1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * This is the linux wireless configuration interface.
   4 *
   5 * Copyright 2006-2010		Johannes Berg <johannes@sipsolutions.net>
   6 * Copyright 2013-2014  Intel Mobile Communications GmbH
   7 * Copyright 2015-2017	Intel Deutschland GmbH
   8 * Copyright (C) 2018-2024 Intel Corporation
   9 */
  10
  11#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  12
  13#include <linux/if.h>
  14#include <linux/module.h>
  15#include <linux/err.h>
  16#include <linux/list.h>
  17#include <linux/slab.h>
  18#include <linux/nl80211.h>
  19#include <linux/debugfs.h>
  20#include <linux/notifier.h>
  21#include <linux/device.h>
  22#include <linux/etherdevice.h>
  23#include <linux/rtnetlink.h>
  24#include <linux/sched.h>
  25#include <net/genetlink.h>
  26#include <net/cfg80211.h>
  27#include "nl80211.h"
  28#include "core.h"
  29#include "sysfs.h"
  30#include "debugfs.h"
  31#include "wext-compat.h"
  32#include "rdev-ops.h"
  33
  34/* name for sysfs, %d is appended */
  35#define PHY_NAME "phy"
  36
  37MODULE_AUTHOR("Johannes Berg");
  38MODULE_LICENSE("GPL");
  39MODULE_DESCRIPTION("wireless configuration support");
  40MODULE_ALIAS_GENL_FAMILY(NL80211_GENL_NAME);
  41
  42/* RCU-protected (and RTNL for writers) */
  43LIST_HEAD(cfg80211_rdev_list);
  44int cfg80211_rdev_list_generation;
  45
  46/* for debugfs */
  47static struct dentry *ieee80211_debugfs_dir;
  48
  49/* for the cleanup, scan and event works */
  50struct workqueue_struct *cfg80211_wq;
  51
  52static bool cfg80211_disable_40mhz_24ghz;
  53module_param(cfg80211_disable_40mhz_24ghz, bool, 0644);
  54MODULE_PARM_DESC(cfg80211_disable_40mhz_24ghz,
  55		 "Disable 40MHz support in the 2.4GHz band");
  56
  57struct cfg80211_registered_device *cfg80211_rdev_by_wiphy_idx(int wiphy_idx)
  58{
  59	struct cfg80211_registered_device *result = NULL, *rdev;
  60
  61	ASSERT_RTNL();
  62
  63	for_each_rdev(rdev) {
  64		if (rdev->wiphy_idx == wiphy_idx) {
  65			result = rdev;
  66			break;
  67		}
  68	}
  69
  70	return result;
  71}
  72
  73int get_wiphy_idx(struct wiphy *wiphy)
  74{
  75	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
  76
  77	return rdev->wiphy_idx;
  78}
  79
  80struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx)
  81{
  82	struct cfg80211_registered_device *rdev;
  83
  84	ASSERT_RTNL();
  85
  86	rdev = cfg80211_rdev_by_wiphy_idx(wiphy_idx);
  87	if (!rdev)
  88		return NULL;
  89	return &rdev->wiphy;
  90}
  91
  92static int cfg80211_dev_check_name(struct cfg80211_registered_device *rdev,
  93				   const char *newname)
  94{
  95	struct cfg80211_registered_device *rdev2;
  96	int wiphy_idx, taken = -1, digits;
  97
  98	ASSERT_RTNL();
  99
 100	if (strlen(newname) > NL80211_WIPHY_NAME_MAXLEN)
 101		return -EINVAL;
 102
 103	/* prohibit calling the thing phy%d when %d is not its number */
 104	sscanf(newname, PHY_NAME "%d%n", &wiphy_idx, &taken);
 105	if (taken == strlen(newname) && wiphy_idx != rdev->wiphy_idx) {
 106		/* count number of places needed to print wiphy_idx */
 107		digits = 1;
 108		while (wiphy_idx /= 10)
 109			digits++;
 110		/*
 111		 * deny the name if it is phy<idx> where <idx> is printed
 112		 * without leading zeroes. taken == strlen(newname) here
 113		 */
 114		if (taken == strlen(PHY_NAME) + digits)
 115			return -EINVAL;
 116	}
 117
 118	/* Ensure another device does not already have this name. */
 119	for_each_rdev(rdev2)
 120		if (strcmp(newname, wiphy_name(&rdev2->wiphy)) == 0)
 121			return -EINVAL;
 122
 123	return 0;
 124}
 125
 126int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
 127			char *newname)
 128{
 129	int result;
 130
 131	ASSERT_RTNL();
 132	lockdep_assert_wiphy(&rdev->wiphy);
 133
 134	/* Ignore nop renames */
 135	if (strcmp(newname, wiphy_name(&rdev->wiphy)) == 0)
 136		return 0;
 137
 138	result = cfg80211_dev_check_name(rdev, newname);
 139	if (result < 0)
 140		return result;
 141
 142	result = device_rename(&rdev->wiphy.dev, newname);
 143	if (result)
 144		return result;
 145
 146	if (!IS_ERR_OR_NULL(rdev->wiphy.debugfsdir))
 147		debugfs_rename(rdev->wiphy.debugfsdir->d_parent,
 148			       rdev->wiphy.debugfsdir,
 149			       rdev->wiphy.debugfsdir->d_parent, newname);
 150
 151	nl80211_notify_wiphy(rdev, NL80211_CMD_NEW_WIPHY);
 152
 153	return 0;
 154}
 155
 156int cfg80211_switch_netns(struct cfg80211_registered_device *rdev,
 157			  struct net *net)
 158{
 159	struct wireless_dev *wdev;
 160	int err = 0;
 161
 162	if (!(rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK))
 163		return -EOPNOTSUPP;
 164
 165	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 166		if (!wdev->netdev)
 167			continue;
 168		wdev->netdev->netns_local = false;
 169		err = dev_change_net_namespace(wdev->netdev, net, "wlan%d");
 170		if (err)
 171			break;
 172		wdev->netdev->netns_local = true;
 173	}
 174
 175	if (err) {
 176		/* failed -- clean up to old netns */
 177		net = wiphy_net(&rdev->wiphy);
 178
 179		list_for_each_entry_continue_reverse(wdev,
 180						     &rdev->wiphy.wdev_list,
 181						     list) {
 182			if (!wdev->netdev)
 183				continue;
 184			wdev->netdev->netns_local = false;
 185			err = dev_change_net_namespace(wdev->netdev, net,
 186							"wlan%d");
 187			WARN_ON(err);
 188			wdev->netdev->netns_local = true;
 189		}
 190
 191		return err;
 192	}
 193
 194	wiphy_lock(&rdev->wiphy);
 195	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 196		if (!wdev->netdev)
 197			continue;
 198		nl80211_notify_iface(rdev, wdev, NL80211_CMD_DEL_INTERFACE);
 199	}
 200
 201	nl80211_notify_wiphy(rdev, NL80211_CMD_DEL_WIPHY);
 202
 203	wiphy_net_set(&rdev->wiphy, net);
 204
 205	err = device_rename(&rdev->wiphy.dev, dev_name(&rdev->wiphy.dev));
 206	WARN_ON(err);
 207
 208	nl80211_notify_wiphy(rdev, NL80211_CMD_NEW_WIPHY);
 209
 210	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 211		if (!wdev->netdev)
 212			continue;
 213		nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);
 214	}
 215	wiphy_unlock(&rdev->wiphy);
 216
 217	return 0;
 218}
 219
 220static void cfg80211_rfkill_poll(struct rfkill *rfkill, void *data)
 221{
 222	struct cfg80211_registered_device *rdev = data;
 223
 224	wiphy_lock(&rdev->wiphy);
 225	rdev_rfkill_poll(rdev);
 226	wiphy_unlock(&rdev->wiphy);
 227}
 228
 229void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
 230			      struct wireless_dev *wdev)
 231{
 232	lockdep_assert_held(&rdev->wiphy.mtx);
 233
 234	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_P2P_DEVICE))
 235		return;
 236
 237	if (!wdev_running(wdev))
 238		return;
 239
 240	rdev_stop_p2p_device(rdev, wdev);
 241	wdev->is_running = false;
 242
 243	rdev->opencount--;
 244
 245	if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
 246		if (WARN_ON(!rdev->scan_req->notified &&
 247			    (!rdev->int_scan_req ||
 248			     !rdev->int_scan_req->notified)))
 249			rdev->scan_req->info.aborted = true;
 250		___cfg80211_scan_done(rdev, false);
 251	}
 252}
 253
 254void cfg80211_stop_nan(struct cfg80211_registered_device *rdev,
 255		       struct wireless_dev *wdev)
 256{
 257	lockdep_assert_held(&rdev->wiphy.mtx);
 258
 259	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_NAN))
 260		return;
 261
 262	if (!wdev_running(wdev))
 263		return;
 264
 265	rdev_stop_nan(rdev, wdev);
 266	wdev->is_running = false;
 267
 268	rdev->opencount--;
 269}
 270
 271void cfg80211_shutdown_all_interfaces(struct wiphy *wiphy)
 272{
 273	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 274	struct wireless_dev *wdev;
 275
 276	ASSERT_RTNL();
 277
 278	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 279		if (wdev->netdev) {
 280			dev_close(wdev->netdev);
 281			continue;
 282		}
 283
 284		/* otherwise, check iftype */
 285
 286		wiphy_lock(wiphy);
 287
 288		switch (wdev->iftype) {
 289		case NL80211_IFTYPE_P2P_DEVICE:
 290			cfg80211_stop_p2p_device(rdev, wdev);
 291			break;
 292		case NL80211_IFTYPE_NAN:
 293			cfg80211_stop_nan(rdev, wdev);
 294			break;
 295		default:
 296			break;
 297		}
 298
 299		wiphy_unlock(wiphy);
 300	}
 301}
 302EXPORT_SYMBOL_GPL(cfg80211_shutdown_all_interfaces);
 303
 304static int cfg80211_rfkill_set_block(void *data, bool blocked)
 305{
 306	struct cfg80211_registered_device *rdev = data;
 307
 308	if (!blocked)
 309		return 0;
 310
 311	rtnl_lock();
 312	cfg80211_shutdown_all_interfaces(&rdev->wiphy);
 313	rtnl_unlock();
 314
 315	return 0;
 316}
 317
 318static void cfg80211_rfkill_block_work(struct work_struct *work)
 319{
 320	struct cfg80211_registered_device *rdev;
 321
 322	rdev = container_of(work, struct cfg80211_registered_device,
 323			    rfkill_block);
 324	cfg80211_rfkill_set_block(rdev, true);
 325}
 326
 327static void cfg80211_event_work(struct work_struct *work)
 328{
 329	struct cfg80211_registered_device *rdev;
 330
 331	rdev = container_of(work, struct cfg80211_registered_device,
 332			    event_work);
 333
 334	wiphy_lock(&rdev->wiphy);
 335	cfg80211_process_rdev_events(rdev);
 336	wiphy_unlock(&rdev->wiphy);
 337}
 338
 339void cfg80211_destroy_ifaces(struct cfg80211_registered_device *rdev)
 340{
 341	struct wireless_dev *wdev, *tmp;
 342
 343	ASSERT_RTNL();
 344
 345	list_for_each_entry_safe(wdev, tmp, &rdev->wiphy.wdev_list, list) {
 346		if (wdev->nl_owner_dead) {
 347			if (wdev->netdev)
 348				dev_close(wdev->netdev);
 349
 350			wiphy_lock(&rdev->wiphy);
 351			cfg80211_leave(rdev, wdev);
 352			cfg80211_remove_virtual_intf(rdev, wdev);
 353			wiphy_unlock(&rdev->wiphy);
 354		}
 355	}
 356}
 357
 358static void cfg80211_destroy_iface_wk(struct work_struct *work)
 359{
 360	struct cfg80211_registered_device *rdev;
 361
 362	rdev = container_of(work, struct cfg80211_registered_device,
 363			    destroy_work);
 364
 365	rtnl_lock();
 366	cfg80211_destroy_ifaces(rdev);
 367	rtnl_unlock();
 368}
 369
 370static void cfg80211_sched_scan_stop_wk(struct wiphy *wiphy,
 371					struct wiphy_work *work)
 372{
 373	struct cfg80211_registered_device *rdev;
 374	struct cfg80211_sched_scan_request *req, *tmp;
 375
 376	rdev = container_of(work, struct cfg80211_registered_device,
 377			   sched_scan_stop_wk);
 378
 379	list_for_each_entry_safe(req, tmp, &rdev->sched_scan_req_list, list) {
 380		if (req->nl_owner_dead)
 381			cfg80211_stop_sched_scan_req(rdev, req, false);
 382	}
 383}
 384
 385static void cfg80211_propagate_radar_detect_wk(struct work_struct *work)
 386{
 387	struct cfg80211_registered_device *rdev;
 388
 389	rdev = container_of(work, struct cfg80211_registered_device,
 390			    propagate_radar_detect_wk);
 391
 392	rtnl_lock();
 393
 394	regulatory_propagate_dfs_state(&rdev->wiphy, &rdev->radar_chandef,
 395				       NL80211_DFS_UNAVAILABLE,
 396				       NL80211_RADAR_DETECTED);
 397
 398	rtnl_unlock();
 399}
 400
 401static void cfg80211_propagate_cac_done_wk(struct work_struct *work)
 402{
 403	struct cfg80211_registered_device *rdev;
 404
 405	rdev = container_of(work, struct cfg80211_registered_device,
 406			    propagate_cac_done_wk);
 407
 408	rtnl_lock();
 409
 410	regulatory_propagate_dfs_state(&rdev->wiphy, &rdev->cac_done_chandef,
 411				       NL80211_DFS_AVAILABLE,
 412				       NL80211_RADAR_CAC_FINISHED);
 413
 414	rtnl_unlock();
 415}
 416
 417static void cfg80211_wiphy_work(struct work_struct *work)
 418{
 419	struct cfg80211_registered_device *rdev;
 420	struct wiphy_work *wk;
 421
 422	rdev = container_of(work, struct cfg80211_registered_device, wiphy_work);
 423
 424	trace_wiphy_work_worker_start(&rdev->wiphy);
 425
 426	wiphy_lock(&rdev->wiphy);
 427	if (rdev->suspended)
 428		goto out;
 429
 430	spin_lock_irq(&rdev->wiphy_work_lock);
 431	wk = list_first_entry_or_null(&rdev->wiphy_work_list,
 432				      struct wiphy_work, entry);
 433	if (wk) {
 434		list_del_init(&wk->entry);
 435		if (!list_empty(&rdev->wiphy_work_list))
 436			queue_work(system_unbound_wq, work);
 437		spin_unlock_irq(&rdev->wiphy_work_lock);
 438
 439		trace_wiphy_work_run(&rdev->wiphy, wk);
 440		wk->func(&rdev->wiphy, wk);
 441	} else {
 442		spin_unlock_irq(&rdev->wiphy_work_lock);
 443	}
 444out:
 445	wiphy_unlock(&rdev->wiphy);
 446}
 447
 448/* exported functions */
 449
 450struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv,
 451			   const char *requested_name)
 452{
 453	static atomic_t wiphy_counter = ATOMIC_INIT(0);
 454
 455	struct cfg80211_registered_device *rdev;
 456	int alloc_size;
 457
 458	WARN_ON(ops->add_key && (!ops->del_key || !ops->set_default_key));
 459	WARN_ON(ops->auth && (!ops->assoc || !ops->deauth || !ops->disassoc));
 460	WARN_ON(ops->connect && !ops->disconnect);
 461	WARN_ON(ops->join_ibss && !ops->leave_ibss);
 462	WARN_ON(ops->add_virtual_intf && !ops->del_virtual_intf);
 463	WARN_ON(ops->add_station && !ops->del_station);
 464	WARN_ON(ops->add_mpath && !ops->del_mpath);
 465	WARN_ON(ops->join_mesh && !ops->leave_mesh);
 466	WARN_ON(ops->start_p2p_device && !ops->stop_p2p_device);
 467	WARN_ON(ops->start_ap && !ops->stop_ap);
 468	WARN_ON(ops->join_ocb && !ops->leave_ocb);
 469	WARN_ON(ops->suspend && !ops->resume);
 470	WARN_ON(ops->sched_scan_start && !ops->sched_scan_stop);
 471	WARN_ON(ops->remain_on_channel && !ops->cancel_remain_on_channel);
 472	WARN_ON(ops->tdls_channel_switch && !ops->tdls_cancel_channel_switch);
 473	WARN_ON(ops->add_tx_ts && !ops->del_tx_ts);
 474
 475	alloc_size = sizeof(*rdev) + sizeof_priv;
 476
 477	rdev = kzalloc(alloc_size, GFP_KERNEL);
 478	if (!rdev)
 479		return NULL;
 480
 481	rdev->ops = ops;
 482
 483	rdev->wiphy_idx = atomic_inc_return(&wiphy_counter);
 484
 485	if (unlikely(rdev->wiphy_idx < 0)) {
 486		/* ugh, wrapped! */
 487		atomic_dec(&wiphy_counter);
 488		kfree(rdev);
 489		return NULL;
 490	}
 491
 492	/* atomic_inc_return makes it start at 1, make it start at 0 */
 493	rdev->wiphy_idx--;
 494
 495	/* give it a proper name */
 496	if (requested_name && requested_name[0]) {
 497		int rv;
 498
 499		rtnl_lock();
 500		rv = cfg80211_dev_check_name(rdev, requested_name);
 501
 502		if (rv < 0) {
 503			rtnl_unlock();
 504			goto use_default_name;
 505		}
 506
 507		rv = dev_set_name(&rdev->wiphy.dev, "%s", requested_name);
 508		rtnl_unlock();
 509		if (rv)
 510			goto use_default_name;
 511	} else {
 512		int rv;
 513
 514use_default_name:
 515		/* NOTE:  This is *probably* safe w/out holding rtnl because of
 516		 * the restrictions on phy names.  Probably this call could
 517		 * fail if some other part of the kernel (re)named a device
 518		 * phyX.  But, might should add some locking and check return
 519		 * value, and use a different name if this one exists?
 520		 */
 521		rv = dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);
 522		if (rv < 0) {
 523			kfree(rdev);
 524			return NULL;
 525		}
 526	}
 527
 528	mutex_init(&rdev->wiphy.mtx);
 529	INIT_LIST_HEAD(&rdev->wiphy.wdev_list);
 530	INIT_LIST_HEAD(&rdev->beacon_registrations);
 531	spin_lock_init(&rdev->beacon_registrations_lock);
 532	spin_lock_init(&rdev->bss_lock);
 533	INIT_LIST_HEAD(&rdev->bss_list);
 534	INIT_LIST_HEAD(&rdev->sched_scan_req_list);
 535	wiphy_work_init(&rdev->scan_done_wk, __cfg80211_scan_done);
 536	INIT_DELAYED_WORK(&rdev->dfs_update_channels_wk,
 537			  cfg80211_dfs_channels_update_work);
 538#ifdef CONFIG_CFG80211_WEXT
 539	rdev->wiphy.wext = &cfg80211_wext_handler;
 540#endif
 541
 542	device_initialize(&rdev->wiphy.dev);
 543	rdev->wiphy.dev.class = &ieee80211_class;
 544	rdev->wiphy.dev.platform_data = rdev;
 545	device_enable_async_suspend(&rdev->wiphy.dev);
 546
 547	INIT_WORK(&rdev->destroy_work, cfg80211_destroy_iface_wk);
 548	wiphy_work_init(&rdev->sched_scan_stop_wk, cfg80211_sched_scan_stop_wk);
 549	INIT_WORK(&rdev->sched_scan_res_wk, cfg80211_sched_scan_results_wk);
 550	INIT_WORK(&rdev->propagate_radar_detect_wk,
 551		  cfg80211_propagate_radar_detect_wk);
 552	INIT_WORK(&rdev->propagate_cac_done_wk, cfg80211_propagate_cac_done_wk);
 553	INIT_WORK(&rdev->mgmt_registrations_update_wk,
 554		  cfg80211_mgmt_registrations_update_wk);
 555	spin_lock_init(&rdev->mgmt_registrations_lock);
 556
 557#ifdef CONFIG_CFG80211_DEFAULT_PS
 558	rdev->wiphy.flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
 559#endif
 560
 561	wiphy_net_set(&rdev->wiphy, &init_net);
 562
 563	rdev->rfkill_ops.set_block = cfg80211_rfkill_set_block;
 564	rdev->wiphy.rfkill = rfkill_alloc(dev_name(&rdev->wiphy.dev),
 565					  &rdev->wiphy.dev, RFKILL_TYPE_WLAN,
 566					  &rdev->rfkill_ops, rdev);
 567
 568	if (!rdev->wiphy.rfkill) {
 569		wiphy_free(&rdev->wiphy);
 570		return NULL;
 571	}
 572
 573	INIT_WORK(&rdev->wiphy_work, cfg80211_wiphy_work);
 574	INIT_LIST_HEAD(&rdev->wiphy_work_list);
 575	spin_lock_init(&rdev->wiphy_work_lock);
 576	INIT_WORK(&rdev->rfkill_block, cfg80211_rfkill_block_work);
 577	INIT_WORK(&rdev->conn_work, cfg80211_conn_work);
 578	INIT_WORK(&rdev->event_work, cfg80211_event_work);
 579	INIT_WORK(&rdev->background_cac_abort_wk,
 580		  cfg80211_background_cac_abort_wk);
 581	INIT_DELAYED_WORK(&rdev->background_cac_done_wk,
 582			  cfg80211_background_cac_done_wk);
 583
 584	init_waitqueue_head(&rdev->dev_wait);
 585
 586	/*
 587	 * Initialize wiphy parameters to IEEE 802.11 MIB default values.
 588	 * Fragmentation and RTS threshold are disabled by default with the
 589	 * special -1 value.
 590	 */
 591	rdev->wiphy.retry_short = 7;
 592	rdev->wiphy.retry_long = 4;
 593	rdev->wiphy.frag_threshold = (u32) -1;
 594	rdev->wiphy.rts_threshold = (u32) -1;
 595	rdev->wiphy.coverage_class = 0;
 596
 597	rdev->wiphy.max_num_csa_counters = 1;
 598
 599	rdev->wiphy.max_sched_scan_plans = 1;
 600	rdev->wiphy.max_sched_scan_plan_interval = U32_MAX;
 601
 602	return &rdev->wiphy;
 603}
 604EXPORT_SYMBOL(wiphy_new_nm);
 605
 606static
 607int wiphy_verify_iface_combinations(struct wiphy *wiphy,
 608				    const struct ieee80211_iface_combination *iface_comb,
 609				    int n_iface_comb,
 610				    bool combined_radio)
 611{
 612	const struct ieee80211_iface_combination *c;
 613	int i, j;
 614
 615	for (i = 0; i < n_iface_comb; i++) {
 616		u32 cnt = 0;
 617		u16 all_iftypes = 0;
 618
 619		c = &iface_comb[i];
 620
 621		/*
 622		 * Combinations with just one interface aren't real,
 623		 * however we make an exception for DFS.
 624		 */
 625		if (WARN_ON((c->max_interfaces < 2) && !c->radar_detect_widths))
 626			return -EINVAL;
 627
 628		/* Need at least one channel */
 629		if (WARN_ON(!c->num_different_channels))
 630			return -EINVAL;
 631
 632		/* DFS only works on one channel. Avoid this check
 633		 * for multi-radio global combination, since it hold
 634		 * the capabilities of all radio combinations.
 635		 */
 636		if (!combined_radio &&
 637		    WARN_ON(c->radar_detect_widths &&
 638			    c->num_different_channels > 1))
 639			return -EINVAL;
 640
 641		if (WARN_ON(!c->n_limits))
 642			return -EINVAL;
 643
 644		for (j = 0; j < c->n_limits; j++) {
 645			u16 types = c->limits[j].types;
 646
 647			/* interface types shouldn't overlap */
 648			if (WARN_ON(types & all_iftypes))
 649				return -EINVAL;
 650			all_iftypes |= types;
 651
 652			if (WARN_ON(!c->limits[j].max))
 653				return -EINVAL;
 654
 655			/* Shouldn't list software iftypes in combinations! */
 656			if (WARN_ON(wiphy->software_iftypes & types))
 657				return -EINVAL;
 658
 659			/* Only a single P2P_DEVICE can be allowed, avoid this
 660			 * check for multi-radio global combination, since it
 661			 * hold the capabilities of all radio combinations.
 662			 */
 663			if (!combined_radio &&
 664			    WARN_ON(types & BIT(NL80211_IFTYPE_P2P_DEVICE) &&
 665				    c->limits[j].max > 1))
 666				return -EINVAL;
 667
 668			/* Only a single NAN can be allowed, avoid this
 669			 * check for multi-radio global combination, since it
 670			 * hold the capabilities of all radio combinations.
 671			 */
 672			if (!combined_radio &&
 673			    WARN_ON(types & BIT(NL80211_IFTYPE_NAN) &&
 674				    c->limits[j].max > 1))
 675				return -EINVAL;
 676
 677			/*
 678			 * This isn't well-defined right now. If you have an
 679			 * IBSS interface, then its beacon interval may change
 680			 * by joining other networks, and nothing prevents it
 681			 * from doing that.
 682			 * So technically we probably shouldn't even allow AP
 683			 * and IBSS in the same interface, but it seems that
 684			 * some drivers support that, possibly only with fixed
 685			 * beacon intervals for IBSS.
 686			 */
 687			if (WARN_ON(types & BIT(NL80211_IFTYPE_ADHOC) &&
 688				    c->beacon_int_min_gcd)) {
 689				return -EINVAL;
 690			}
 691
 692			cnt += c->limits[j].max;
 693			/*
 694			 * Don't advertise an unsupported type
 695			 * in a combination.
 696			 */
 697			if (WARN_ON((wiphy->interface_modes & types) != types))
 698				return -EINVAL;
 699		}
 700
 701		if (WARN_ON(all_iftypes & BIT(NL80211_IFTYPE_WDS)))
 702			return -EINVAL;
 703
 704		/* You can't even choose that many! */
 705		if (WARN_ON(cnt < c->max_interfaces))
 706			return -EINVAL;
 707	}
 708
 709	return 0;
 710}
 711
 712static int wiphy_verify_combinations(struct wiphy *wiphy)
 713{
 714	int i, ret;
 715	bool combined_radio = false;
 716
 717	if (wiphy->n_radio) {
 718		for (i = 0; i < wiphy->n_radio; i++) {
 719			const struct wiphy_radio *radio = &wiphy->radio[i];
 720
 721			ret = wiphy_verify_iface_combinations(wiphy,
 722							      radio->iface_combinations,
 723							      radio->n_iface_combinations,
 724							      false);
 725			if (ret)
 726				return ret;
 727		}
 728
 729		combined_radio = true;
 730	}
 731
 732	ret = wiphy_verify_iface_combinations(wiphy,
 733					      wiphy->iface_combinations,
 734					      wiphy->n_iface_combinations,
 735					      combined_radio);
 736
 737	return ret;
 738}
 739
 740int wiphy_register(struct wiphy *wiphy)
 741{
 742	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 743	int res;
 744	enum nl80211_band band;
 745	struct ieee80211_supported_band *sband;
 746	bool have_band = false;
 747	int i;
 748	u16 ifmodes = wiphy->interface_modes;
 749
 750#ifdef CONFIG_PM
 751	if (WARN_ON(wiphy->wowlan &&
 752		    (wiphy->wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
 753		    !(wiphy->wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)))
 754		return -EINVAL;
 755	if (WARN_ON(wiphy->wowlan &&
 756		    !wiphy->wowlan->flags && !wiphy->wowlan->n_patterns &&
 757		    !wiphy->wowlan->tcp))
 758		return -EINVAL;
 759#endif
 760	if (WARN_ON((wiphy->features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH) &&
 761		    (!rdev->ops->tdls_channel_switch ||
 762		     !rdev->ops->tdls_cancel_channel_switch)))
 763		return -EINVAL;
 764
 765	if (WARN_ON((wiphy->interface_modes & BIT(NL80211_IFTYPE_NAN)) &&
 766		    (!rdev->ops->start_nan || !rdev->ops->stop_nan ||
 767		     !rdev->ops->add_nan_func || !rdev->ops->del_nan_func ||
 768		     !(wiphy->nan_supported_bands & BIT(NL80211_BAND_2GHZ)))))
 769		return -EINVAL;
 770
 771	if (WARN_ON(wiphy->interface_modes & BIT(NL80211_IFTYPE_WDS)))
 772		return -EINVAL;
 773
 774	if (WARN_ON(wiphy->pmsr_capa && !wiphy->pmsr_capa->ftm.supported))
 775		return -EINVAL;
 776
 777	if (wiphy->pmsr_capa && wiphy->pmsr_capa->ftm.supported) {
 778		if (WARN_ON(!wiphy->pmsr_capa->ftm.asap &&
 779			    !wiphy->pmsr_capa->ftm.non_asap))
 780			return -EINVAL;
 781		if (WARN_ON(!wiphy->pmsr_capa->ftm.preambles ||
 782			    !wiphy->pmsr_capa->ftm.bandwidths))
 783			return -EINVAL;
 784		if (WARN_ON(wiphy->pmsr_capa->ftm.preambles &
 785				~(BIT(NL80211_PREAMBLE_LEGACY) |
 786				  BIT(NL80211_PREAMBLE_HT) |
 787				  BIT(NL80211_PREAMBLE_VHT) |
 788				  BIT(NL80211_PREAMBLE_HE) |
 789				  BIT(NL80211_PREAMBLE_DMG))))
 790			return -EINVAL;
 791		if (WARN_ON((wiphy->pmsr_capa->ftm.trigger_based ||
 792			     wiphy->pmsr_capa->ftm.non_trigger_based) &&
 793			    !(wiphy->pmsr_capa->ftm.preambles &
 794			      BIT(NL80211_PREAMBLE_HE))))
 795			return -EINVAL;
 796		if (WARN_ON(wiphy->pmsr_capa->ftm.bandwidths &
 797				~(BIT(NL80211_CHAN_WIDTH_20_NOHT) |
 798				  BIT(NL80211_CHAN_WIDTH_20) |
 799				  BIT(NL80211_CHAN_WIDTH_40) |
 800				  BIT(NL80211_CHAN_WIDTH_80) |
 801				  BIT(NL80211_CHAN_WIDTH_80P80) |
 802				  BIT(NL80211_CHAN_WIDTH_160) |
 803				  BIT(NL80211_CHAN_WIDTH_5) |
 804				  BIT(NL80211_CHAN_WIDTH_10))))
 805			return -EINVAL;
 806	}
 807
 808	if (WARN_ON((wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED) &&
 809		    (wiphy->regulatory_flags &
 810					(REGULATORY_CUSTOM_REG |
 811					 REGULATORY_STRICT_REG |
 812					 REGULATORY_COUNTRY_IE_FOLLOW_POWER |
 813					 REGULATORY_COUNTRY_IE_IGNORE))))
 814		return -EINVAL;
 815
 816	if (WARN_ON(wiphy->coalesce &&
 817		    (!wiphy->coalesce->n_rules ||
 818		     !wiphy->coalesce->n_patterns) &&
 819		    (!wiphy->coalesce->pattern_min_len ||
 820		     wiphy->coalesce->pattern_min_len >
 821			wiphy->coalesce->pattern_max_len)))
 822		return -EINVAL;
 823
 824	if (WARN_ON(wiphy->ap_sme_capa &&
 825		    !(wiphy->flags & WIPHY_FLAG_HAVE_AP_SME)))
 826		return -EINVAL;
 827
 828	if (WARN_ON(wiphy->addresses && !wiphy->n_addresses))
 829		return -EINVAL;
 830
 831	if (WARN_ON(wiphy->addresses &&
 832		    !is_zero_ether_addr(wiphy->perm_addr) &&
 833		    memcmp(wiphy->perm_addr, wiphy->addresses[0].addr,
 834			   ETH_ALEN)))
 835		return -EINVAL;
 836
 837	if (WARN_ON(wiphy->max_acl_mac_addrs &&
 838		    (!(wiphy->flags & WIPHY_FLAG_HAVE_AP_SME) ||
 839		     !rdev->ops->set_mac_acl)))
 840		return -EINVAL;
 841
 842	/* assure only valid behaviours are flagged by driver
 843	 * hence subtract 2 as bit 0 is invalid.
 844	 */
 845	if (WARN_ON(wiphy->bss_select_support &&
 846		    (wiphy->bss_select_support & ~(BIT(__NL80211_BSS_SELECT_ATTR_AFTER_LAST) - 2))))
 847		return -EINVAL;
 848
 849	if (WARN_ON(wiphy_ext_feature_isset(&rdev->wiphy,
 850					    NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X) &&
 851		    (!rdev->ops->set_pmk || !rdev->ops->del_pmk)))
 852		return -EINVAL;
 853
 854	if (WARN_ON(!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
 855		    rdev->ops->update_connect_params))
 856		return -EINVAL;
 857
 858	if (wiphy->addresses)
 859		memcpy(wiphy->perm_addr, wiphy->addresses[0].addr, ETH_ALEN);
 860
 861	/* sanity check ifmodes */
 862	WARN_ON(!ifmodes);
 863	ifmodes &= ((1 << NUM_NL80211_IFTYPES) - 1) & ~1;
 864	if (WARN_ON(ifmodes != wiphy->interface_modes))
 865		wiphy->interface_modes = ifmodes;
 866
 867	res = wiphy_verify_combinations(wiphy);
 868	if (res)
 869		return res;
 870
 871	/* sanity check supported bands/channels */
 872	for (band = 0; band < NUM_NL80211_BANDS; band++) {
 873		const struct ieee80211_sband_iftype_data *iftd;
 874		u16 types = 0;
 875		bool have_he = false;
 876
 877		sband = wiphy->bands[band];
 878		if (!sband)
 879			continue;
 880
 881		sband->band = band;
 882		if (WARN_ON(!sband->n_channels))
 883			return -EINVAL;
 884		/*
 885		 * on 60GHz or sub-1Ghz band, there are no legacy rates, so
 886		 * n_bitrates is 0
 887		 */
 888		if (WARN_ON((band != NL80211_BAND_60GHZ &&
 889			     band != NL80211_BAND_S1GHZ) &&
 890			    !sband->n_bitrates))
 891			return -EINVAL;
 892
 893		if (WARN_ON(band == NL80211_BAND_6GHZ &&
 894			    (sband->ht_cap.ht_supported ||
 895			     sband->vht_cap.vht_supported)))
 896			return -EINVAL;
 897
 898		/*
 899		 * Since cfg80211_disable_40mhz_24ghz is global, we can
 900		 * modify the sband's ht data even if the driver uses a
 901		 * global structure for that.
 902		 */
 903		if (cfg80211_disable_40mhz_24ghz &&
 904		    band == NL80211_BAND_2GHZ &&
 905		    sband->ht_cap.ht_supported) {
 906			sband->ht_cap.cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 907			sband->ht_cap.cap &= ~IEEE80211_HT_CAP_SGI_40;
 908		}
 909
 910		/*
 911		 * Since we use a u32 for rate bitmaps in
 912		 * ieee80211_get_response_rate, we cannot
 913		 * have more than 32 legacy rates.
 914		 */
 915		if (WARN_ON(sband->n_bitrates > 32))
 916			return -EINVAL;
 917
 918		for (i = 0; i < sband->n_channels; i++) {
 919			sband->channels[i].orig_flags =
 920				sband->channels[i].flags;
 921			sband->channels[i].orig_mag = INT_MAX;
 922			sband->channels[i].orig_mpwr =
 923				sband->channels[i].max_power;
 924			sband->channels[i].band = band;
 925
 926			if (WARN_ON(sband->channels[i].freq_offset >= 1000))
 927				return -EINVAL;
 928		}
 929
 930		for_each_sband_iftype_data(sband, i, iftd) {
 931			bool has_ap, has_non_ap;
 932			u32 ap_bits = BIT(NL80211_IFTYPE_AP) |
 933				      BIT(NL80211_IFTYPE_P2P_GO);
 934
 935			if (WARN_ON(!iftd->types_mask))
 936				return -EINVAL;
 937			if (WARN_ON(types & iftd->types_mask))
 938				return -EINVAL;
 939
 940			/* at least one piece of information must be present */
 941			if (WARN_ON(!iftd->he_cap.has_he))
 942				return -EINVAL;
 943
 944			types |= iftd->types_mask;
 945
 946			if (i == 0)
 947				have_he = iftd->he_cap.has_he;
 948			else
 949				have_he = have_he &&
 950					  iftd->he_cap.has_he;
 951
 952			has_ap = iftd->types_mask & ap_bits;
 953			has_non_ap = iftd->types_mask & ~ap_bits;
 954
 955			/*
 956			 * For EHT 20 MHz STA, the capabilities format differs
 957			 * but to simplify, don't check 20 MHz but rather check
 958			 * only if AP and non-AP were mentioned at the same time,
 959			 * reject if so.
 960			 */
 961			if (WARN_ON(iftd->eht_cap.has_eht &&
 962				    has_ap && has_non_ap))
 963				return -EINVAL;
 964		}
 965
 966		if (WARN_ON(!have_he && band == NL80211_BAND_6GHZ))
 967			return -EINVAL;
 968
 969		have_band = true;
 970	}
 971
 972	if (!have_band) {
 973		WARN_ON(1);
 974		return -EINVAL;
 975	}
 976
 977	for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
 978		/*
 979		 * Validate we have a policy (can be explicitly set to
 980		 * VENDOR_CMD_RAW_DATA which is non-NULL) and also that
 981		 * we have at least one of doit/dumpit.
 982		 */
 983		if (WARN_ON(!rdev->wiphy.vendor_commands[i].policy))
 984			return -EINVAL;
 985		if (WARN_ON(!rdev->wiphy.vendor_commands[i].doit &&
 986			    !rdev->wiphy.vendor_commands[i].dumpit))
 987			return -EINVAL;
 988	}
 989
 990#ifdef CONFIG_PM
 991	if (WARN_ON(rdev->wiphy.wowlan && rdev->wiphy.wowlan->n_patterns &&
 992		    (!rdev->wiphy.wowlan->pattern_min_len ||
 993		     rdev->wiphy.wowlan->pattern_min_len >
 994				rdev->wiphy.wowlan->pattern_max_len)))
 995		return -EINVAL;
 996#endif
 997
 998	if (!wiphy->max_num_akm_suites)
 999		wiphy->max_num_akm_suites = NL80211_MAX_NR_AKM_SUITES;
1000	else if (wiphy->max_num_akm_suites < NL80211_MAX_NR_AKM_SUITES ||
1001		 wiphy->max_num_akm_suites > CFG80211_MAX_NUM_AKM_SUITES)
1002		return -EINVAL;
1003
1004	/* check and set up bitrates */
1005	ieee80211_set_bitrate_flags(wiphy);
1006
1007	rdev->wiphy.features |= NL80211_FEATURE_SCAN_FLUSH;
1008
1009	rtnl_lock();
1010	wiphy_lock(&rdev->wiphy);
1011	res = device_add(&rdev->wiphy.dev);
1012	if (res) {
1013		wiphy_unlock(&rdev->wiphy);
1014		rtnl_unlock();
1015		return res;
1016	}
1017
1018	list_add_rcu(&rdev->list, &cfg80211_rdev_list);
1019	cfg80211_rdev_list_generation++;
1020
1021	/* add to debugfs */
1022	rdev->wiphy.debugfsdir = debugfs_create_dir(wiphy_name(&rdev->wiphy),
1023						    ieee80211_debugfs_dir);
1024
1025	cfg80211_debugfs_rdev_add(rdev);
1026	nl80211_notify_wiphy(rdev, NL80211_CMD_NEW_WIPHY);
1027	wiphy_unlock(&rdev->wiphy);
1028
1029	/* set up regulatory info */
1030	wiphy_regulatory_register(wiphy);
1031
1032	if (wiphy->regulatory_flags & REGULATORY_CUSTOM_REG) {
1033		struct regulatory_request request;
1034
1035		request.wiphy_idx = get_wiphy_idx(wiphy);
1036		request.initiator = NL80211_REGDOM_SET_BY_DRIVER;
1037		request.alpha2[0] = '9';
1038		request.alpha2[1] = '9';
1039
1040		nl80211_send_reg_change_event(&request);
1041	}
1042
1043	/* Check that nobody globally advertises any capabilities they do not
1044	 * advertise on all possible interface types.
1045	 */
1046	if (wiphy->extended_capabilities_len &&
1047	    wiphy->num_iftype_ext_capab &&
1048	    wiphy->iftype_ext_capab) {
1049		u8 supported_on_all, j;
1050		const struct wiphy_iftype_ext_capab *capab;
1051
1052		capab = wiphy->iftype_ext_capab;
1053		for (j = 0; j < wiphy->extended_capabilities_len; j++) {
1054			if (capab[0].extended_capabilities_len > j)
1055				supported_on_all =
1056					capab[0].extended_capabilities[j];
1057			else
1058				supported_on_all = 0x00;
1059			for (i = 1; i < wiphy->num_iftype_ext_capab; i++) {
1060				if (j >= capab[i].extended_capabilities_len) {
1061					supported_on_all = 0x00;
1062					break;
1063				}
1064				supported_on_all &=
1065					capab[i].extended_capabilities[j];
1066			}
1067			if (WARN_ON(wiphy->extended_capabilities[j] &
1068				    ~supported_on_all))
1069				break;
1070		}
1071	}
1072
1073	rdev->wiphy.registered = true;
1074	rtnl_unlock();
1075
1076	res = rfkill_register(rdev->wiphy.rfkill);
1077	if (res) {
1078		rfkill_destroy(rdev->wiphy.rfkill);
1079		rdev->wiphy.rfkill = NULL;
1080		wiphy_unregister(&rdev->wiphy);
1081		return res;
1082	}
1083
1084	return 0;
1085}
1086EXPORT_SYMBOL(wiphy_register);
1087
1088void wiphy_rfkill_start_polling(struct wiphy *wiphy)
1089{
1090	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1091
1092	if (!rdev->ops->rfkill_poll)
1093		return;
1094	rdev->rfkill_ops.poll = cfg80211_rfkill_poll;
1095	rfkill_resume_polling(wiphy->rfkill);
1096}
1097EXPORT_SYMBOL(wiphy_rfkill_start_polling);
1098
1099void cfg80211_process_wiphy_works(struct cfg80211_registered_device *rdev,
1100				  struct wiphy_work *end)
1101{
1102	unsigned int runaway_limit = 100;
1103	unsigned long flags;
1104
1105	lockdep_assert_held(&rdev->wiphy.mtx);
1106
1107	spin_lock_irqsave(&rdev->wiphy_work_lock, flags);
1108	while (!list_empty(&rdev->wiphy_work_list)) {
1109		struct wiphy_work *wk;
1110
1111		wk = list_first_entry(&rdev->wiphy_work_list,
1112				      struct wiphy_work, entry);
1113		list_del_init(&wk->entry);
1114		spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags);
1115
1116		trace_wiphy_work_run(&rdev->wiphy, wk);
1117		wk->func(&rdev->wiphy, wk);
1118
1119		spin_lock_irqsave(&rdev->wiphy_work_lock, flags);
1120
1121		if (wk == end)
1122			break;
1123
1124		if (WARN_ON(--runaway_limit == 0))
1125			INIT_LIST_HEAD(&rdev->wiphy_work_list);
1126	}
1127	spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags);
1128}
1129
1130void wiphy_unregister(struct wiphy *wiphy)
1131{
1132	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1133
1134	wait_event(rdev->dev_wait, ({
1135		int __count;
1136		wiphy_lock(&rdev->wiphy);
1137		__count = rdev->opencount;
1138		wiphy_unlock(&rdev->wiphy);
1139		__count == 0; }));
1140
1141	if (rdev->wiphy.rfkill)
1142		rfkill_unregister(rdev->wiphy.rfkill);
1143
1144	rtnl_lock();
1145	wiphy_lock(&rdev->wiphy);
1146	nl80211_notify_wiphy(rdev, NL80211_CMD_DEL_WIPHY);
1147	rdev->wiphy.registered = false;
1148
1149	WARN_ON(!list_empty(&rdev->wiphy.wdev_list));
1150
1151	/*
1152	 * First remove the hardware from everywhere, this makes
1153	 * it impossible to find from userspace.
1154	 */
1155	debugfs_remove_recursive(rdev->wiphy.debugfsdir);
1156	list_del_rcu(&rdev->list);
1157	synchronize_rcu();
1158
1159	/*
1160	 * If this device got a regulatory hint tell core its
1161	 * free to listen now to a new shiny device regulatory hint
1162	 */
1163	wiphy_regulatory_deregister(wiphy);
1164
1165	cfg80211_rdev_list_generation++;
1166	device_del(&rdev->wiphy.dev);
1167
1168#ifdef CONFIG_PM
1169	if (rdev->wiphy.wowlan_config && rdev->ops->set_wakeup)
1170		rdev_set_wakeup(rdev, false);
1171#endif
1172
1173	/* surely nothing is reachable now, clean up work */
1174	cfg80211_process_wiphy_works(rdev, NULL);
1175	wiphy_unlock(&rdev->wiphy);
1176	rtnl_unlock();
1177
1178	/* this has nothing to do now but make sure it's gone */
1179	cancel_work_sync(&rdev->wiphy_work);
1180
1181	cancel_work_sync(&rdev->conn_work);
1182	flush_work(&rdev->event_work);
1183	cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);
1184	cancel_delayed_work_sync(&rdev->background_cac_done_wk);
1185	flush_work(&rdev->destroy_work);
1186	flush_work(&rdev->propagate_radar_detect_wk);
1187	flush_work(&rdev->propagate_cac_done_wk);
1188	flush_work(&rdev->mgmt_registrations_update_wk);
1189	flush_work(&rdev->background_cac_abort_wk);
1190
1191	cfg80211_rdev_free_wowlan(rdev);
1192	cfg80211_free_coalesce(rdev->coalesce);
1193	rdev->coalesce = NULL;
1194}
1195EXPORT_SYMBOL(wiphy_unregister);
1196
1197void cfg80211_dev_free(struct cfg80211_registered_device *rdev)
1198{
1199	struct cfg80211_internal_bss *scan, *tmp;
1200	struct cfg80211_beacon_registration *reg, *treg;
1201	rfkill_destroy(rdev->wiphy.rfkill);
1202	list_for_each_entry_safe(reg, treg, &rdev->beacon_registrations, list) {
1203		list_del(&reg->list);
1204		kfree(reg);
1205	}
1206	list_for_each_entry_safe(scan, tmp, &rdev->bss_list, list)
1207		cfg80211_put_bss(&rdev->wiphy, &scan->pub);
1208	mutex_destroy(&rdev->wiphy.mtx);
1209
1210	/*
1211	 * The 'regd' can only be non-NULL if we never finished
1212	 * initializing the wiphy and thus never went through the
1213	 * unregister path - e.g. in failure scenarios. Thus, it
1214	 * cannot have been visible to anyone if non-NULL, so we
1215	 * can just free it here.
1216	 */
1217	kfree(rcu_dereference_raw(rdev->wiphy.regd));
1218
1219	kfree(rdev);
1220}
1221
1222void wiphy_free(struct wiphy *wiphy)
1223{
1224	put_device(&wiphy->dev);
1225}
1226EXPORT_SYMBOL(wiphy_free);
1227
1228void wiphy_rfkill_set_hw_state_reason(struct wiphy *wiphy, bool blocked,
1229				      enum rfkill_hard_block_reasons reason)
1230{
1231	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1232
1233	if (rfkill_set_hw_state_reason(wiphy->rfkill, blocked, reason))
1234		schedule_work(&rdev->rfkill_block);
1235}
1236EXPORT_SYMBOL(wiphy_rfkill_set_hw_state_reason);
1237
1238static void _cfg80211_unregister_wdev(struct wireless_dev *wdev,
1239				      bool unregister_netdev)
1240{
1241	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
1242	struct cfg80211_cqm_config *cqm_config;
1243	unsigned int link_id;
1244
1245	ASSERT_RTNL();
1246	lockdep_assert_held(&rdev->wiphy.mtx);
1247
1248	nl80211_notify_iface(rdev, wdev, NL80211_CMD_DEL_INTERFACE);
1249
1250	wdev->registered = false;
1251
1252	if (wdev->netdev) {
1253		sysfs_remove_link(&wdev->netdev->dev.kobj, "phy80211");
1254		if (unregister_netdev)
1255			unregister_netdevice(wdev->netdev);
1256	}
1257
1258	list_del_rcu(&wdev->list);
1259	synchronize_net();
1260	rdev->devlist_generation++;
1261
1262	cfg80211_mlme_purge_registrations(wdev);
1263
1264	switch (wdev->iftype) {
1265	case NL80211_IFTYPE_P2P_DEVICE:
1266		cfg80211_stop_p2p_device(rdev, wdev);
1267		break;
1268	case NL80211_IFTYPE_NAN:
1269		cfg80211_stop_nan(rdev, wdev);
1270		break;
1271	default:
1272		break;
1273	}
1274
1275#ifdef CONFIG_CFG80211_WEXT
1276	kfree_sensitive(wdev->wext.keys);
1277	wdev->wext.keys = NULL;
1278#endif
1279	wiphy_work_cancel(wdev->wiphy, &wdev->cqm_rssi_work);
1280	/* deleted from the list, so can't be found from nl80211 any more */
1281	cqm_config = rcu_access_pointer(wdev->cqm_config);
1282	kfree_rcu(cqm_config, rcu_head);
1283	RCU_INIT_POINTER(wdev->cqm_config, NULL);
1284
1285	/*
1286	 * Ensure that all events have been processed and
1287	 * freed.
1288	 */
1289	cfg80211_process_wdev_events(wdev);
1290
1291	if (wdev->iftype == NL80211_IFTYPE_STATION ||
1292	    wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) {
1293		for (link_id = 0; link_id < ARRAY_SIZE(wdev->links); link_id++) {
1294			struct cfg80211_internal_bss *curbss;
1295
1296			curbss = wdev->links[link_id].client.current_bss;
1297
1298			if (WARN_ON(curbss)) {
1299				cfg80211_unhold_bss(curbss);
1300				cfg80211_put_bss(wdev->wiphy, &curbss->pub);
1301				wdev->links[link_id].client.current_bss = NULL;
1302			}
1303		}
1304	}
1305
1306	wdev->connected = false;
1307}
1308
1309void cfg80211_unregister_wdev(struct wireless_dev *wdev)
1310{
1311	_cfg80211_unregister_wdev(wdev, true);
1312}
1313EXPORT_SYMBOL(cfg80211_unregister_wdev);
1314
1315static const struct device_type wiphy_type = {
1316	.name	= "wlan",
1317};
1318
1319void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev,
1320			       enum nl80211_iftype iftype, int num)
1321{
1322	lockdep_assert_held(&rdev->wiphy.mtx);
1323
1324	rdev->num_running_ifaces += num;
1325	if (iftype == NL80211_IFTYPE_MONITOR)
1326		rdev->num_running_monitor_ifaces += num;
1327}
1328
1329void cfg80211_leave(struct cfg80211_registered_device *rdev,
1330		    struct wireless_dev *wdev)
1331{
1332	struct net_device *dev = wdev->netdev;
1333	struct cfg80211_sched_scan_request *pos, *tmp;
1334
1335	lockdep_assert_held(&rdev->wiphy.mtx);
1336
1337	cfg80211_pmsr_wdev_down(wdev);
1338
1339	cfg80211_stop_background_radar_detection(wdev);
1340
1341	switch (wdev->iftype) {
1342	case NL80211_IFTYPE_ADHOC:
1343		cfg80211_leave_ibss(rdev, dev, true);
1344		break;
1345	case NL80211_IFTYPE_P2P_CLIENT:
1346	case NL80211_IFTYPE_STATION:
1347		list_for_each_entry_safe(pos, tmp, &rdev->sched_scan_req_list,
1348					 list) {
1349			if (dev == pos->dev)
1350				cfg80211_stop_sched_scan_req(rdev, pos, false);
1351		}
1352
1353#ifdef CONFIG_CFG80211_WEXT
1354		kfree(wdev->wext.ie);
1355		wdev->wext.ie = NULL;
1356		wdev->wext.ie_len = 0;
1357		wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
1358#endif
1359		cfg80211_disconnect(rdev, dev,
1360				    WLAN_REASON_DEAUTH_LEAVING, true);
1361		break;
1362	case NL80211_IFTYPE_MESH_POINT:
1363		cfg80211_leave_mesh(rdev, dev);
1364		break;
1365	case NL80211_IFTYPE_AP:
1366	case NL80211_IFTYPE_P2P_GO:
1367		cfg80211_stop_ap(rdev, dev, -1, true);
1368		break;
1369	case NL80211_IFTYPE_OCB:
1370		cfg80211_leave_ocb(rdev, dev);
1371		break;
1372	case NL80211_IFTYPE_P2P_DEVICE:
1373	case NL80211_IFTYPE_NAN:
1374		/* cannot happen, has no netdev */
1375		break;
1376	case NL80211_IFTYPE_AP_VLAN:
1377	case NL80211_IFTYPE_MONITOR:
1378		/* nothing to do */
1379		break;
1380	case NL80211_IFTYPE_UNSPECIFIED:
1381	case NL80211_IFTYPE_WDS:
1382	case NUM_NL80211_IFTYPES:
1383		/* invalid */
1384		break;
1385	}
1386}
1387
1388void cfg80211_stop_iface(struct wiphy *wiphy, struct wireless_dev *wdev,
1389			 gfp_t gfp)
1390{
1391	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1392	struct cfg80211_event *ev;
1393	unsigned long flags;
1394
1395	trace_cfg80211_stop_iface(wiphy, wdev);
1396
1397	ev = kzalloc(sizeof(*ev), gfp);
1398	if (!ev)
1399		return;
1400
1401	ev->type = EVENT_STOPPED;
1402
1403	spin_lock_irqsave(&wdev->event_lock, flags);
1404	list_add_tail(&ev->list, &wdev->event_list);
1405	spin_unlock_irqrestore(&wdev->event_lock, flags);
1406	queue_work(cfg80211_wq, &rdev->event_work);
1407}
1408EXPORT_SYMBOL(cfg80211_stop_iface);
1409
1410void cfg80211_init_wdev(struct wireless_dev *wdev)
1411{
1412	INIT_LIST_HEAD(&wdev->event_list);
1413	spin_lock_init(&wdev->event_lock);
1414	INIT_LIST_HEAD(&wdev->mgmt_registrations);
1415	INIT_LIST_HEAD(&wdev->pmsr_list);
1416	spin_lock_init(&wdev->pmsr_lock);
1417	INIT_WORK(&wdev->pmsr_free_wk, cfg80211_pmsr_free_wk);
1418
1419#ifdef CONFIG_CFG80211_WEXT
1420	wdev->wext.default_key = -1;
1421	wdev->wext.default_mgmt_key = -1;
1422	wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
1423#endif
1424
1425	wiphy_work_init(&wdev->cqm_rssi_work, cfg80211_cqm_rssi_notify_work);
1426
1427	if (wdev->wiphy->flags & WIPHY_FLAG_PS_ON_BY_DEFAULT)
1428		wdev->ps = true;
1429	else
1430		wdev->ps = false;
1431	/* allow mac80211 to determine the timeout */
1432	wdev->ps_timeout = -1;
1433
1434	wdev->radio_mask = BIT(wdev->wiphy->n_radio) - 1;
1435
1436	if ((wdev->iftype == NL80211_IFTYPE_STATION ||
1437	     wdev->iftype == NL80211_IFTYPE_P2P_CLIENT ||
1438	     wdev->iftype == NL80211_IFTYPE_ADHOC) && !wdev->use_4addr)
1439		wdev->netdev->priv_flags |= IFF_DONT_BRIDGE;
1440
1441	INIT_WORK(&wdev->disconnect_wk, cfg80211_autodisconnect_wk);
1442}
1443
1444void cfg80211_register_wdev(struct cfg80211_registered_device *rdev,
1445			    struct wireless_dev *wdev)
1446{
1447	ASSERT_RTNL();
1448	lockdep_assert_held(&rdev->wiphy.mtx);
1449
1450	/*
1451	 * We get here also when the interface changes network namespaces,
1452	 * as it's registered into the new one, but we don't want it to
1453	 * change ID in that case. Checking if the ID is already assigned
1454	 * works, because 0 isn't considered a valid ID and the memory is
1455	 * 0-initialized.
1456	 */
1457	if (!wdev->identifier)
1458		wdev->identifier = ++rdev->wdev_id;
1459	list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
1460	rdev->devlist_generation++;
1461	wdev->registered = true;
1462
1463	if (wdev->netdev &&
1464	    sysfs_create_link(&wdev->netdev->dev.kobj, &rdev->wiphy.dev.kobj,
1465			      "phy80211"))
1466		pr_err("failed to add phy80211 symlink to netdev!\n");
1467
1468	nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);
1469}
1470
1471int cfg80211_register_netdevice(struct net_device *dev)
1472{
1473	struct wireless_dev *wdev = dev->ieee80211_ptr;
1474	struct cfg80211_registered_device *rdev;
1475	int ret;
1476
1477	ASSERT_RTNL();
1478
1479	if (WARN_ON(!wdev))
1480		return -EINVAL;
1481
1482	rdev = wiphy_to_rdev(wdev->wiphy);
1483
1484	lockdep_assert_held(&rdev->wiphy.mtx);
1485
1486	/* we'll take care of this */
1487	wdev->registered = true;
1488	wdev->registering = true;
1489	ret = register_netdevice(dev);
1490	if (ret)
1491		goto out;
1492
1493	cfg80211_register_wdev(rdev, wdev);
1494	ret = 0;
1495out:
1496	wdev->registering = false;
1497	if (ret)
1498		wdev->registered = false;
1499	return ret;
1500}
1501EXPORT_SYMBOL(cfg80211_register_netdevice);
1502
1503static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
1504					 unsigned long state, void *ptr)
1505{
1506	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1507	struct wireless_dev *wdev = dev->ieee80211_ptr;
1508	struct cfg80211_registered_device *rdev;
1509	struct cfg80211_sched_scan_request *pos, *tmp;
1510
1511	if (!wdev)
1512		return NOTIFY_DONE;
1513
1514	rdev = wiphy_to_rdev(wdev->wiphy);
1515
1516	WARN_ON(wdev->iftype == NL80211_IFTYPE_UNSPECIFIED);
1517
1518	switch (state) {
1519	case NETDEV_POST_INIT:
1520		SET_NETDEV_DEVTYPE(dev, &wiphy_type);
1521		wdev->netdev = dev;
1522		/* can only change netns with wiphy */
1523		dev->netns_local = true;
1524
1525		cfg80211_init_wdev(wdev);
1526		break;
1527	case NETDEV_REGISTER:
1528		if (!wdev->registered) {
1529			wiphy_lock(&rdev->wiphy);
1530			cfg80211_register_wdev(rdev, wdev);
1531			wiphy_unlock(&rdev->wiphy);
1532		}
1533		break;
1534	case NETDEV_UNREGISTER:
1535		/*
1536		 * It is possible to get NETDEV_UNREGISTER multiple times,
1537		 * so check wdev->registered.
1538		 */
1539		if (wdev->registered && !wdev->registering) {
1540			wiphy_lock(&rdev->wiphy);
1541			_cfg80211_unregister_wdev(wdev, false);
1542			wiphy_unlock(&rdev->wiphy);
1543		}
1544		break;
1545	case NETDEV_GOING_DOWN:
1546		wiphy_lock(&rdev->wiphy);
1547		cfg80211_leave(rdev, wdev);
1548		cfg80211_remove_links(wdev);
1549		wiphy_unlock(&rdev->wiphy);
1550		/* since we just did cfg80211_leave() nothing to do there */
1551		cancel_work_sync(&wdev->disconnect_wk);
1552		cancel_work_sync(&wdev->pmsr_free_wk);
1553		break;
1554	case NETDEV_DOWN:
1555		wiphy_lock(&rdev->wiphy);
1556		cfg80211_update_iface_num(rdev, wdev->iftype, -1);
1557		if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
1558			if (WARN_ON(!rdev->scan_req->notified &&
1559				    (!rdev->int_scan_req ||
1560				     !rdev->int_scan_req->notified)))
1561				rdev->scan_req->info.aborted = true;
1562			___cfg80211_scan_done(rdev, false);
1563		}
1564
1565		list_for_each_entry_safe(pos, tmp,
1566					 &rdev->sched_scan_req_list, list) {
1567			if (WARN_ON(pos->dev == wdev->netdev))
1568				cfg80211_stop_sched_scan_req(rdev, pos, false);
1569		}
1570
1571		rdev->opencount--;
1572		wiphy_unlock(&rdev->wiphy);
1573		wake_up(&rdev->dev_wait);
1574		break;
1575	case NETDEV_UP:
1576		wiphy_lock(&rdev->wiphy);
1577		cfg80211_update_iface_num(rdev, wdev->iftype, 1);
1578		switch (wdev->iftype) {
1579#ifdef CONFIG_CFG80211_WEXT
1580		case NL80211_IFTYPE_ADHOC:
1581			cfg80211_ibss_wext_join(rdev, wdev);
1582			break;
1583		case NL80211_IFTYPE_STATION:
1584			cfg80211_mgd_wext_connect(rdev, wdev);
1585			break;
1586#endif
1587#ifdef CONFIG_MAC80211_MESH
1588		case NL80211_IFTYPE_MESH_POINT:
1589			{
1590				/* backward compat code... */
1591				struct mesh_setup setup;
1592				memcpy(&setup, &default_mesh_setup,
1593						sizeof(setup));
1594				 /* back compat only needed for mesh_id */
1595				setup.mesh_id = wdev->u.mesh.id;
1596				setup.mesh_id_len = wdev->u.mesh.id_up_len;
1597				if (wdev->u.mesh.id_up_len)
1598					__cfg80211_join_mesh(rdev, dev,
1599							&setup,
1600							&default_mesh_config);
1601				break;
1602			}
1603#endif
1604		default:
1605			break;
1606		}
1607		rdev->opencount++;
1608
1609		/*
1610		 * Configure power management to the driver here so that its
1611		 * correctly set also after interface type changes etc.
1612		 */
1613		if ((wdev->iftype == NL80211_IFTYPE_STATION ||
1614		     wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
1615		    rdev->ops->set_power_mgmt &&
1616		    rdev_set_power_mgmt(rdev, dev, wdev->ps,
1617					wdev->ps_timeout)) {
1618			/* assume this means it's off */
1619			wdev->ps = false;
1620		}
1621		wiphy_unlock(&rdev->wiphy);
1622		break;
1623	case NETDEV_PRE_UP:
1624		if (!cfg80211_iftype_allowed(wdev->wiphy, wdev->iftype,
1625					     wdev->use_4addr, 0))
1626			return notifier_from_errno(-EOPNOTSUPP);
1627
1628		if (rfkill_blocked(rdev->wiphy.rfkill))
1629			return notifier_from_errno(-ERFKILL);
1630		break;
1631	default:
1632		return NOTIFY_DONE;
1633	}
1634
1635	wireless_nlevent_flush();
1636
1637	return NOTIFY_OK;
1638}
1639
1640static struct notifier_block cfg80211_netdev_notifier = {
1641	.notifier_call = cfg80211_netdev_notifier_call,
1642};
1643
1644static void __net_exit cfg80211_pernet_exit(struct net *net)
1645{
1646	struct cfg80211_registered_device *rdev;
1647
1648	rtnl_lock();
1649	for_each_rdev(rdev) {
1650		if (net_eq(wiphy_net(&rdev->wiphy), net))
1651			WARN_ON(cfg80211_switch_netns(rdev, &init_net));
1652	}
1653	rtnl_unlock();
1654}
1655
1656static struct pernet_operations cfg80211_pernet_ops = {
1657	.exit = cfg80211_pernet_exit,
1658};
1659
1660void wiphy_work_queue(struct wiphy *wiphy, struct wiphy_work *work)
1661{
1662	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1663	unsigned long flags;
1664
1665	trace_wiphy_work_queue(wiphy, work);
1666
1667	spin_lock_irqsave(&rdev->wiphy_work_lock, flags);
1668	if (list_empty(&work->entry))
1669		list_add_tail(&work->entry, &rdev->wiphy_work_list);
1670	spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags);
1671
1672	queue_work(system_unbound_wq, &rdev->wiphy_work);
1673}
1674EXPORT_SYMBOL_GPL(wiphy_work_queue);
1675
1676void wiphy_work_cancel(struct wiphy *wiphy, struct wiphy_work *work)
1677{
1678	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1679	unsigned long flags;
1680
1681	lockdep_assert_held(&wiphy->mtx);
1682
1683	trace_wiphy_work_cancel(wiphy, work);
1684
1685	spin_lock_irqsave(&rdev->wiphy_work_lock, flags);
1686	if (!list_empty(&work->entry))
1687		list_del_init(&work->entry);
1688	spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags);
1689}
1690EXPORT_SYMBOL_GPL(wiphy_work_cancel);
1691
1692void wiphy_work_flush(struct wiphy *wiphy, struct wiphy_work *work)
1693{
1694	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
1695	unsigned long flags;
1696	bool run;
1697
1698	trace_wiphy_work_flush(wiphy, work);
1699
1700	spin_lock_irqsave(&rdev->wiphy_work_lock, flags);
1701	run = !work || !list_empty(&work->entry);
1702	spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags);
1703
1704	if (run)
1705		cfg80211_process_wiphy_works(rdev, work);
1706}
1707EXPORT_SYMBOL_GPL(wiphy_work_flush);
1708
1709void wiphy_delayed_work_timer(struct timer_list *t)
1710{
1711	struct wiphy_delayed_work *dwork = from_timer(dwork, t, timer);
1712
1713	wiphy_work_queue(dwork->wiphy, &dwork->work);
1714}
1715EXPORT_SYMBOL(wiphy_delayed_work_timer);
1716
1717void wiphy_delayed_work_queue(struct wiphy *wiphy,
1718			      struct wiphy_delayed_work *dwork,
1719			      unsigned long delay)
1720{
1721	trace_wiphy_delayed_work_queue(wiphy, &dwork->work, delay);
1722
1723	if (!delay) {
1724		del_timer(&dwork->timer);
1725		wiphy_work_queue(wiphy, &dwork->work);
1726		return;
1727	}
1728
1729	dwork->wiphy = wiphy;
1730	mod_timer(&dwork->timer, jiffies + delay);
1731}
1732EXPORT_SYMBOL_GPL(wiphy_delayed_work_queue);
1733
1734void wiphy_delayed_work_cancel(struct wiphy *wiphy,
1735			       struct wiphy_delayed_work *dwork)
1736{
1737	lockdep_assert_held(&wiphy->mtx);
1738
1739	del_timer_sync(&dwork->timer);
1740	wiphy_work_cancel(wiphy, &dwork->work);
1741}
1742EXPORT_SYMBOL_GPL(wiphy_delayed_work_cancel);
1743
1744void wiphy_delayed_work_flush(struct wiphy *wiphy,
1745			      struct wiphy_delayed_work *dwork)
1746{
1747	lockdep_assert_held(&wiphy->mtx);
1748
1749	del_timer_sync(&dwork->timer);
1750	wiphy_work_flush(wiphy, &dwork->work);
1751}
1752EXPORT_SYMBOL_GPL(wiphy_delayed_work_flush);
1753
1754bool wiphy_delayed_work_pending(struct wiphy *wiphy,
1755				struct wiphy_delayed_work *dwork)
1756{
1757	return timer_pending(&dwork->timer);
1758}
1759EXPORT_SYMBOL_GPL(wiphy_delayed_work_pending);
1760
1761static int __init cfg80211_init(void)
1762{
1763	int err;
1764
1765	err = register_pernet_device(&cfg80211_pernet_ops);
1766	if (err)
1767		goto out_fail_pernet;
1768
1769	err = wiphy_sysfs_init();
1770	if (err)
1771		goto out_fail_sysfs;
1772
1773	err = register_netdevice_notifier(&cfg80211_netdev_notifier);
1774	if (err)
1775		goto out_fail_notifier;
1776
1777	err = nl80211_init();
1778	if (err)
1779		goto out_fail_nl80211;
1780
1781	ieee80211_debugfs_dir = debugfs_create_dir("ieee80211", NULL);
1782
1783	err = regulatory_init();
1784	if (err)
1785		goto out_fail_reg;
1786
1787	cfg80211_wq = alloc_ordered_workqueue("cfg80211", WQ_MEM_RECLAIM);
1788	if (!cfg80211_wq) {
1789		err = -ENOMEM;
1790		goto out_fail_wq;
1791	}
1792
1793	return 0;
1794
1795out_fail_wq:
1796	regulatory_exit();
1797out_fail_reg:
1798	debugfs_remove(ieee80211_debugfs_dir);
1799	nl80211_exit();
1800out_fail_nl80211:
1801	unregister_netdevice_notifier(&cfg80211_netdev_notifier);
1802out_fail_notifier:
1803	wiphy_sysfs_exit();
1804out_fail_sysfs:
1805	unregister_pernet_device(&cfg80211_pernet_ops);
1806out_fail_pernet:
1807	return err;
1808}
1809fs_initcall(cfg80211_init);
1810
1811static void __exit cfg80211_exit(void)
1812{
1813	debugfs_remove(ieee80211_debugfs_dir);
1814	nl80211_exit();
1815	unregister_netdevice_notifier(&cfg80211_netdev_notifier);
1816	wiphy_sysfs_exit();
1817	regulatory_exit();
1818	unregister_pernet_device(&cfg80211_pernet_ops);
1819	destroy_workqueue(cfg80211_wq);
1820}
1821module_exit(cfg80211_exit);