1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * Wireless utility functions
   4 *
   5 * Copyright 2007-2009	Johannes Berg <johannes@sipsolutions.net>
   6 * Copyright 2013-2014  Intel Mobile Communications GmbH
   7 * Copyright 2017	Intel Deutschland GmbH
   8 * Copyright (C) 2018-2023 Intel Corporation
   9 */
  10#include <linux/export.h>
  11#include <linux/bitops.h>
  12#include <linux/etherdevice.h>
  13#include <linux/slab.h>
  14#include <linux/ieee80211.h>
  15#include <net/cfg80211.h>
  16#include <net/ip.h>
  17#include <net/dsfield.h>
  18#include <linux/if_vlan.h>
  19#include <linux/mpls.h>
  20#include <linux/gcd.h>
  21#include <linux/bitfield.h>
  22#include <linux/nospec.h>
  23#include "core.h"
  24#include "rdev-ops.h"
  25
  26
  27const struct ieee80211_rate *
  28ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
  29			    u32 basic_rates, int bitrate)
  30{
  31	struct ieee80211_rate *result = &sband->bitrates[0];
  32	int i;
  33
  34	for (i = 0; i < sband->n_bitrates; i++) {
  35		if (!(basic_rates & BIT(i)))
  36			continue;
  37		if (sband->bitrates[i].bitrate > bitrate)
  38			continue;
  39		result = &sband->bitrates[i];
  40	}
  41
  42	return result;
  43}
  44EXPORT_SYMBOL(ieee80211_get_response_rate);
  45
  46u32 ieee80211_mandatory_rates(struct ieee80211_supported_band *sband)
 
  47{
  48	struct ieee80211_rate *bitrates;
  49	u32 mandatory_rates = 0;
  50	enum ieee80211_rate_flags mandatory_flag;
  51	int i;
  52
  53	if (WARN_ON(!sband))
  54		return 1;
  55
  56	if (sband->band == NL80211_BAND_2GHZ)
  57		mandatory_flag = IEEE80211_RATE_MANDATORY_B;
  58	else
 
 
 
 
  59		mandatory_flag = IEEE80211_RATE_MANDATORY_A;
 
  60
  61	bitrates = sband->bitrates;
  62	for (i = 0; i < sband->n_bitrates; i++)
  63		if (bitrates[i].flags & mandatory_flag)
  64			mandatory_rates |= BIT(i);
  65	return mandatory_rates;
  66}
  67EXPORT_SYMBOL(ieee80211_mandatory_rates);
  68
  69u32 ieee80211_channel_to_freq_khz(int chan, enum nl80211_band band)
  70{
  71	/* see 802.11 17.3.8.3.2 and Annex J
  72	 * there are overlapping channel numbers in 5GHz and 2GHz bands */
  73	if (chan <= 0)
  74		return 0; /* not supported */
  75	switch (band) {
  76	case NL80211_BAND_2GHZ:
  77	case NL80211_BAND_LC:
  78		if (chan == 14)
  79			return MHZ_TO_KHZ(2484);
  80		else if (chan < 14)
  81			return MHZ_TO_KHZ(2407 + chan * 5);
  82		break;
  83	case NL80211_BAND_5GHZ:
  84		if (chan >= 182 && chan <= 196)
  85			return MHZ_TO_KHZ(4000 + chan * 5);
  86		else
  87			return MHZ_TO_KHZ(5000 + chan * 5);
  88		break;
  89	case NL80211_BAND_6GHZ:
  90		/* see 802.11ax D6.1 27.3.23.2 */
  91		if (chan == 2)
  92			return MHZ_TO_KHZ(5935);
  93		if (chan <= 233)
  94			return MHZ_TO_KHZ(5950 + chan * 5);
  95		break;
  96	case NL80211_BAND_60GHZ:
  97		if (chan < 7)
  98			return MHZ_TO_KHZ(56160 + chan * 2160);
  99		break;
 100	case NL80211_BAND_S1GHZ:
 101		return 902000 + chan * 500;
 102	default:
 103		;
 104	}
 105	return 0; /* not supported */
 106}
 107EXPORT_SYMBOL(ieee80211_channel_to_freq_khz);
 108
 109enum nl80211_chan_width
 110ieee80211_s1g_channel_width(const struct ieee80211_channel *chan)
 111{
 112	if (WARN_ON(!chan || chan->band != NL80211_BAND_S1GHZ))
 113		return NL80211_CHAN_WIDTH_20_NOHT;
 114
 115	/*S1G defines a single allowed channel width per channel.
 116	 * Extract that width here.
 117	 */
 118	if (chan->flags & IEEE80211_CHAN_1MHZ)
 119		return NL80211_CHAN_WIDTH_1;
 120	else if (chan->flags & IEEE80211_CHAN_2MHZ)
 121		return NL80211_CHAN_WIDTH_2;
 122	else if (chan->flags & IEEE80211_CHAN_4MHZ)
 123		return NL80211_CHAN_WIDTH_4;
 124	else if (chan->flags & IEEE80211_CHAN_8MHZ)
 125		return NL80211_CHAN_WIDTH_8;
 126	else if (chan->flags & IEEE80211_CHAN_16MHZ)
 127		return NL80211_CHAN_WIDTH_16;
 128
 129	pr_err("unknown channel width for channel at %dKHz?\n",
 130	       ieee80211_channel_to_khz(chan));
 131
 132	return NL80211_CHAN_WIDTH_1;
 133}
 134EXPORT_SYMBOL(ieee80211_s1g_channel_width);
 135
 136int ieee80211_freq_khz_to_channel(u32 freq)
 137{
 138	/* TODO: just handle MHz for now */
 139	freq = KHZ_TO_MHZ(freq);
 140
 141	/* see 802.11 17.3.8.3.2 and Annex J */
 142	if (freq == 2484)
 143		return 14;
 144	else if (freq < 2484)
 145		return (freq - 2407) / 5;
 146	else if (freq >= 4910 && freq <= 4980)
 147		return (freq - 4000) / 5;
 148	else if (freq < 5925)
 149		return (freq - 5000) / 5;
 150	else if (freq == 5935)
 151		return 2;
 152	else if (freq <= 45000) /* DMG band lower limit */
 153		/* see 802.11ax D6.1 27.3.22.2 */
 154		return (freq - 5950) / 5;
 155	else if (freq >= 58320 && freq <= 70200)
 156		return (freq - 56160) / 2160;
 157	else
 158		return 0;
 159}
 160EXPORT_SYMBOL(ieee80211_freq_khz_to_channel);
 161
 162struct ieee80211_channel *ieee80211_get_channel_khz(struct wiphy *wiphy,
 163						    u32 freq)
 164{
 165	enum nl80211_band band;
 166	struct ieee80211_supported_band *sband;
 167	int i;
 168
 169	for (band = 0; band < NUM_NL80211_BANDS; band++) {
 170		sband = wiphy->bands[band];
 171
 172		if (!sband)
 173			continue;
 174
 175		for (i = 0; i < sband->n_channels; i++) {
 176			struct ieee80211_channel *chan = &sband->channels[i];
 177
 178			if (ieee80211_channel_to_khz(chan) == freq)
 179				return chan;
 180		}
 181	}
 182
 183	return NULL;
 184}
 185EXPORT_SYMBOL(ieee80211_get_channel_khz);
 186
 187static void set_mandatory_flags_band(struct ieee80211_supported_band *sband)
 188{
 189	int i, want;
 190
 191	switch (sband->band) {
 192	case NL80211_BAND_5GHZ:
 193	case NL80211_BAND_6GHZ:
 194		want = 3;
 195		for (i = 0; i < sband->n_bitrates; i++) {
 196			if (sband->bitrates[i].bitrate == 60 ||
 197			    sband->bitrates[i].bitrate == 120 ||
 198			    sband->bitrates[i].bitrate == 240) {
 199				sband->bitrates[i].flags |=
 200					IEEE80211_RATE_MANDATORY_A;
 201				want--;
 202			}
 203		}
 204		WARN_ON(want);
 205		break;
 206	case NL80211_BAND_2GHZ:
 207	case NL80211_BAND_LC:
 208		want = 7;
 209		for (i = 0; i < sband->n_bitrates; i++) {
 210			switch (sband->bitrates[i].bitrate) {
 211			case 10:
 212			case 20:
 213			case 55:
 214			case 110:
 215				sband->bitrates[i].flags |=
 216					IEEE80211_RATE_MANDATORY_B |
 217					IEEE80211_RATE_MANDATORY_G;
 218				want--;
 219				break;
 220			case 60:
 221			case 120:
 222			case 240:
 223				sband->bitrates[i].flags |=
 224					IEEE80211_RATE_MANDATORY_G;
 225				want--;
 226				fallthrough;
 227			default:
 228				sband->bitrates[i].flags |=
 229					IEEE80211_RATE_ERP_G;
 230				break;
 231			}
 232		}
 233		WARN_ON(want != 0 && want != 3);
 234		break;
 235	case NL80211_BAND_60GHZ:
 236		/* check for mandatory HT MCS 1..4 */
 237		WARN_ON(!sband->ht_cap.ht_supported);
 238		WARN_ON((sband->ht_cap.mcs.rx_mask[0] & 0x1e) != 0x1e);
 239		break;
 240	case NL80211_BAND_S1GHZ:
 241		/* Figure 9-589bd: 3 means unsupported, so != 3 means at least
 242		 * mandatory is ok.
 243		 */
 244		WARN_ON((sband->s1g_cap.nss_mcs[0] & 0x3) == 0x3);
 245		break;
 246	case NUM_NL80211_BANDS:
 247	default:
 248		WARN_ON(1);
 249		break;
 250	}
 251}
 252
 253void ieee80211_set_bitrate_flags(struct wiphy *wiphy)
 254{
 255	enum nl80211_band band;
 256
 257	for (band = 0; band < NUM_NL80211_BANDS; band++)
 258		if (wiphy->bands[band])
 259			set_mandatory_flags_band(wiphy->bands[band]);
 260}
 261
 262bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher)
 263{
 264	int i;
 265	for (i = 0; i < wiphy->n_cipher_suites; i++)
 266		if (cipher == wiphy->cipher_suites[i])
 267			return true;
 268	return false;
 269}
 270
 271static bool
 272cfg80211_igtk_cipher_supported(struct cfg80211_registered_device *rdev)
 273{
 274	struct wiphy *wiphy = &rdev->wiphy;
 275	int i;
 276
 277	for (i = 0; i < wiphy->n_cipher_suites; i++) {
 278		switch (wiphy->cipher_suites[i]) {
 279		case WLAN_CIPHER_SUITE_AES_CMAC:
 280		case WLAN_CIPHER_SUITE_BIP_CMAC_256:
 281		case WLAN_CIPHER_SUITE_BIP_GMAC_128:
 282		case WLAN_CIPHER_SUITE_BIP_GMAC_256:
 283			return true;
 284		}
 285	}
 286
 287	return false;
 288}
 289
 290bool cfg80211_valid_key_idx(struct cfg80211_registered_device *rdev,
 291			    int key_idx, bool pairwise)
 292{
 293	int max_key_idx;
 294
 295	if (pairwise)
 296		max_key_idx = 3;
 297	else if (wiphy_ext_feature_isset(&rdev->wiphy,
 298					 NL80211_EXT_FEATURE_BEACON_PROTECTION) ||
 299		 wiphy_ext_feature_isset(&rdev->wiphy,
 300					 NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
 301		max_key_idx = 7;
 302	else if (cfg80211_igtk_cipher_supported(rdev))
 303		max_key_idx = 5;
 304	else
 305		max_key_idx = 3;
 306
 307	if (key_idx < 0 || key_idx > max_key_idx)
 308		return false;
 309
 310	return true;
 311}
 312
 313int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
 314				   struct key_params *params, int key_idx,
 315				   bool pairwise, const u8 *mac_addr)
 316{
 317	if (!cfg80211_valid_key_idx(rdev, key_idx, pairwise))
 318		return -EINVAL;
 319
 320	if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
 321		return -EINVAL;
 322
 323	if (pairwise && !mac_addr)
 324		return -EINVAL;
 325
 326	switch (params->cipher) {
 327	case WLAN_CIPHER_SUITE_TKIP:
 328		/* Extended Key ID can only be used with CCMP/GCMP ciphers */
 329		if ((pairwise && key_idx) ||
 330		    params->mode != NL80211_KEY_RX_TX)
 331			return -EINVAL;
 332		break;
 333	case WLAN_CIPHER_SUITE_CCMP:
 334	case WLAN_CIPHER_SUITE_CCMP_256:
 335	case WLAN_CIPHER_SUITE_GCMP:
 336	case WLAN_CIPHER_SUITE_GCMP_256:
 337		/* IEEE802.11-2016 allows only 0 and - when supporting
 338		 * Extended Key ID - 1 as index for pairwise keys.
 339		 * @NL80211_KEY_NO_TX is only allowed for pairwise keys when
 340		 * the driver supports Extended Key ID.
 341		 * @NL80211_KEY_SET_TX can't be set when installing and
 342		 * validating a key.
 343		 */
 344		if ((params->mode == NL80211_KEY_NO_TX && !pairwise) ||
 345		    params->mode == NL80211_KEY_SET_TX)
 346			return -EINVAL;
 347		if (wiphy_ext_feature_isset(&rdev->wiphy,
 348					    NL80211_EXT_FEATURE_EXT_KEY_ID)) {
 349			if (pairwise && (key_idx < 0 || key_idx > 1))
 350				return -EINVAL;
 351		} else if (pairwise && key_idx) {
 352			return -EINVAL;
 353		}
 354		break;
 355	case WLAN_CIPHER_SUITE_AES_CMAC:
 356	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
 357	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
 358	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
 359		/* Disallow BIP (group-only) cipher as pairwise cipher */
 360		if (pairwise)
 361			return -EINVAL;
 362		if (key_idx < 4)
 363			return -EINVAL;
 364		break;
 365	case WLAN_CIPHER_SUITE_WEP40:
 366	case WLAN_CIPHER_SUITE_WEP104:
 367		if (key_idx > 3)
 368			return -EINVAL;
 369		break;
 370	default:
 371		break;
 372	}
 373
 374	switch (params->cipher) {
 375	case WLAN_CIPHER_SUITE_WEP40:
 376		if (params->key_len != WLAN_KEY_LEN_WEP40)
 377			return -EINVAL;
 378		break;
 379	case WLAN_CIPHER_SUITE_TKIP:
 380		if (params->key_len != WLAN_KEY_LEN_TKIP)
 381			return -EINVAL;
 382		break;
 383	case WLAN_CIPHER_SUITE_CCMP:
 384		if (params->key_len != WLAN_KEY_LEN_CCMP)
 385			return -EINVAL;
 386		break;
 387	case WLAN_CIPHER_SUITE_CCMP_256:
 388		if (params->key_len != WLAN_KEY_LEN_CCMP_256)
 389			return -EINVAL;
 390		break;
 391	case WLAN_CIPHER_SUITE_GCMP:
 392		if (params->key_len != WLAN_KEY_LEN_GCMP)
 393			return -EINVAL;
 394		break;
 395	case WLAN_CIPHER_SUITE_GCMP_256:
 396		if (params->key_len != WLAN_KEY_LEN_GCMP_256)
 397			return -EINVAL;
 398		break;
 399	case WLAN_CIPHER_SUITE_WEP104:
 400		if (params->key_len != WLAN_KEY_LEN_WEP104)
 401			return -EINVAL;
 402		break;
 403	case WLAN_CIPHER_SUITE_AES_CMAC:
 404		if (params->key_len != WLAN_KEY_LEN_AES_CMAC)
 405			return -EINVAL;
 406		break;
 407	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
 408		if (params->key_len != WLAN_KEY_LEN_BIP_CMAC_256)
 409			return -EINVAL;
 410		break;
 411	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
 412		if (params->key_len != WLAN_KEY_LEN_BIP_GMAC_128)
 413			return -EINVAL;
 414		break;
 415	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
 416		if (params->key_len != WLAN_KEY_LEN_BIP_GMAC_256)
 417			return -EINVAL;
 418		break;
 419	default:
 420		/*
 421		 * We don't know anything about this algorithm,
 422		 * allow using it -- but the driver must check
 423		 * all parameters! We still check below whether
 424		 * or not the driver supports this algorithm,
 425		 * of course.
 426		 */
 427		break;
 428	}
 429
 430	if (params->seq) {
 431		switch (params->cipher) {
 432		case WLAN_CIPHER_SUITE_WEP40:
 433		case WLAN_CIPHER_SUITE_WEP104:
 434			/* These ciphers do not use key sequence */
 435			return -EINVAL;
 436		case WLAN_CIPHER_SUITE_TKIP:
 437		case WLAN_CIPHER_SUITE_CCMP:
 438		case WLAN_CIPHER_SUITE_CCMP_256:
 439		case WLAN_CIPHER_SUITE_GCMP:
 440		case WLAN_CIPHER_SUITE_GCMP_256:
 441		case WLAN_CIPHER_SUITE_AES_CMAC:
 442		case WLAN_CIPHER_SUITE_BIP_CMAC_256:
 443		case WLAN_CIPHER_SUITE_BIP_GMAC_128:
 444		case WLAN_CIPHER_SUITE_BIP_GMAC_256:
 445			if (params->seq_len != 6)
 446				return -EINVAL;
 447			break;
 448		}
 449	}
 450
 451	if (!cfg80211_supported_cipher_suite(&rdev->wiphy, params->cipher))
 452		return -EINVAL;
 453
 454	return 0;
 455}
 456
 457unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc)
 458{
 459	unsigned int hdrlen = 24;
 460
 461	if (ieee80211_is_ext(fc)) {
 462		hdrlen = 4;
 463		goto out;
 464	}
 465
 466	if (ieee80211_is_data(fc)) {
 467		if (ieee80211_has_a4(fc))
 468			hdrlen = 30;
 469		if (ieee80211_is_data_qos(fc)) {
 470			hdrlen += IEEE80211_QOS_CTL_LEN;
 471			if (ieee80211_has_order(fc))
 472				hdrlen += IEEE80211_HT_CTL_LEN;
 473		}
 474		goto out;
 475	}
 476
 477	if (ieee80211_is_mgmt(fc)) {
 478		if (ieee80211_has_order(fc))
 479			hdrlen += IEEE80211_HT_CTL_LEN;
 480		goto out;
 481	}
 482
 483	if (ieee80211_is_ctl(fc)) {
 484		/*
 485		 * ACK and CTS are 10 bytes, all others 16. To see how
 486		 * to get this condition consider
 487		 *   subtype mask:   0b0000000011110000 (0x00F0)
 488		 *   ACK subtype:    0b0000000011010000 (0x00D0)
 489		 *   CTS subtype:    0b0000000011000000 (0x00C0)
 490		 *   bits that matter:         ^^^      (0x00E0)
 491		 *   value of those: 0b0000000011000000 (0x00C0)
 492		 */
 493		if ((fc & cpu_to_le16(0x00E0)) == cpu_to_le16(0x00C0))
 494			hdrlen = 10;
 495		else
 496			hdrlen = 16;
 497	}
 498out:
 499	return hdrlen;
 500}
 501EXPORT_SYMBOL(ieee80211_hdrlen);
 502
 503unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb)
 504{
 505	const struct ieee80211_hdr *hdr =
 506			(const struct ieee80211_hdr *)skb->data;
 507	unsigned int hdrlen;
 508
 509	if (unlikely(skb->len < 10))
 510		return 0;
 511	hdrlen = ieee80211_hdrlen(hdr->frame_control);
 512	if (unlikely(hdrlen > skb->len))
 513		return 0;
 514	return hdrlen;
 515}
 516EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
 517
 518static unsigned int __ieee80211_get_mesh_hdrlen(u8 flags)
 519{
 520	int ae = flags & MESH_FLAGS_AE;
 521	/* 802.11-2012, 8.2.4.7.3 */
 522	switch (ae) {
 523	default:
 524	case 0:
 525		return 6;
 526	case MESH_FLAGS_AE_A4:
 527		return 12;
 528	case MESH_FLAGS_AE_A5_A6:
 529		return 18;
 530	}
 531}
 532
 533unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
 534{
 535	return __ieee80211_get_mesh_hdrlen(meshhdr->flags);
 536}
 537EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
 538
 539bool ieee80211_get_8023_tunnel_proto(const void *hdr, __be16 *proto)
 540{
 541	const __be16 *hdr_proto = hdr + ETH_ALEN;
 542
 543	if (!(ether_addr_equal(hdr, rfc1042_header) &&
 544	      *hdr_proto != htons(ETH_P_AARP) &&
 545	      *hdr_proto != htons(ETH_P_IPX)) &&
 546	    !ether_addr_equal(hdr, bridge_tunnel_header))
 547		return false;
 548
 549	*proto = *hdr_proto;
 550
 551	return true;
 552}
 553EXPORT_SYMBOL(ieee80211_get_8023_tunnel_proto);
 554
 555int ieee80211_strip_8023_mesh_hdr(struct sk_buff *skb)
 556{
 557	const void *mesh_addr;
 558	struct {
 559		struct ethhdr eth;
 560		u8 flags;
 561	} payload;
 562	int hdrlen;
 563	int ret;
 564
 565	ret = skb_copy_bits(skb, 0, &payload, sizeof(payload));
 566	if (ret)
 567		return ret;
 568
 569	hdrlen = sizeof(payload.eth) + __ieee80211_get_mesh_hdrlen(payload.flags);
 570
 571	if (likely(pskb_may_pull(skb, hdrlen + 8) &&
 572		   ieee80211_get_8023_tunnel_proto(skb->data + hdrlen,
 573						   &payload.eth.h_proto)))
 574		hdrlen += ETH_ALEN + 2;
 575	else if (!pskb_may_pull(skb, hdrlen))
 576		return -EINVAL;
 577	else
 578		payload.eth.h_proto = htons(skb->len - hdrlen);
 579
 580	mesh_addr = skb->data + sizeof(payload.eth) + ETH_ALEN;
 581	switch (payload.flags & MESH_FLAGS_AE) {
 582	case MESH_FLAGS_AE_A4:
 583		memcpy(&payload.eth.h_source, mesh_addr, ETH_ALEN);
 584		break;
 585	case MESH_FLAGS_AE_A5_A6:
 586		memcpy(&payload.eth, mesh_addr, 2 * ETH_ALEN);
 587		break;
 588	default:
 589		break;
 590	}
 591
 592	pskb_pull(skb, hdrlen - sizeof(payload.eth));
 593	memcpy(skb->data, &payload.eth, sizeof(payload.eth));
 594
 595	return 0;
 596}
 597EXPORT_SYMBOL(ieee80211_strip_8023_mesh_hdr);
 598
 599int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
 600				  const u8 *addr, enum nl80211_iftype iftype,
 601				  u8 data_offset, bool is_amsdu)
 602{
 603	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 604	struct {
 605		u8 hdr[ETH_ALEN] __aligned(2);
 606		__be16 proto;
 607	} payload;
 608	struct ethhdr tmp;
 609	u16 hdrlen;
 
 610
 611	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
 612		return -1;
 613
 614	hdrlen = ieee80211_hdrlen(hdr->frame_control) + data_offset;
 615	if (skb->len < hdrlen)
 616		return -1;
 617
 618	/* convert IEEE 802.11 header + possible LLC headers into Ethernet
 619	 * header
 620	 * IEEE 802.11 address fields:
 621	 * ToDS FromDS Addr1 Addr2 Addr3 Addr4
 622	 *   0     0   DA    SA    BSSID n/a
 623	 *   0     1   DA    BSSID SA    n/a
 624	 *   1     0   BSSID SA    DA    n/a
 625	 *   1     1   RA    TA    DA    SA
 626	 */
 627	memcpy(tmp.h_dest, ieee80211_get_DA(hdr), ETH_ALEN);
 628	memcpy(tmp.h_source, ieee80211_get_SA(hdr), ETH_ALEN);
 629
 
 
 
 
 
 630	switch (hdr->frame_control &
 631		cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
 632	case cpu_to_le16(IEEE80211_FCTL_TODS):
 633		if (unlikely(iftype != NL80211_IFTYPE_AP &&
 634			     iftype != NL80211_IFTYPE_AP_VLAN &&
 635			     iftype != NL80211_IFTYPE_P2P_GO))
 636			return -1;
 637		break;
 638	case cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
 639		if (unlikely(iftype != NL80211_IFTYPE_MESH_POINT &&
 640			     iftype != NL80211_IFTYPE_AP_VLAN &&
 641			     iftype != NL80211_IFTYPE_STATION))
 642			return -1;
 
 
 
 
 
 
 
 
 
 
 643		break;
 644	case cpu_to_le16(IEEE80211_FCTL_FROMDS):
 645		if ((iftype != NL80211_IFTYPE_STATION &&
 646		     iftype != NL80211_IFTYPE_P2P_CLIENT &&
 647		     iftype != NL80211_IFTYPE_MESH_POINT) ||
 648		    (is_multicast_ether_addr(tmp.h_dest) &&
 649		     ether_addr_equal(tmp.h_source, addr)))
 650			return -1;
 
 
 
 
 
 
 
 
 
 651		break;
 652	case cpu_to_le16(0):
 653		if (iftype != NL80211_IFTYPE_ADHOC &&
 654		    iftype != NL80211_IFTYPE_STATION &&
 655		    iftype != NL80211_IFTYPE_OCB)
 656				return -1;
 657		break;
 658	}
 659
 660	if (likely(!is_amsdu && iftype != NL80211_IFTYPE_MESH_POINT &&
 661		   skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
 662		   ieee80211_get_8023_tunnel_proto(&payload, &tmp.h_proto))) {
 663		/* remove RFC1042 or Bridge-Tunnel encapsulation */
 
 
 
 
 
 664		hdrlen += ETH_ALEN + 2;
 665		skb_postpull_rcsum(skb, &payload, ETH_ALEN + 2);
 666	} else {
 667		tmp.h_proto = htons(skb->len - hdrlen);
 668	}
 669
 670	pskb_pull(skb, hdrlen);
 671
 672	if (!ehdr)
 673		ehdr = skb_push(skb, sizeof(struct ethhdr));
 674	memcpy(ehdr, &tmp, sizeof(tmp));
 675
 676	return 0;
 677}
 678EXPORT_SYMBOL(ieee80211_data_to_8023_exthdr);
 679
 680static void
 681__frame_add_frag(struct sk_buff *skb, struct page *page,
 682		 void *ptr, int len, int size)
 683{
 684	struct skb_shared_info *sh = skb_shinfo(skb);
 685	int page_offset;
 686
 687	get_page(page);
 688	page_offset = ptr - page_address(page);
 689	skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size);
 690}
 691
 692static void
 693__ieee80211_amsdu_copy_frag(struct sk_buff *skb, struct sk_buff *frame,
 694			    int offset, int len)
 695{
 696	struct skb_shared_info *sh = skb_shinfo(skb);
 697	const skb_frag_t *frag = &sh->frags[0];
 698	struct page *frag_page;
 699	void *frag_ptr;
 700	int frag_len, frag_size;
 701	int head_size = skb->len - skb->data_len;
 702	int cur_len;
 703
 704	frag_page = virt_to_head_page(skb->head);
 705	frag_ptr = skb->data;
 706	frag_size = head_size;
 707
 708	while (offset >= frag_size) {
 709		offset -= frag_size;
 710		frag_page = skb_frag_page(frag);
 711		frag_ptr = skb_frag_address(frag);
 712		frag_size = skb_frag_size(frag);
 713		frag++;
 714	}
 715
 716	frag_ptr += offset;
 717	frag_len = frag_size - offset;
 718
 719	cur_len = min(len, frag_len);
 720
 721	__frame_add_frag(frame, frag_page, frag_ptr, cur_len, frag_size);
 722	len -= cur_len;
 723
 724	while (len > 0) {
 725		frag_len = skb_frag_size(frag);
 726		cur_len = min(len, frag_len);
 727		__frame_add_frag(frame, skb_frag_page(frag),
 728				 skb_frag_address(frag), cur_len, frag_len);
 729		len -= cur_len;
 730		frag++;
 731	}
 732}
 733
 734static struct sk_buff *
 735__ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen,
 736		       int offset, int len, bool reuse_frag,
 737		       int min_len)
 738{
 739	struct sk_buff *frame;
 740	int cur_len = len;
 741
 742	if (skb->len - offset < len)
 743		return NULL;
 744
 745	/*
 746	 * When reusing framents, copy some data to the head to simplify
 747	 * ethernet header handling and speed up protocol header processing
 748	 * in the stack later.
 749	 */
 750	if (reuse_frag)
 751		cur_len = min_t(int, len, min_len);
 752
 753	/*
 754	 * Allocate and reserve two bytes more for payload
 755	 * alignment since sizeof(struct ethhdr) is 14.
 756	 */
 757	frame = dev_alloc_skb(hlen + sizeof(struct ethhdr) + 2 + cur_len);
 758	if (!frame)
 759		return NULL;
 760
 761	frame->priority = skb->priority;
 762	skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
 763	skb_copy_bits(skb, offset, skb_put(frame, cur_len), cur_len);
 764
 765	len -= cur_len;
 766	if (!len)
 767		return frame;
 768
 769	offset += cur_len;
 770	__ieee80211_amsdu_copy_frag(skb, frame, offset, len);
 771
 772	return frame;
 773}
 774
 775static u16
 776ieee80211_amsdu_subframe_length(void *field, u8 mesh_flags, u8 hdr_type)
 777{
 778	__le16 *field_le = field;
 779	__be16 *field_be = field;
 780	u16 len;
 781
 782	if (hdr_type >= 2)
 783		len = le16_to_cpu(*field_le);
 784	else
 785		len = be16_to_cpu(*field_be);
 786	if (hdr_type)
 787		len += __ieee80211_get_mesh_hdrlen(mesh_flags);
 788
 789	return len;
 790}
 791
 792bool ieee80211_is_valid_amsdu(struct sk_buff *skb, u8 mesh_hdr)
 793{
 794	int offset = 0, remaining, subframe_len, padding;
 795
 796	for (offset = 0; offset < skb->len; offset += subframe_len + padding) {
 797		struct {
 798		    __be16 len;
 799		    u8 mesh_flags;
 800		} hdr;
 801		u16 len;
 802
 803		if (skb_copy_bits(skb, offset + 2 * ETH_ALEN, &hdr, sizeof(hdr)) < 0)
 804			return false;
 805
 806		len = ieee80211_amsdu_subframe_length(&hdr.len, hdr.mesh_flags,
 807						      mesh_hdr);
 808		subframe_len = sizeof(struct ethhdr) + len;
 809		padding = (4 - subframe_len) & 0x3;
 810		remaining = skb->len - offset;
 811
 812		if (subframe_len > remaining)
 813			return false;
 814	}
 815
 816	return true;
 817}
 818EXPORT_SYMBOL(ieee80211_is_valid_amsdu);
 819
 820void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
 821			      const u8 *addr, enum nl80211_iftype iftype,
 822			      const unsigned int extra_headroom,
 823			      const u8 *check_da, const u8 *check_sa,
 824			      u8 mesh_control)
 825{
 826	unsigned int hlen = ALIGN(extra_headroom, 4);
 827	struct sk_buff *frame = NULL;
 
 
 828	int offset = 0, remaining;
 829	struct {
 830		struct ethhdr eth;
 831		uint8_t flags;
 832	} hdr;
 833	bool reuse_frag = skb->head_frag && !skb_has_frag_list(skb);
 834	bool reuse_skb = false;
 835	bool last = false;
 836	int copy_len = sizeof(hdr.eth);
 837
 838	if (iftype == NL80211_IFTYPE_MESH_POINT)
 839		copy_len = sizeof(hdr);
 840
 841	while (!last) {
 842		unsigned int subframe_len;
 843		int len, mesh_len = 0;
 844		u8 padding;
 845
 846		skb_copy_bits(skb, offset, &hdr, copy_len);
 847		if (iftype == NL80211_IFTYPE_MESH_POINT)
 848			mesh_len = __ieee80211_get_mesh_hdrlen(hdr.flags);
 849		len = ieee80211_amsdu_subframe_length(&hdr.eth.h_proto, hdr.flags,
 850						      mesh_control);
 851		subframe_len = sizeof(struct ethhdr) + len;
 852		padding = (4 - subframe_len) & 0x3;
 853
 854		/* the last MSDU has no padding */
 855		remaining = skb->len - offset;
 856		if (subframe_len > remaining)
 857			goto purge;
 858		/* mitigate A-MSDU aggregation injection attacks */
 859		if (ether_addr_equal(hdr.eth.h_dest, rfc1042_header))
 860			goto purge;
 861
 862		offset += sizeof(struct ethhdr);
 863		last = remaining <= subframe_len + padding;
 864
 865		/* FIXME: should we really accept multicast DA? */
 866		if ((check_da && !is_multicast_ether_addr(hdr.eth.h_dest) &&
 867		     !ether_addr_equal(check_da, hdr.eth.h_dest)) ||
 868		    (check_sa && !ether_addr_equal(check_sa, hdr.eth.h_source))) {
 869			offset += len + padding;
 870			continue;
 871		}
 872
 873		/* reuse skb for the last subframe */
 874		if (!skb_is_nonlinear(skb) && !reuse_frag && last) {
 875			skb_pull(skb, offset);
 876			frame = skb;
 877			reuse_skb = true;
 878		} else {
 879			frame = __ieee80211_amsdu_copy(skb, hlen, offset, len,
 880						       reuse_frag, 32 + mesh_len);
 881			if (!frame)
 882				goto purge;
 883
 884			offset += len + padding;
 885		}
 886
 887		skb_reset_network_header(frame);
 888		frame->dev = skb->dev;
 889		frame->priority = skb->priority;
 890
 891		if (likely(iftype != NL80211_IFTYPE_MESH_POINT &&
 892			   ieee80211_get_8023_tunnel_proto(frame->data, &hdr.eth.h_proto)))
 
 
 
 
 893			skb_pull(frame, ETH_ALEN + 2);
 
 894
 895		memcpy(skb_push(frame, sizeof(hdr.eth)), &hdr.eth, sizeof(hdr.eth));
 896		__skb_queue_tail(list, frame);
 897	}
 898
 899	if (!reuse_skb)
 900		dev_kfree_skb(skb);
 901
 902	return;
 903
 904 purge:
 905	__skb_queue_purge(list);
 906	dev_kfree_skb(skb);
 907}
 908EXPORT_SYMBOL(ieee80211_amsdu_to_8023s);
 909
 910/* Given a data frame determine the 802.1p/1d tag to use. */
 911unsigned int cfg80211_classify8021d(struct sk_buff *skb,
 912				    struct cfg80211_qos_map *qos_map)
 913{
 914	unsigned int dscp;
 915	unsigned char vlan_priority;
 916	unsigned int ret;
 917
 918	/* skb->priority values from 256->263 are magic values to
 919	 * directly indicate a specific 802.1d priority.  This is used
 920	 * to allow 802.1d priority to be passed directly in from VLAN
 921	 * tags, etc.
 922	 */
 923	if (skb->priority >= 256 && skb->priority <= 263) {
 924		ret = skb->priority - 256;
 925		goto out;
 926	}
 927
 928	if (skb_vlan_tag_present(skb)) {
 929		vlan_priority = (skb_vlan_tag_get(skb) & VLAN_PRIO_MASK)
 930			>> VLAN_PRIO_SHIFT;
 931		if (vlan_priority > 0) {
 932			ret = vlan_priority;
 933			goto out;
 934		}
 935	}
 936
 937	switch (skb->protocol) {
 938	case htons(ETH_P_IP):
 939		dscp = ipv4_get_dsfield(ip_hdr(skb)) & 0xfc;
 940		break;
 941	case htons(ETH_P_IPV6):
 942		dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & 0xfc;
 943		break;
 944	case htons(ETH_P_MPLS_UC):
 945	case htons(ETH_P_MPLS_MC): {
 946		struct mpls_label mpls_tmp, *mpls;
 947
 948		mpls = skb_header_pointer(skb, sizeof(struct ethhdr),
 949					  sizeof(*mpls), &mpls_tmp);
 950		if (!mpls)
 951			return 0;
 952
 953		ret = (ntohl(mpls->entry) & MPLS_LS_TC_MASK)
 954			>> MPLS_LS_TC_SHIFT;
 955		goto out;
 956	}
 957	case htons(ETH_P_80221):
 958		/* 802.21 is always network control traffic */
 959		return 7;
 960	default:
 961		return 0;
 962	}
 963
 964	if (qos_map) {
 965		unsigned int i, tmp_dscp = dscp >> 2;
 966
 967		for (i = 0; i < qos_map->num_des; i++) {
 968			if (tmp_dscp == qos_map->dscp_exception[i].dscp) {
 969				ret = qos_map->dscp_exception[i].up;
 970				goto out;
 971			}
 972		}
 973
 974		for (i = 0; i < 8; i++) {
 975			if (tmp_dscp >= qos_map->up[i].low &&
 976			    tmp_dscp <= qos_map->up[i].high) {
 977				ret = i;
 978				goto out;
 979			}
 980		}
 981	}
 982
 983	/* The default mapping as defined Section 2.3 in RFC8325: The three
 984	 * Most Significant Bits (MSBs) of the DSCP are used as the
 985	 * corresponding L2 markings.
 986	 */
 987	ret = dscp >> 5;
 988
 989	/* Handle specific DSCP values for which the default mapping (as
 990	 * described above) doesn't adhere to the intended usage of the DSCP
 991	 * value. See section 4 in RFC8325. Specifically, for the following
 992	 * Diffserv Service Classes no update is needed:
 993	 * - Standard: DF
 994	 * - Low Priority Data: CS1
 995	 * - Multimedia Streaming: AF31, AF32, AF33
 996	 * - Multimedia Conferencing: AF41, AF42, AF43
 997	 * - Network Control Traffic: CS7
 998	 * - Real-Time Interactive: CS4
 999	 */
1000	switch (dscp >> 2) {
1001	case 10:
1002	case 12:
1003	case 14:
1004		/* High throughput data: AF11, AF12, AF13 */
1005		ret = 0;
1006		break;
1007	case 16:
1008		/* Operations, Administration, and Maintenance and Provisioning:
1009		 * CS2
1010		 */
1011		ret = 0;
1012		break;
1013	case 18:
1014	case 20:
1015	case 22:
1016		/* Low latency data: AF21, AF22, AF23 */
1017		ret = 3;
1018		break;
1019	case 24:
1020		/* Broadcasting video: CS3 */
1021		ret = 4;
1022		break;
1023	case 40:
1024		/* Signaling: CS5 */
1025		ret = 5;
1026		break;
1027	case 44:
1028		/* Voice Admit: VA */
1029		ret = 6;
1030		break;
1031	case 46:
1032		/* Telephony traffic: EF */
1033		ret = 6;
1034		break;
1035	case 48:
1036		/* Network Control Traffic: CS6 */
1037		ret = 7;
1038		break;
1039	}
1040out:
1041	return array_index_nospec(ret, IEEE80211_NUM_TIDS);
1042}
1043EXPORT_SYMBOL(cfg80211_classify8021d);
1044
1045const struct element *ieee80211_bss_get_elem(struct cfg80211_bss *bss, u8 id)
1046{
1047	const struct cfg80211_bss_ies *ies;
1048
1049	ies = rcu_dereference(bss->ies);
1050	if (!ies)
1051		return NULL;
1052
1053	return cfg80211_find_elem(id, ies->data, ies->len);
1054}
1055EXPORT_SYMBOL(ieee80211_bss_get_elem);
1056
1057void cfg80211_upload_connect_keys(struct wireless_dev *wdev)
1058{
1059	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
1060	struct net_device *dev = wdev->netdev;
1061	int i;
1062
1063	if (!wdev->connect_keys)
1064		return;
1065
1066	for (i = 0; i < 4; i++) {
1067		if (!wdev->connect_keys->params[i].cipher)
1068			continue;
1069		if (rdev_add_key(rdev, dev, -1, i, false, NULL,
1070				 &wdev->connect_keys->params[i])) {
1071			netdev_err(dev, "failed to set key %d\n", i);
1072			continue;
1073		}
1074		if (wdev->connect_keys->def == i &&
1075		    rdev_set_default_key(rdev, dev, -1, i, true, true)) {
1076			netdev_err(dev, "failed to set defkey %d\n", i);
1077			continue;
1078		}
1079	}
1080
1081	kfree_sensitive(wdev->connect_keys);
1082	wdev->connect_keys = NULL;
1083}
1084
1085void cfg80211_process_wdev_events(struct wireless_dev *wdev)
1086{
1087	struct cfg80211_event *ev;
1088	unsigned long flags;
1089
1090	spin_lock_irqsave(&wdev->event_lock, flags);
1091	while (!list_empty(&wdev->event_list)) {
1092		ev = list_first_entry(&wdev->event_list,
1093				      struct cfg80211_event, list);
1094		list_del(&ev->list);
1095		spin_unlock_irqrestore(&wdev->event_lock, flags);
1096
 
1097		switch (ev->type) {
1098		case EVENT_CONNECT_RESULT:
1099			__cfg80211_connect_result(
1100				wdev->netdev,
1101				&ev->cr,
1102				ev->cr.status == WLAN_STATUS_SUCCESS);
1103			break;
1104		case EVENT_ROAMED:
1105			__cfg80211_roamed(wdev, &ev->rm);
1106			break;
1107		case EVENT_DISCONNECTED:
1108			__cfg80211_disconnected(wdev->netdev,
1109						ev->dc.ie, ev->dc.ie_len,
1110						ev->dc.reason,
1111						!ev->dc.locally_generated);
1112			break;
1113		case EVENT_IBSS_JOINED:
1114			__cfg80211_ibss_joined(wdev->netdev, ev->ij.bssid,
1115					       ev->ij.channel);
1116			break;
1117		case EVENT_STOPPED:
1118			cfg80211_leave(wiphy_to_rdev(wdev->wiphy), wdev);
1119			break;
1120		case EVENT_PORT_AUTHORIZED:
1121			__cfg80211_port_authorized(wdev, ev->pa.peer_addr,
1122						   ev->pa.td_bitmap,
1123						   ev->pa.td_bitmap_len);
1124			break;
1125		}
 
1126
1127		kfree(ev);
1128
1129		spin_lock_irqsave(&wdev->event_lock, flags);
1130	}
1131	spin_unlock_irqrestore(&wdev->event_lock, flags);
1132}
1133
1134void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev)
1135{
1136	struct wireless_dev *wdev;
1137
1138	lockdep_assert_held(&rdev->wiphy.mtx);
1139
1140	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list)
1141		cfg80211_process_wdev_events(wdev);
1142}
1143
1144int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
1145			  struct net_device *dev, enum nl80211_iftype ntype,
1146			  struct vif_params *params)
1147{
1148	int err;
1149	enum nl80211_iftype otype = dev->ieee80211_ptr->iftype;
1150
1151	lockdep_assert_held(&rdev->wiphy.mtx);
1152
1153	/* don't support changing VLANs, you just re-create them */
1154	if (otype == NL80211_IFTYPE_AP_VLAN)
1155		return -EOPNOTSUPP;
1156
1157	/* cannot change into P2P device or NAN */
1158	if (ntype == NL80211_IFTYPE_P2P_DEVICE ||
1159	    ntype == NL80211_IFTYPE_NAN)
1160		return -EOPNOTSUPP;
1161
1162	if (!rdev->ops->change_virtual_intf ||
1163	    !(rdev->wiphy.interface_modes & (1 << ntype)))
1164		return -EOPNOTSUPP;
1165
1166	if (ntype != otype) {
1167		/* if it's part of a bridge, reject changing type to station/ibss */
1168		if (netif_is_bridge_port(dev) &&
1169		    (ntype == NL80211_IFTYPE_ADHOC ||
1170		     ntype == NL80211_IFTYPE_STATION ||
1171		     ntype == NL80211_IFTYPE_P2P_CLIENT))
1172			return -EBUSY;
1173
 
1174		dev->ieee80211_ptr->use_4addr = false;
 
 
1175		rdev_set_qos_map(rdev, dev, NULL);
 
1176
1177		switch (otype) {
1178		case NL80211_IFTYPE_AP:
1179		case NL80211_IFTYPE_P2P_GO:
1180			cfg80211_stop_ap(rdev, dev, -1, true);
1181			break;
1182		case NL80211_IFTYPE_ADHOC:
1183			cfg80211_leave_ibss(rdev, dev, false);
1184			break;
1185		case NL80211_IFTYPE_STATION:
1186		case NL80211_IFTYPE_P2P_CLIENT:
 
1187			cfg80211_disconnect(rdev, dev,
1188					    WLAN_REASON_DEAUTH_LEAVING, true);
 
1189			break;
1190		case NL80211_IFTYPE_MESH_POINT:
1191			/* mesh should be handled? */
1192			break;
1193		case NL80211_IFTYPE_OCB:
1194			cfg80211_leave_ocb(rdev, dev);
1195			break;
1196		default:
1197			break;
1198		}
1199
1200		cfg80211_process_rdev_events(rdev);
1201		cfg80211_mlme_purge_registrations(dev->ieee80211_ptr);
1202
1203		memset(&dev->ieee80211_ptr->u, 0,
1204		       sizeof(dev->ieee80211_ptr->u));
1205		memset(&dev->ieee80211_ptr->links, 0,
1206		       sizeof(dev->ieee80211_ptr->links));
1207	}
1208
1209	err = rdev_change_virtual_intf(rdev, dev, ntype, params);
1210
1211	WARN_ON(!err && dev->ieee80211_ptr->iftype != ntype);
1212
1213	if (!err && params && params->use_4addr != -1)
1214		dev->ieee80211_ptr->use_4addr = params->use_4addr;
1215
1216	if (!err) {
1217		dev->priv_flags &= ~IFF_DONT_BRIDGE;
1218		switch (ntype) {
1219		case NL80211_IFTYPE_STATION:
1220			if (dev->ieee80211_ptr->use_4addr)
1221				break;
1222			fallthrough;
1223		case NL80211_IFTYPE_OCB:
1224		case NL80211_IFTYPE_P2P_CLIENT:
1225		case NL80211_IFTYPE_ADHOC:
1226			dev->priv_flags |= IFF_DONT_BRIDGE;
1227			break;
1228		case NL80211_IFTYPE_P2P_GO:
1229		case NL80211_IFTYPE_AP:
1230		case NL80211_IFTYPE_AP_VLAN:
1231		case NL80211_IFTYPE_MESH_POINT:
1232			/* bridging OK */
1233			break;
1234		case NL80211_IFTYPE_MONITOR:
1235			/* monitor can't bridge anyway */
1236			break;
1237		case NL80211_IFTYPE_UNSPECIFIED:
1238		case NUM_NL80211_IFTYPES:
1239			/* not happening */
1240			break;
1241		case NL80211_IFTYPE_P2P_DEVICE:
1242		case NL80211_IFTYPE_WDS:
1243		case NL80211_IFTYPE_NAN:
1244			WARN_ON(1);
1245			break;
1246		}
1247	}
1248
1249	if (!err && ntype != otype && netif_running(dev)) {
1250		cfg80211_update_iface_num(rdev, ntype, 1);
1251		cfg80211_update_iface_num(rdev, otype, -1);
1252	}
1253
1254	return err;
1255}
1256
1257static u32 cfg80211_calculate_bitrate_ht(struct rate_info *rate)
1258{
1259	int modulation, streams, bitrate;
1260
1261	/* the formula below does only work for MCS values smaller than 32 */
1262	if (WARN_ON_ONCE(rate->mcs >= 32))
1263		return 0;
1264
1265	modulation = rate->mcs & 7;
1266	streams = (rate->mcs >> 3) + 1;
1267
1268	bitrate = (rate->bw == RATE_INFO_BW_40) ? 13500000 : 6500000;
1269
1270	if (modulation < 4)
1271		bitrate *= (modulation + 1);
1272	else if (modulation == 4)
1273		bitrate *= (modulation + 2);
1274	else
1275		bitrate *= (modulation + 3);
1276
1277	bitrate *= streams;
1278
1279	if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1280		bitrate = (bitrate / 9) * 10;
1281
1282	/* do NOT round down here */
1283	return (bitrate + 50000) / 100000;
1284}
1285
1286static u32 cfg80211_calculate_bitrate_dmg(struct rate_info *rate)
1287{
1288	static const u32 __mcs2bitrate[] = {
1289		/* control PHY */
1290		[0] =   275,
1291		/* SC PHY */
1292		[1] =  3850,
1293		[2] =  7700,
1294		[3] =  9625,
1295		[4] = 11550,
1296		[5] = 12512, /* 1251.25 mbps */
1297		[6] = 15400,
1298		[7] = 19250,
1299		[8] = 23100,
1300		[9] = 25025,
1301		[10] = 30800,
1302		[11] = 38500,
1303		[12] = 46200,
1304		/* OFDM PHY */
1305		[13] =  6930,
1306		[14] =  8662, /* 866.25 mbps */
1307		[15] = 13860,
1308		[16] = 17325,
1309		[17] = 20790,
1310		[18] = 27720,
1311		[19] = 34650,
1312		[20] = 41580,
1313		[21] = 45045,
1314		[22] = 51975,
1315		[23] = 62370,
1316		[24] = 67568, /* 6756.75 mbps */
1317		/* LP-SC PHY */
1318		[25] =  6260,
1319		[26] =  8340,
1320		[27] = 11120,
1321		[28] = 12510,
1322		[29] = 16680,
1323		[30] = 22240,
1324		[31] = 25030,
1325	};
1326
1327	if (WARN_ON_ONCE(rate->mcs >= ARRAY_SIZE(__mcs2bitrate)))
1328		return 0;
1329
1330	return __mcs2bitrate[rate->mcs];
1331}
1332
1333static u32 cfg80211_calculate_bitrate_extended_sc_dmg(struct rate_info *rate)
1334{
1335	static const u32 __mcs2bitrate[] = {
1336		[6 - 6] = 26950, /* MCS 9.1 : 2695.0 mbps */
1337		[7 - 6] = 50050, /* MCS 12.1 */
1338		[8 - 6] = 53900,
1339		[9 - 6] = 57750,
1340		[10 - 6] = 63900,
1341		[11 - 6] = 75075,
1342		[12 - 6] = 80850,
1343	};
1344
1345	/* Extended SC MCS not defined for base MCS below 6 or above 12 */
1346	if (WARN_ON_ONCE(rate->mcs < 6 || rate->mcs > 12))
1347		return 0;
1348
1349	return __mcs2bitrate[rate->mcs - 6];
1350}
1351
1352static u32 cfg80211_calculate_bitrate_edmg(struct rate_info *rate)
1353{
1354	static const u32 __mcs2bitrate[] = {
1355		/* control PHY */
1356		[0] =   275,
1357		/* SC PHY */
1358		[1] =  3850,
1359		[2] =  7700,
1360		[3] =  9625,
1361		[4] = 11550,
1362		[5] = 12512, /* 1251.25 mbps */
1363		[6] = 13475,
1364		[7] = 15400,
1365		[8] = 19250,
1366		[9] = 23100,
1367		[10] = 25025,
1368		[11] = 26950,
1369		[12] = 30800,
1370		[13] = 38500,
1371		[14] = 46200,
1372		[15] = 50050,
1373		[16] = 53900,
1374		[17] = 57750,
1375		[18] = 69300,
1376		[19] = 75075,
1377		[20] = 80850,
1378	};
1379
1380	if (WARN_ON_ONCE(rate->mcs >= ARRAY_SIZE(__mcs2bitrate)))
1381		return 0;
1382
1383	return __mcs2bitrate[rate->mcs] * rate->n_bonded_ch;
1384}
1385
1386static u32 cfg80211_calculate_bitrate_vht(struct rate_info *rate)
1387{
1388	static const u32 base[4][12] = {
1389		{   6500000,
1390		   13000000,
1391		   19500000,
1392		   26000000,
1393		   39000000,
1394		   52000000,
1395		   58500000,
1396		   65000000,
1397		   78000000,
1398		/* not in the spec, but some devices use this: */
1399		   86700000,
1400		   97500000,
1401		  108300000,
1402		},
1403		{  13500000,
1404		   27000000,
1405		   40500000,
1406		   54000000,
1407		   81000000,
1408		  108000000,
1409		  121500000,
1410		  135000000,
1411		  162000000,
1412		  180000000,
1413		  202500000,
1414		  225000000,
1415		},
1416		{  29300000,
1417		   58500000,
1418		   87800000,
1419		  117000000,
1420		  175500000,
1421		  234000000,
1422		  263300000,
1423		  292500000,
1424		  351000000,
1425		  390000000,
1426		  438800000,
1427		  487500000,
1428		},
1429		{  58500000,
1430		  117000000,
1431		  175500000,
1432		  234000000,
1433		  351000000,
1434		  468000000,
1435		  526500000,
1436		  585000000,
1437		  702000000,
1438		  780000000,
1439		  877500000,
1440		  975000000,
1441		},
1442	};
1443	u32 bitrate;
1444	int idx;
1445
1446	if (rate->mcs > 11)
1447		goto warn;
1448
1449	switch (rate->bw) {
1450	case RATE_INFO_BW_160:
1451		idx = 3;
1452		break;
1453	case RATE_INFO_BW_80:
1454		idx = 2;
1455		break;
1456	case RATE_INFO_BW_40:
1457		idx = 1;
1458		break;
1459	case RATE_INFO_BW_5:
1460	case RATE_INFO_BW_10:
1461	default:
1462		goto warn;
1463	case RATE_INFO_BW_20:
1464		idx = 0;
1465	}
1466
1467	bitrate = base[idx][rate->mcs];
1468	bitrate *= rate->nss;
1469
1470	if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1471		bitrate = (bitrate / 9) * 10;
1472
1473	/* do NOT round down here */
1474	return (bitrate + 50000) / 100000;
1475 warn:
1476	WARN_ONCE(1, "invalid rate bw=%d, mcs=%d, nss=%d\n",
1477		  rate->bw, rate->mcs, rate->nss);
1478	return 0;
1479}
1480
1481static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate)
1482{
1483#define SCALE 6144
1484	u32 mcs_divisors[14] = {
1485		102399, /* 16.666666... */
1486		 51201, /*  8.333333... */
1487		 34134, /*  5.555555... */
1488		 25599, /*  4.166666... */
1489		 17067, /*  2.777777... */
1490		 12801, /*  2.083333... */
1491		 11377, /*  1.851725... */
1492		 10239, /*  1.666666... */
1493		  8532, /*  1.388888... */
1494		  7680, /*  1.250000... */
1495		  6828, /*  1.111111... */
1496		  6144, /*  1.000000... */
1497		  5690, /*  0.926106... */
1498		  5120, /*  0.833333... */
1499	};
1500	u32 rates_160M[3] = { 960777777, 907400000, 816666666 };
1501	u32 rates_969[3] =  { 480388888, 453700000, 408333333 };
1502	u32 rates_484[3] =  { 229411111, 216666666, 195000000 };
1503	u32 rates_242[3] =  { 114711111, 108333333,  97500000 };
1504	u32 rates_106[3] =  {  40000000,  37777777,  34000000 };
1505	u32 rates_52[3]  =  {  18820000,  17777777,  16000000 };
1506	u32 rates_26[3]  =  {   9411111,   8888888,   8000000 };
1507	u64 tmp;
1508	u32 result;
1509
1510	if (WARN_ON_ONCE(rate->mcs > 13))
1511		return 0;
1512
1513	if (WARN_ON_ONCE(rate->he_gi > NL80211_RATE_INFO_HE_GI_3_2))
1514		return 0;
1515	if (WARN_ON_ONCE(rate->he_ru_alloc >
1516			 NL80211_RATE_INFO_HE_RU_ALLOC_2x996))
1517		return 0;
1518	if (WARN_ON_ONCE(rate->nss < 1 || rate->nss > 8))
1519		return 0;
1520
1521	if (rate->bw == RATE_INFO_BW_160)
1522		result = rates_160M[rate->he_gi];
1523	else if (rate->bw == RATE_INFO_BW_80 ||
1524		 (rate->bw == RATE_INFO_BW_HE_RU &&
1525		  rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_996))
1526		result = rates_969[rate->he_gi];
1527	else if (rate->bw == RATE_INFO_BW_40 ||
1528		 (rate->bw == RATE_INFO_BW_HE_RU &&
1529		  rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_484))
1530		result = rates_484[rate->he_gi];
1531	else if (rate->bw == RATE_INFO_BW_20 ||
1532		 (rate->bw == RATE_INFO_BW_HE_RU &&
1533		  rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_242))
1534		result = rates_242[rate->he_gi];
1535	else if (rate->bw == RATE_INFO_BW_HE_RU &&
1536		 rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_106)
1537		result = rates_106[rate->he_gi];
1538	else if (rate->bw == RATE_INFO_BW_HE_RU &&
1539		 rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_52)
1540		result = rates_52[rate->he_gi];
1541	else if (rate->bw == RATE_INFO_BW_HE_RU &&
1542		 rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_26)
1543		result = rates_26[rate->he_gi];
1544	else {
1545		WARN(1, "invalid HE MCS: bw:%d, ru:%d\n",
1546		     rate->bw, rate->he_ru_alloc);
1547		return 0;
1548	}
1549
1550	/* now scale to the appropriate MCS */
1551	tmp = result;
1552	tmp *= SCALE;
1553	do_div(tmp, mcs_divisors[rate->mcs]);
1554	result = tmp;
1555
1556	/* and take NSS, DCM into account */
1557	result = (result * rate->nss) / 8;
1558	if (rate->he_dcm)
1559		result /= 2;
1560
1561	return result / 10000;
1562}
1563
1564static u32 cfg80211_calculate_bitrate_eht(struct rate_info *rate)
1565{
1566#define SCALE 6144
1567	static const u32 mcs_divisors[16] = {
1568		102399, /* 16.666666... */
1569		 51201, /*  8.333333... */
1570		 34134, /*  5.555555... */
1571		 25599, /*  4.166666... */
1572		 17067, /*  2.777777... */
1573		 12801, /*  2.083333... */
1574		 11377, /*  1.851725... */
1575		 10239, /*  1.666666... */
1576		  8532, /*  1.388888... */
1577		  7680, /*  1.250000... */
1578		  6828, /*  1.111111... */
1579		  6144, /*  1.000000... */
1580		  5690, /*  0.926106... */
1581		  5120, /*  0.833333... */
1582		409600, /* 66.666666... */
1583		204800, /* 33.333333... */
1584	};
1585	static const u32 rates_996[3] =  { 480388888, 453700000, 408333333 };
1586	static const u32 rates_484[3] =  { 229411111, 216666666, 195000000 };
1587	static const u32 rates_242[3] =  { 114711111, 108333333,  97500000 };
1588	static const u32 rates_106[3] =  {  40000000,  37777777,  34000000 };
1589	static const u32 rates_52[3]  =  {  18820000,  17777777,  16000000 };
1590	static const u32 rates_26[3]  =  {   9411111,   8888888,   8000000 };
1591	u64 tmp;
1592	u32 result;
1593
1594	if (WARN_ON_ONCE(rate->mcs > 15))
1595		return 0;
1596	if (WARN_ON_ONCE(rate->eht_gi > NL80211_RATE_INFO_EHT_GI_3_2))
1597		return 0;
1598	if (WARN_ON_ONCE(rate->eht_ru_alloc >
1599			 NL80211_RATE_INFO_EHT_RU_ALLOC_4x996))
1600		return 0;
1601	if (WARN_ON_ONCE(rate->nss < 1 || rate->nss > 8))
1602		return 0;
1603
1604	/* Bandwidth checks for MCS 14 */
1605	if (rate->mcs == 14) {
1606		if ((rate->bw != RATE_INFO_BW_EHT_RU &&
1607		     rate->bw != RATE_INFO_BW_80 &&
1608		     rate->bw != RATE_INFO_BW_160 &&
1609		     rate->bw != RATE_INFO_BW_320) ||
1610		    (rate->bw == RATE_INFO_BW_EHT_RU &&
1611		     rate->eht_ru_alloc != NL80211_RATE_INFO_EHT_RU_ALLOC_996 &&
1612		     rate->eht_ru_alloc != NL80211_RATE_INFO_EHT_RU_ALLOC_2x996 &&
1613		     rate->eht_ru_alloc != NL80211_RATE_INFO_EHT_RU_ALLOC_4x996)) {
1614			WARN(1, "invalid EHT BW for MCS 14: bw:%d, ru:%d\n",
1615			     rate->bw, rate->eht_ru_alloc);
1616			return 0;
1617		}
1618	}
1619
1620	if (rate->bw == RATE_INFO_BW_320 ||
1621	    (rate->bw == RATE_INFO_BW_EHT_RU &&
1622	     rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_4x996))
1623		result = 4 * rates_996[rate->eht_gi];
1624	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1625		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_3x996P484)
1626		result = 3 * rates_996[rate->eht_gi] + rates_484[rate->eht_gi];
1627	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1628		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_3x996)
1629		result = 3 * rates_996[rate->eht_gi];
1630	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1631		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_2x996P484)
1632		result = 2 * rates_996[rate->eht_gi] + rates_484[rate->eht_gi];
1633	else if (rate->bw == RATE_INFO_BW_160 ||
1634		 (rate->bw == RATE_INFO_BW_EHT_RU &&
1635		  rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_2x996))
1636		result = 2 * rates_996[rate->eht_gi];
1637	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1638		 rate->eht_ru_alloc ==
1639		 NL80211_RATE_INFO_EHT_RU_ALLOC_996P484P242)
1640		result = rates_996[rate->eht_gi] + rates_484[rate->eht_gi]
1641			 + rates_242[rate->eht_gi];
1642	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1643		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_996P484)
1644		result = rates_996[rate->eht_gi] + rates_484[rate->eht_gi];
1645	else if (rate->bw == RATE_INFO_BW_80 ||
1646		 (rate->bw == RATE_INFO_BW_EHT_RU &&
1647		  rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_996))
1648		result = rates_996[rate->eht_gi];
1649	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1650		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_484P242)
1651		result = rates_484[rate->eht_gi] + rates_242[rate->eht_gi];
1652	else if (rate->bw == RATE_INFO_BW_40 ||
1653		 (rate->bw == RATE_INFO_BW_EHT_RU &&
1654		  rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_484))
1655		result = rates_484[rate->eht_gi];
1656	else if (rate->bw == RATE_INFO_BW_20 ||
1657		 (rate->bw == RATE_INFO_BW_EHT_RU &&
1658		  rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_242))
1659		result = rates_242[rate->eht_gi];
1660	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1661		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_106P26)
1662		result = rates_106[rate->eht_gi] + rates_26[rate->eht_gi];
1663	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1664		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_106)
1665		result = rates_106[rate->eht_gi];
1666	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1667		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_52P26)
1668		result = rates_52[rate->eht_gi] + rates_26[rate->eht_gi];
1669	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1670		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_52)
1671		result = rates_52[rate->eht_gi];
1672	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1673		 rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_26)
1674		result = rates_26[rate->eht_gi];
1675	else {
1676		WARN(1, "invalid EHT MCS: bw:%d, ru:%d\n",
1677		     rate->bw, rate->eht_ru_alloc);
1678		return 0;
1679	}
1680
1681	/* now scale to the appropriate MCS */
1682	tmp = result;
1683	tmp *= SCALE;
1684	do_div(tmp, mcs_divisors[rate->mcs]);
1685
1686	/* and take NSS */
1687	tmp *= rate->nss;
1688	do_div(tmp, 8);
1689
1690	result = tmp;
1691
1692	return result / 10000;
1693}
1694
1695static u32 cfg80211_calculate_bitrate_s1g(struct rate_info *rate)
1696{
1697	/* For 1, 2, 4, 8 and 16 MHz channels */
1698	static const u32 base[5][11] = {
1699		{  300000,
1700		   600000,
1701		   900000,
1702		  1200000,
1703		  1800000,
1704		  2400000,
1705		  2700000,
1706		  3000000,
1707		  3600000,
1708		  4000000,
1709		  /* MCS 10 supported in 1 MHz only */
1710		  150000,
1711		},
1712		{  650000,
1713		  1300000,
1714		  1950000,
1715		  2600000,
1716		  3900000,
1717		  5200000,
1718		  5850000,
1719		  6500000,
1720		  7800000,
1721		  /* MCS 9 not valid */
1722		},
1723		{  1350000,
1724		   2700000,
1725		   4050000,
1726		   5400000,
1727		   8100000,
1728		  10800000,
1729		  12150000,
1730		  13500000,
1731		  16200000,
1732		  18000000,
1733		},
1734		{  2925000,
1735		   5850000,
1736		   8775000,
1737		  11700000,
1738		  17550000,
1739		  23400000,
1740		  26325000,
1741		  29250000,
1742		  35100000,
1743		  39000000,
1744		},
1745		{  8580000,
1746		  11700000,
1747		  17550000,
1748		  23400000,
1749		  35100000,
1750		  46800000,
1751		  52650000,
1752		  58500000,
1753		  70200000,
1754		  78000000,
1755		},
1756	};
1757	u32 bitrate;
1758	/* default is 1 MHz index */
1759	int idx = 0;
1760
1761	if (rate->mcs >= 11)
1762		goto warn;
1763
1764	switch (rate->bw) {
1765	case RATE_INFO_BW_16:
1766		idx = 4;
1767		break;
1768	case RATE_INFO_BW_8:
1769		idx = 3;
1770		break;
1771	case RATE_INFO_BW_4:
1772		idx = 2;
1773		break;
1774	case RATE_INFO_BW_2:
1775		idx = 1;
1776		break;
1777	case RATE_INFO_BW_1:
1778		idx = 0;
1779		break;
1780	case RATE_INFO_BW_5:
1781	case RATE_INFO_BW_10:
1782	case RATE_INFO_BW_20:
1783	case RATE_INFO_BW_40:
1784	case RATE_INFO_BW_80:
1785	case RATE_INFO_BW_160:
1786	default:
1787		goto warn;
1788	}
1789
1790	bitrate = base[idx][rate->mcs];
1791	bitrate *= rate->nss;
1792
1793	if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1794		bitrate = (bitrate / 9) * 10;
1795	/* do NOT round down here */
1796	return (bitrate + 50000) / 100000;
1797warn:
1798	WARN_ONCE(1, "invalid rate bw=%d, mcs=%d, nss=%d\n",
1799		  rate->bw, rate->mcs, rate->nss);
1800	return 0;
1801}
1802
1803u32 cfg80211_calculate_bitrate(struct rate_info *rate)
1804{
1805	if (rate->flags & RATE_INFO_FLAGS_MCS)
1806		return cfg80211_calculate_bitrate_ht(rate);
1807	if (rate->flags & RATE_INFO_FLAGS_DMG)
1808		return cfg80211_calculate_bitrate_dmg(rate);
1809	if (rate->flags & RATE_INFO_FLAGS_EXTENDED_SC_DMG)
1810		return cfg80211_calculate_bitrate_extended_sc_dmg(rate);
1811	if (rate->flags & RATE_INFO_FLAGS_EDMG)
1812		return cfg80211_calculate_bitrate_edmg(rate);
1813	if (rate->flags & RATE_INFO_FLAGS_VHT_MCS)
1814		return cfg80211_calculate_bitrate_vht(rate);
1815	if (rate->flags & RATE_INFO_FLAGS_HE_MCS)
1816		return cfg80211_calculate_bitrate_he(rate);
1817	if (rate->flags & RATE_INFO_FLAGS_EHT_MCS)
1818		return cfg80211_calculate_bitrate_eht(rate);
1819	if (rate->flags & RATE_INFO_FLAGS_S1G_MCS)
1820		return cfg80211_calculate_bitrate_s1g(rate);
1821
1822	return rate->legacy;
1823}
1824EXPORT_SYMBOL(cfg80211_calculate_bitrate);
1825
1826int cfg80211_get_p2p_attr(const u8 *ies, unsigned int len,
1827			  enum ieee80211_p2p_attr_id attr,
1828			  u8 *buf, unsigned int bufsize)
1829{
1830	u8 *out = buf;
1831	u16 attr_remaining = 0;
1832	bool desired_attr = false;
1833	u16 desired_len = 0;
1834
1835	while (len > 0) {
1836		unsigned int iedatalen;
1837		unsigned int copy;
1838		const u8 *iedata;
1839
1840		if (len < 2)
1841			return -EILSEQ;
1842		iedatalen = ies[1];
1843		if (iedatalen + 2 > len)
1844			return -EILSEQ;
1845
1846		if (ies[0] != WLAN_EID_VENDOR_SPECIFIC)
1847			goto cont;
1848
1849		if (iedatalen < 4)
1850			goto cont;
1851
1852		iedata = ies + 2;
1853
1854		/* check WFA OUI, P2P subtype */
1855		if (iedata[0] != 0x50 || iedata[1] != 0x6f ||
1856		    iedata[2] != 0x9a || iedata[3] != 0x09)
1857			goto cont;
1858
1859		iedatalen -= 4;
1860		iedata += 4;
1861
1862		/* check attribute continuation into this IE */
1863		copy = min_t(unsigned int, attr_remaining, iedatalen);
1864		if (copy && desired_attr) {
1865			desired_len += copy;
1866			if (out) {
1867				memcpy(out, iedata, min(bufsize, copy));
1868				out += min(bufsize, copy);
1869				bufsize -= min(bufsize, copy);
1870			}
1871
1872
1873			if (copy == attr_remaining)
1874				return desired_len;
1875		}
1876
1877		attr_remaining -= copy;
1878		if (attr_remaining)
1879			goto cont;
1880
1881		iedatalen -= copy;
1882		iedata += copy;
1883
1884		while (iedatalen > 0) {
1885			u16 attr_len;
1886
1887			/* P2P attribute ID & size must fit */
1888			if (iedatalen < 3)
1889				return -EILSEQ;
1890			desired_attr = iedata[0] == attr;
1891			attr_len = get_unaligned_le16(iedata + 1);
1892			iedatalen -= 3;
1893			iedata += 3;
1894
1895			copy = min_t(unsigned int, attr_len, iedatalen);
1896
1897			if (desired_attr) {
1898				desired_len += copy;
1899				if (out) {
1900					memcpy(out, iedata, min(bufsize, copy));
1901					out += min(bufsize, copy);
1902					bufsize -= min(bufsize, copy);
1903				}
1904
1905				if (copy == attr_len)
1906					return desired_len;
1907			}
1908
1909			iedata += copy;
1910			iedatalen -= copy;
1911			attr_remaining = attr_len - copy;
1912		}
1913
1914 cont:
1915		len -= ies[1] + 2;
1916		ies += ies[1] + 2;
1917	}
1918
1919	if (attr_remaining && desired_attr)
1920		return -EILSEQ;
1921
1922	return -ENOENT;
1923}
1924EXPORT_SYMBOL(cfg80211_get_p2p_attr);
1925
1926static bool ieee80211_id_in_list(const u8 *ids, int n_ids, u8 id, bool id_ext)
1927{
1928	int i;
1929
1930	/* Make sure array values are legal */
1931	if (WARN_ON(ids[n_ids - 1] == WLAN_EID_EXTENSION))
1932		return false;
1933
1934	i = 0;
1935	while (i < n_ids) {
1936		if (ids[i] == WLAN_EID_EXTENSION) {
1937			if (id_ext && (ids[i + 1] == id))
1938				return true;
1939
1940			i += 2;
1941			continue;
1942		}
1943
1944		if (ids[i] == id && !id_ext)
1945			return true;
1946
1947		i++;
1948	}
1949	return false;
1950}
1951
1952static size_t skip_ie(const u8 *ies, size_t ielen, size_t pos)
1953{
1954	/* we assume a validly formed IEs buffer */
1955	u8 len = ies[pos + 1];
1956
1957	pos += 2 + len;
1958
1959	/* the IE itself must have 255 bytes for fragments to follow */
1960	if (len < 255)
1961		return pos;
1962
1963	while (pos < ielen && ies[pos] == WLAN_EID_FRAGMENT) {
1964		len = ies[pos + 1];
1965		pos += 2 + len;
1966	}
1967
1968	return pos;
1969}
1970
1971size_t ieee80211_ie_split_ric(const u8 *ies, size_t ielen,
1972			      const u8 *ids, int n_ids,
1973			      const u8 *after_ric, int n_after_ric,
1974			      size_t offset)
1975{
1976	size_t pos = offset;
1977
1978	while (pos < ielen) {
1979		u8 ext = 0;
1980
1981		if (ies[pos] == WLAN_EID_EXTENSION)
1982			ext = 2;
1983		if ((pos + ext) >= ielen)
1984			break;
1985
1986		if (!ieee80211_id_in_list(ids, n_ids, ies[pos + ext],
1987					  ies[pos] == WLAN_EID_EXTENSION))
1988			break;
1989
1990		if (ies[pos] == WLAN_EID_RIC_DATA && n_after_ric) {
1991			pos = skip_ie(ies, ielen, pos);
1992
1993			while (pos < ielen) {
1994				if (ies[pos] == WLAN_EID_EXTENSION)
1995					ext = 2;
1996				else
1997					ext = 0;
1998
1999				if ((pos + ext) >= ielen)
2000					break;
2001
2002				if (!ieee80211_id_in_list(after_ric,
2003							  n_after_ric,
2004							  ies[pos + ext],
2005							  ext == 2))
2006					pos = skip_ie(ies, ielen, pos);
2007				else
2008					break;
2009			}
2010		} else {
2011			pos = skip_ie(ies, ielen, pos);
2012		}
2013	}
2014
2015	return pos;
2016}
2017EXPORT_SYMBOL(ieee80211_ie_split_ric);
2018
2019void ieee80211_fragment_element(struct sk_buff *skb, u8 *len_pos, u8 frag_id)
2020{
2021	unsigned int elem_len;
2022
2023	if (!len_pos)
2024		return;
2025
2026	elem_len = skb->data + skb->len - len_pos - 1;
2027
2028	while (elem_len > 255) {
2029		/* this one is 255 */
2030		*len_pos = 255;
2031		/* remaining data gets smaller */
2032		elem_len -= 255;
2033		/* make space for the fragment ID/len in SKB */
2034		skb_put(skb, 2);
2035		/* shift back the remaining data to place fragment ID/len */
2036		memmove(len_pos + 255 + 3, len_pos + 255 + 1, elem_len);
2037		/* place the fragment ID */
2038		len_pos += 255 + 1;
2039		*len_pos = frag_id;
2040		/* and point to fragment length to update later */
2041		len_pos++;
2042	}
2043
2044	*len_pos = elem_len;
2045}
2046EXPORT_SYMBOL(ieee80211_fragment_element);
2047
2048bool ieee80211_operating_class_to_band(u8 operating_class,
2049				       enum nl80211_band *band)
2050{
2051	switch (operating_class) {
2052	case 112:
2053	case 115 ... 127:
2054	case 128 ... 130:
2055		*band = NL80211_BAND_5GHZ;
2056		return true;
2057	case 131 ... 135:
2058	case 137:
2059		*band = NL80211_BAND_6GHZ;
2060		return true;
2061	case 81:
2062	case 82:
2063	case 83:
2064	case 84:
2065		*band = NL80211_BAND_2GHZ;
2066		return true;
2067	case 180:
2068		*band = NL80211_BAND_60GHZ;
2069		return true;
2070	}
2071
2072	return false;
2073}
2074EXPORT_SYMBOL(ieee80211_operating_class_to_band);
2075
2076bool ieee80211_chandef_to_operating_class(struct cfg80211_chan_def *chandef,
2077					  u8 *op_class)
2078{
2079	u8 vht_opclass;
2080	u32 freq = chandef->center_freq1;
2081
2082	if (freq >= 2412 && freq <= 2472) {
2083		if (chandef->width > NL80211_CHAN_WIDTH_40)
2084			return false;
2085
2086		/* 2.407 GHz, channels 1..13 */
2087		if (chandef->width == NL80211_CHAN_WIDTH_40) {
2088			if (freq > chandef->chan->center_freq)
2089				*op_class = 83; /* HT40+ */
2090			else
2091				*op_class = 84; /* HT40- */
2092		} else {
2093			*op_class = 81;
2094		}
2095
2096		return true;
2097	}
2098
2099	if (freq == 2484) {
2100		/* channel 14 is only for IEEE 802.11b */
2101		if (chandef->width != NL80211_CHAN_WIDTH_20_NOHT)
2102			return false;
2103
2104		*op_class = 82; /* channel 14 */
2105		return true;
2106	}
2107
2108	switch (chandef->width) {
2109	case NL80211_CHAN_WIDTH_80:
2110		vht_opclass = 128;
2111		break;
2112	case NL80211_CHAN_WIDTH_160:
2113		vht_opclass = 129;
2114		break;
2115	case NL80211_CHAN_WIDTH_80P80:
2116		vht_opclass = 130;
2117		break;
2118	case NL80211_CHAN_WIDTH_10:
2119	case NL80211_CHAN_WIDTH_5:
2120		return false; /* unsupported for now */
2121	default:
2122		vht_opclass = 0;
2123		break;
2124	}
2125
2126	/* 5 GHz, channels 36..48 */
2127	if (freq >= 5180 && freq <= 5240) {
2128		if (vht_opclass) {
2129			*op_class = vht_opclass;
2130		} else if (chandef->width == NL80211_CHAN_WIDTH_40) {
2131			if (freq > chandef->chan->center_freq)
2132				*op_class = 116;
2133			else
2134				*op_class = 117;
2135		} else {
2136			*op_class = 115;
2137		}
2138
2139		return true;
2140	}
2141
2142	/* 5 GHz, channels 52..64 */
2143	if (freq >= 5260 && freq <= 5320) {
2144		if (vht_opclass) {
2145			*op_class = vht_opclass;
2146		} else if (chandef->width == NL80211_CHAN_WIDTH_40) {
2147			if (freq > chandef->chan->center_freq)
2148				*op_class = 119;
2149			else
2150				*op_class = 120;
2151		} else {
2152			*op_class = 118;
2153		}
2154
2155		return true;
2156	}
2157
2158	/* 5 GHz, channels 100..144 */
2159	if (freq >= 5500 && freq <= 5720) {
2160		if (vht_opclass) {
2161			*op_class = vht_opclass;
2162		} else if (chandef->width == NL80211_CHAN_WIDTH_40) {
2163			if (freq > chandef->chan->center_freq)
2164				*op_class = 122;
2165			else
2166				*op_class = 123;
2167		} else {
2168			*op_class = 121;
2169		}
2170
2171		return true;
2172	}
2173
2174	/* 5 GHz, channels 149..169 */
2175	if (freq >= 5745 && freq <= 5845) {
2176		if (vht_opclass) {
2177			*op_class = vht_opclass;
2178		} else if (chandef->width == NL80211_CHAN_WIDTH_40) {
2179			if (freq > chandef->chan->center_freq)
2180				*op_class = 126;
2181			else
2182				*op_class = 127;
2183		} else if (freq <= 5805) {
2184			*op_class = 124;
2185		} else {
2186			*op_class = 125;
2187		}
2188
2189		return true;
2190	}
2191
2192	/* 56.16 GHz, channel 1..4 */
2193	if (freq >= 56160 + 2160 * 1 && freq <= 56160 + 2160 * 6) {
2194		if (chandef->width >= NL80211_CHAN_WIDTH_40)
2195			return false;
2196
2197		*op_class = 180;
2198		return true;
2199	}
2200
2201	/* not supported yet */
2202	return false;
2203}
2204EXPORT_SYMBOL(ieee80211_chandef_to_operating_class);
2205
2206static int cfg80211_wdev_bi(struct wireless_dev *wdev)
2207{
2208	switch (wdev->iftype) {
2209	case NL80211_IFTYPE_AP:
2210	case NL80211_IFTYPE_P2P_GO:
2211		WARN_ON(wdev->valid_links);
2212		return wdev->links[0].ap.beacon_interval;
2213	case NL80211_IFTYPE_MESH_POINT:
2214		return wdev->u.mesh.beacon_interval;
2215	case NL80211_IFTYPE_ADHOC:
2216		return wdev->u.ibss.beacon_interval;
2217	default:
2218		break;
2219	}
2220
2221	return 0;
2222}
2223
2224static void cfg80211_calculate_bi_data(struct wiphy *wiphy, u32 new_beacon_int,
2225				       u32 *beacon_int_gcd,
2226				       bool *beacon_int_different)
2227{
2228	struct wireless_dev *wdev;
2229
2230	*beacon_int_gcd = 0;
2231	*beacon_int_different = false;
2232
2233	list_for_each_entry(wdev, &wiphy->wdev_list, list) {
2234		int wdev_bi;
2235
2236		/* this feature isn't supported with MLO */
2237		if (wdev->valid_links)
2238			continue;
2239
2240		wdev_bi = cfg80211_wdev_bi(wdev);
2241
2242		if (!wdev_bi)
2243			continue;
2244
2245		if (!*beacon_int_gcd) {
2246			*beacon_int_gcd = wdev_bi;
2247			continue;
2248		}
2249
2250		if (wdev_bi == *beacon_int_gcd)
2251			continue;
2252
2253		*beacon_int_different = true;
2254		*beacon_int_gcd = gcd(*beacon_int_gcd, wdev_bi);
2255	}
2256
2257	if (new_beacon_int && *beacon_int_gcd != new_beacon_int) {
2258		if (*beacon_int_gcd)
2259			*beacon_int_different = true;
2260		*beacon_int_gcd = gcd(*beacon_int_gcd, new_beacon_int);
2261	}
2262}
2263
2264int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
2265				 enum nl80211_iftype iftype, u32 beacon_int)
2266{
2267	/*
2268	 * This is just a basic pre-condition check; if interface combinations
2269	 * are possible the driver must already be checking those with a call
2270	 * to cfg80211_check_combinations(), in which case we'll validate more
2271	 * through the cfg80211_calculate_bi_data() call and code in
2272	 * cfg80211_iter_combinations().
2273	 */
2274
2275	if (beacon_int < 10 || beacon_int > 10000)
2276		return -EINVAL;
2277
2278	return 0;
2279}
2280
2281int cfg80211_iter_combinations(struct wiphy *wiphy,
2282			       struct iface_combination_params *params,
2283			       void (*iter)(const struct ieee80211_iface_combination *c,
2284					    void *data),
2285			       void *data)
2286{
2287	const struct ieee80211_regdomain *regdom;
2288	enum nl80211_dfs_regions region = 0;
2289	int i, j, iftype;
2290	int num_interfaces = 0;
2291	u32 used_iftypes = 0;
2292	u32 beacon_int_gcd;
2293	bool beacon_int_different;
2294
2295	/*
2296	 * This is a bit strange, since the iteration used to rely only on
2297	 * the data given by the driver, but here it now relies on context,
2298	 * in form of the currently operating interfaces.
2299	 * This is OK for all current users, and saves us from having to
2300	 * push the GCD calculations into all the drivers.
2301	 * In the future, this should probably rely more on data that's in
2302	 * cfg80211 already - the only thing not would appear to be any new
2303	 * interfaces (while being brought up) and channel/radar data.
2304	 */
2305	cfg80211_calculate_bi_data(wiphy, params->new_beacon_int,
2306				   &beacon_int_gcd, &beacon_int_different);
2307
2308	if (params->radar_detect) {
2309		rcu_read_lock();
2310		regdom = rcu_dereference(cfg80211_regdomain);
2311		if (regdom)
2312			region = regdom->dfs_region;
2313		rcu_read_unlock();
2314	}
2315
2316	for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
2317		num_interfaces += params->iftype_num[iftype];
2318		if (params->iftype_num[iftype] > 0 &&
2319		    !cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
2320			used_iftypes |= BIT(iftype);
2321	}
2322
2323	for (i = 0; i < wiphy->n_iface_combinations; i++) {
2324		const struct ieee80211_iface_combination *c;
2325		struct ieee80211_iface_limit *limits;
2326		u32 all_iftypes = 0;
2327
2328		c = &wiphy->iface_combinations[i];
2329
2330		if (num_interfaces > c->max_interfaces)
2331			continue;
2332		if (params->num_different_channels > c->num_different_channels)
2333			continue;
2334
2335		limits = kmemdup(c->limits, sizeof(limits[0]) * c->n_limits,
2336				 GFP_KERNEL);
2337		if (!limits)
2338			return -ENOMEM;
2339
2340		for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
2341			if (cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
2342				continue;
2343			for (j = 0; j < c->n_limits; j++) {
2344				all_iftypes |= limits[j].types;
2345				if (!(limits[j].types & BIT(iftype)))
2346					continue;
2347				if (limits[j].max < params->iftype_num[iftype])
2348					goto cont;
2349				limits[j].max -= params->iftype_num[iftype];
2350			}
2351		}
2352
2353		if (params->radar_detect !=
2354			(c->radar_detect_widths & params->radar_detect))
2355			goto cont;
2356
2357		if (params->radar_detect && c->radar_detect_regions &&
2358		    !(c->radar_detect_regions & BIT(region)))
2359			goto cont;
2360
2361		/* Finally check that all iftypes that we're currently
2362		 * using are actually part of this combination. If they
2363		 * aren't then we can't use this combination and have
2364		 * to continue to the next.
2365		 */
2366		if ((all_iftypes & used_iftypes) != used_iftypes)
2367			goto cont;
2368
2369		if (beacon_int_gcd) {
2370			if (c->beacon_int_min_gcd &&
2371			    beacon_int_gcd < c->beacon_int_min_gcd)
2372				goto cont;
2373			if (!c->beacon_int_min_gcd && beacon_int_different)
2374				goto cont;
2375		}
2376
2377		/* This combination covered all interface types and
2378		 * supported the requested numbers, so we're good.
2379		 */
2380
2381		(*iter)(c, data);
2382 cont:
2383		kfree(limits);
2384	}
2385
2386	return 0;
2387}
2388EXPORT_SYMBOL(cfg80211_iter_combinations);
2389
2390static void
2391cfg80211_iter_sum_ifcombs(const struct ieee80211_iface_combination *c,
2392			  void *data)
2393{
2394	int *num = data;
2395	(*num)++;
2396}
2397
2398int cfg80211_check_combinations(struct wiphy *wiphy,
2399				struct iface_combination_params *params)
2400{
2401	int err, num = 0;
2402
2403	err = cfg80211_iter_combinations(wiphy, params,
2404					 cfg80211_iter_sum_ifcombs, &num);
2405	if (err)
2406		return err;
2407	if (num == 0)
2408		return -EBUSY;
2409
2410	return 0;
2411}
2412EXPORT_SYMBOL(cfg80211_check_combinations);
2413
2414int ieee80211_get_ratemask(struct ieee80211_supported_band *sband,
2415			   const u8 *rates, unsigned int n_rates,
2416			   u32 *mask)
2417{
2418	int i, j;
2419
2420	if (!sband)
2421		return -EINVAL;
2422
2423	if (n_rates == 0 || n_rates > NL80211_MAX_SUPP_RATES)
2424		return -EINVAL;
2425
2426	*mask = 0;
2427
2428	for (i = 0; i < n_rates; i++) {
2429		int rate = (rates[i] & 0x7f) * 5;
2430		bool found = false;
2431
2432		for (j = 0; j < sband->n_bitrates; j++) {
2433			if (sband->bitrates[j].bitrate == rate) {
2434				found = true;
2435				*mask |= BIT(j);
2436				break;
2437			}
2438		}
2439		if (!found)
2440			return -EINVAL;
2441	}
2442
2443	/*
2444	 * mask must have at least one bit set here since we
2445	 * didn't accept a 0-length rates array nor allowed
2446	 * entries in the array that didn't exist
2447	 */
2448
2449	return 0;
2450}
2451
2452unsigned int ieee80211_get_num_supported_channels(struct wiphy *wiphy)
2453{
2454	enum nl80211_band band;
2455	unsigned int n_channels = 0;
2456
2457	for (band = 0; band < NUM_NL80211_BANDS; band++)
2458		if (wiphy->bands[band])
2459			n_channels += wiphy->bands[band]->n_channels;
2460
2461	return n_channels;
2462}
2463EXPORT_SYMBOL(ieee80211_get_num_supported_channels);
2464
2465int cfg80211_get_station(struct net_device *dev, const u8 *mac_addr,
2466			 struct station_info *sinfo)
2467{
2468	struct cfg80211_registered_device *rdev;
2469	struct wireless_dev *wdev;
2470
2471	wdev = dev->ieee80211_ptr;
2472	if (!wdev)
2473		return -EOPNOTSUPP;
2474
2475	rdev = wiphy_to_rdev(wdev->wiphy);
2476	if (!rdev->ops->get_station)
2477		return -EOPNOTSUPP;
2478
2479	memset(sinfo, 0, sizeof(*sinfo));
2480
2481	return rdev_get_station(rdev, dev, mac_addr, sinfo);
2482}
2483EXPORT_SYMBOL(cfg80211_get_station);
2484
2485void cfg80211_free_nan_func(struct cfg80211_nan_func *f)
2486{
2487	int i;
2488
2489	if (!f)
2490		return;
2491
2492	kfree(f->serv_spec_info);
2493	kfree(f->srf_bf);
2494	kfree(f->srf_macs);
2495	for (i = 0; i < f->num_rx_filters; i++)
2496		kfree(f->rx_filters[i].filter);
2497
2498	for (i = 0; i < f->num_tx_filters; i++)
2499		kfree(f->tx_filters[i].filter);
2500
2501	kfree(f->rx_filters);
2502	kfree(f->tx_filters);
2503	kfree(f);
2504}
2505EXPORT_SYMBOL(cfg80211_free_nan_func);
2506
2507bool cfg80211_does_bw_fit_range(const struct ieee80211_freq_range *freq_range,
2508				u32 center_freq_khz, u32 bw_khz)
2509{
2510	u32 start_freq_khz, end_freq_khz;
2511
2512	start_freq_khz = center_freq_khz - (bw_khz / 2);
2513	end_freq_khz = center_freq_khz + (bw_khz / 2);
2514
2515	if (start_freq_khz >= freq_range->start_freq_khz &&
2516	    end_freq_khz <= freq_range->end_freq_khz)
2517		return true;
2518
2519	return false;
2520}
2521
2522int cfg80211_sinfo_alloc_tid_stats(struct station_info *sinfo, gfp_t gfp)
2523{
2524	sinfo->pertid = kcalloc(IEEE80211_NUM_TIDS + 1,
2525				sizeof(*(sinfo->pertid)),
2526				gfp);
2527	if (!sinfo->pertid)
2528		return -ENOMEM;
2529
2530	return 0;
2531}
2532EXPORT_SYMBOL(cfg80211_sinfo_alloc_tid_stats);
2533
2534/* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
2535/* Ethernet-II snap header (RFC1042 for most EtherTypes) */
2536const unsigned char rfc1042_header[] __aligned(2) =
2537	{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
2538EXPORT_SYMBOL(rfc1042_header);
2539
2540/* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
2541const unsigned char bridge_tunnel_header[] __aligned(2) =
2542	{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
2543EXPORT_SYMBOL(bridge_tunnel_header);
2544
2545/* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
2546struct iapp_layer2_update {
2547	u8 da[ETH_ALEN];	/* broadcast */
2548	u8 sa[ETH_ALEN];	/* STA addr */
2549	__be16 len;		/* 6 */
2550	u8 dsap;		/* 0 */
2551	u8 ssap;		/* 0 */
2552	u8 control;
2553	u8 xid_info[3];
2554} __packed;
2555
2556void cfg80211_send_layer2_update(struct net_device *dev, const u8 *addr)
2557{
2558	struct iapp_layer2_update *msg;
2559	struct sk_buff *skb;
2560
2561	/* Send Level 2 Update Frame to update forwarding tables in layer 2
2562	 * bridge devices */
2563
2564	skb = dev_alloc_skb(sizeof(*msg));
2565	if (!skb)
2566		return;
2567	msg = skb_put(skb, sizeof(*msg));
2568
2569	/* 802.2 Type 1 Logical Link Control (LLC) Exchange Identifier (XID)
2570	 * Update response frame; IEEE Std 802.2-1998, 5.4.1.2.1 */
2571
2572	eth_broadcast_addr(msg->da);
2573	ether_addr_copy(msg->sa, addr);
2574	msg->len = htons(6);
2575	msg->dsap = 0;
2576	msg->ssap = 0x01;	/* NULL LSAP, CR Bit: Response */
2577	msg->control = 0xaf;	/* XID response lsb.1111F101.
2578				 * F=0 (no poll command; unsolicited frame) */
2579	msg->xid_info[0] = 0x81;	/* XID format identifier */
2580	msg->xid_info[1] = 1;	/* LLC types/classes: Type 1 LLC */
2581	msg->xid_info[2] = 0;	/* XID sender's receive window size (RW) */
2582
2583	skb->dev = dev;
2584	skb->protocol = eth_type_trans(skb, dev);
2585	memset(skb->cb, 0, sizeof(skb->cb));
2586	netif_rx(skb);
2587}
2588EXPORT_SYMBOL(cfg80211_send_layer2_update);
2589
2590int ieee80211_get_vht_max_nss(struct ieee80211_vht_cap *cap,
2591			      enum ieee80211_vht_chanwidth bw,
2592			      int mcs, bool ext_nss_bw_capable,
2593			      unsigned int max_vht_nss)
2594{
2595	u16 map = le16_to_cpu(cap->supp_mcs.rx_mcs_map);
2596	int ext_nss_bw;
2597	int supp_width;
2598	int i, mcs_encoding;
2599
2600	if (map == 0xffff)
2601		return 0;
2602
2603	if (WARN_ON(mcs > 9 || max_vht_nss > 8))
2604		return 0;
2605	if (mcs <= 7)
2606		mcs_encoding = 0;
2607	else if (mcs == 8)
2608		mcs_encoding = 1;
2609	else
2610		mcs_encoding = 2;
2611
2612	if (!max_vht_nss) {
2613		/* find max_vht_nss for the given MCS */
2614		for (i = 7; i >= 0; i--) {
2615			int supp = (map >> (2 * i)) & 3;
2616
2617			if (supp == 3)
2618				continue;
2619
2620			if (supp >= mcs_encoding) {
2621				max_vht_nss = i + 1;
2622				break;
2623			}
2624		}
2625	}
2626
2627	if (!(cap->supp_mcs.tx_mcs_map &
2628			cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE)))
2629		return max_vht_nss;
2630
2631	ext_nss_bw = le32_get_bits(cap->vht_cap_info,
2632				   IEEE80211_VHT_CAP_EXT_NSS_BW_MASK);
2633	supp_width = le32_get_bits(cap->vht_cap_info,
2634				   IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK);
2635
2636	/* if not capable, treat ext_nss_bw as 0 */
2637	if (!ext_nss_bw_capable)
2638		ext_nss_bw = 0;
2639
2640	/* This is invalid */
2641	if (supp_width == 3)
2642		return 0;
2643
2644	/* This is an invalid combination so pretend nothing is supported */
2645	if (supp_width == 2 && (ext_nss_bw == 1 || ext_nss_bw == 2))
2646		return 0;
2647
2648	/*
2649	 * Cover all the special cases according to IEEE 802.11-2016
2650	 * Table 9-250. All other cases are either factor of 1 or not
2651	 * valid/supported.
2652	 */
2653	switch (bw) {
2654	case IEEE80211_VHT_CHANWIDTH_USE_HT:
2655	case IEEE80211_VHT_CHANWIDTH_80MHZ:
2656		if ((supp_width == 1 || supp_width == 2) &&
2657		    ext_nss_bw == 3)
2658			return 2 * max_vht_nss;
2659		break;
2660	case IEEE80211_VHT_CHANWIDTH_160MHZ:
2661		if (supp_width == 0 &&
2662		    (ext_nss_bw == 1 || ext_nss_bw == 2))
2663			return max_vht_nss / 2;
2664		if (supp_width == 0 &&
2665		    ext_nss_bw == 3)
2666			return (3 * max_vht_nss) / 4;
2667		if (supp_width == 1 &&
2668		    ext_nss_bw == 3)
2669			return 2 * max_vht_nss;
2670		break;
2671	case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
2672		if (supp_width == 0 && ext_nss_bw == 1)
2673			return 0; /* not possible */
2674		if (supp_width == 0 &&
2675		    ext_nss_bw == 2)
2676			return max_vht_nss / 2;
2677		if (supp_width == 0 &&
2678		    ext_nss_bw == 3)
2679			return (3 * max_vht_nss) / 4;
2680		if (supp_width == 1 &&
2681		    ext_nss_bw == 0)
2682			return 0; /* not possible */
2683		if (supp_width == 1 &&
2684		    ext_nss_bw == 1)
2685			return max_vht_nss / 2;
2686		if (supp_width == 1 &&
2687		    ext_nss_bw == 2)
2688			return (3 * max_vht_nss) / 4;
2689		break;
2690	}
2691
2692	/* not covered or invalid combination received */
2693	return max_vht_nss;
2694}
2695EXPORT_SYMBOL(ieee80211_get_vht_max_nss);
2696
2697bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype,
2698			     bool is_4addr, u8 check_swif)
2699
2700{
2701	bool is_vlan = iftype == NL80211_IFTYPE_AP_VLAN;
2702
2703	switch (check_swif) {
2704	case 0:
2705		if (is_vlan && is_4addr)
2706			return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
2707		return wiphy->interface_modes & BIT(iftype);
2708	case 1:
2709		if (!(wiphy->software_iftypes & BIT(iftype)) && is_vlan)
2710			return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
2711		return wiphy->software_iftypes & BIT(iftype);
2712	default:
2713		break;
2714	}
2715
2716	return false;
2717}
2718EXPORT_SYMBOL(cfg80211_iftype_allowed);
2719
2720void cfg80211_remove_link(struct wireless_dev *wdev, unsigned int link_id)
2721{
2722	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2723
2724	lockdep_assert_wiphy(wdev->wiphy);
2725
2726	switch (wdev->iftype) {
2727	case NL80211_IFTYPE_AP:
2728	case NL80211_IFTYPE_P2P_GO:
2729		cfg80211_stop_ap(rdev, wdev->netdev, link_id, true);
2730		break;
2731	default:
2732		/* per-link not relevant */
2733		break;
2734	}
2735
2736	wdev->valid_links &= ~BIT(link_id);
2737
2738	rdev_del_intf_link(rdev, wdev, link_id);
2739
2740	eth_zero_addr(wdev->links[link_id].addr);
2741}
2742
2743void cfg80211_remove_links(struct wireless_dev *wdev)
2744{
2745	unsigned int link_id;
2746
2747	/*
2748	 * links are controlled by upper layers (userspace/cfg)
2749	 * only for AP mode, so only remove them here for AP
2750	 */
2751	if (wdev->iftype != NL80211_IFTYPE_AP)
2752		return;
2753
2754	if (wdev->valid_links) {
2755		for_each_valid_link(wdev, link_id)
2756			cfg80211_remove_link(wdev, link_id);
2757	}
2758}
2759
2760int cfg80211_remove_virtual_intf(struct cfg80211_registered_device *rdev,
2761				 struct wireless_dev *wdev)
2762{
2763	cfg80211_remove_links(wdev);
2764
2765	return rdev_del_virtual_intf(rdev, wdev);
2766}
2767
2768const struct wiphy_iftype_ext_capab *
2769cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type)
2770{
2771	int i;
2772
2773	for (i = 0; i < wiphy->num_iftype_ext_capab; i++) {
2774		if (wiphy->iftype_ext_capab[i].iftype == type)
2775			return &wiphy->iftype_ext_capab[i];
2776	}
2777
2778	return NULL;
2779}
2780EXPORT_SYMBOL(cfg80211_get_iftype_ext_capa);