1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Interface handling
   4 *
   5 * Copyright 2002-2005, Instant802 Networks, Inc.
   6 * Copyright 2005-2006, Devicescape Software, Inc.
   7 * Copyright (c) 2006 Jiri Benc <jbenc@suse.cz>
   8 * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
   9 * Copyright 2013-2014  Intel Mobile Communications GmbH
  10 * Copyright (c) 2016        Intel Deutschland GmbH
  11 * Copyright (C) 2018-2021 Intel Corporation
  12 */
  13#include <linux/slab.h>
  14#include <linux/kernel.h>
  15#include <linux/if_arp.h>
  16#include <linux/netdevice.h>
  17#include <linux/rtnetlink.h>
  18#include <linux/kcov.h>
  19#include <net/mac80211.h>
  20#include <net/ieee80211_radiotap.h>
  21#include "ieee80211_i.h"
  22#include "sta_info.h"
  23#include "debugfs_netdev.h"
  24#include "mesh.h"
  25#include "led.h"
  26#include "driver-ops.h"
  27#include "wme.h"
  28#include "rate.h"
  29
  30/**
  31 * DOC: Interface list locking
  32 *
  33 * The interface list in each struct ieee80211_local is protected
  34 * three-fold:
  35 *
  36 * (1) modifications may only be done under the RTNL
  37 * (2) modifications and readers are protected against each other by
  38 *     the iflist_mtx.
  39 * (3) modifications are done in an RCU manner so atomic readers
  40 *     can traverse the list in RCU-safe blocks.
  41 *
  42 * As a consequence, reads (traversals) of the list can be protected
  43 * by either the RTNL, the iflist_mtx or RCU.
  44 */
  45
  46static void ieee80211_iface_work(struct work_struct *work);
  47
  48bool __ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata)
  49{
  50	struct ieee80211_chanctx_conf *chanctx_conf;
  51	int power;
  52
  53	rcu_read_lock();
  54	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
  55	if (!chanctx_conf) {
  56		rcu_read_unlock();
  57		return false;
  58	}
  59
  60	power = ieee80211_chandef_max_power(&chanctx_conf->def);
  61	rcu_read_unlock();
  62
  63	if (sdata->user_power_level != IEEE80211_UNSET_POWER_LEVEL)
  64		power = min(power, sdata->user_power_level);
  65
  66	if (sdata->ap_power_level != IEEE80211_UNSET_POWER_LEVEL)
  67		power = min(power, sdata->ap_power_level);
  68
  69	if (power != sdata->vif.bss_conf.txpower) {
  70		sdata->vif.bss_conf.txpower = power;
  71		ieee80211_hw_config(sdata->local, 0);
  72		return true;
  73	}
  74
  75	return false;
  76}
  77
  78void ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata,
  79			      bool update_bss)
  80{
  81	if (__ieee80211_recalc_txpower(sdata) ||
  82	    (update_bss && ieee80211_sdata_running(sdata)))
  83		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_TXPOWER);
  84}
  85
  86static u32 __ieee80211_idle_off(struct ieee80211_local *local)
  87{
  88	if (!(local->hw.conf.flags & IEEE80211_CONF_IDLE))
  89		return 0;
  90
  91	local->hw.conf.flags &= ~IEEE80211_CONF_IDLE;
  92	return IEEE80211_CONF_CHANGE_IDLE;
  93}
  94
  95static u32 __ieee80211_idle_on(struct ieee80211_local *local)
  96{
  97	if (local->hw.conf.flags & IEEE80211_CONF_IDLE)
  98		return 0;
  99
 100	ieee80211_flush_queues(local, NULL, false);
 101
 102	local->hw.conf.flags |= IEEE80211_CONF_IDLE;
 103	return IEEE80211_CONF_CHANGE_IDLE;
 104}
 105
 106static u32 __ieee80211_recalc_idle(struct ieee80211_local *local,
 107				   bool force_active)
 108{
 109	bool working, scanning, active;
 110	unsigned int led_trig_start = 0, led_trig_stop = 0;
 111
 112	lockdep_assert_held(&local->mtx);
 113
 114	active = force_active ||
 115		 !list_empty(&local->chanctx_list) ||
 116		 local->monitors;
 117
 118	working = !local->ops->remain_on_channel &&
 119		  !list_empty(&local->roc_list);
 120
 121	scanning = test_bit(SCAN_SW_SCANNING, &local->scanning) ||
 122		   test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning);
 123
 124	if (working || scanning)
 125		led_trig_start |= IEEE80211_TPT_LEDTRIG_FL_WORK;
 126	else
 127		led_trig_stop |= IEEE80211_TPT_LEDTRIG_FL_WORK;
 128
 129	if (active)
 130		led_trig_start |= IEEE80211_TPT_LEDTRIG_FL_CONNECTED;
 131	else
 132		led_trig_stop |= IEEE80211_TPT_LEDTRIG_FL_CONNECTED;
 133
 134	ieee80211_mod_tpt_led_trig(local, led_trig_start, led_trig_stop);
 135
 136	if (working || scanning || active)
 137		return __ieee80211_idle_off(local);
 138	return __ieee80211_idle_on(local);
 139}
 140
 141u32 ieee80211_idle_off(struct ieee80211_local *local)
 142{
 143	return __ieee80211_recalc_idle(local, true);
 144}
 145
 146void ieee80211_recalc_idle(struct ieee80211_local *local)
 147{
 148	u32 change = __ieee80211_recalc_idle(local, false);
 149	if (change)
 150		ieee80211_hw_config(local, change);
 151}
 152
 153static int ieee80211_verify_mac(struct ieee80211_sub_if_data *sdata, u8 *addr,
 154				bool check_dup)
 155{
 156	struct ieee80211_local *local = sdata->local;
 157	struct ieee80211_sub_if_data *iter;
 158	u64 new, mask, tmp;
 159	u8 *m;
 160	int ret = 0;
 161
 162	if (is_zero_ether_addr(local->hw.wiphy->addr_mask))
 163		return 0;
 164
 165	m = addr;
 166	new =	((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
 167		((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
 168		((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
 169
 170	m = local->hw.wiphy->addr_mask;
 171	mask =	((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
 172		((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
 173		((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
 174
 175	if (!check_dup)
 176		return ret;
 177
 178	mutex_lock(&local->iflist_mtx);
 179	list_for_each_entry(iter, &local->interfaces, list) {
 180		if (iter == sdata)
 181			continue;
 182
 183		if (iter->vif.type == NL80211_IFTYPE_MONITOR &&
 184		    !(iter->u.mntr.flags & MONITOR_FLAG_ACTIVE))
 185			continue;
 186
 187		m = iter->vif.addr;
 188		tmp =	((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
 189			((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
 190			((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
 191
 192		if ((new & ~mask) != (tmp & ~mask)) {
 193			ret = -EINVAL;
 194			break;
 195		}
 196	}
 197	mutex_unlock(&local->iflist_mtx);
 198
 199	return ret;
 200}
 201
 202static int ieee80211_change_mac(struct net_device *dev, void *addr)
 203{
 204	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 205	struct sockaddr *sa = addr;
 206	bool check_dup = true;
 207	int ret;
 208
 209	if (ieee80211_sdata_running(sdata))
 210		return -EBUSY;
 211
 212	if (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
 213	    !(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE))
 214		check_dup = false;
 215
 216	ret = ieee80211_verify_mac(sdata, sa->sa_data, check_dup);
 217	if (ret)
 218		return ret;
 219
 220	ret = eth_mac_addr(dev, sa);
 221
 222	if (ret == 0)
 223		memcpy(sdata->vif.addr, sa->sa_data, ETH_ALEN);
 224
 225	return ret;
 226}
 227
 228static inline int identical_mac_addr_allowed(int type1, int type2)
 229{
 230	return type1 == NL80211_IFTYPE_MONITOR ||
 231		type2 == NL80211_IFTYPE_MONITOR ||
 232		type1 == NL80211_IFTYPE_P2P_DEVICE ||
 233		type2 == NL80211_IFTYPE_P2P_DEVICE ||
 
 
 
 
 234		(type1 == NL80211_IFTYPE_AP && type2 == NL80211_IFTYPE_AP_VLAN) ||
 235		(type1 == NL80211_IFTYPE_AP_VLAN &&
 236			(type2 == NL80211_IFTYPE_AP ||
 237			 type2 == NL80211_IFTYPE_AP_VLAN));
 238}
 239
 240static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,
 241					    enum nl80211_iftype iftype)
 242{
 243	struct ieee80211_local *local = sdata->local;
 244	struct ieee80211_sub_if_data *nsdata;
 245	int ret;
 246
 247	ASSERT_RTNL();
 248
 249	/* we hold the RTNL here so can safely walk the list */
 250	list_for_each_entry(nsdata, &local->interfaces, list) {
 251		if (nsdata != sdata && ieee80211_sdata_running(nsdata)) {
 252			/*
 253			 * Only OCB and monitor mode may coexist
 254			 */
 255			if ((sdata->vif.type == NL80211_IFTYPE_OCB &&
 256			     nsdata->vif.type != NL80211_IFTYPE_MONITOR) ||
 257			    (sdata->vif.type != NL80211_IFTYPE_MONITOR &&
 258			     nsdata->vif.type == NL80211_IFTYPE_OCB))
 259				return -EBUSY;
 260
 261			/*
 262			 * Allow only a single IBSS interface to be up at any
 263			 * time. This is restricted because beacon distribution
 264			 * cannot work properly if both are in the same IBSS.
 265			 *
 266			 * To remove this restriction we'd have to disallow them
 267			 * from setting the same SSID on different IBSS interfaces
 268			 * belonging to the same hardware. Then, however, we're
 269			 * faced with having to adopt two different TSF timers...
 270			 */
 271			if (iftype == NL80211_IFTYPE_ADHOC &&
 272			    nsdata->vif.type == NL80211_IFTYPE_ADHOC)
 273				return -EBUSY;
 274			/*
 275			 * will not add another interface while any channel
 276			 * switch is active.
 277			 */
 278			if (nsdata->vif.csa_active)
 279				return -EBUSY;
 280
 281			/*
 282			 * The remaining checks are only performed for interfaces
 283			 * with the same MAC address.
 284			 */
 285			if (!ether_addr_equal(sdata->vif.addr,
 286					      nsdata->vif.addr))
 287				continue;
 288
 289			/*
 290			 * check whether it may have the same address
 291			 */
 292			if (!identical_mac_addr_allowed(iftype,
 293							nsdata->vif.type))
 294				return -ENOTUNIQ;
 295
 296			/*
 297			 * can only add VLANs to enabled APs
 298			 */
 299			if (iftype == NL80211_IFTYPE_AP_VLAN &&
 300			    nsdata->vif.type == NL80211_IFTYPE_AP)
 301				sdata->bss = &nsdata->u.ap;
 302		}
 303	}
 304
 305	mutex_lock(&local->chanctx_mtx);
 306	ret = ieee80211_check_combinations(sdata, NULL, 0, 0);
 307	mutex_unlock(&local->chanctx_mtx);
 308	return ret;
 309}
 310
 311static int ieee80211_check_queues(struct ieee80211_sub_if_data *sdata,
 312				  enum nl80211_iftype iftype)
 313{
 314	int n_queues = sdata->local->hw.queues;
 315	int i;
 316
 317	if (iftype == NL80211_IFTYPE_NAN)
 318		return 0;
 319
 320	if (iftype != NL80211_IFTYPE_P2P_DEVICE) {
 321		for (i = 0; i < IEEE80211_NUM_ACS; i++) {
 322			if (WARN_ON_ONCE(sdata->vif.hw_queue[i] ==
 323					 IEEE80211_INVAL_HW_QUEUE))
 324				return -EINVAL;
 325			if (WARN_ON_ONCE(sdata->vif.hw_queue[i] >=
 326					 n_queues))
 327				return -EINVAL;
 328		}
 329	}
 330
 331	if ((iftype != NL80211_IFTYPE_AP &&
 332	     iftype != NL80211_IFTYPE_P2P_GO &&
 333	     iftype != NL80211_IFTYPE_MESH_POINT) ||
 334	    !ieee80211_hw_check(&sdata->local->hw, QUEUE_CONTROL)) {
 335		sdata->vif.cab_queue = IEEE80211_INVAL_HW_QUEUE;
 336		return 0;
 337	}
 338
 339	if (WARN_ON_ONCE(sdata->vif.cab_queue == IEEE80211_INVAL_HW_QUEUE))
 340		return -EINVAL;
 341
 342	if (WARN_ON_ONCE(sdata->vif.cab_queue >= n_queues))
 343		return -EINVAL;
 344
 345	return 0;
 346}
 347
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 348static int ieee80211_open(struct net_device *dev)
 349{
 350	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 351	int err;
 352
 353	/* fail early if user set an invalid address */
 354	if (!is_valid_ether_addr(dev->dev_addr))
 355		return -EADDRNOTAVAIL;
 356
 357	err = ieee80211_check_concurrent_iface(sdata, sdata->vif.type);
 358	if (err)
 359		return err;
 360
 361	wiphy_lock(sdata->local->hw.wiphy);
 362	err = ieee80211_do_open(&sdata->wdev, true);
 363	wiphy_unlock(sdata->local->hw.wiphy);
 364
 365	return err;
 366}
 367
 368static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_down)
 
 369{
 370	struct ieee80211_local *local = sdata->local;
 371	unsigned long flags;
 372	struct sk_buff *skb, *tmp;
 373	u32 hw_reconf_flags = 0;
 374	int i, flushed;
 375	struct ps_data *ps;
 376	struct cfg80211_chan_def chandef;
 377	bool cancel_scan;
 378	struct cfg80211_nan_func *func;
 379
 380	clear_bit(SDATA_STATE_RUNNING, &sdata->state);
 381
 382	cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
 383	if (cancel_scan)
 384		ieee80211_scan_cancel(local);
 385
 386	/*
 387	 * Stop TX on this interface first.
 388	 */
 389	if (sdata->dev)
 390		netif_tx_stop_all_queues(sdata->dev);
 391
 392	ieee80211_roc_purge(local, sdata);
 393
 394	switch (sdata->vif.type) {
 395	case NL80211_IFTYPE_STATION:
 396		ieee80211_mgd_stop(sdata);
 397		break;
 398	case NL80211_IFTYPE_ADHOC:
 399		ieee80211_ibss_stop(sdata);
 400		break;
 401	case NL80211_IFTYPE_MONITOR:
 402		if (sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES)
 403			break;
 404		list_del_rcu(&sdata->u.mntr.list);
 405		break;
 406	default:
 407		break;
 408	}
 409
 410	/*
 411	 * Remove all stations associated with this interface.
 412	 *
 413	 * This must be done before calling ops->remove_interface()
 414	 * because otherwise we can later invoke ops->sta_notify()
 415	 * whenever the STAs are removed, and that invalidates driver
 416	 * assumptions about always getting a vif pointer that is valid
 417	 * (because if we remove a STA after ops->remove_interface()
 418	 * the driver will have removed the vif info already!)
 419	 *
 420	 * For AP_VLANs stations may exist since there's nothing else that
 
 421	 * would have removed them, but in other modes there shouldn't
 422	 * be any stations.
 423	 */
 424	flushed = sta_info_flush(sdata);
 425	WARN_ON_ONCE(sdata->vif.type != NL80211_IFTYPE_AP_VLAN && flushed > 0);
 
 
 426
 427	/* don't count this interface for allmulti while it is down */
 428	if (sdata->flags & IEEE80211_SDATA_ALLMULTI)
 429		atomic_dec(&local->iff_allmultis);
 430
 431	if (sdata->vif.type == NL80211_IFTYPE_AP) {
 432		local->fif_pspoll--;
 433		local->fif_probe_req--;
 434	} else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
 435		local->fif_probe_req--;
 436	}
 437
 438	if (sdata->dev) {
 439		netif_addr_lock_bh(sdata->dev);
 440		spin_lock_bh(&local->filter_lock);
 441		__hw_addr_unsync(&local->mc_list, &sdata->dev->mc,
 442				 sdata->dev->addr_len);
 443		spin_unlock_bh(&local->filter_lock);
 444		netif_addr_unlock_bh(sdata->dev);
 445	}
 446
 447	del_timer_sync(&local->dynamic_ps_timer);
 448	cancel_work_sync(&local->dynamic_ps_enable_work);
 449
 450	cancel_work_sync(&sdata->recalc_smps);
 451	sdata_lock(sdata);
 452	mutex_lock(&local->mtx);
 453	sdata->vif.csa_active = false;
 454	if (sdata->vif.type == NL80211_IFTYPE_STATION)
 455		sdata->u.mgd.csa_waiting_bcn = false;
 456	if (sdata->csa_block_tx) {
 457		ieee80211_wake_vif_queues(local, sdata,
 458					  IEEE80211_QUEUE_STOP_REASON_CSA);
 459		sdata->csa_block_tx = false;
 460	}
 461	mutex_unlock(&local->mtx);
 462	sdata_unlock(sdata);
 463
 464	cancel_work_sync(&sdata->csa_finalize_work);
 465
 466	cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
 467
 468	if (sdata->wdev.cac_started) {
 469		chandef = sdata->vif.bss_conf.chandef;
 470		WARN_ON(local->suspended);
 471		mutex_lock(&local->mtx);
 472		ieee80211_vif_release_channel(sdata);
 473		mutex_unlock(&local->mtx);
 474		cfg80211_cac_event(sdata->dev, &chandef,
 475				   NL80211_RADAR_CAC_ABORTED,
 476				   GFP_KERNEL);
 477	}
 478
 
 479	if (sdata->vif.type == NL80211_IFTYPE_AP) {
 
 
 
 
 
 
 480		WARN_ON(!list_empty(&sdata->u.ap.vlans));
 481	} else if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
 482		/* remove all packets in parent bc_buf pointing to this dev */
 483		ps = &sdata->bss->ps;
 484
 485		spin_lock_irqsave(&ps->bc_buf.lock, flags);
 486		skb_queue_walk_safe(&ps->bc_buf, skb, tmp) {
 487			if (skb->dev == sdata->dev) {
 488				__skb_unlink(skb, &ps->bc_buf);
 489				local->total_ps_buffered--;
 490				ieee80211_free_txskb(&local->hw, skb);
 491			}
 492		}
 493		spin_unlock_irqrestore(&ps->bc_buf.lock, flags);
 494	}
 495
 496	if (going_down)
 497		local->open_count--;
 498
 499	switch (sdata->vif.type) {
 500	case NL80211_IFTYPE_AP_VLAN:
 501		mutex_lock(&local->mtx);
 502		list_del(&sdata->u.vlan.list);
 503		mutex_unlock(&local->mtx);
 504		RCU_INIT_POINTER(sdata->vif.chanctx_conf, NULL);
 505		/* see comment in the default case below */
 506		ieee80211_free_keys(sdata, true);
 507		/* no need to tell driver */
 508		break;
 509	case NL80211_IFTYPE_MONITOR:
 510		if (sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES) {
 511			local->cooked_mntrs--;
 512			break;
 513		}
 514
 515		local->monitors--;
 516		if (local->monitors == 0) {
 517			local->hw.conf.flags &= ~IEEE80211_CONF_MONITOR;
 518			hw_reconf_flags |= IEEE80211_CONF_CHANGE_MONITOR;
 519		}
 520
 521		ieee80211_adjust_monitor_flags(sdata, -1);
 522		break;
 523	case NL80211_IFTYPE_NAN:
 524		/* clean all the functions */
 525		spin_lock_bh(&sdata->u.nan.func_lock);
 526
 527		idr_for_each_entry(&sdata->u.nan.function_inst_ids, func, i) {
 528			idr_remove(&sdata->u.nan.function_inst_ids, i);
 529			cfg80211_free_nan_func(func);
 530		}
 531		idr_destroy(&sdata->u.nan.function_inst_ids);
 532
 533		spin_unlock_bh(&sdata->u.nan.func_lock);
 534		break;
 535	case NL80211_IFTYPE_P2P_DEVICE:
 536		/* relies on synchronize_rcu() below */
 537		RCU_INIT_POINTER(local->p2p_sdata, NULL);
 538		fallthrough;
 539	default:
 540		cancel_work_sync(&sdata->work);
 541		/*
 542		 * When we get here, the interface is marked down.
 543		 * Free the remaining keys, if there are any
 544		 * (which can happen in AP mode if userspace sets
 545		 * keys before the interface is operating)
 
 546		 *
 547		 * Force the key freeing to always synchronize_net()
 548		 * to wait for the RX path in case it is using this
 549		 * interface enqueuing frames at this very time on
 550		 * another CPU.
 551		 */
 552		ieee80211_free_keys(sdata, true);
 553		skb_queue_purge(&sdata->skb_queue);
 554	}
 555
 556	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 557	for (i = 0; i < IEEE80211_MAX_QUEUES; i++) {
 558		skb_queue_walk_safe(&local->pending[i], skb, tmp) {
 559			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 560			if (info->control.vif == &sdata->vif) {
 561				__skb_unlink(skb, &local->pending[i]);
 562				ieee80211_free_txskb(&local->hw, skb);
 563			}
 564		}
 565	}
 566	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 567
 568	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
 569		ieee80211_txq_remove_vlan(local, sdata);
 570
 571	sdata->bss = NULL;
 572
 573	if (local->open_count == 0)
 574		ieee80211_clear_tx_pending(local);
 575
 576	sdata->vif.bss_conf.beacon_int = 0;
 577
 578	/*
 579	 * If the interface goes down while suspended, presumably because
 580	 * the device was unplugged and that happens before our resume,
 581	 * then the driver is already unconfigured and the remainder of
 582	 * this function isn't needed.
 583	 * XXX: what about WoWLAN? If the device has software state, e.g.
 584	 *	memory allocated, it might expect teardown commands from
 585	 *	mac80211 here?
 586	 */
 587	if (local->suspended) {
 588		WARN_ON(local->wowlan);
 589		WARN_ON(rtnl_dereference(local->monitor_sdata));
 590		return;
 591	}
 592
 593	switch (sdata->vif.type) {
 594	case NL80211_IFTYPE_AP_VLAN:
 595		break;
 596	case NL80211_IFTYPE_MONITOR:
 597		if (local->monitors == 0)
 598			ieee80211_del_virtual_monitor(local);
 599
 600		mutex_lock(&local->mtx);
 601		ieee80211_recalc_idle(local);
 602		mutex_unlock(&local->mtx);
 603
 604		if (!(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE))
 605			break;
 606
 607		fallthrough;
 608	default:
 609		if (going_down)
 610			drv_remove_interface(local, sdata);
 611	}
 612
 613	ieee80211_recalc_ps(local);
 614
 615	if (cancel_scan)
 616		flush_delayed_work(&local->scan_work);
 617
 618	if (local->open_count == 0) {
 619		ieee80211_stop_device(local);
 620
 621		/* no reconfiguring after stop! */
 622		return;
 623	}
 624
 625	/* do after stop to avoid reconfiguring when we stop anyway */
 626	ieee80211_configure_filter(local);
 627	ieee80211_hw_config(local, hw_reconf_flags);
 628
 629	if (local->monitors == local->open_count)
 630		ieee80211_add_virtual_monitor(local);
 631}
 632
 633static int ieee80211_stop(struct net_device *dev)
 634{
 635	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 636
 637	/* close all dependent VLAN interfaces before locking wiphy */
 638	if (sdata->vif.type == NL80211_IFTYPE_AP) {
 639		struct ieee80211_sub_if_data *vlan, *tmpsdata;
 640
 641		list_for_each_entry_safe(vlan, tmpsdata, &sdata->u.ap.vlans,
 642					 u.vlan.list)
 643			dev_close(vlan->dev);
 644	}
 645
 646	wiphy_lock(sdata->local->hw.wiphy);
 647	ieee80211_do_stop(sdata, true);
 648	wiphy_unlock(sdata->local->hw.wiphy);
 649
 650	return 0;
 651}
 652
 653static void ieee80211_set_multicast_list(struct net_device *dev)
 654{
 655	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 656	struct ieee80211_local *local = sdata->local;
 657	int allmulti, sdata_allmulti;
 658
 659	allmulti = !!(dev->flags & IFF_ALLMULTI);
 660	sdata_allmulti = !!(sdata->flags & IEEE80211_SDATA_ALLMULTI);
 661
 662	if (allmulti != sdata_allmulti) {
 663		if (dev->flags & IFF_ALLMULTI)
 664			atomic_inc(&local->iff_allmultis);
 665		else
 666			atomic_dec(&local->iff_allmultis);
 667		sdata->flags ^= IEEE80211_SDATA_ALLMULTI;
 668	}
 669
 670	spin_lock_bh(&local->filter_lock);
 671	__hw_addr_sync(&local->mc_list, &dev->mc, dev->addr_len);
 672	spin_unlock_bh(&local->filter_lock);
 673	ieee80211_queue_work(&local->hw, &local->reconfig_filter);
 674}
 675
 676/*
 677 * Called when the netdev is removed or, by the code below, before
 678 * the interface type changes.
 679 */
 680static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata)
 681{
 
 
 682	/* free extra data */
 683	ieee80211_free_keys(sdata, false);
 684
 685	ieee80211_debugfs_remove_netdev(sdata);
 686
 687	ieee80211_destroy_frag_cache(&sdata->frags);
 
 
 688
 689	if (ieee80211_vif_is_mesh(&sdata->vif))
 690		ieee80211_mesh_teardown_sdata(sdata);
 691}
 692
 693static void ieee80211_uninit(struct net_device *dev)
 694{
 695	ieee80211_teardown_sdata(IEEE80211_DEV_TO_SUB_IF(dev));
 696}
 697
 698static u16 ieee80211_netdev_select_queue(struct net_device *dev,
 699					 struct sk_buff *skb,
 700					 struct net_device *sb_dev)
 701{
 702	return ieee80211_select_queue(IEEE80211_DEV_TO_SUB_IF(dev), skb);
 703}
 704
 705static void
 706ieee80211_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
 707{
 708	dev_fetch_sw_netstats(stats, dev->tstats);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 709}
 710
 711static const struct net_device_ops ieee80211_dataif_ops = {
 712	.ndo_open		= ieee80211_open,
 713	.ndo_stop		= ieee80211_stop,
 714	.ndo_uninit		= ieee80211_uninit,
 715	.ndo_start_xmit		= ieee80211_subif_start_xmit,
 716	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
 717	.ndo_set_mac_address 	= ieee80211_change_mac,
 718	.ndo_select_queue	= ieee80211_netdev_select_queue,
 719	.ndo_get_stats64	= ieee80211_get_stats64,
 720};
 721
 722static u16 ieee80211_monitor_select_queue(struct net_device *dev,
 723					  struct sk_buff *skb,
 724					  struct net_device *sb_dev)
 725{
 726	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 727	struct ieee80211_local *local = sdata->local;
 728	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 729	struct ieee80211_hdr *hdr;
 730	int len_rthdr;
 731
 732	if (local->hw.queues < IEEE80211_NUM_ACS)
 733		return 0;
 734
 735	/* reset flags and info before parsing radiotap header */
 736	memset(info, 0, sizeof(*info));
 737
 738	if (!ieee80211_parse_tx_radiotap(skb, dev))
 739		return 0; /* doesn't matter, frame will be dropped */
 740
 741	len_rthdr = ieee80211_get_radiotap_len(skb->data);
 742	hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
 743	if (skb->len < len_rthdr + 2 ||
 744	    skb->len < len_rthdr + ieee80211_hdrlen(hdr->frame_control))
 745		return 0; /* doesn't matter, frame will be dropped */
 746
 747	return ieee80211_select_queue_80211(sdata, skb, hdr);
 748}
 749
 750static const struct net_device_ops ieee80211_monitorif_ops = {
 751	.ndo_open		= ieee80211_open,
 752	.ndo_stop		= ieee80211_stop,
 753	.ndo_uninit		= ieee80211_uninit,
 754	.ndo_start_xmit		= ieee80211_monitor_start_xmit,
 755	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
 756	.ndo_set_mac_address 	= ieee80211_change_mac,
 757	.ndo_select_queue	= ieee80211_monitor_select_queue,
 758	.ndo_get_stats64	= ieee80211_get_stats64,
 759};
 760
 761static const struct net_device_ops ieee80211_dataif_8023_ops = {
 762	.ndo_open		= ieee80211_open,
 763	.ndo_stop		= ieee80211_stop,
 764	.ndo_uninit		= ieee80211_uninit,
 765	.ndo_start_xmit		= ieee80211_subif_start_xmit_8023,
 766	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
 767	.ndo_set_mac_address	= ieee80211_change_mac,
 768	.ndo_select_queue	= ieee80211_netdev_select_queue,
 769	.ndo_get_stats64	= ieee80211_get_stats64,
 770};
 771
 772static bool ieee80211_iftype_supports_hdr_offload(enum nl80211_iftype iftype)
 773{
 774	switch (iftype) {
 775	/* P2P GO and client are mapped to AP/STATION types */
 776	case NL80211_IFTYPE_AP:
 777	case NL80211_IFTYPE_STATION:
 778		return true;
 779	default:
 780		return false;
 781	}
 782}
 783
 784static bool ieee80211_set_sdata_offload_flags(struct ieee80211_sub_if_data *sdata)
 785{
 786	struct ieee80211_local *local = sdata->local;
 787	u32 flags;
 788
 789	flags = sdata->vif.offload_flags;
 790
 791	if (ieee80211_hw_check(&local->hw, SUPPORTS_TX_ENCAP_OFFLOAD) &&
 792	    ieee80211_iftype_supports_hdr_offload(sdata->vif.type)) {
 793		flags |= IEEE80211_OFFLOAD_ENCAP_ENABLED;
 794
 795		if (!ieee80211_hw_check(&local->hw, SUPPORTS_TX_FRAG) &&
 796		    local->hw.wiphy->frag_threshold != (u32)-1)
 797			flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
 798
 799		if (local->monitors)
 800			flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
 801	} else {
 802		flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
 803	}
 804
 805	if (ieee80211_hw_check(&local->hw, SUPPORTS_RX_DECAP_OFFLOAD) &&
 806	    ieee80211_iftype_supports_hdr_offload(sdata->vif.type)) {
 807		flags |= IEEE80211_OFFLOAD_DECAP_ENABLED;
 808
 809		if (local->monitors &&
 810		    !ieee80211_hw_check(&local->hw, SUPPORTS_CONC_MON_RX_DECAP))
 811			flags &= ~IEEE80211_OFFLOAD_DECAP_ENABLED;
 812	} else {
 813		flags &= ~IEEE80211_OFFLOAD_DECAP_ENABLED;
 814	}
 815
 816	if (sdata->vif.offload_flags == flags)
 817		return false;
 818
 819	sdata->vif.offload_flags = flags;
 820	ieee80211_check_fast_rx_iface(sdata);
 821	return true;
 822}
 823
 824static void ieee80211_set_vif_encap_ops(struct ieee80211_sub_if_data *sdata)
 825{
 826	struct ieee80211_local *local = sdata->local;
 827	struct ieee80211_sub_if_data *bss = sdata;
 828	bool enabled;
 829
 830	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
 831		if (!sdata->bss)
 832			return;
 833
 834		bss = container_of(sdata->bss, struct ieee80211_sub_if_data, u.ap);
 835	}
 836
 837	if (!ieee80211_hw_check(&local->hw, SUPPORTS_TX_ENCAP_OFFLOAD) ||
 838	    !ieee80211_iftype_supports_hdr_offload(bss->vif.type))
 839		return;
 840
 841	enabled = bss->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED;
 842	if (sdata->wdev.use_4addr &&
 843	    !(bss->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_4ADDR))
 844		enabled = false;
 845
 846	sdata->dev->netdev_ops = enabled ? &ieee80211_dataif_8023_ops :
 847					   &ieee80211_dataif_ops;
 848}
 849
 850static void ieee80211_recalc_sdata_offload(struct ieee80211_sub_if_data *sdata)
 851{
 
 852	struct ieee80211_local *local = sdata->local;
 853	struct ieee80211_sub_if_data *vsdata;
 854
 855	if (ieee80211_set_sdata_offload_flags(sdata)) {
 856		drv_update_vif_offload(local, sdata);
 857		ieee80211_set_vif_encap_ops(sdata);
 858	}
 859
 860	list_for_each_entry(vsdata, &local->interfaces, list) {
 861		if (vsdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
 862		    vsdata->bss != &sdata->u.ap)
 863			continue;
 864
 865		ieee80211_set_vif_encap_ops(vsdata);
 866	}
 867}
 868
 869void ieee80211_recalc_offload(struct ieee80211_local *local)
 870{
 871	struct ieee80211_sub_if_data *sdata;
 872
 873	if (!ieee80211_hw_check(&local->hw, SUPPORTS_TX_ENCAP_OFFLOAD))
 874		return;
 875
 876	mutex_lock(&local->iflist_mtx);
 877
 878	list_for_each_entry(sdata, &local->interfaces, list) {
 879		if (!ieee80211_sdata_running(sdata))
 880			continue;
 881
 882		ieee80211_recalc_sdata_offload(sdata);
 883	}
 884
 885	mutex_unlock(&local->iflist_mtx);
 886}
 887
 888void ieee80211_adjust_monitor_flags(struct ieee80211_sub_if_data *sdata,
 889				    const int offset)
 890{
 891	struct ieee80211_local *local = sdata->local;
 892	u32 flags = sdata->u.mntr.flags;
 893
 894#define ADJUST(_f, _s)	do {					\
 895	if (flags & MONITOR_FLAG_##_f)				\
 896		local->fif_##_s += offset;			\
 897	} while (0)
 898
 899	ADJUST(FCSFAIL, fcsfail);
 900	ADJUST(PLCPFAIL, plcpfail);
 901	ADJUST(CONTROL, control);
 902	ADJUST(CONTROL, pspoll);
 903	ADJUST(OTHER_BSS, other_bss);
 904
 905#undef ADJUST
 906}
 907
 908static void ieee80211_set_default_queues(struct ieee80211_sub_if_data *sdata)
 909{
 910	struct ieee80211_local *local = sdata->local;
 911	int i;
 912
 913	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
 914		if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
 915			sdata->vif.hw_queue[i] = IEEE80211_INVAL_HW_QUEUE;
 916		else if (local->hw.queues >= IEEE80211_NUM_ACS)
 917			sdata->vif.hw_queue[i] = i;
 918		else
 919			sdata->vif.hw_queue[i] = 0;
 920	}
 921	sdata->vif.cab_queue = IEEE80211_INVAL_HW_QUEUE;
 922}
 923
 924int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
 925{
 926	struct ieee80211_sub_if_data *sdata;
 927	int ret;
 928
 929	if (!ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF))
 930		return 0;
 931
 932	ASSERT_RTNL();
 933
 934	if (local->monitor_sdata)
 935		return 0;
 936
 937	sdata = kzalloc(sizeof(*sdata) + local->hw.vif_data_size, GFP_KERNEL);
 938	if (!sdata)
 939		return -ENOMEM;
 940
 941	/* set up data */
 942	sdata->local = local;
 943	sdata->vif.type = NL80211_IFTYPE_MONITOR;
 944	snprintf(sdata->name, IFNAMSIZ, "%s-monitor",
 945		 wiphy_name(local->hw.wiphy));
 946	sdata->wdev.iftype = NL80211_IFTYPE_MONITOR;
 947
 948	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
 949
 950	ieee80211_set_default_queues(sdata);
 951
 952	ret = drv_add_interface(local, sdata);
 953	if (WARN_ON(ret)) {
 954		/* ok .. stupid driver, it asked for this! */
 955		kfree(sdata);
 956		return ret;
 957	}
 958
 959	set_bit(SDATA_STATE_RUNNING, &sdata->state);
 960
 961	ret = ieee80211_check_queues(sdata, NL80211_IFTYPE_MONITOR);
 962	if (ret) {
 963		kfree(sdata);
 964		return ret;
 965	}
 966
 967	mutex_lock(&local->iflist_mtx);
 968	rcu_assign_pointer(local->monitor_sdata, sdata);
 969	mutex_unlock(&local->iflist_mtx);
 970
 971	mutex_lock(&local->mtx);
 972	ret = ieee80211_vif_use_channel(sdata, &local->monitor_chandef,
 973					IEEE80211_CHANCTX_EXCLUSIVE);
 974	mutex_unlock(&local->mtx);
 975	if (ret) {
 976		mutex_lock(&local->iflist_mtx);
 977		RCU_INIT_POINTER(local->monitor_sdata, NULL);
 978		mutex_unlock(&local->iflist_mtx);
 979		synchronize_net();
 980		drv_remove_interface(local, sdata);
 981		kfree(sdata);
 982		return ret;
 983	}
 984
 985	skb_queue_head_init(&sdata->skb_queue);
 986	INIT_WORK(&sdata->work, ieee80211_iface_work);
 987
 988	return 0;
 989}
 990
 991void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
 992{
 993	struct ieee80211_sub_if_data *sdata;
 994
 995	if (!ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF))
 996		return;
 997
 998	ASSERT_RTNL();
 999
1000	mutex_lock(&local->iflist_mtx);
 
 
1001
1002	sdata = rcu_dereference_protected(local->monitor_sdata,
1003					  lockdep_is_held(&local->iflist_mtx));
1004	if (!sdata) {
1005		mutex_unlock(&local->iflist_mtx);
1006		return;
 
 
 
 
 
1007	}
1008
1009	RCU_INIT_POINTER(local->monitor_sdata, NULL);
1010	mutex_unlock(&local->iflist_mtx);
1011
1012	synchronize_net();
1013
1014	mutex_lock(&local->mtx);
1015	ieee80211_vif_release_channel(sdata);
1016	mutex_unlock(&local->mtx);
1017
1018	drv_remove_interface(local, sdata);
1019
1020	kfree(sdata);
1021}
1022
1023/*
1024 * NOTE: Be very careful when changing this function, it must NOT return
1025 * an error on interface type changes that have been pre-checked, so most
1026 * checks should be in ieee80211_check_concurrent_iface.
1027 */
1028int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
1029{
1030	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
1031	struct net_device *dev = wdev->netdev;
1032	struct ieee80211_local *local = sdata->local;
1033	u32 changed = 0;
1034	int res;
1035	u32 hw_reconf_flags = 0;
1036
1037	switch (sdata->vif.type) {
1038	case NL80211_IFTYPE_AP_VLAN: {
1039		struct ieee80211_sub_if_data *master;
1040
1041		if (!sdata->bss)
1042			return -ENOLINK;
1043
1044		mutex_lock(&local->mtx);
1045		list_add(&sdata->u.vlan.list, &sdata->bss->vlans);
1046		mutex_unlock(&local->mtx);
1047
1048		master = container_of(sdata->bss,
1049				      struct ieee80211_sub_if_data, u.ap);
1050		sdata->control_port_protocol =
1051			master->control_port_protocol;
1052		sdata->control_port_no_encrypt =
1053			master->control_port_no_encrypt;
1054		sdata->control_port_over_nl80211 =
1055			master->control_port_over_nl80211;
1056		sdata->control_port_no_preauth =
1057			master->control_port_no_preauth;
1058		sdata->vif.cab_queue = master->vif.cab_queue;
1059		memcpy(sdata->vif.hw_queue, master->vif.hw_queue,
1060		       sizeof(sdata->vif.hw_queue));
1061		sdata->vif.bss_conf.chandef = master->vif.bss_conf.chandef;
1062
1063		mutex_lock(&local->key_mtx);
1064		sdata->crypto_tx_tailroom_needed_cnt +=
1065			master->crypto_tx_tailroom_needed_cnt;
1066		mutex_unlock(&local->key_mtx);
1067
1068		break;
1069		}
1070	case NL80211_IFTYPE_AP:
1071		sdata->bss = &sdata->u.ap;
1072		break;
1073	case NL80211_IFTYPE_MESH_POINT:
1074	case NL80211_IFTYPE_STATION:
1075	case NL80211_IFTYPE_MONITOR:
1076	case NL80211_IFTYPE_ADHOC:
1077	case NL80211_IFTYPE_P2P_DEVICE:
1078	case NL80211_IFTYPE_OCB:
1079	case NL80211_IFTYPE_NAN:
1080		/* no special treatment */
1081		break;
1082	case NL80211_IFTYPE_UNSPECIFIED:
1083	case NUM_NL80211_IFTYPES:
1084	case NL80211_IFTYPE_P2P_CLIENT:
1085	case NL80211_IFTYPE_P2P_GO:
1086	case NL80211_IFTYPE_WDS:
1087		/* cannot happen */
1088		WARN_ON(1);
1089		break;
1090	}
1091
1092	if (local->open_count == 0) {
1093		res = drv_start(local);
1094		if (res)
1095			goto err_del_bss;
1096		/* we're brought up, everything changes */
1097		hw_reconf_flags = ~0;
1098		ieee80211_led_radio(local, true);
1099		ieee80211_mod_tpt_led_trig(local,
1100					   IEEE80211_TPT_LEDTRIG_FL_RADIO, 0);
1101	}
1102
1103	/*
1104	 * Copy the hopefully now-present MAC address to
1105	 * this interface, if it has the special null one.
1106	 */
1107	if (dev && is_zero_ether_addr(dev->dev_addr)) {
1108		memcpy(dev->dev_addr,
1109		       local->hw.wiphy->perm_addr,
1110		       ETH_ALEN);
1111		memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
1112
1113		if (!is_valid_ether_addr(dev->dev_addr)) {
1114			res = -EADDRNOTAVAIL;
1115			goto err_stop;
1116		}
1117	}
1118
1119	switch (sdata->vif.type) {
1120	case NL80211_IFTYPE_AP_VLAN:
1121		/* no need to tell driver, but set carrier and chanctx */
1122		if (rtnl_dereference(sdata->bss->beacon)) {
1123			ieee80211_vif_vlan_copy_chanctx(sdata);
1124			netif_carrier_on(dev);
1125			ieee80211_set_vif_encap_ops(sdata);
1126		} else {
1127			netif_carrier_off(dev);
1128		}
1129		break;
1130	case NL80211_IFTYPE_MONITOR:
1131		if (sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES) {
1132			local->cooked_mntrs++;
1133			break;
1134		}
1135
1136		if (sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE) {
1137			res = drv_add_interface(local, sdata);
1138			if (res)
1139				goto err_stop;
1140		} else if (local->monitors == 0 && local->open_count == 0) {
1141			res = ieee80211_add_virtual_monitor(local);
1142			if (res)
1143				goto err_stop;
1144		}
1145
1146		/* must be before the call to ieee80211_configure_filter */
1147		local->monitors++;
1148		if (local->monitors == 1) {
1149			local->hw.conf.flags |= IEEE80211_CONF_MONITOR;
1150			hw_reconf_flags |= IEEE80211_CONF_CHANGE_MONITOR;
1151		}
1152
1153		ieee80211_adjust_monitor_flags(sdata, 1);
1154		ieee80211_configure_filter(local);
1155		ieee80211_recalc_offload(local);
1156		mutex_lock(&local->mtx);
1157		ieee80211_recalc_idle(local);
1158		mutex_unlock(&local->mtx);
1159
1160		netif_carrier_on(dev);
1161		break;
1162	default:
1163		if (coming_up) {
1164			ieee80211_del_virtual_monitor(local);
1165			ieee80211_set_sdata_offload_flags(sdata);
1166
1167			res = drv_add_interface(local, sdata);
1168			if (res)
1169				goto err_stop;
1170
1171			ieee80211_set_vif_encap_ops(sdata);
1172			res = ieee80211_check_queues(sdata,
1173				ieee80211_vif_type_p2p(&sdata->vif));
1174			if (res)
1175				goto err_del_interface;
1176		}
1177
1178		if (sdata->vif.type == NL80211_IFTYPE_AP) {
1179			local->fif_pspoll++;
1180			local->fif_probe_req++;
1181
1182			ieee80211_configure_filter(local);
1183		} else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1184			local->fif_probe_req++;
1185		}
1186
1187		if (sdata->vif.probe_req_reg)
1188			drv_config_iface_filter(local, sdata,
1189						FIF_PROBE_REQ,
1190						FIF_PROBE_REQ);
1191
1192		if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
1193		    sdata->vif.type != NL80211_IFTYPE_NAN)
1194			changed |= ieee80211_reset_erp_info(sdata);
1195		ieee80211_bss_info_change_notify(sdata, changed);
1196
1197		switch (sdata->vif.type) {
1198		case NL80211_IFTYPE_STATION:
1199		case NL80211_IFTYPE_ADHOC:
1200		case NL80211_IFTYPE_AP:
1201		case NL80211_IFTYPE_MESH_POINT:
1202		case NL80211_IFTYPE_OCB:
1203			netif_carrier_off(dev);
1204			break;
1205		case NL80211_IFTYPE_P2P_DEVICE:
1206		case NL80211_IFTYPE_NAN:
1207			break;
1208		default:
1209			/* not reached */
1210			WARN_ON(1);
1211		}
1212
1213		/*
1214		 * Set default queue parameters so drivers don't
1215		 * need to initialise the hardware if the hardware
1216		 * doesn't start up with sane defaults.
1217		 * Enable QoS for anything but station interfaces.
1218		 */
1219		ieee80211_set_wmm_default(sdata, true,
1220			sdata->vif.type != NL80211_IFTYPE_STATION);
1221	}
1222
1223	set_bit(SDATA_STATE_RUNNING, &sdata->state);
 
 
1224
1225	switch (sdata->vif.type) {
1226	case NL80211_IFTYPE_P2P_DEVICE:
1227		rcu_assign_pointer(local->p2p_sdata, sdata);
1228		break;
1229	case NL80211_IFTYPE_MONITOR:
1230		if (sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES)
1231			break;
1232		list_add_tail_rcu(&sdata->u.mntr.list, &local->mon_list);
1233		break;
1234	default:
1235		break;
1236	}
 
1237
1238	/*
1239	 * set_multicast_list will be invoked by the networking core
1240	 * which will check whether any increments here were done in
1241	 * error and sync them down to the hardware as filter flags.
1242	 */
1243	if (sdata->flags & IEEE80211_SDATA_ALLMULTI)
1244		atomic_inc(&local->iff_allmultis);
1245
1246	if (coming_up)
1247		local->open_count++;
1248
1249	if (hw_reconf_flags)
1250		ieee80211_hw_config(local, hw_reconf_flags);
1251
1252	ieee80211_recalc_ps(local);
1253
1254	if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
1255	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
1256	    local->ops->wake_tx_queue) {
1257		/* XXX: for AP_VLAN, actually track AP queues */
1258		if (dev)
1259			netif_tx_start_all_queues(dev);
1260	} else if (dev) {
1261		unsigned long flags;
1262		int n_acs = IEEE80211_NUM_ACS;
1263		int ac;
1264
1265		if (local->hw.queues < IEEE80211_NUM_ACS)
1266			n_acs = 1;
1267
1268		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
1269		if (sdata->vif.cab_queue == IEEE80211_INVAL_HW_QUEUE ||
1270		    (local->queue_stop_reasons[sdata->vif.cab_queue] == 0 &&
1271		     skb_queue_empty(&local->pending[sdata->vif.cab_queue]))) {
1272			for (ac = 0; ac < n_acs; ac++) {
1273				int ac_queue = sdata->vif.hw_queue[ac];
1274
1275				if (local->queue_stop_reasons[ac_queue] == 0 &&
1276				    skb_queue_empty(&local->pending[ac_queue]))
1277					netif_start_subqueue(dev, ac);
1278			}
1279		}
1280		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1281	}
1282
1283	return 0;
1284 err_del_interface:
1285	drv_remove_interface(local, sdata);
1286 err_stop:
1287	if (!local->open_count)
1288		drv_stop(local);
1289 err_del_bss:
1290	sdata->bss = NULL;
1291	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
1292		mutex_lock(&local->mtx);
1293		list_del(&sdata->u.vlan.list);
1294		mutex_unlock(&local->mtx);
1295	}
1296	/* might already be clear but that doesn't matter */
1297	clear_bit(SDATA_STATE_RUNNING, &sdata->state);
1298	return res;
1299}
 
1300
1301static void ieee80211_if_free(struct net_device *dev)
1302{
1303	free_percpu(dev->tstats);
1304}
1305
1306static void ieee80211_if_setup(struct net_device *dev)
1307{
1308	ether_setup(dev);
1309	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
1310	dev->netdev_ops = &ieee80211_dataif_ops;
1311	dev->needs_free_netdev = true;
1312	dev->priv_destructor = ieee80211_if_free;
1313}
1314
1315static void ieee80211_if_setup_no_queue(struct net_device *dev)
1316{
1317	ieee80211_if_setup(dev);
1318	dev->priv_flags |= IFF_NO_QUEUE;
1319}
1320
1321static void ieee80211_iface_process_skb(struct ieee80211_local *local,
1322					struct ieee80211_sub_if_data *sdata,
1323					struct sk_buff *skb)
1324{
1325	struct ieee80211_mgmt *mgmt = (void *)skb->data;
1326
1327	if (ieee80211_is_action(mgmt->frame_control) &&
1328	    mgmt->u.action.category == WLAN_CATEGORY_BACK) {
1329		struct sta_info *sta;
1330		int len = skb->len;
1331
1332		mutex_lock(&local->sta_mtx);
1333		sta = sta_info_get_bss(sdata, mgmt->sa);
1334		if (sta) {
1335			switch (mgmt->u.action.u.addba_req.action_code) {
1336			case WLAN_ACTION_ADDBA_REQ:
1337				ieee80211_process_addba_request(local, sta,
1338								mgmt, len);
1339				break;
1340			case WLAN_ACTION_ADDBA_RESP:
1341				ieee80211_process_addba_resp(local, sta,
1342							     mgmt, len);
1343				break;
1344			case WLAN_ACTION_DELBA:
1345				ieee80211_process_delba(sdata, sta,
1346							mgmt, len);
1347				break;
1348			default:
1349				WARN_ON(1);
1350				break;
1351			}
1352		}
1353		mutex_unlock(&local->sta_mtx);
1354	} else if (ieee80211_is_action(mgmt->frame_control) &&
1355		   mgmt->u.action.category == WLAN_CATEGORY_VHT) {
1356		switch (mgmt->u.action.u.vht_group_notif.action_code) {
1357		case WLAN_VHT_ACTION_OPMODE_NOTIF: {
1358			struct ieee80211_rx_status *status;
1359			enum nl80211_band band;
1360			struct sta_info *sta;
1361			u8 opmode;
1362
1363			status = IEEE80211_SKB_RXCB(skb);
1364			band = status->band;
1365			opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;
1366
1367			mutex_lock(&local->sta_mtx);
1368			sta = sta_info_get_bss(sdata, mgmt->sa);
1369
1370			if (sta)
1371				ieee80211_vht_handle_opmode(sdata, sta, opmode,
1372							    band);
1373
1374			mutex_unlock(&local->sta_mtx);
1375			break;
1376		}
1377		case WLAN_VHT_ACTION_GROUPID_MGMT:
1378			ieee80211_process_mu_groups(sdata, mgmt);
1379			break;
1380		default:
1381			WARN_ON(1);
1382			break;
1383		}
1384	} else if (ieee80211_is_ext(mgmt->frame_control)) {
1385		if (sdata->vif.type == NL80211_IFTYPE_STATION)
1386			ieee80211_sta_rx_queued_ext(sdata, skb);
1387		else
1388			WARN_ON(1);
1389	} else if (ieee80211_is_data_qos(mgmt->frame_control)) {
1390		struct ieee80211_hdr *hdr = (void *)mgmt;
1391		struct sta_info *sta;
1392
1393		/*
1394		 * So the frame isn't mgmt, but frame_control
1395		 * is at the right place anyway, of course, so
1396		 * the if statement is correct.
1397		 *
1398		 * Warn if we have other data frame types here,
1399		 * they must not get here.
1400		 */
1401		WARN_ON(hdr->frame_control &
1402				cpu_to_le16(IEEE80211_STYPE_NULLFUNC));
1403		WARN_ON(!(hdr->seq_ctrl &
1404				cpu_to_le16(IEEE80211_SCTL_FRAG)));
1405		/*
1406		 * This was a fragment of a frame, received while
1407		 * a block-ack session was active. That cannot be
1408		 * right, so terminate the session.
1409		 */
1410		mutex_lock(&local->sta_mtx);
1411		sta = sta_info_get_bss(sdata, mgmt->sa);
1412		if (sta) {
1413			u16 tid = ieee80211_get_tid(hdr);
1414
1415			__ieee80211_stop_rx_ba_session(
1416				sta, tid, WLAN_BACK_RECIPIENT,
1417				WLAN_REASON_QSTA_REQUIRE_SETUP,
1418				true);
1419		}
1420		mutex_unlock(&local->sta_mtx);
1421	} else switch (sdata->vif.type) {
1422	case NL80211_IFTYPE_STATION:
1423		ieee80211_sta_rx_queued_mgmt(sdata, skb);
1424		break;
1425	case NL80211_IFTYPE_ADHOC:
1426		ieee80211_ibss_rx_queued_mgmt(sdata, skb);
1427		break;
1428	case NL80211_IFTYPE_MESH_POINT:
1429		if (!ieee80211_vif_is_mesh(&sdata->vif))
1430			break;
1431		ieee80211_mesh_rx_queued_mgmt(sdata, skb);
1432		break;
1433	default:
1434		WARN(1, "frame for unexpected interface type");
1435		break;
1436	}
1437}
1438
1439static void ieee80211_iface_work(struct work_struct *work)
1440{
1441	struct ieee80211_sub_if_data *sdata =
1442		container_of(work, struct ieee80211_sub_if_data, work);
1443	struct ieee80211_local *local = sdata->local;
1444	struct sk_buff *skb;
 
1445
1446	if (!ieee80211_sdata_running(sdata))
1447		return;
1448
1449	if (test_bit(SCAN_SW_SCANNING, &local->scanning))
1450		return;
1451
1452	if (!ieee80211_can_run_worker(local))
1453		return;
1454
1455	/* first process frames */
1456	while ((skb = skb_dequeue(&sdata->skb_queue))) {
1457		kcov_remote_start_common(skb_get_kcov_handle(skb));
1458
1459		if (skb->protocol == cpu_to_be16(ETH_P_TDLS))
1460			ieee80211_process_tdls_channel_switch(sdata, skb);
1461		else
1462			ieee80211_iface_process_skb(local, sdata, skb);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1463
1464		kfree_skb(skb);
1465		kcov_remote_stop();
1466	}
1467
1468	/* then other type-dependent work */
1469	switch (sdata->vif.type) {
1470	case NL80211_IFTYPE_STATION:
1471		ieee80211_sta_work(sdata);
1472		break;
1473	case NL80211_IFTYPE_ADHOC:
1474		ieee80211_ibss_work(sdata);
1475		break;
1476	case NL80211_IFTYPE_MESH_POINT:
1477		if (!ieee80211_vif_is_mesh(&sdata->vif))
1478			break;
1479		ieee80211_mesh_work(sdata);
1480		break;
1481	case NL80211_IFTYPE_OCB:
1482		ieee80211_ocb_work(sdata);
1483		break;
1484	default:
1485		break;
1486	}
1487}
1488
1489static void ieee80211_recalc_smps_work(struct work_struct *work)
1490{
1491	struct ieee80211_sub_if_data *sdata =
1492		container_of(work, struct ieee80211_sub_if_data, recalc_smps);
1493
1494	ieee80211_recalc_smps(sdata);
1495}
1496
1497/*
1498 * Helper function to initialise an interface to a specific type.
1499 */
1500static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
1501				  enum nl80211_iftype type)
1502{
1503	static const u8 bssid_wildcard[ETH_ALEN] = {0xff, 0xff, 0xff,
1504						    0xff, 0xff, 0xff};
1505
1506	/* clear type-dependent union */
1507	memset(&sdata->u, 0, sizeof(sdata->u));
1508
1509	/* and set some type-dependent values */
1510	sdata->vif.type = type;
1511	sdata->vif.p2p = false;
1512	sdata->wdev.iftype = type;
1513
1514	sdata->control_port_protocol = cpu_to_be16(ETH_P_PAE);
1515	sdata->control_port_no_encrypt = false;
1516	sdata->control_port_over_nl80211 = false;
1517	sdata->control_port_no_preauth = false;
1518	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
1519	sdata->vif.bss_conf.idle = true;
1520	sdata->vif.bss_conf.txpower = INT_MIN; /* unset */
1521
1522	sdata->noack_map = 0;
 
1523
1524	/* only monitor/p2p-device differ */
1525	if (sdata->dev) {
1526		sdata->dev->netdev_ops = &ieee80211_dataif_ops;
1527		sdata->dev->type = ARPHRD_ETHER;
1528	}
1529
1530	skb_queue_head_init(&sdata->skb_queue);
1531	INIT_WORK(&sdata->work, ieee80211_iface_work);
1532	INIT_WORK(&sdata->recalc_smps, ieee80211_recalc_smps_work);
1533	INIT_WORK(&sdata->csa_finalize_work, ieee80211_csa_finalize_work);
1534	INIT_LIST_HEAD(&sdata->assigned_chanctx_list);
1535	INIT_LIST_HEAD(&sdata->reserved_chanctx_list);
1536
1537	switch (type) {
1538	case NL80211_IFTYPE_P2P_GO:
1539		type = NL80211_IFTYPE_AP;
1540		sdata->vif.type = type;
1541		sdata->vif.p2p = true;
1542		fallthrough;
1543	case NL80211_IFTYPE_AP:
1544		skb_queue_head_init(&sdata->u.ap.ps.bc_buf);
1545		INIT_LIST_HEAD(&sdata->u.ap.vlans);
1546		sdata->vif.bss_conf.bssid = sdata->vif.addr;
1547		break;
1548	case NL80211_IFTYPE_P2P_CLIENT:
1549		type = NL80211_IFTYPE_STATION;
1550		sdata->vif.type = type;
1551		sdata->vif.p2p = true;
1552		fallthrough;
1553	case NL80211_IFTYPE_STATION:
1554		sdata->vif.bss_conf.bssid = sdata->u.mgd.bssid;
1555		ieee80211_sta_setup_sdata(sdata);
1556		break;
1557	case NL80211_IFTYPE_OCB:
1558		sdata->vif.bss_conf.bssid = bssid_wildcard;
1559		ieee80211_ocb_setup_sdata(sdata);
1560		break;
1561	case NL80211_IFTYPE_ADHOC:
1562		sdata->vif.bss_conf.bssid = sdata->u.ibss.bssid;
1563		ieee80211_ibss_setup_sdata(sdata);
1564		break;
1565	case NL80211_IFTYPE_MESH_POINT:
1566		if (ieee80211_vif_is_mesh(&sdata->vif))
1567			ieee80211_mesh_init_sdata(sdata);
1568		break;
1569	case NL80211_IFTYPE_MONITOR:
1570		sdata->dev->type = ARPHRD_IEEE80211_RADIOTAP;
1571		sdata->dev->netdev_ops = &ieee80211_monitorif_ops;
1572		sdata->u.mntr.flags = MONITOR_FLAG_CONTROL |
1573				      MONITOR_FLAG_OTHER_BSS;
1574		break;
 
 
 
1575	case NL80211_IFTYPE_NAN:
1576		idr_init(&sdata->u.nan.function_inst_ids);
1577		spin_lock_init(&sdata->u.nan.func_lock);
1578		sdata->vif.bss_conf.bssid = sdata->vif.addr;
1579		break;
1580	case NL80211_IFTYPE_AP_VLAN:
1581	case NL80211_IFTYPE_P2P_DEVICE:
1582		sdata->vif.bss_conf.bssid = sdata->vif.addr;
1583		break;
1584	case NL80211_IFTYPE_UNSPECIFIED:
1585	case NL80211_IFTYPE_WDS:
1586	case NUM_NL80211_IFTYPES:
1587		WARN_ON(1);
1588		break;
1589	}
1590
1591	ieee80211_debugfs_add_netdev(sdata);
1592}
1593
1594static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
1595					   enum nl80211_iftype type)
1596{
1597	struct ieee80211_local *local = sdata->local;
1598	int ret, err;
1599	enum nl80211_iftype internal_type = type;
1600	bool p2p = false;
1601
1602	ASSERT_RTNL();
1603
1604	if (!local->ops->change_interface)
1605		return -EBUSY;
1606
1607	switch (sdata->vif.type) {
1608	case NL80211_IFTYPE_AP:
1609		if (!list_empty(&sdata->u.ap.vlans))
1610			return -EBUSY;
1611		break;
1612	case NL80211_IFTYPE_STATION:
1613	case NL80211_IFTYPE_ADHOC:
1614	case NL80211_IFTYPE_OCB:
1615		/*
1616		 * Could maybe also all others here?
1617		 * Just not sure how that interacts
1618		 * with the RX/config path e.g. for
1619		 * mesh.
1620		 */
1621		break;
1622	default:
1623		return -EBUSY;
1624	}
1625
1626	switch (type) {
1627	case NL80211_IFTYPE_AP:
1628	case NL80211_IFTYPE_STATION:
1629	case NL80211_IFTYPE_ADHOC:
1630	case NL80211_IFTYPE_OCB:
1631		/*
1632		 * Could probably support everything
1633		 * but here.
 
 
1634		 */
1635		break;
1636	case NL80211_IFTYPE_P2P_CLIENT:
1637		p2p = true;
1638		internal_type = NL80211_IFTYPE_STATION;
1639		break;
1640	case NL80211_IFTYPE_P2P_GO:
1641		p2p = true;
1642		internal_type = NL80211_IFTYPE_AP;
1643		break;
1644	default:
1645		return -EBUSY;
1646	}
1647
1648	ret = ieee80211_check_concurrent_iface(sdata, internal_type);
1649	if (ret)
1650		return ret;
1651
1652	ieee80211_stop_vif_queues(local, sdata,
1653				  IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE);
1654	synchronize_net();
1655
1656	ieee80211_do_stop(sdata, false);
1657
1658	ieee80211_teardown_sdata(sdata);
1659
1660	ieee80211_set_sdata_offload_flags(sdata);
1661	ret = drv_change_interface(local, sdata, internal_type, p2p);
1662	if (ret)
1663		type = ieee80211_vif_type_p2p(&sdata->vif);
1664
1665	/*
1666	 * Ignore return value here, there's not much we can do since
1667	 * the driver changed the interface type internally already.
1668	 * The warnings will hopefully make driver authors fix it :-)
1669	 */
1670	ieee80211_check_queues(sdata, type);
1671
1672	ieee80211_setup_sdata(sdata, type);
1673	ieee80211_set_vif_encap_ops(sdata);
1674
1675	err = ieee80211_do_open(&sdata->wdev, false);
1676	WARN(err, "type change: do_open returned %d", err);
1677
1678	ieee80211_wake_vif_queues(local, sdata,
1679				  IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE);
1680	return ret;
1681}
1682
1683int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
1684			     enum nl80211_iftype type)
1685{
1686	int ret;
1687
1688	ASSERT_RTNL();
1689
1690	if (type == ieee80211_vif_type_p2p(&sdata->vif))
1691		return 0;
1692
1693	if (ieee80211_sdata_running(sdata)) {
1694		ret = ieee80211_runtime_change_iftype(sdata, type);
1695		if (ret)
1696			return ret;
1697	} else {
1698		/* Purge and reset type-dependent state. */
1699		ieee80211_teardown_sdata(sdata);
1700		ieee80211_setup_sdata(sdata, type);
1701	}
1702
1703	/* reset some values that shouldn't be kept across type changes */
1704	if (type == NL80211_IFTYPE_STATION)
1705		sdata->u.mgd.use_4addr = false;
1706
1707	return 0;
1708}
1709
1710static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
1711				       u8 *perm_addr, enum nl80211_iftype type)
1712{
1713	struct ieee80211_sub_if_data *sdata;
1714	u64 mask, start, addr, val, inc;
1715	u8 *m;
1716	u8 tmp_addr[ETH_ALEN];
1717	int i;
1718
1719	/* default ... something at least */
1720	memcpy(perm_addr, local->hw.wiphy->perm_addr, ETH_ALEN);
1721
1722	if (is_zero_ether_addr(local->hw.wiphy->addr_mask) &&
1723	    local->hw.wiphy->n_addresses <= 1)
1724		return;
1725
1726	mutex_lock(&local->iflist_mtx);
1727
1728	switch (type) {
1729	case NL80211_IFTYPE_MONITOR:
1730		/* doesn't matter */
1731		break;
 
1732	case NL80211_IFTYPE_AP_VLAN:
1733		/* match up with an AP interface */
1734		list_for_each_entry(sdata, &local->interfaces, list) {
1735			if (sdata->vif.type != NL80211_IFTYPE_AP)
1736				continue;
1737			memcpy(perm_addr, sdata->vif.addr, ETH_ALEN);
1738			break;
1739		}
1740		/* keep default if no AP interface present */
1741		break;
1742	case NL80211_IFTYPE_P2P_CLIENT:
1743	case NL80211_IFTYPE_P2P_GO:
1744		if (ieee80211_hw_check(&local->hw, P2P_DEV_ADDR_FOR_INTF)) {
1745			list_for_each_entry(sdata, &local->interfaces, list) {
1746				if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE)
1747					continue;
1748				if (!ieee80211_sdata_running(sdata))
1749					continue;
1750				memcpy(perm_addr, sdata->vif.addr, ETH_ALEN);
1751				goto out_unlock;
1752			}
1753		}
1754		fallthrough;
1755	default:
1756		/* assign a new address if possible -- try n_addresses first */
1757		for (i = 0; i < local->hw.wiphy->n_addresses; i++) {
1758			bool used = false;
1759
1760			list_for_each_entry(sdata, &local->interfaces, list) {
1761				if (ether_addr_equal(local->hw.wiphy->addresses[i].addr,
1762						     sdata->vif.addr)) {
1763					used = true;
1764					break;
1765				}
1766			}
1767
1768			if (!used) {
1769				memcpy(perm_addr,
1770				       local->hw.wiphy->addresses[i].addr,
1771				       ETH_ALEN);
1772				break;
1773			}
1774		}
1775
1776		/* try mask if available */
1777		if (is_zero_ether_addr(local->hw.wiphy->addr_mask))
1778			break;
1779
1780		m = local->hw.wiphy->addr_mask;
1781		mask =	((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
1782			((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
1783			((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
1784
1785		if (__ffs64(mask) + hweight64(mask) != fls64(mask)) {
1786			/* not a contiguous mask ... not handled now! */
1787			pr_info("not contiguous\n");
1788			break;
1789		}
1790
1791		/*
1792		 * Pick address of existing interface in case user changed
1793		 * MAC address manually, default to perm_addr.
1794		 */
1795		m = local->hw.wiphy->perm_addr;
1796		list_for_each_entry(sdata, &local->interfaces, list) {
1797			if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
1798				continue;
1799			m = sdata->vif.addr;
1800			break;
1801		}
1802		start = ((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
1803			((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
1804			((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
1805
1806		inc = 1ULL<<__ffs64(mask);
1807		val = (start & mask);
1808		addr = (start & ~mask) | (val & mask);
1809		do {
1810			bool used = false;
1811
1812			tmp_addr[5] = addr >> 0*8;
1813			tmp_addr[4] = addr >> 1*8;
1814			tmp_addr[3] = addr >> 2*8;
1815			tmp_addr[2] = addr >> 3*8;
1816			tmp_addr[1] = addr >> 4*8;
1817			tmp_addr[0] = addr >> 5*8;
1818
1819			val += inc;
1820
1821			list_for_each_entry(sdata, &local->interfaces, list) {
1822				if (ether_addr_equal(tmp_addr, sdata->vif.addr)) {
1823					used = true;
1824					break;
1825				}
1826			}
1827
1828			if (!used) {
1829				memcpy(perm_addr, tmp_addr, ETH_ALEN);
1830				break;
1831			}
1832			addr = (start & ~mask) | (val & mask);
1833		} while (addr != start);
1834
1835		break;
1836	}
1837
1838 out_unlock:
1839	mutex_unlock(&local->iflist_mtx);
1840}
1841
1842int ieee80211_if_add(struct ieee80211_local *local, const char *name,
1843		     unsigned char name_assign_type,
1844		     struct wireless_dev **new_wdev, enum nl80211_iftype type,
1845		     struct vif_params *params)
1846{
1847	struct net_device *ndev = NULL;
1848	struct ieee80211_sub_if_data *sdata = NULL;
1849	struct txq_info *txqi;
1850	void (*if_setup)(struct net_device *dev);
1851	int ret, i;
1852	int txqs = 1;
1853
1854	ASSERT_RTNL();
1855
1856	if (type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN) {
1857		struct wireless_dev *wdev;
1858
1859		sdata = kzalloc(sizeof(*sdata) + local->hw.vif_data_size,
1860				GFP_KERNEL);
1861		if (!sdata)
1862			return -ENOMEM;
1863		wdev = &sdata->wdev;
1864
1865		sdata->dev = NULL;
1866		strlcpy(sdata->name, name, IFNAMSIZ);
1867		ieee80211_assign_perm_addr(local, wdev->address, type);
1868		memcpy(sdata->vif.addr, wdev->address, ETH_ALEN);
1869	} else {
1870		int size = ALIGN(sizeof(*sdata) + local->hw.vif_data_size,
1871				 sizeof(void *));
1872		int txq_size = 0;
1873
1874		if (local->ops->wake_tx_queue &&
1875		    type != NL80211_IFTYPE_AP_VLAN &&
1876		    (type != NL80211_IFTYPE_MONITOR ||
1877		     (params->flags & MONITOR_FLAG_ACTIVE)))
1878			txq_size += sizeof(struct txq_info) +
1879				    local->hw.txq_data_size;
1880
1881		if (local->ops->wake_tx_queue) {
1882			if_setup = ieee80211_if_setup_no_queue;
1883		} else {
1884			if_setup = ieee80211_if_setup;
1885			if (local->hw.queues >= IEEE80211_NUM_ACS)
1886				txqs = IEEE80211_NUM_ACS;
1887		}
1888
1889		ndev = alloc_netdev_mqs(size + txq_size,
1890					name, name_assign_type,
1891					if_setup, txqs, 1);
1892		if (!ndev)
1893			return -ENOMEM;
1894
1895		if (!local->ops->wake_tx_queue && local->hw.wiphy->tx_queue_len)
1896			ndev->tx_queue_len = local->hw.wiphy->tx_queue_len;
1897
1898		dev_net_set(ndev, wiphy_net(local->hw.wiphy));
1899
1900		ndev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
1901		if (!ndev->tstats) {
1902			free_netdev(ndev);
1903			return -ENOMEM;
1904		}
1905
1906		ndev->needed_headroom = local->tx_headroom +
1907					4*6 /* four MAC addresses */
1908					+ 2 + 2 + 2 + 2 /* ctl, dur, seq, qos */
1909					+ 6 /* mesh */
1910					+ 8 /* rfc1042/bridge tunnel */
1911					- ETH_HLEN /* ethernet hard_header_len */
1912					+ IEEE80211_ENCRYPT_HEADROOM;
1913		ndev->needed_tailroom = IEEE80211_ENCRYPT_TAILROOM;
1914
1915		ret = dev_alloc_name(ndev, ndev->name);
1916		if (ret < 0) {
1917			ieee80211_if_free(ndev);
1918			free_netdev(ndev);
1919			return ret;
1920		}
1921
1922		ieee80211_assign_perm_addr(local, ndev->perm_addr, type);
1923		if (is_valid_ether_addr(params->macaddr))
1924			memcpy(ndev->dev_addr, params->macaddr, ETH_ALEN);
1925		else
1926			memcpy(ndev->dev_addr, ndev->perm_addr, ETH_ALEN);
1927		SET_NETDEV_DEV(ndev, wiphy_dev(local->hw.wiphy));
1928
1929		/* don't use IEEE80211_DEV_TO_SUB_IF -- it checks too much */
1930		sdata = netdev_priv(ndev);
1931		ndev->ieee80211_ptr = &sdata->wdev;
1932		memcpy(sdata->vif.addr, ndev->dev_addr, ETH_ALEN);
1933		memcpy(sdata->name, ndev->name, IFNAMSIZ);
1934
1935		if (txq_size) {
1936			txqi = netdev_priv(ndev) + size;
1937			ieee80211_txq_init(sdata, NULL, txqi, 0);
1938		}
1939
1940		sdata->dev = ndev;
1941	}
1942
1943	/* initialise type-independent data */
1944	sdata->wdev.wiphy = local->hw.wiphy;
1945	sdata->local = local;
1946
1947	ieee80211_init_frag_cache(&sdata->frags);
 
1948
1949	INIT_LIST_HEAD(&sdata->key_list);
1950
1951	INIT_DELAYED_WORK(&sdata->dfs_cac_timer_work,
1952			  ieee80211_dfs_cac_timer_work);
1953	INIT_DELAYED_WORK(&sdata->dec_tailroom_needed_wk,
1954			  ieee80211_delayed_tailroom_dec);
1955
1956	for (i = 0; i < NUM_NL80211_BANDS; i++) {
1957		struct ieee80211_supported_band *sband;
1958		sband = local->hw.wiphy->bands[i];
1959		sdata->rc_rateidx_mask[i] =
1960			sband ? (1 << sband->n_bitrates) - 1 : 0;
1961		if (sband) {
1962			__le16 cap;
1963			u16 *vht_rate_mask;
1964
1965			memcpy(sdata->rc_rateidx_mcs_mask[i],
1966			       sband->ht_cap.mcs.rx_mask,
1967			       sizeof(sdata->rc_rateidx_mcs_mask[i]));
1968
1969			cap = sband->vht_cap.vht_mcs.rx_mcs_map;
1970			vht_rate_mask = sdata->rc_rateidx_vht_mcs_mask[i];
1971			ieee80211_get_vht_mask_from_cap(cap, vht_rate_mask);
1972		} else {
1973			memset(sdata->rc_rateidx_mcs_mask[i], 0,
1974			       sizeof(sdata->rc_rateidx_mcs_mask[i]));
1975			memset(sdata->rc_rateidx_vht_mcs_mask[i], 0,
1976			       sizeof(sdata->rc_rateidx_vht_mcs_mask[i]));
1977		}
1978	}
1979
1980	for (i = 0; i < IEEE80211_NUM_ACS; i++)
1981		init_airtime_info(&sdata->airtime[i], &local->airtime[i]);
1982
1983	ieee80211_set_default_queues(sdata);
1984
1985	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
1986	sdata->user_power_level = local->user_power_level;
1987
1988	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
1989
1990	/* setup type-dependent data */
1991	ieee80211_setup_sdata(sdata, type);
1992
1993	if (ndev) {
1994		ndev->ieee80211_ptr->use_4addr = params->use_4addr;
1995		if (type == NL80211_IFTYPE_STATION)
1996			sdata->u.mgd.use_4addr = params->use_4addr;
1997
1998		ndev->features |= local->hw.netdev_features;
1999		ndev->hw_features |= ndev->features &
2000					MAC80211_SUPPORTED_FEATURES_TX;
2001
2002		netdev_set_default_ethtool_ops(ndev, &ieee80211_ethtool_ops);
2003
2004		/* MTU range is normally 256 - 2304, where the upper limit is
2005		 * the maximum MSDU size. Monitor interfaces send and receive
2006		 * MPDU and A-MSDU frames which may be much larger so we do
2007		 * not impose an upper limit in that case.
2008		 */
2009		ndev->min_mtu = 256;
2010		if (type == NL80211_IFTYPE_MONITOR)
2011			ndev->max_mtu = 0;
2012		else
2013			ndev->max_mtu = local->hw.max_mtu;
2014
2015		ret = cfg80211_register_netdevice(ndev);
2016		if (ret) {
2017			free_netdev(ndev);
2018			return ret;
2019		}
2020	}
2021
2022	mutex_lock(&local->iflist_mtx);
2023	list_add_tail_rcu(&sdata->list, &local->interfaces);
2024	mutex_unlock(&local->iflist_mtx);
2025
2026	if (new_wdev)
2027		*new_wdev = &sdata->wdev;
2028
2029	return 0;
2030}
2031
2032void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata)
2033{
2034	ASSERT_RTNL();
2035
2036	mutex_lock(&sdata->local->iflist_mtx);
2037	list_del_rcu(&sdata->list);
2038	mutex_unlock(&sdata->local->iflist_mtx);
2039
2040	if (sdata->vif.txq)
2041		ieee80211_txq_purge(sdata->local, to_txq_info(sdata->vif.txq));
2042
2043	synchronize_rcu();
2044
2045	cfg80211_unregister_wdev(&sdata->wdev);
2046
2047	if (!sdata->dev) {
 
2048		ieee80211_teardown_sdata(sdata);
2049		kfree(sdata);
2050	}
2051}
2052
2053void ieee80211_sdata_stop(struct ieee80211_sub_if_data *sdata)
2054{
2055	if (WARN_ON_ONCE(!test_bit(SDATA_STATE_RUNNING, &sdata->state)))
2056		return;
2057	ieee80211_do_stop(sdata, true);
2058}
2059
2060void ieee80211_remove_interfaces(struct ieee80211_local *local)
2061{
2062	struct ieee80211_sub_if_data *sdata, *tmp;
2063	LIST_HEAD(unreg_list);
2064	LIST_HEAD(wdev_list);
2065
2066	ASSERT_RTNL();
2067
2068	/* Before destroying the interfaces, make sure they're all stopped so
2069	 * that the hardware is stopped. Otherwise, the driver might still be
2070	 * iterating the interfaces during the shutdown, e.g. from a worker
2071	 * or from RX processing or similar, and if it does so (using atomic
2072	 * iteration) while we're manipulating the list, the iteration will
2073	 * crash.
2074	 *
2075	 * After this, the hardware should be stopped and the driver should
2076	 * have stopped all of its activities, so that we can do RCU-unaware
2077	 * manipulations of the interface list below.
2078	 */
2079	cfg80211_shutdown_all_interfaces(local->hw.wiphy);
2080
2081	WARN(local->open_count, "%s: open count remains %d\n",
2082	     wiphy_name(local->hw.wiphy), local->open_count);
2083
2084	ieee80211_txq_teardown_flows(local);
2085
2086	mutex_lock(&local->iflist_mtx);
2087	list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
2088		list_del(&sdata->list);
2089
2090		if (sdata->dev)
2091			unregister_netdevice_queue(sdata->dev, &unreg_list);
2092		else
2093			list_add(&sdata->list, &wdev_list);
2094	}
2095	mutex_unlock(&local->iflist_mtx);
2096
2097	unregister_netdevice_many(&unreg_list);
2098
2099	wiphy_lock(local->hw.wiphy);
2100	list_for_each_entry_safe(sdata, tmp, &wdev_list, list) {
2101		list_del(&sdata->list);
2102		cfg80211_unregister_wdev(&sdata->wdev);
2103		kfree(sdata);
2104	}
2105	wiphy_unlock(local->hw.wiphy);
2106}
2107
2108static int netdev_notify(struct notifier_block *nb,
2109			 unsigned long state, void *ptr)
2110{
2111	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
2112	struct ieee80211_sub_if_data *sdata;
2113
2114	if (state != NETDEV_CHANGENAME)
2115		return NOTIFY_DONE;
2116
2117	if (!dev->ieee80211_ptr || !dev->ieee80211_ptr->wiphy)
2118		return NOTIFY_DONE;
2119
2120	if (dev->ieee80211_ptr->wiphy->privid != mac80211_wiphy_privid)
2121		return NOTIFY_DONE;
2122
2123	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2124	memcpy(sdata->name, dev->name, IFNAMSIZ);
2125	ieee80211_debugfs_rename_netdev(sdata);
2126
2127	return NOTIFY_OK;
2128}
2129
2130static struct notifier_block mac80211_netdev_notifier = {
2131	.notifier_call = netdev_notify,
2132};
2133
2134int ieee80211_iface_init(void)
2135{
2136	return register_netdevice_notifier(&mac80211_netdev_notifier);
2137}
2138
2139void ieee80211_iface_exit(void)
2140{
2141	unregister_netdevice_notifier(&mac80211_netdev_notifier);
2142}
2143
2144void ieee80211_vif_inc_num_mcast(struct ieee80211_sub_if_data *sdata)
2145{
2146	if (sdata->vif.type == NL80211_IFTYPE_AP)
2147		atomic_inc(&sdata->u.ap.num_mcast_sta);
2148	else if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
2149		atomic_inc(&sdata->u.vlan.num_mcast_sta);
2150}
2151
2152void ieee80211_vif_dec_num_mcast(struct ieee80211_sub_if_data *sdata)
2153{
2154	if (sdata->vif.type == NL80211_IFTYPE_AP)
2155		atomic_dec(&sdata->u.ap.num_mcast_sta);
2156	else if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
2157		atomic_dec(&sdata->u.vlan.num_mcast_sta);
2158}