  2925000,
1747		   5850000,
1748		   8775000,
1749		  11700000,
1750		  17550000,
1751		  23400000,
1752		  26325000,
1753		  29250000,
1754		  35100000,
1755		  39000000,
1756		},
1757		{  8580000,
1758		  11700000,
1759		  17550000,
1760		  23400000,
1761		  35100000,
1762		  46800000,
1763		  52650000,
1764		  58500000,
1765		  70200000,
1766		  78000000,
1767		},
1768	};
1769	u32 bitrate;
1770	/* default is 1 MHz index */
1771	int idx = 0;
1772
1773	if (rate->mcs >= 11)
1774		goto warn;
1775
1776	switch (rate->bw) {
1777	case RATE_INFO_BW_16:
1778		idx = 4;
1779		break;
1780	case RATE_INFO_BW_8:
1781		idx = 3;
1782		break;
1783	case RATE_INFO_BW_4:
1784		idx = 2;
1785		break;
1786	case RATE_INFO_BW_2:
1787		idx = 1;
1788		break;
1789	case RATE_INFO_BW_1:
1790		idx = 0;
1791		break;
1792	case RATE_INFO_BW_5:
1793	case RATE_INFO_BW_10:
1794	case RATE_INFO_BW_20:
1795	case RATE_INFO_BW_40:
1796	case RATE_INFO_BW_80:
1797	case RATE_INFO_BW_160:
1798	default:
1799		goto warn;
1800	}
1801
1802	bitrate = base[idx][rate->mcs];
1803	bitrate *= rate->nss;
1804
1805	if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1806		bitrate = (bitrate / 9) * 10;
1807	/* do NOT round down here */
1808	return (bitrate + 50000) / 100000;
1809warn:
1810	WARN_ONCE(1, "invalid rate bw=%d, mcs=%d, nss=%d\n",
1811		  rate->bw, rate->mcs, rate->nss);
1812	return 0;
1813}
1814
1815u32 cfg80211_calculate_bitrate(struct rate_info *rate)
1816{
1817	if (rate->flags & RATE_INFO_FLAGS_MCS)
1818		return cfg80211_calculate_bitrate_ht(rate);
1819	if (rate->flags & RATE_INFO_FLAGS_DMG)
1820		return cfg80211_calculate_bitrate_dmg(rate);
1821	if (rate->flags & RATE_INFO_FLAGS_EXTENDED_SC_DMG)
1822		return cfg80211_calculate_bitrate_extended_sc_dmg(rate);
1823	if (rate->flags & RATE_INFO_FLAGS_EDMG)
1824		return cfg80211_calculate_bitrate_edmg(rate);
1825	if (rate->flags & RATE_INFO_FLAGS_VHT_MCS)
1826		return cfg80211_calculate_bitrate_vht(rate);
1827	if (rate->flags & RATE_INFO_FLAGS_HE_MCS)
1828		return cfg80211_calculate_bitrate_he(rate);
1829	if (rate->flags & RATE_INFO_FLAGS_EHT_MCS)
1830		return cfg80211_calculate_bitrate_eht(rate);
1831	if (rate->flags & RATE_INFO_FLAGS_S1G_MCS)
1832		return cfg80211_calculate_bitrate_s1g(rate);
1833
1834	return rate->legacy;
1835}
1836EXPORT_SYMBOL(cfg80211_calculate_bitrate);
1837
1838int cfg80211_get_p2p_attr(const u8 *ies, unsigned int len,
1839			  enum ieee80211_p2p_attr_id attr,
1840			  u8 *buf, unsigned int bufsize)
1841{
1842	u8 *out = buf;
1843	u16 attr_remaining = 0;
1844	bool desired_attr = false;
1845	u16 desired_len = 0;
1846
1847	while (len > 0) {
1848		unsigned int iedatalen;
1849		unsigned int copy;
1850		const u8 *iedata;
1851
1852		if (len < 2)
1853			return -EILSEQ;
1854		iedatalen = ies[1];
1855		if (iedatalen + 2 > len)
1856			return -EILSEQ;
1857
1858		if (ies[0] != WLAN_EID_VENDOR_SPECIFIC)
1859			goto cont;
1860
1861		if (iedatalen < 4)
1862			goto cont;
1863
1864		iedata = ies + 2;
1865
1866		/* check WFA OUI, P2P subtype */
1867		if (iedata[0] != 0x50 || iedata[1] != 0x6f ||
1868		    iedata[2] != 0x9a || iedata[3] != 0x09)
1869			goto cont;
1870
1871		iedatalen -= 4;
1872		iedata += 4;
1873
1874		/* check attribute continuation into this IE */
1875		copy = min_t(unsigned int, attr_remaining, iedatalen);
1876		if (copy && desired_attr) {
1877			desired_len += copy;
1878			if (out) {
1879				memcpy(out, iedata, min(bufsize, copy));
1880				out += min(bufsize, copy);
1881				bufsize -= min(bufsize, copy);
1882			}
1883
1884
1885			if (copy == attr_remaining)
1886				return desired_len;
1887		}
1888
1889		attr_remaining -= copy;
1890		if (attr_remaining)
1891			goto cont;
1892
1893		iedatalen -= copy;
1894		iedata += copy;
1895
1896		while (iedatalen > 0) {
1897			u16 attr_len;
1898
1899			/* P2P attribute ID & size must fit */
1900			if (iedatalen < 3)
1901				return -EILSEQ;
1902			desired_attr = iedata[0] == attr;
1903			attr_len = get_unaligned_le16(iedata + 1);
1904			iedatalen -= 3;
1905			iedata += 3;
1906
1907			copy = min_t(unsigned int, attr_len, iedatalen);
1908
1909			if (desired_attr) {
1910				desired_len += copy;
1911				if (out) {
1912					memcpy(out, iedata, min(bufsize, copy));
1913					out += min(bufsize, copy);
1914					bufsize -= min(bufsize, copy);
1915				}
1916
1917				if (copy == attr_len)
1918					return desired_len;
1919			}
1920
1921			iedata += copy;
1922			iedatalen -= copy;
1923			attr_remaining = attr_len - copy;
1924		}
1925
1926 cont:
1927		len -= ies[1] + 2;
1928		ies += ies[1] + 2;
1929	}
1930
1931	if (attr_remaining && desired_attr)
1932		return -EILSEQ;
1933
1934	return -ENOENT;
1935}
1936EXPORT_SYMBOL(cfg80211_get_p2p_attr);
1937
1938static bool ieee80211_id_in_list(const u8 *ids, int n_ids, u8 id, bool id_ext)
1939{
1940	int i;
1941
1942	/* Make sure array values are legal */
1943	if (WARN_ON(ids[n_ids - 1] == WLAN_EID_EXTENSION))
1944		return false;
1945
1946	i = 0;
1947	while (i < n_ids) {
1948		if (ids[i] == WLAN_EID_EXTENSION) {
1949			if (id_ext && (ids[i + 1] == id))
1950				return true;
1951
1952			i += 2;
1953			continue;
1954		}
1955
1956		if (ids[i] == id && !id_ext)
1957			return true;
1958
1959		i++;
1960	}
1961	return false;
1962}
1963
1964static size_t skip_ie(const u8 *ies, size_t ielen, size_t pos)
1965{
1966	/* we assume a validly formed IEs buffer */
1967	u8 len = ies[pos + 1];
1968
1969	pos += 2 + len;
1970
1971	/* the IE itself must have 255 bytes for fragments to follow */
1972	if (len < 255)
1973		return pos;
1974
1975	while (pos < ielen && ies[pos] == WLAN_EID_FRAGMENT) {
1976		len = ies[pos + 1];
1977		pos += 2 + len;
1978	}
1979
1980	return pos;
1981}
1982
1983size_t ieee80211_ie_split_ric(const u8 *ies, size_t ielen,
1984			      const u8 *ids, int n_ids,
1985			      const u8 *after_ric, int n_after_ric,
1986			      size_t offset)
1987{
1988	size_t pos = offset;
1989
1990	while (pos < ielen) {
1991		u8 ext = 0;
1992
1993		if (ies[pos] == WLAN_EID_EXTENSION)
1994			ext = 2;
1995		if ((pos + ext) >= ielen)
1996			break;
1997
1998		if (!ieee80211_id_in_list(ids, n_ids, ies[pos + ext],
1999					  ies[pos] == WLAN_EID_EXTENSION))
2000			break;
2001
2002		if (ies[pos] == WLAN_EID_RIC_DATA && n_after_ric) {
2003			pos = skip_ie(ies, ielen, pos);
2004
2005			while (pos < ielen) {
2006				if (ies[pos] == WLAN_EID_EXTENSION)
2007					ext = 2;
2008				else
2009					ext = 0;
2010
2011				if ((pos + ext) >= ielen)
2012					break;
2013
2014				if (!ieee80211_id_in_list(after_ric,
2015							  n_after_ric,
2016							  ies[pos + ext],
2017							  ext == 2))
2018					pos = skip_ie(ies, ielen, pos);
2019				else
2020					break;
2021			}
2022		} else {
2023			pos = skip_ie(ies, ielen, pos);
2024		}
2025	}
2026
2027	return pos;
2028}
2029EXPORT_SYMBOL(ieee80211_ie_split_ric);
2030
2031void ieee80211_fragment_element(struct sk_buff *skb, u8 *len_pos, u8 frag_id)
2032{
2033	unsigned int elem_len;
2034
2035	if (!len_pos)
2036		return;
2037
2038	elem_len = skb->data + skb->len - len_pos - 1;
2039
2040	while (elem_len > 255) {
2041		/* this one is 255 */
2042		*len_pos = 255;
2043		/* remaining data gets smaller */
2044		elem_len -= 255;
2045		/* make space for the fragment ID/len in SKB */
2046		skb_put(skb, 2);
2047		/* shift back the remaining data to place fragment ID/len */
2048		memmove(len_pos + 255 + 3, len_pos + 255 + 1, elem_len);
2049		/* place the fragment ID */
2050		len_pos += 255 + 1;
2051		*len_pos = frag_id;
2052		/* and point to fragment length to update later */
2053		len_pos++;
2054	}
2055
2056	*len_pos = elem_len;
2057}
2058EXPORT_SYMBOL(ieee80211_fragment_element);
2059
2060bool ieee80211_operating_class_to_band(u8 operating_class,
2061				       enum nl80211_band *band)
2062{
2063	switch (operating_class) {
2064	case 112:
2065	case 115 ... 127:
2066	case 128 ... 130:
2067		*band = NL80211_BAND_5GHZ;
2068		return true;
2069	case 131 ... 135:
2070	case 137:
2071		*band = NL80211_BAND_6GHZ;
2072		return true;
2073	case 81:
2074	case 82:
2075	case 83:
2076	case 84:
2077		*band = NL80211_BAND_2GHZ;
2078		return true;
2079	case 180:
2080		*band = NL80211_BAND_60GHZ;
2081		return true;
2082	}
2083
2084	return false;
2085}
2086EXPORT_SYMBOL(ieee80211_operating_class_to_band);
2087
2088bool ieee80211_operating_class_to_chandef(u8 operating_class,
2089					  struct ieee80211_channel *chan,
2090					  struct cfg80211_chan_def *chandef)
2091{
2092	u32 control_freq, offset = 0;
2093	enum nl80211_band band;
2094
2095	if (!ieee80211_operating_class_to_band(operating_class, &band) ||
2096	    !chan || band != chan->band)
2097		return false;
2098
2099	control_freq = chan->center_freq;
2100	chandef->chan = chan;
2101
2102	if (control_freq >= 5955)
2103		offset = control_freq - 5955;
2104	else if (control_freq >= 5745)
2105		offset = control_freq - 5745;
2106	else if (control_freq >= 5180)
2107		offset = control_freq - 5180;
2108	offset /= 20;
2109
2110	switch (operating_class) {
2111	case 81:  /* 2 GHz band; 20 MHz; channels 1..13 */
2112	case 82:  /* 2 GHz band; 20 MHz; channel 14 */
2113	case 115: /* 5 GHz band; 20 MHz; channels 36,40,44,48 */
2114	case 118: /* 5 GHz band; 20 MHz; channels 52,56,60,64 */
2115	case 121: /* 5 GHz band; 20 MHz; channels 100..144 */
2116	case 124: /* 5 GHz band; 20 MHz; channels 149,153,157,161 */
2117	case 125: /* 5 GHz band; 20 MHz; channels 149..177 */
2118	case 131: /* 6 GHz band; 20 MHz; channels 1..233*/
2119	case 136: /* 6 GHz band; 20 MHz; channel 2 */
2120		chandef->center_freq1 = control_freq;
2121		chandef->width = NL80211_CHAN_WIDTH_20;
2122		return true;
2123	case 83:  /* 2 GHz band; 40 MHz; channels 1..9 */
2124	case 116: /* 5 GHz band; 40 MHz; channels 36,44 */
2125	case 119: /* 5 GHz band; 40 MHz; channels 52,60 */
2126	case 122: /* 5 GHz band; 40 MHz; channels 100,108,116,124,132,140 */
2127	case 126: /* 5 GHz band; 40 MHz; channels 149,157,165,173 */
2128		chandef->center_freq1 = control_freq + 10;
2129		chandef->width = NL80211_CHAN_WIDTH_40;
2130		return true;
2131	case 84:  /* 2 GHz band; 40 MHz; channels 5..13 */
2132	case 117: /* 5 GHz band; 40 MHz; channels 40,48 */
2133	case 120: /* 5 GHz band; 40 MHz; channels 56,64 */
2134	case 123: /* 5 GHz band; 40 MHz; channels 104,112,120,128,136,144 */
2135	case 127: /* 5 GHz band; 40 MHz; channels 153,161,169,177 */
2136		chandef->center_freq1 = control_freq - 10;
2137		chandef->width = NL80211_CHAN_WIDTH_40;
2138		return true;
2139	case 132: /* 6 GHz band; 40 MHz; channels 1,5,..,229*/
2140		chandef->center_freq1 = control_freq + 10 - (offset & 1) * 20;
2141		chandef->width = NL80211_CHAN_WIDTH_40;
2142		return true;
2143	case 128: /* 5 GHz band; 80 MHz; channels 36..64,100..144,149..177 */
2144	case 133: /* 6 GHz band; 80 MHz; channels 1,5,..,229 */
2145		chandef->center_freq1 = control_freq + 30 - (offset & 3) * 20;
2146		chandef->width = NL80211_CHAN_WIDTH_80;
2147		return true;
2148	case 129: /* 5 GHz band; 160 MHz; channels 36..64,100..144,149..177 */
2149	case 134: /* 6 GHz band; 160 MHz; channels 1,5,..,229 */
2150		chandef->center_freq1 = control_freq + 70 - (offset & 7) * 20;
2151		chandef->width = NL80211_CHAN_WIDTH_160;
2152		return true;
2153	case 130: /* 5 GHz band; 80+80 MHz; channels 36..64,100..144,149..177 */
2154	case 135: /* 6 GHz band; 80+80 MHz; channels 1,5,..,229 */
2155		  /* The center_freq2 of 80+80 MHz is unknown */
2156	case 137: /* 6 GHz band; 320 MHz; channels 1,5,..,229 */
2157		  /* 320-1 or 320-2 channelization is unknown */
2158	default:
2159		return false;
2160	}
2161}
2162EXPORT_SYMBOL(ieee80211_operating_class_to_chandef);
2163
2164bool ieee80211_chandef_to_operating_class(struct cfg80211_chan_def *chandef,
2165					  u8 *op_class)
2166{
2167	u8 vht_opclass;
2168	u32 freq = chandef->center_freq1;
2169
2170	if (freq >= 2412 && freq <= 2472) {
2171		if (chandef->width > NL80211_CHAN_WIDTH_40)
2172			return false;
2173
2174		/* 2.407 GHz, channels 1..13 */
2175		if (chandef->width == NL80211_CHAN_WIDTH_40) {
2176			if (freq > chandef->chan->center_freq)
2177				*op_class = 83; /* HT40+ */
2178			else
2179				*op_class = 84; /* HT40- */
2180		} else {
2181			*op_class = 81;
2182		}
2183
2184		return true;
2185	}
2186
2187	if (freq == 2484) {
2188		/* channel 14 is only for IEEE 802.11b */
2189		if (chandef->width != NL80211_CHAN_WIDTH_20_NOHT)
2190			return false;
2191
2192		*op_class = 82; /* channel 14 */
2193		return true;
2194	}
2195
2196	switch (chandef->width) {
2197	case NL80211_CHAN_WIDTH_80:
2198		vht_opclass = 128;
2199		break;
2200	case NL80211_CHAN_WIDTH_160:
2201		vht_opclass = 129;
2202		break;
2203	case NL80211_CHAN_WIDTH_80P80:
2204		vht_opclass = 130;
2205		break;
2206	case NL80211_CHAN_WIDTH_10:
2207	case NL80211_CHAN_WIDTH_5:
2208		return false; /* unsupported for now */
2209	default:
2210		vht_opclass = 0;
2211		break;
2212	}
2213
2214	/* 5 GHz, channels 36..48 */
2215	if (freq >= 5180 && freq <= 5240) {
2216		if (vht_opclass) {
2217			*op_class = vht_opclass;
2218		} else if (chandef->width == NL80211_CHAN_WIDTH_40) {
2219			if (freq > chandef->chan->center_freq)
2220				*op_class = 116;
2221			else
2222				*op_class = 117;
2223		} else {
2224			*op_class = 115;
2225		}
2226
2227		return true;
2228	}
2229
2230	/* 5 GHz, channels 52..64 */
2231	if (freq >= 5260 && freq <= 5320) {
2232		if (vht_opclass) {
2233			*op_class = vht_opclass;
2234		} else if (chandef->width == NL80211_CHAN_WIDTH_40) {
2235			if (freq > chandef->chan->center_freq)
2236				*op_class = 119;
2237			else
2238				*op_class = 120;
2239		} else {
2240			*op_class = 118;
2241		}
2242
2243		return true;
2244	}
2245
2246	/* 5 GHz, channels 100..144 */
2247	if (freq >= 5500 && freq <= 5720) {
2248		if (vht_opclass) {
2249			*op_class = vht_opclass;
2250		} else if (chandef->width == NL80211_CHAN_WIDTH_40) {
2251			if (freq > chandef->chan->center_freq)
2252				*op_class = 122;
2253			else
2254				*op_class = 123;
2255		} else {
2256			*op_class = 121;
2257		}
2258
2259		return true;
2260	}
2261
2262	/* 5 GHz, channels 149..169 */
2263	if (freq >= 5745 && freq <= 5845) {
2264		if (vht_opclass) {
2265			*op_class = vht_opclass;
2266		} else if (chandef->width == NL80211_CHAN_WIDTH_40) {
2267			if (freq > chandef->chan->center_freq)
2268				*op_class = 126;
2269			else
2270				*op_class = 127;
2271		} else if (freq <= 5805) {
2272			*op_class = 124;
2273		} else {
2274			*op_class = 125;
2275		}
2276
2277		return true;
2278	}
2279
2280	/* 56.16 GHz, channel 1..4 */
2281	if (freq >= 56160 + 2160 * 1 && freq <= 56160 + 2160 * 6) {
2282		if (chandef->width >= NL80211_CHAN_WIDTH_40)
2283			return false;
2284
2285		*op_class = 180;
2286		return true;
2287	}
2288
2289	/* not supported yet */
2290	return false;
2291}
2292EXPORT_SYMBOL(ieee80211_chandef_to_operating_class);
2293
2294static int cfg80211_wdev_bi(struct wireless_dev *wdev)
2295{
2296	switch (wdev->iftype) {
2297	case NL80211_IFTYPE_AP:
2298	case NL80211_IFTYPE_P2P_GO:
2299		WARN_ON(wdev->valid_links);
2300		return wdev->links[0].ap.beacon_interval;
2301	case NL80211_IFTYPE_MESH_POINT:
2302		return wdev->u.mesh.beacon_interval;
2303	case NL80211_IFTYPE_ADHOC:
2304		return wdev->u.ibss.beacon_interval;
2305	default:
2306		break;
2307	}
2308
2309	return 0;
2310}
2311
2312static void cfg80211_calculate_bi_data(struct wiphy *wiphy, u32 new_beacon_int,
2313				       u32 *beacon_int_gcd,
2314				       bool *beacon_int_different,
2315				       int radio_idx)
2316{
2317	struct cfg80211_registered_device *rdev;
2318	struct wireless_dev *wdev;
2319
2320	*beacon_int_gcd = 0;
2321	*beacon_int_different = false;
2322
2323	rdev = wiphy_to_rdev(wiphy);
2324	list_for_each_entry(wdev, &wiphy->wdev_list, list) {
2325		int wdev_bi;
2326
2327		/* this feature isn't supported with MLO */
2328		if (wdev->valid_links)
2329			continue;
2330
2331		/* skip wdevs not active on the given wiphy radio */
2332		if (radio_idx >= 0 &&
2333		    !(rdev_get_radio_mask(rdev, wdev->netdev) & BIT(radio_idx)))
2334			continue;
2335
2336		wdev_bi = cfg80211_wdev_bi(wdev);
2337
2338		if (!wdev_bi)
2339			continue;
2340
2341		if (!*beacon_int_gcd) {
2342			*beacon_int_gcd = wdev_bi;
2343			continue;
2344		}
2345
2346		if (wdev_bi == *beacon_int_gcd)
2347			continue;
2348
2349		*beacon_int_different = true;
2350		*beacon_int_gcd = gcd(*beacon_int_gcd, wdev_bi);
2351	}
2352
2353	if (new_beacon_int && *beacon_int_gcd != new_beacon_int) {
2354		if (*beacon_int_gcd)
2355			*beacon_int_different = true;
2356		*beacon_int_gcd = gcd(*beacon_int_gcd, new_beacon_int);
2357	}
2358}
2359
2360int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
2361				 enum nl80211_iftype iftype, u32 beacon_int)
2362{
2363	/*
2364	 * This is just a basic pre-condition check; if interface combinations
2365	 * are possible the driver must already be checking those with a call
2366	 * to cfg80211_check_combinations(), in which case we'll validate more
2367	 * through the cfg80211_calculate_bi_data() call and code in
2368	 * cfg80211_iter_combinations().
2369	 */
2370
2371	if (beacon_int < 10 || beacon_int > 10000)
2372		return -EINVAL;
2373
2374	return 0;
2375}
2376
2377int cfg80211_iter_combinations(struct wiphy *wiphy,
2378			       struct iface_combination_params *params,
2379			       void (*iter)(const struct ieee80211_iface_combination *c,
2380					    void *data),
2381			       void *data)
2382{
2383	const struct wiphy_radio *radio = NULL;
2384	const struct ieee80211_iface_combination *c, *cs;
2385	const struct ieee80211_regdomain *regdom;
2386	enum nl80211_dfs_regions region = 0;
2387	int i, j, n, iftype;
2388	int num_interfaces = 0;
2389	u32 used_iftypes = 0;
2390	u32 beacon_int_gcd;
2391	bool beacon_int_different;
2392
2393	if (params->radio_idx >= 0)
2394		radio = &wiphy->radio[params->radio_idx];
2395
2396	/*
2397	 * This is a bit strange, since the iteration used to rely only on
2398	 * the data given by the driver, but here it now relies on context,
2399	 * in form of the currently operating interfaces.
2400	 * This is OK for all current users, and saves us from having to
2401	 * push the GCD calculations into all the drivers.
2402	 * In the future, this should probably rely more on data that's in
2403	 * cfg80211 already - the only thing not would appear to be any new
2404	 * interfaces (while being brought up) and channel/radar data.
2405	 */
2406	cfg80211_calculate_bi_data(wiphy, params->new_beacon_int,
2407				   &beacon_int_gcd, &beacon_int_different,
2408				   params->radio_idx);
2409
2410	if (params->radar_detect) {
2411		rcu_read_lock();
2412		regdom = rcu_dereference(cfg80211_regdomain);
2413		if (regdom)
2414			region = regdom->dfs_region;
2415		rcu_read_unlock();
2416	}
2417
2418	for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
2419		num_interfaces += params->iftype_num[iftype];
2420		if (params->iftype_num[iftype] > 0 &&
2421		    !cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
2422			used_iftypes |= BIT(iftype);
2423	}
2424
2425	if (radio) {
2426		cs = radio->iface_combinations;
2427		n = radio->n_iface_combinations;
2428	} else {
2429		cs = wiphy->iface_combinations;
2430		n = wiphy->n_iface_combinations;
2431	}
2432	for (i = 0; i < n; i++) {
2433		struct ieee80211_iface_limit *limits;
2434		u32 all_iftypes = 0;
2435
2436		c = &cs[i];
2437		if (num_interfaces > c->max_interfaces)
2438			continue;
2439		if (params->num_different_channels > c->num_different_channels)
2440			continue;
2441
2442		limits = kmemdup_array(c->limits, c->n_limits, sizeof(*limits),
2443				       GFP_KERNEL);
2444		if (!limits)
2445			return -ENOMEM;
2446
2447		for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
2448			if (cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
2449				continue;
2450			for (j = 0; j < c->n_limits; j++) {
2451				all_iftypes |= limits[j].types;
2452				if (!(limits[j].types & BIT(iftype)))
2453					continue;
2454				if (limits[j].max < params->iftype_num[iftype])
2455					goto cont;
2456				limits[j].max -= params->iftype_num[iftype];
2457			}
2458		}
2459
2460		if (params->radar_detect !=
2461			(c->radar_detect_widths & params->radar_detect))
2462			goto cont;
2463
2464		if (params->radar_detect && c->radar_detect_regions &&
2465		    !(c->radar_detect_regions & BIT(region)))
2466			goto cont;
2467
2468		/* Finally check that all iftypes that we're currently
2469		 * using are actually part of this combination. If they
2470		 * aren't then we can't use this combination and have
2471		 * to continue to the next.
2472		 */
2473		if ((all_iftypes & used_iftypes) != used_iftypes)
2474			goto cont;
2475
2476		if (beacon_int_gcd) {
2477			if (c->beacon_int_min_gcd &&
2478			    beacon_int_gcd < c->beacon_int_min_gcd)
2479				goto cont;
2480			if (!c->beacon_int_min_gcd && beacon_int_different)
2481				goto cont;
2482		}
2483
2484		/* This combination covered all interface types and
2485		 * supported the requested numbers, so we're good.
2486		 */
2487
2488		(*iter)(c, data);
2489 cont:
2490		kfree(limits);
2491	}
2492
2493	return 0;
2494}
2495EXPORT_SYMBOL(cfg80211_iter_combinations);
2496
2497static void
2498cfg80211_iter_sum_ifcombs(const struct ieee80211_iface_combination *c,
2499			  void *data)
2500{
2501	int *num = data;
2502	(*num)++;
2503}
2504
2505int cfg80211_check_combinations(struct wiphy *wiphy,
2506				struct iface_combination_params *params)
2507{
2508	int err, num = 0;
2509
2510	err = cfg80211_iter_combinations(wiphy, params,
2511					 cfg80211_iter_sum_ifcombs, &num);
2512	if (err)
2513		return err;
2514	if (num == 0)
2515		return -EBUSY;
2516
2517	return 0;
2518}
2519EXPORT_SYMBOL(cfg80211_check_combinations);
2520
2521int cfg80211_get_radio_idx_by_chan(struct wiphy *wiphy,
2522				   const struct ieee80211_channel *chan)
2523{
2524	const struct wiphy_radio *radio;
2525	int i, j;
2526	u32 freq;
2527
2528	if (!chan)
2529		return -EINVAL;
2530
2531	freq = ieee80211_channel_to_khz(chan);
2532	for (i = 0; i < wiphy->n_radio; i++) {
2533		radio = &wiphy->radio[i];
2534		for (j = 0; j < radio->n_freq_range; j++) {
2535			if (freq >= radio->freq_range[j].start_freq &&
2536			    freq < radio->freq_range[j].end_freq)
2537				return i;
2538		}
2539	}
2540
2541	return -EINVAL;
2542}
2543EXPORT_SYMBOL(cfg80211_get_radio_idx_by_chan);
2544
2545int ieee80211_get_ratemask(struct ieee80211_supported_band *sband,
2546			   const u8 *rates, unsigned int n_rates,
2547			   u32 *mask)
2548{
2549	int i, j;
2550
2551	if (!sband)
2552		return -EINVAL;
2553
2554	if (n_rates == 0 || n_rates > NL80211_MAX_SUPP_RATES)
2555		return -EINVAL;
2556
2557	*mask = 0;
2558
2559	for (i = 0; i < n_rates; i++) {
2560		int rate = (rates[i] & 0x7f) * 5;
2561		bool found = false;
2562
2563		for (j = 0; j < sband->n_bitrates; j++) {
2564			if (sband->bitrates[j].bitrate == rate) {
2565				found = true;
2566				*mask |= BIT(j);
2567				break;
2568			}
2569		}
2570		if (!found)
2571			return -EINVAL;
2572	}
2573
2574	/*
2575	 * mask must have at least one bit set here since we
2576	 * didn't accept a 0-length rates array nor allowed
2577	 * entries in the array that didn't exist
2578	 */
2579
2580	return 0;
2581}
2582
2583unsigned int ieee80211_get_num_supported_channels(struct wiphy *wiphy)
2584{
2585	enum nl80211_band band;
2586	unsigned int n_channels = 0;
2587
2588	for (band = 0; band < NUM_NL80211_BANDS; band++)
2589		if (wiphy->bands[band])
2590			n_channels += wiphy->bands[band]->n_channels;
2591
2592	return n_channels;
2593}
2594EXPORT_SYMBOL(ieee80211_get_num_supported_channels);
2595
2596int cfg80211_get_station(struct net_device *dev, const u8 *mac_addr,
2597			 struct station_info *sinfo)
2598{
2599	struct cfg80211_registered_device *rdev;
2600	struct wireless_dev *wdev;
2601
2602	wdev = dev->ieee80211_ptr;
2603	if (!wdev)
2604		return -EOPNOTSUPP;
2605
2606	rdev = wiphy_to_rdev(wdev->wiphy);
2607	if (!rdev->ops->get_station)
2608		return -EOPNOTSUPP;
2609
2610	memset(sinfo, 0, sizeof(*sinfo));
2611
2612	guard(wiphy)(&rdev->wiphy);
2613
2614	return rdev_get_station(rdev, dev, mac_addr, sinfo);
2615}
2616EXPORT_SYMBOL(cfg80211_get_station);
2617
2618void cfg80211_free_nan_func(struct cfg80211_nan_func *f)
2619{
2620	int i;
2621
2622	if (!f)
2623		return;
2624
2625	kfree(f->serv_spec_info);
2626	kfree(f->srf_bf);
2627	kfree(f->srf_macs);
2628	for (i = 0; i < f->num_rx_filters; i++)
2629		kfree(f->rx_filters[i].filter);
2630
2631	for (i = 0; i < f->num_tx_filters; i++)
2632		kfree(f->tx_filters[i].filter);
2633
2634	kfree(f->rx_filters);
2635	kfree(f->tx_filters);
2636	kfree(f);
2637}
2638EXPORT_SYMBOL(cfg80211_free_nan_func);
2639
2640bool cfg80211_does_bw_fit_range(const struct ieee80211_freq_range *freq_range,
2641				u32 center_freq_khz, u32 bw_khz)
2642{
2643	u32 start_freq_khz, end_freq_khz;
2644
2645	start_freq_khz = center_freq_khz - (bw_khz / 2);
2646	end_freq_khz = center_freq_khz + (bw_khz / 2);
2647
2648	if (start_freq_khz >= freq_range->start_freq_khz &&
2649	    end_freq_khz <= freq_range->end_freq_khz)
2650		return true;
2651
2652	return false;
2653}
2654
2655int cfg80211_link_sinfo_alloc_tid_stats(struct link_station_info *link_sinfo,
2656					gfp_t gfp)
2657{
2658	link_sinfo->pertid = kcalloc(IEEE80211_NUM_TIDS + 1,
2659				     sizeof(*link_sinfo->pertid), gfp);
2660	if (!link_sinfo->pertid)
2661		return -ENOMEM;
2662
2663	return 0;
2664}
2665EXPORT_SYMBOL(cfg80211_link_sinfo_alloc_tid_stats);
2666
2667int cfg80211_sinfo_alloc_tid_stats(struct station_info *sinfo, gfp_t gfp)
2668{
2669	sinfo->pertid = kcalloc(IEEE80211_NUM_TIDS + 1,
2670				sizeof(*(sinfo->pertid)),
2671				gfp);
2672	if (!sinfo->pertid)
2673		return -ENOMEM;
2674
2675	return 0;
2676}
2677EXPORT_SYMBOL(cfg80211_sinfo_alloc_tid_stats);
2678
2679/* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
2680/* Ethernet-II snap header (RFC1042 for most EtherTypes) */
2681const unsigned char rfc1042_header[] __aligned(2) =
2682	{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
2683EXPORT_SYMBOL(rfc1042_header);
2684
2685/* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
2686const unsigned char bridge_tunnel_header[] __aligned(2) =
2687	{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
2688EXPORT_SYMBOL(bridge_tunnel_header);
2689
2690/* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
2691struct iapp_layer2_update {
2692	u8 da[ETH_ALEN];	/* broadcast */
2693	u8 sa[ETH_ALEN];	/* STA addr */
2694	__be16 len;		/* 6 */
2695	u8 dsap;		/* 0 */
2696	u8 ssap;		/* 0 */
2697	u8 control;
2698	u8 xid_info[3];
2699} __packed;
2700
2701void cfg80211_send_layer2_update(struct net_device *dev, const u8 *addr)
2702{
2703	struct iapp_layer2_update *msg;
2704	struct sk_buff *skb;
2705
2706	/* Send Level 2 Update Frame to update forwarding tables in layer 2
2707	 * bridge devices */
2708
2709	skb = dev_alloc_skb(sizeof(*msg));
2710	if (!skb)
2711		return;
2712	msg = skb_put(skb, sizeof(*msg));
2713
2714	/* 802.2 Type 1 Logical Link Control (LLC) Exchange Identifier (XID)
2715	 * Update response frame; IEEE Std 802.2-1998, 5.4.1.2.1 */
2716
2717	eth_broadcast_addr(msg->da);
2718	ether_addr_copy(msg->sa, addr);
2719	msg->len = htons(6);
2720	msg->dsap = 0;
2721	msg->ssap = 0x01;	/* NULL LSAP, CR Bit: Response */
2722	msg->control = 0xaf;	/* XID response lsb.1111F101.
2723				 * F=0 (no poll command; unsolicited frame) */
2724	msg->xid_info[0] = 0x81;	/* XID format identifier */
2725	msg->xid_info[1] = 1;	/* LLC types/classes: Type 1 LLC */
2726	msg->xid_info[2] = 0;	/* XID sender's receive window size (RW) */
2727
2728	skb->dev = dev;
2729	skb->protocol = eth_type_trans(skb, dev);
2730	memset(skb->cb, 0, sizeof(skb->cb));
2731	netif_rx(skb);
2732}
2733EXPORT_SYMBOL(cfg80211_send_layer2_update);
2734
2735int ieee80211_get_vht_max_nss(struct ieee80211_vht_cap *cap,
2736			      enum ieee80211_vht_chanwidth bw,
2737			      int mcs, bool ext_nss_bw_capable,
2738			      unsigned int max_vht_nss)
2739{
2740	u16 map = le16_to_cpu(cap->supp_mcs.rx_mcs_map);
2741	int ext_nss_bw;
2742	int supp_width;
2743	int i, mcs_encoding;
2744
2745	if (map == 0xffff)
2746		return 0;
2747
2748	if (WARN_ON(mcs > 9 || max_vht_nss > 8))
2749		return 0;
2750	if (mcs <= 7)
2751		mcs_encoding = 0;
2752	else if (mcs == 8)
2753		mcs_encoding = 1;
2754	else
2755		mcs_encoding = 2;
2756
2757	if (!max_vht_nss) {
2758		/* find max_vht_nss for the given MCS */
2759		for (i = 7; i >= 0; i--) {
2760			int supp = (map >> (2 * i)) & 3;
2761
2762			if (supp == 3)
2763				continue;
2764
2765			if (supp >= mcs_encoding) {
2766				max_vht_nss = i + 1;
2767				break;
2768			}
2769		}
2770	}
2771
2772	if (!(cap->supp_mcs.tx_mcs_map &
2773			cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE)))
2774		return max_vht_nss;
2775
2776	ext_nss_bw = le32_get_bits(cap->vht_cap_info,
2777				   IEEE80211_VHT_CAP_EXT_NSS_BW_MASK);
2778	supp_width = le32_get_bits(cap->vht_cap_info,
2779				   IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK);
2780
2781	/* if not capable, treat ext_nss_bw as 0 */
2782	if (!ext_nss_bw_capable)
2783		ext_nss_bw = 0;
2784
2785	/* This is invalid */
2786	if (supp_width == 3)
2787		return 0;
2788
2789	/* This is an invalid combination so pretend nothing is supported */
2790	if (supp_width == 2 && (ext_nss_bw == 1 || ext_nss_bw == 2))
2791		return 0;
2792
2793	/*
2794	 * Cover all the special cases according to IEEE 802.11-2016
2795	 * Table 9-250. All other cases are either factor of 1 or not
2796	 * valid/supported.
2797	 */
2798	switch (bw) {
2799	case IEEE80211_VHT_CHANWIDTH_USE_HT:
2800	case IEEE80211_VHT_CHANWIDTH_80MHZ:
2801		if ((supp_width == 1 || supp_width == 2) &&
2802		    ext_nss_bw == 3)
2803			return 2 * max_vht_nss;
2804		break;
2805	case IEEE80211_VHT_CHANWIDTH_160MHZ:
2806		if (supp_width == 0 &&
2807		    (ext_nss_bw == 1 || ext_nss_bw == 2))
2808			return max_vht_nss / 2;
2809		if (supp_width == 0 &&
2810		    ext_nss_bw == 3)
2811			return (3 * max_vht_nss) / 4;
2812		if (supp_width == 1 &&
2813		    ext_nss_bw == 3)
2814			return 2 * max_vht_nss;
2815		break;
2816	case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
2817		if (supp_width == 0 && ext_nss_bw == 1)
2818			return 0; /* not possible */
2819		if (supp_width == 0 &&
2820		    ext_nss_bw == 2)
2821			return max_vht_nss / 2;
2822		if (supp_width == 0 &&
2823		    ext_nss_bw == 3)
2824			return (3 * max_vht_nss) / 4;
2825		if (supp_width == 1 &&
2826		    ext_nss_bw == 0)
2827			return 0; /* not possible */
2828		if (supp_width == 1 &&
2829		    ext_nss_bw == 1)
2830			return max_vht_nss / 2;
2831		if (supp_width == 1 &&
2832		    ext_nss_bw == 2)
2833			return (3 * max_vht_nss) / 4;
2834		break;
2835	}
2836
2837	/* not covered or invalid combination received */
2838	return max_vht_nss;
2839}
2840EXPORT_SYMBOL(ieee80211_get_vht_max_nss);
2841
2842bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype,
2843			     bool is_4addr, u8 check_swif)
2844
2845{
2846	bool is_vlan = iftype == NL80211_IFTYPE_AP_VLAN;
2847
2848	switch (check_swif) {
2849	case 0:
2850		if (is_vlan && is_4addr)
2851			return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
2852		return wiphy->interface_modes & BIT(iftype);
2853	case 1:
2854		if (!(wiphy->software_iftypes & BIT(iftype)) && is_vlan)
2855			return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
2856		return wiphy->software_iftypes & BIT(iftype);
2857	default:
2858		break;
2859	}
2860
2861	return false;
2862}
2863EXPORT_SYMBOL(cfg80211_iftype_allowed);
2864
2865void cfg80211_remove_link(struct wireless_dev *wdev, unsigned int link_id)
2866{
2867	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2868
2869	lockdep_assert_wiphy(wdev->wiphy);
2870
2871	switch (wdev->iftype) {
2872	case NL80211_IFTYPE_AP:
2873	case NL80211_IFTYPE_P2P_GO:
2874		cfg80211_stop_ap(rdev, wdev->netdev, link_id, true);
2875		break;
2876	default:
2877		/* per-link not relevant */
2878		break;
2879	}
2880
2881	rdev_del_intf_link(rdev, wdev, link_id);
2882
2883	wdev->valid_links &= ~BIT(link_id);
2884	eth_zero_addr(wdev->links[link_id].addr);
2885}
2886
2887void cfg80211_remove_links(struct wireless_dev *wdev)
2888{
2889	unsigned int link_id;
2890
2891	/*
2892	 * links are controlled by upper layers (userspace/cfg)
2893	 * only for AP mode, so only remove them here for AP
2894	 */
2895	if (wdev->iftype != NL80211_IFTYPE_AP)
2896		return;
2897
2898	if (wdev->valid_links) {
2899		for_each_valid_link(wdev, link_id)
2900			cfg80211_remove_link(wdev, link_id);
2901	}
2902}
2903
2904int cfg80211_remove_virtual_intf(struct cfg80211_registered_device *rdev,
2905				 struct wireless_dev *wdev)
2906{
2907	cfg80211_remove_links(wdev);
2908
2909	return rdev_del_virtual_intf(rdev, wdev);
2910}
2911
2912const struct wiphy_iftype_ext_capab *
2913cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type)
2914{
2915	int i;
2916
2917	for (i = 0; i < wiphy->num_iftype_ext_capab; i++) {
2918		if (wiphy->iftype_ext_capab[i].iftype == type)
2919			return &wiphy->iftype_ext_capab[i];
2920	}
2921
2922	return NULL;
2923}
2924EXPORT_SYMBOL(cfg80211_get_iftype_ext_capa);
2925
2926bool ieee80211_radio_freq_range_valid(const struct wiphy_radio *radio,
2927				      u32 freq, u32 width)
2928{
2929	const struct wiphy_radio_freq_range *r;
2930	int i;
2931
2932	for (i = 0; i < radio->n_freq_range; i++) {
2933		r = &radio->freq_range[i];
2934		if (freq - width / 2 >= r->start_freq &&
2935		    freq + width / 2 <= r->end_freq)
2936			return true;
2937	}
2938
2939	return false;
2940}
2941EXPORT_SYMBOL(ieee80211_radio_freq_range_valid);
2942
2943bool cfg80211_radio_chandef_valid(const struct wiphy_radio *radio,
2944				  const struct cfg80211_chan_def *chandef)
2945{
2946	u32 freq, width;
2947
2948	freq = ieee80211_chandef_to_khz(chandef);
2949	width = MHZ_TO_KHZ(cfg80211_chandef_get_width(chandef));
2950	if (!ieee80211_radio_freq_range_valid(radio, freq, width))
2951		return false;
2952
2953	freq = MHZ_TO_KHZ(chandef->center_freq2);
2954	if (freq && !ieee80211_radio_freq_range_valid(radio, freq, width))
2955		return false;
2956
2957	return true;
2958}
2959EXPORT_SYMBOL(cfg80211_radio_chandef_valid);
2960
2961bool cfg80211_wdev_channel_allowed(struct wireless_dev *wdev,
2962				   struct ieee80211_channel *chan)
2963{
2964	struct wiphy *wiphy = wdev->wiphy;
2965	const struct wiphy_radio *radio;
2966	struct cfg80211_chan_def chandef;
2967	u32 radio_mask;
2968	int i;
2969
2970	radio_mask = wdev->radio_mask;
2971	if (!wiphy->n_radio || radio_mask == BIT(wiphy->n_radio) - 1)
2972		return true;
2973
2974	cfg80211_chandef_create(&chandef, chan, NL80211_CHAN_HT20);
2975	for (i = 0; i < wiphy->n_radio; i++) {
2976		if (!(radio_mask & BIT(i)))
2977			continue;
2978
2979		radio = &wiphy->radio[i];
2980		if (!cfg80211_radio_chandef_valid(radio, &chandef))
2981			continue;
2982
2983		return true;
2984	}
2985
2986	return false;
2987}
2988EXPORT_SYMBOL(cfg80211_wdev_channel_allowed);