xref: /openbmc/linux/net/mac80211/cfg.c (revision 206204a1)
1 /*
2  * mac80211 configuration hooks for cfg80211
3  *
4  * Copyright 2006-2010	Johannes Berg <johannes@sipsolutions.net>
5  *
6  * This file is GPLv2 as found in COPYING.
7  */
8 
9 #include <linux/ieee80211.h>
10 #include <linux/nl80211.h>
11 #include <linux/rtnetlink.h>
12 #include <linux/slab.h>
13 #include <net/net_namespace.h>
14 #include <linux/rcupdate.h>
15 #include <linux/if_ether.h>
16 #include <net/cfg80211.h>
17 #include "ieee80211_i.h"
18 #include "driver-ops.h"
19 #include "cfg.h"
20 #include "rate.h"
21 #include "mesh.h"
22 
23 static struct wireless_dev *ieee80211_add_iface(struct wiphy *wiphy,
24 						const char *name,
25 						enum nl80211_iftype type,
26 						u32 *flags,
27 						struct vif_params *params)
28 {
29 	struct ieee80211_local *local = wiphy_priv(wiphy);
30 	struct wireless_dev *wdev;
31 	struct ieee80211_sub_if_data *sdata;
32 	int err;
33 
34 	err = ieee80211_if_add(local, name, &wdev, type, params);
35 	if (err)
36 		return ERR_PTR(err);
37 
38 	if (type == NL80211_IFTYPE_MONITOR && flags) {
39 		sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
40 		sdata->u.mntr_flags = *flags;
41 	}
42 
43 	return wdev;
44 }
45 
46 static int ieee80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
47 {
48 	ieee80211_if_remove(IEEE80211_WDEV_TO_SUB_IF(wdev));
49 
50 	return 0;
51 }
52 
53 static int ieee80211_change_iface(struct wiphy *wiphy,
54 				  struct net_device *dev,
55 				  enum nl80211_iftype type, u32 *flags,
56 				  struct vif_params *params)
57 {
58 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
59 	int ret;
60 
61 	ret = ieee80211_if_change_type(sdata, type);
62 	if (ret)
63 		return ret;
64 
65 	if (type == NL80211_IFTYPE_AP_VLAN &&
66 	    params && params->use_4addr == 0)
67 		RCU_INIT_POINTER(sdata->u.vlan.sta, NULL);
68 	else if (type == NL80211_IFTYPE_STATION &&
69 		 params && params->use_4addr >= 0)
70 		sdata->u.mgd.use_4addr = params->use_4addr;
71 
72 	if (sdata->vif.type == NL80211_IFTYPE_MONITOR && flags) {
73 		struct ieee80211_local *local = sdata->local;
74 
75 		if (ieee80211_sdata_running(sdata)) {
76 			u32 mask = MONITOR_FLAG_COOK_FRAMES |
77 				   MONITOR_FLAG_ACTIVE;
78 
79 			/*
80 			 * Prohibit MONITOR_FLAG_COOK_FRAMES and
81 			 * MONITOR_FLAG_ACTIVE to be changed while the
82 			 * interface is up.
83 			 * Else we would need to add a lot of cruft
84 			 * to update everything:
85 			 *	cooked_mntrs, monitor and all fif_* counters
86 			 *	reconfigure hardware
87 			 */
88 			if ((*flags & mask) != (sdata->u.mntr_flags & mask))
89 				return -EBUSY;
90 
91 			ieee80211_adjust_monitor_flags(sdata, -1);
92 			sdata->u.mntr_flags = *flags;
93 			ieee80211_adjust_monitor_flags(sdata, 1);
94 
95 			ieee80211_configure_filter(local);
96 		} else {
97 			/*
98 			 * Because the interface is down, ieee80211_do_stop
99 			 * and ieee80211_do_open take care of "everything"
100 			 * mentioned in the comment above.
101 			 */
102 			sdata->u.mntr_flags = *flags;
103 		}
104 	}
105 
106 	return 0;
107 }
108 
109 static int ieee80211_start_p2p_device(struct wiphy *wiphy,
110 				      struct wireless_dev *wdev)
111 {
112 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
113 	int ret;
114 
115 	mutex_lock(&sdata->local->chanctx_mtx);
116 	ret = ieee80211_check_combinations(sdata, NULL, 0, 0);
117 	mutex_unlock(&sdata->local->chanctx_mtx);
118 	if (ret < 0)
119 		return ret;
120 
121 	return ieee80211_do_open(wdev, true);
122 }
123 
124 static void ieee80211_stop_p2p_device(struct wiphy *wiphy,
125 				      struct wireless_dev *wdev)
126 {
127 	ieee80211_sdata_stop(IEEE80211_WDEV_TO_SUB_IF(wdev));
128 }
129 
130 static int ieee80211_set_noack_map(struct wiphy *wiphy,
131 				  struct net_device *dev,
132 				  u16 noack_map)
133 {
134 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
135 
136 	sdata->noack_map = noack_map;
137 	return 0;
138 }
139 
140 static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
141 			     u8 key_idx, bool pairwise, const u8 *mac_addr,
142 			     struct key_params *params)
143 {
144 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
145 	struct ieee80211_local *local = sdata->local;
146 	struct sta_info *sta = NULL;
147 	const struct ieee80211_cipher_scheme *cs = NULL;
148 	struct ieee80211_key *key;
149 	int err;
150 
151 	if (!ieee80211_sdata_running(sdata))
152 		return -ENETDOWN;
153 
154 	/* reject WEP and TKIP keys if WEP failed to initialize */
155 	switch (params->cipher) {
156 	case WLAN_CIPHER_SUITE_WEP40:
157 	case WLAN_CIPHER_SUITE_TKIP:
158 	case WLAN_CIPHER_SUITE_WEP104:
159 		if (IS_ERR(local->wep_tx_tfm))
160 			return -EINVAL;
161 		break;
162 	case WLAN_CIPHER_SUITE_CCMP:
163 	case WLAN_CIPHER_SUITE_AES_CMAC:
164 	case WLAN_CIPHER_SUITE_GCMP:
165 		break;
166 	default:
167 		cs = ieee80211_cs_get(local, params->cipher, sdata->vif.type);
168 		break;
169 	}
170 
171 	key = ieee80211_key_alloc(params->cipher, key_idx, params->key_len,
172 				  params->key, params->seq_len, params->seq,
173 				  cs);
174 	if (IS_ERR(key))
175 		return PTR_ERR(key);
176 
177 	if (pairwise)
178 		key->conf.flags |= IEEE80211_KEY_FLAG_PAIRWISE;
179 
180 	mutex_lock(&local->sta_mtx);
181 
182 	if (mac_addr) {
183 		if (ieee80211_vif_is_mesh(&sdata->vif))
184 			sta = sta_info_get(sdata, mac_addr);
185 		else
186 			sta = sta_info_get_bss(sdata, mac_addr);
187 		/*
188 		 * The ASSOC test makes sure the driver is ready to
189 		 * receive the key. When wpa_supplicant has roamed
190 		 * using FT, it attempts to set the key before
191 		 * association has completed, this rejects that attempt
192 		 * so it will set the key again after assocation.
193 		 *
194 		 * TODO: accept the key if we have a station entry and
195 		 *       add it to the device after the station.
196 		 */
197 		if (!sta || !test_sta_flag(sta, WLAN_STA_ASSOC)) {
198 			ieee80211_key_free_unused(key);
199 			err = -ENOENT;
200 			goto out_unlock;
201 		}
202 	}
203 
204 	switch (sdata->vif.type) {
205 	case NL80211_IFTYPE_STATION:
206 		if (sdata->u.mgd.mfp != IEEE80211_MFP_DISABLED)
207 			key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT;
208 		break;
209 	case NL80211_IFTYPE_AP:
210 	case NL80211_IFTYPE_AP_VLAN:
211 		/* Keys without a station are used for TX only */
212 		if (key->sta && test_sta_flag(key->sta, WLAN_STA_MFP))
213 			key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT;
214 		break;
215 	case NL80211_IFTYPE_ADHOC:
216 		/* no MFP (yet) */
217 		break;
218 	case NL80211_IFTYPE_MESH_POINT:
219 #ifdef CONFIG_MAC80211_MESH
220 		if (sdata->u.mesh.security != IEEE80211_MESH_SEC_NONE)
221 			key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT;
222 		break;
223 #endif
224 	case NL80211_IFTYPE_WDS:
225 	case NL80211_IFTYPE_MONITOR:
226 	case NL80211_IFTYPE_P2P_DEVICE:
227 	case NL80211_IFTYPE_UNSPECIFIED:
228 	case NUM_NL80211_IFTYPES:
229 	case NL80211_IFTYPE_P2P_CLIENT:
230 	case NL80211_IFTYPE_P2P_GO:
231 		/* shouldn't happen */
232 		WARN_ON_ONCE(1);
233 		break;
234 	}
235 
236 	if (sta)
237 		sta->cipher_scheme = cs;
238 
239 	err = ieee80211_key_link(key, sdata, sta);
240 
241  out_unlock:
242 	mutex_unlock(&local->sta_mtx);
243 
244 	return err;
245 }
246 
247 static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
248 			     u8 key_idx, bool pairwise, const u8 *mac_addr)
249 {
250 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
251 	struct ieee80211_local *local = sdata->local;
252 	struct sta_info *sta;
253 	struct ieee80211_key *key = NULL;
254 	int ret;
255 
256 	mutex_lock(&local->sta_mtx);
257 	mutex_lock(&local->key_mtx);
258 
259 	if (mac_addr) {
260 		ret = -ENOENT;
261 
262 		sta = sta_info_get_bss(sdata, mac_addr);
263 		if (!sta)
264 			goto out_unlock;
265 
266 		if (pairwise)
267 			key = key_mtx_dereference(local, sta->ptk[key_idx]);
268 		else
269 			key = key_mtx_dereference(local, sta->gtk[key_idx]);
270 	} else
271 		key = key_mtx_dereference(local, sdata->keys[key_idx]);
272 
273 	if (!key) {
274 		ret = -ENOENT;
275 		goto out_unlock;
276 	}
277 
278 	ieee80211_key_free(key, true);
279 
280 	ret = 0;
281  out_unlock:
282 	mutex_unlock(&local->key_mtx);
283 	mutex_unlock(&local->sta_mtx);
284 
285 	return ret;
286 }
287 
288 static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
289 			     u8 key_idx, bool pairwise, const u8 *mac_addr,
290 			     void *cookie,
291 			     void (*callback)(void *cookie,
292 					      struct key_params *params))
293 {
294 	struct ieee80211_sub_if_data *sdata;
295 	struct sta_info *sta = NULL;
296 	u8 seq[6] = {0};
297 	struct key_params params;
298 	struct ieee80211_key *key = NULL;
299 	u64 pn64;
300 	u32 iv32;
301 	u16 iv16;
302 	int err = -ENOENT;
303 
304 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
305 
306 	rcu_read_lock();
307 
308 	if (mac_addr) {
309 		sta = sta_info_get_bss(sdata, mac_addr);
310 		if (!sta)
311 			goto out;
312 
313 		if (pairwise && key_idx < NUM_DEFAULT_KEYS)
314 			key = rcu_dereference(sta->ptk[key_idx]);
315 		else if (!pairwise &&
316 			 key_idx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
317 			key = rcu_dereference(sta->gtk[key_idx]);
318 	} else
319 		key = rcu_dereference(sdata->keys[key_idx]);
320 
321 	if (!key)
322 		goto out;
323 
324 	memset(&params, 0, sizeof(params));
325 
326 	params.cipher = key->conf.cipher;
327 
328 	switch (key->conf.cipher) {
329 	case WLAN_CIPHER_SUITE_TKIP:
330 		iv32 = key->u.tkip.tx.iv32;
331 		iv16 = key->u.tkip.tx.iv16;
332 
333 		if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
334 			drv_get_tkip_seq(sdata->local,
335 					 key->conf.hw_key_idx,
336 					 &iv32, &iv16);
337 
338 		seq[0] = iv16 & 0xff;
339 		seq[1] = (iv16 >> 8) & 0xff;
340 		seq[2] = iv32 & 0xff;
341 		seq[3] = (iv32 >> 8) & 0xff;
342 		seq[4] = (iv32 >> 16) & 0xff;
343 		seq[5] = (iv32 >> 24) & 0xff;
344 		params.seq = seq;
345 		params.seq_len = 6;
346 		break;
347 	case WLAN_CIPHER_SUITE_CCMP:
348 		pn64 = atomic64_read(&key->u.ccmp.tx_pn);
349 		seq[0] = pn64;
350 		seq[1] = pn64 >> 8;
351 		seq[2] = pn64 >> 16;
352 		seq[3] = pn64 >> 24;
353 		seq[4] = pn64 >> 32;
354 		seq[5] = pn64 >> 40;
355 		params.seq = seq;
356 		params.seq_len = 6;
357 		break;
358 	case WLAN_CIPHER_SUITE_AES_CMAC:
359 		pn64 = atomic64_read(&key->u.aes_cmac.tx_pn);
360 		seq[0] = pn64;
361 		seq[1] = pn64 >> 8;
362 		seq[2] = pn64 >> 16;
363 		seq[3] = pn64 >> 24;
364 		seq[4] = pn64 >> 32;
365 		seq[5] = pn64 >> 40;
366 		params.seq = seq;
367 		params.seq_len = 6;
368 		break;
369 	}
370 
371 	params.key = key->conf.key;
372 	params.key_len = key->conf.keylen;
373 
374 	callback(cookie, &params);
375 	err = 0;
376 
377  out:
378 	rcu_read_unlock();
379 	return err;
380 }
381 
382 static int ieee80211_config_default_key(struct wiphy *wiphy,
383 					struct net_device *dev,
384 					u8 key_idx, bool uni,
385 					bool multi)
386 {
387 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
388 
389 	ieee80211_set_default_key(sdata, key_idx, uni, multi);
390 
391 	return 0;
392 }
393 
394 static int ieee80211_config_default_mgmt_key(struct wiphy *wiphy,
395 					     struct net_device *dev,
396 					     u8 key_idx)
397 {
398 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
399 
400 	ieee80211_set_default_mgmt_key(sdata, key_idx);
401 
402 	return 0;
403 }
404 
405 void sta_set_rate_info_tx(struct sta_info *sta,
406 			  const struct ieee80211_tx_rate *rate,
407 			  struct rate_info *rinfo)
408 {
409 	rinfo->flags = 0;
410 	if (rate->flags & IEEE80211_TX_RC_MCS) {
411 		rinfo->flags |= RATE_INFO_FLAGS_MCS;
412 		rinfo->mcs = rate->idx;
413 	} else if (rate->flags & IEEE80211_TX_RC_VHT_MCS) {
414 		rinfo->flags |= RATE_INFO_FLAGS_VHT_MCS;
415 		rinfo->mcs = ieee80211_rate_get_vht_mcs(rate);
416 		rinfo->nss = ieee80211_rate_get_vht_nss(rate);
417 	} else {
418 		struct ieee80211_supported_band *sband;
419 		int shift = ieee80211_vif_get_shift(&sta->sdata->vif);
420 		u16 brate;
421 
422 		sband = sta->local->hw.wiphy->bands[
423 				ieee80211_get_sdata_band(sta->sdata)];
424 		brate = sband->bitrates[rate->idx].bitrate;
425 		rinfo->legacy = DIV_ROUND_UP(brate, 1 << shift);
426 	}
427 	if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
428 		rinfo->flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
429 	if (rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
430 		rinfo->flags |= RATE_INFO_FLAGS_80_MHZ_WIDTH;
431 	if (rate->flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
432 		rinfo->flags |= RATE_INFO_FLAGS_160_MHZ_WIDTH;
433 	if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
434 		rinfo->flags |= RATE_INFO_FLAGS_SHORT_GI;
435 }
436 
437 void sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
438 {
439 	rinfo->flags = 0;
440 
441 	if (sta->last_rx_rate_flag & RX_FLAG_HT) {
442 		rinfo->flags |= RATE_INFO_FLAGS_MCS;
443 		rinfo->mcs = sta->last_rx_rate_idx;
444 	} else if (sta->last_rx_rate_flag & RX_FLAG_VHT) {
445 		rinfo->flags |= RATE_INFO_FLAGS_VHT_MCS;
446 		rinfo->nss = sta->last_rx_rate_vht_nss;
447 		rinfo->mcs = sta->last_rx_rate_idx;
448 	} else {
449 		struct ieee80211_supported_band *sband;
450 		int shift = ieee80211_vif_get_shift(&sta->sdata->vif);
451 		u16 brate;
452 
453 		sband = sta->local->hw.wiphy->bands[
454 				ieee80211_get_sdata_band(sta->sdata)];
455 		brate = sband->bitrates[sta->last_rx_rate_idx].bitrate;
456 		rinfo->legacy = DIV_ROUND_UP(brate, 1 << shift);
457 	}
458 
459 	if (sta->last_rx_rate_flag & RX_FLAG_40MHZ)
460 		rinfo->flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
461 	if (sta->last_rx_rate_flag & RX_FLAG_SHORT_GI)
462 		rinfo->flags |= RATE_INFO_FLAGS_SHORT_GI;
463 	if (sta->last_rx_rate_vht_flag & RX_VHT_FLAG_80MHZ)
464 		rinfo->flags |= RATE_INFO_FLAGS_80_MHZ_WIDTH;
465 	if (sta->last_rx_rate_vht_flag & RX_VHT_FLAG_80P80MHZ)
466 		rinfo->flags |= RATE_INFO_FLAGS_80P80_MHZ_WIDTH;
467 	if (sta->last_rx_rate_vht_flag & RX_VHT_FLAG_160MHZ)
468 		rinfo->flags |= RATE_INFO_FLAGS_160_MHZ_WIDTH;
469 }
470 
471 static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
472 {
473 	struct ieee80211_sub_if_data *sdata = sta->sdata;
474 	struct ieee80211_local *local = sdata->local;
475 	struct rate_control_ref *ref = local->rate_ctrl;
476 	struct timespec uptime;
477 	u64 packets = 0;
478 	u32 thr = 0;
479 	int i, ac;
480 
481 	sinfo->generation = sdata->local->sta_generation;
482 
483 	sinfo->filled = STATION_INFO_INACTIVE_TIME |
484 			STATION_INFO_RX_BYTES64 |
485 			STATION_INFO_TX_BYTES64 |
486 			STATION_INFO_RX_PACKETS |
487 			STATION_INFO_TX_PACKETS |
488 			STATION_INFO_TX_RETRIES |
489 			STATION_INFO_TX_FAILED |
490 			STATION_INFO_TX_BITRATE |
491 			STATION_INFO_RX_BITRATE |
492 			STATION_INFO_RX_DROP_MISC |
493 			STATION_INFO_BSS_PARAM |
494 			STATION_INFO_CONNECTED_TIME |
495 			STATION_INFO_STA_FLAGS |
496 			STATION_INFO_BEACON_LOSS_COUNT;
497 
498 	do_posix_clock_monotonic_gettime(&uptime);
499 	sinfo->connected_time = uptime.tv_sec - sta->last_connected;
500 
501 	sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
502 	sinfo->tx_bytes = 0;
503 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
504 		sinfo->tx_bytes += sta->tx_bytes[ac];
505 		packets += sta->tx_packets[ac];
506 	}
507 	sinfo->tx_packets = packets;
508 	sinfo->rx_bytes = sta->rx_bytes;
509 	sinfo->rx_packets = sta->rx_packets;
510 	sinfo->tx_retries = sta->tx_retry_count;
511 	sinfo->tx_failed = sta->tx_retry_failed;
512 	sinfo->rx_dropped_misc = sta->rx_dropped;
513 	sinfo->beacon_loss_count = sta->beacon_loss_count;
514 
515 	if ((sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) ||
516 	    (sta->local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)) {
517 		sinfo->filled |= STATION_INFO_SIGNAL | STATION_INFO_SIGNAL_AVG;
518 		if (!local->ops->get_rssi ||
519 		    drv_get_rssi(local, sdata, &sta->sta, &sinfo->signal))
520 			sinfo->signal = (s8)sta->last_signal;
521 		sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
522 	}
523 	if (sta->chains) {
524 		sinfo->filled |= STATION_INFO_CHAIN_SIGNAL |
525 				 STATION_INFO_CHAIN_SIGNAL_AVG;
526 
527 		sinfo->chains = sta->chains;
528 		for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
529 			sinfo->chain_signal[i] = sta->chain_signal_last[i];
530 			sinfo->chain_signal_avg[i] =
531 				(s8) -ewma_read(&sta->chain_signal_avg[i]);
532 		}
533 	}
534 
535 	sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
536 	sta_set_rate_info_rx(sta, &sinfo->rxrate);
537 
538 	if (ieee80211_vif_is_mesh(&sdata->vif)) {
539 #ifdef CONFIG_MAC80211_MESH
540 		sinfo->filled |= STATION_INFO_LLID |
541 				 STATION_INFO_PLID |
542 				 STATION_INFO_PLINK_STATE |
543 				 STATION_INFO_LOCAL_PM |
544 				 STATION_INFO_PEER_PM |
545 				 STATION_INFO_NONPEER_PM;
546 
547 		sinfo->llid = sta->llid;
548 		sinfo->plid = sta->plid;
549 		sinfo->plink_state = sta->plink_state;
550 		if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
551 			sinfo->filled |= STATION_INFO_T_OFFSET;
552 			sinfo->t_offset = sta->t_offset;
553 		}
554 		sinfo->local_pm = sta->local_pm;
555 		sinfo->peer_pm = sta->peer_pm;
556 		sinfo->nonpeer_pm = sta->nonpeer_pm;
557 #endif
558 	}
559 
560 	sinfo->bss_param.flags = 0;
561 	if (sdata->vif.bss_conf.use_cts_prot)
562 		sinfo->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
563 	if (sdata->vif.bss_conf.use_short_preamble)
564 		sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
565 	if (sdata->vif.bss_conf.use_short_slot)
566 		sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
567 	sinfo->bss_param.dtim_period = sdata->local->hw.conf.ps_dtim_period;
568 	sinfo->bss_param.beacon_interval = sdata->vif.bss_conf.beacon_int;
569 
570 	sinfo->sta_flags.set = 0;
571 	sinfo->sta_flags.mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
572 				BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
573 				BIT(NL80211_STA_FLAG_WME) |
574 				BIT(NL80211_STA_FLAG_MFP) |
575 				BIT(NL80211_STA_FLAG_AUTHENTICATED) |
576 				BIT(NL80211_STA_FLAG_ASSOCIATED) |
577 				BIT(NL80211_STA_FLAG_TDLS_PEER);
578 	if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
579 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
580 	if (test_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE))
581 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
582 	if (test_sta_flag(sta, WLAN_STA_WME))
583 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_WME);
584 	if (test_sta_flag(sta, WLAN_STA_MFP))
585 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
586 	if (test_sta_flag(sta, WLAN_STA_AUTH))
587 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
588 	if (test_sta_flag(sta, WLAN_STA_ASSOC))
589 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
590 	if (test_sta_flag(sta, WLAN_STA_TDLS_PEER))
591 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
592 
593 	/* check if the driver has a SW RC implementation */
594 	if (ref && ref->ops->get_expected_throughput)
595 		thr = ref->ops->get_expected_throughput(sta->rate_ctrl_priv);
596 	else
597 		thr = drv_get_expected_throughput(local, &sta->sta);
598 
599 	if (thr != 0) {
600 		sinfo->filled |= STATION_INFO_EXPECTED_THROUGHPUT;
601 		sinfo->expected_throughput = thr;
602 	}
603 }
604 
605 static const char ieee80211_gstrings_sta_stats[][ETH_GSTRING_LEN] = {
606 	"rx_packets", "rx_bytes", "wep_weak_iv_count",
607 	"rx_duplicates", "rx_fragments", "rx_dropped",
608 	"tx_packets", "tx_bytes", "tx_fragments",
609 	"tx_filtered", "tx_retry_failed", "tx_retries",
610 	"beacon_loss", "sta_state", "txrate", "rxrate", "signal",
611 	"channel", "noise", "ch_time", "ch_time_busy",
612 	"ch_time_ext_busy", "ch_time_rx", "ch_time_tx"
613 };
614 #define STA_STATS_LEN	ARRAY_SIZE(ieee80211_gstrings_sta_stats)
615 
616 static int ieee80211_get_et_sset_count(struct wiphy *wiphy,
617 				       struct net_device *dev,
618 				       int sset)
619 {
620 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
621 	int rv = 0;
622 
623 	if (sset == ETH_SS_STATS)
624 		rv += STA_STATS_LEN;
625 
626 	rv += drv_get_et_sset_count(sdata, sset);
627 
628 	if (rv == 0)
629 		return -EOPNOTSUPP;
630 	return rv;
631 }
632 
633 static void ieee80211_get_et_stats(struct wiphy *wiphy,
634 				   struct net_device *dev,
635 				   struct ethtool_stats *stats,
636 				   u64 *data)
637 {
638 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
639 	struct ieee80211_chanctx_conf *chanctx_conf;
640 	struct ieee80211_channel *channel;
641 	struct sta_info *sta;
642 	struct ieee80211_local *local = sdata->local;
643 	struct station_info sinfo;
644 	struct survey_info survey;
645 	int i, q;
646 #define STA_STATS_SURVEY_LEN 7
647 
648 	memset(data, 0, sizeof(u64) * STA_STATS_LEN);
649 
650 #define ADD_STA_STATS(sta)				\
651 	do {						\
652 		data[i++] += sta->rx_packets;		\
653 		data[i++] += sta->rx_bytes;		\
654 		data[i++] += sta->wep_weak_iv_count;	\
655 		data[i++] += sta->num_duplicates;	\
656 		data[i++] += sta->rx_fragments;		\
657 		data[i++] += sta->rx_dropped;		\
658 							\
659 		data[i++] += sinfo.tx_packets;		\
660 		data[i++] += sinfo.tx_bytes;		\
661 		data[i++] += sta->tx_fragments;		\
662 		data[i++] += sta->tx_filtered_count;	\
663 		data[i++] += sta->tx_retry_failed;	\
664 		data[i++] += sta->tx_retry_count;	\
665 		data[i++] += sta->beacon_loss_count;	\
666 	} while (0)
667 
668 	/* For Managed stations, find the single station based on BSSID
669 	 * and use that.  For interface types, iterate through all available
670 	 * stations and add stats for any station that is assigned to this
671 	 * network device.
672 	 */
673 
674 	mutex_lock(&local->sta_mtx);
675 
676 	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
677 		sta = sta_info_get_bss(sdata, sdata->u.mgd.bssid);
678 
679 		if (!(sta && !WARN_ON(sta->sdata->dev != dev)))
680 			goto do_survey;
681 
682 		sinfo.filled = 0;
683 		sta_set_sinfo(sta, &sinfo);
684 
685 		i = 0;
686 		ADD_STA_STATS(sta);
687 
688 		data[i++] = sta->sta_state;
689 
690 
691 		if (sinfo.filled & STATION_INFO_TX_BITRATE)
692 			data[i] = 100000 *
693 				cfg80211_calculate_bitrate(&sinfo.txrate);
694 		i++;
695 		if (sinfo.filled & STATION_INFO_RX_BITRATE)
696 			data[i] = 100000 *
697 				cfg80211_calculate_bitrate(&sinfo.rxrate);
698 		i++;
699 
700 		if (sinfo.filled & STATION_INFO_SIGNAL_AVG)
701 			data[i] = (u8)sinfo.signal_avg;
702 		i++;
703 	} else {
704 		list_for_each_entry(sta, &local->sta_list, list) {
705 			/* Make sure this station belongs to the proper dev */
706 			if (sta->sdata->dev != dev)
707 				continue;
708 
709 			sinfo.filled = 0;
710 			sta_set_sinfo(sta, &sinfo);
711 			i = 0;
712 			ADD_STA_STATS(sta);
713 		}
714 	}
715 
716 do_survey:
717 	i = STA_STATS_LEN - STA_STATS_SURVEY_LEN;
718 	/* Get survey stats for current channel */
719 	survey.filled = 0;
720 
721 	rcu_read_lock();
722 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
723 	if (chanctx_conf)
724 		channel = chanctx_conf->def.chan;
725 	else
726 		channel = NULL;
727 	rcu_read_unlock();
728 
729 	if (channel) {
730 		q = 0;
731 		do {
732 			survey.filled = 0;
733 			if (drv_get_survey(local, q, &survey) != 0) {
734 				survey.filled = 0;
735 				break;
736 			}
737 			q++;
738 		} while (channel != survey.channel);
739 	}
740 
741 	if (survey.filled)
742 		data[i++] = survey.channel->center_freq;
743 	else
744 		data[i++] = 0;
745 	if (survey.filled & SURVEY_INFO_NOISE_DBM)
746 		data[i++] = (u8)survey.noise;
747 	else
748 		data[i++] = -1LL;
749 	if (survey.filled & SURVEY_INFO_CHANNEL_TIME)
750 		data[i++] = survey.channel_time;
751 	else
752 		data[i++] = -1LL;
753 	if (survey.filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
754 		data[i++] = survey.channel_time_busy;
755 	else
756 		data[i++] = -1LL;
757 	if (survey.filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
758 		data[i++] = survey.channel_time_ext_busy;
759 	else
760 		data[i++] = -1LL;
761 	if (survey.filled & SURVEY_INFO_CHANNEL_TIME_RX)
762 		data[i++] = survey.channel_time_rx;
763 	else
764 		data[i++] = -1LL;
765 	if (survey.filled & SURVEY_INFO_CHANNEL_TIME_TX)
766 		data[i++] = survey.channel_time_tx;
767 	else
768 		data[i++] = -1LL;
769 
770 	mutex_unlock(&local->sta_mtx);
771 
772 	if (WARN_ON(i != STA_STATS_LEN))
773 		return;
774 
775 	drv_get_et_stats(sdata, stats, &(data[STA_STATS_LEN]));
776 }
777 
778 static void ieee80211_get_et_strings(struct wiphy *wiphy,
779 				     struct net_device *dev,
780 				     u32 sset, u8 *data)
781 {
782 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
783 	int sz_sta_stats = 0;
784 
785 	if (sset == ETH_SS_STATS) {
786 		sz_sta_stats = sizeof(ieee80211_gstrings_sta_stats);
787 		memcpy(data, ieee80211_gstrings_sta_stats, sz_sta_stats);
788 	}
789 	drv_get_et_strings(sdata, sset, &(data[sz_sta_stats]));
790 }
791 
792 static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
793 				  int idx, u8 *mac, struct station_info *sinfo)
794 {
795 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
796 	struct ieee80211_local *local = sdata->local;
797 	struct sta_info *sta;
798 	int ret = -ENOENT;
799 
800 	mutex_lock(&local->sta_mtx);
801 
802 	sta = sta_info_get_by_idx(sdata, idx);
803 	if (sta) {
804 		ret = 0;
805 		memcpy(mac, sta->sta.addr, ETH_ALEN);
806 		sta_set_sinfo(sta, sinfo);
807 	}
808 
809 	mutex_unlock(&local->sta_mtx);
810 
811 	return ret;
812 }
813 
814 static int ieee80211_dump_survey(struct wiphy *wiphy, struct net_device *dev,
815 				 int idx, struct survey_info *survey)
816 {
817 	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
818 
819 	return drv_get_survey(local, idx, survey);
820 }
821 
822 static int ieee80211_get_station(struct wiphy *wiphy, struct net_device *dev,
823 				 const u8 *mac, struct station_info *sinfo)
824 {
825 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
826 	struct ieee80211_local *local = sdata->local;
827 	struct sta_info *sta;
828 	int ret = -ENOENT;
829 
830 	mutex_lock(&local->sta_mtx);
831 
832 	sta = sta_info_get_bss(sdata, mac);
833 	if (sta) {
834 		ret = 0;
835 		sta_set_sinfo(sta, sinfo);
836 	}
837 
838 	mutex_unlock(&local->sta_mtx);
839 
840 	return ret;
841 }
842 
843 static int ieee80211_set_monitor_channel(struct wiphy *wiphy,
844 					 struct cfg80211_chan_def *chandef)
845 {
846 	struct ieee80211_local *local = wiphy_priv(wiphy);
847 	struct ieee80211_sub_if_data *sdata;
848 	int ret = 0;
849 
850 	if (cfg80211_chandef_identical(&local->monitor_chandef, chandef))
851 		return 0;
852 
853 	mutex_lock(&local->mtx);
854 	mutex_lock(&local->iflist_mtx);
855 	if (local->use_chanctx) {
856 		sdata = rcu_dereference_protected(
857 				local->monitor_sdata,
858 				lockdep_is_held(&local->iflist_mtx));
859 		if (sdata) {
860 			ieee80211_vif_release_channel(sdata);
861 			ret = ieee80211_vif_use_channel(sdata, chandef,
862 					IEEE80211_CHANCTX_EXCLUSIVE);
863 		}
864 	} else if (local->open_count == local->monitors) {
865 		local->_oper_chandef = *chandef;
866 		ieee80211_hw_config(local, 0);
867 	}
868 
869 	if (ret == 0)
870 		local->monitor_chandef = *chandef;
871 	mutex_unlock(&local->iflist_mtx);
872 	mutex_unlock(&local->mtx);
873 
874 	return ret;
875 }
876 
877 static int ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
878 				    const u8 *resp, size_t resp_len)
879 {
880 	struct probe_resp *new, *old;
881 
882 	if (!resp || !resp_len)
883 		return 1;
884 
885 	old = sdata_dereference(sdata->u.ap.probe_resp, sdata);
886 
887 	new = kzalloc(sizeof(struct probe_resp) + resp_len, GFP_KERNEL);
888 	if (!new)
889 		return -ENOMEM;
890 
891 	new->len = resp_len;
892 	memcpy(new->data, resp, resp_len);
893 
894 	rcu_assign_pointer(sdata->u.ap.probe_resp, new);
895 	if (old)
896 		kfree_rcu(old, rcu_head);
897 
898 	return 0;
899 }
900 
901 static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
902 				   struct cfg80211_beacon_data *params)
903 {
904 	struct beacon_data *new, *old;
905 	int new_head_len, new_tail_len;
906 	int size, err;
907 	u32 changed = BSS_CHANGED_BEACON;
908 
909 	old = sdata_dereference(sdata->u.ap.beacon, sdata);
910 
911 
912 	/* Need to have a beacon head if we don't have one yet */
913 	if (!params->head && !old)
914 		return -EINVAL;
915 
916 	/* new or old head? */
917 	if (params->head)
918 		new_head_len = params->head_len;
919 	else
920 		new_head_len = old->head_len;
921 
922 	/* new or old tail? */
923 	if (params->tail || !old)
924 		/* params->tail_len will be zero for !params->tail */
925 		new_tail_len = params->tail_len;
926 	else
927 		new_tail_len = old->tail_len;
928 
929 	size = sizeof(*new) + new_head_len + new_tail_len;
930 
931 	new = kzalloc(size, GFP_KERNEL);
932 	if (!new)
933 		return -ENOMEM;
934 
935 	/* start filling the new info now */
936 
937 	/*
938 	 * pointers go into the block we allocated,
939 	 * memory is | beacon_data | head | tail |
940 	 */
941 	new->head = ((u8 *) new) + sizeof(*new);
942 	new->tail = new->head + new_head_len;
943 	new->head_len = new_head_len;
944 	new->tail_len = new_tail_len;
945 
946 	/* copy in head */
947 	if (params->head)
948 		memcpy(new->head, params->head, new_head_len);
949 	else
950 		memcpy(new->head, old->head, new_head_len);
951 
952 	/* copy in optional tail */
953 	if (params->tail)
954 		memcpy(new->tail, params->tail, new_tail_len);
955 	else
956 		if (old)
957 			memcpy(new->tail, old->tail, new_tail_len);
958 
959 	err = ieee80211_set_probe_resp(sdata, params->probe_resp,
960 				       params->probe_resp_len);
961 	if (err < 0)
962 		return err;
963 	if (err == 0)
964 		changed |= BSS_CHANGED_AP_PROBE_RESP;
965 
966 	rcu_assign_pointer(sdata->u.ap.beacon, new);
967 
968 	if (old)
969 		kfree_rcu(old, rcu_head);
970 
971 	return changed;
972 }
973 
974 static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
975 			      struct cfg80211_ap_settings *params)
976 {
977 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
978 	struct ieee80211_local *local = sdata->local;
979 	struct beacon_data *old;
980 	struct ieee80211_sub_if_data *vlan;
981 	u32 changed = BSS_CHANGED_BEACON_INT |
982 		      BSS_CHANGED_BEACON_ENABLED |
983 		      BSS_CHANGED_BEACON |
984 		      BSS_CHANGED_SSID |
985 		      BSS_CHANGED_P2P_PS;
986 	int err;
987 
988 	old = sdata_dereference(sdata->u.ap.beacon, sdata);
989 	if (old)
990 		return -EALREADY;
991 
992 	/* TODO: make hostapd tell us what it wants */
993 	sdata->smps_mode = IEEE80211_SMPS_OFF;
994 	sdata->needed_rx_chains = sdata->local->rx_chains;
995 
996 	mutex_lock(&local->mtx);
997 	err = ieee80211_vif_use_channel(sdata, &params->chandef,
998 					IEEE80211_CHANCTX_SHARED);
999 	if (!err)
1000 		ieee80211_vif_copy_chanctx_to_vlans(sdata, false);
1001 	mutex_unlock(&local->mtx);
1002 	if (err)
1003 		return err;
1004 
1005 	/*
1006 	 * Apply control port protocol, this allows us to
1007 	 * not encrypt dynamic WEP control frames.
1008 	 */
1009 	sdata->control_port_protocol = params->crypto.control_port_ethertype;
1010 	sdata->control_port_no_encrypt = params->crypto.control_port_no_encrypt;
1011 	sdata->encrypt_headroom = ieee80211_cs_headroom(sdata->local,
1012 							&params->crypto,
1013 							sdata->vif.type);
1014 
1015 	list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list) {
1016 		vlan->control_port_protocol =
1017 			params->crypto.control_port_ethertype;
1018 		vlan->control_port_no_encrypt =
1019 			params->crypto.control_port_no_encrypt;
1020 		vlan->encrypt_headroom =
1021 			ieee80211_cs_headroom(sdata->local,
1022 					      &params->crypto,
1023 					      vlan->vif.type);
1024 	}
1025 
1026 	sdata->vif.bss_conf.beacon_int = params->beacon_interval;
1027 	sdata->vif.bss_conf.dtim_period = params->dtim_period;
1028 	sdata->vif.bss_conf.enable_beacon = true;
1029 
1030 	sdata->vif.bss_conf.ssid_len = params->ssid_len;
1031 	if (params->ssid_len)
1032 		memcpy(sdata->vif.bss_conf.ssid, params->ssid,
1033 		       params->ssid_len);
1034 	sdata->vif.bss_conf.hidden_ssid =
1035 		(params->hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE);
1036 
1037 	memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
1038 	       sizeof(sdata->vif.bss_conf.p2p_noa_attr));
1039 	sdata->vif.bss_conf.p2p_noa_attr.oppps_ctwindow =
1040 		params->p2p_ctwindow & IEEE80211_P2P_OPPPS_CTWINDOW_MASK;
1041 	if (params->p2p_opp_ps)
1042 		sdata->vif.bss_conf.p2p_noa_attr.oppps_ctwindow |=
1043 					IEEE80211_P2P_OPPPS_ENABLE_BIT;
1044 
1045 	err = ieee80211_assign_beacon(sdata, &params->beacon);
1046 	if (err < 0) {
1047 		ieee80211_vif_release_channel(sdata);
1048 		return err;
1049 	}
1050 	changed |= err;
1051 
1052 	err = drv_start_ap(sdata->local, sdata);
1053 	if (err) {
1054 		old = sdata_dereference(sdata->u.ap.beacon, sdata);
1055 
1056 		if (old)
1057 			kfree_rcu(old, rcu_head);
1058 		RCU_INIT_POINTER(sdata->u.ap.beacon, NULL);
1059 		ieee80211_vif_release_channel(sdata);
1060 		return err;
1061 	}
1062 
1063 	ieee80211_recalc_dtim(local, sdata);
1064 	ieee80211_bss_info_change_notify(sdata, changed);
1065 
1066 	netif_carrier_on(dev);
1067 	list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
1068 		netif_carrier_on(vlan->dev);
1069 
1070 	return 0;
1071 }
1072 
1073 static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
1074 				   struct cfg80211_beacon_data *params)
1075 {
1076 	struct ieee80211_sub_if_data *sdata;
1077 	struct beacon_data *old;
1078 	int err;
1079 
1080 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1081 	sdata_assert_lock(sdata);
1082 
1083 	/* don't allow changing the beacon while CSA is in place - offset
1084 	 * of channel switch counter may change
1085 	 */
1086 	if (sdata->vif.csa_active)
1087 		return -EBUSY;
1088 
1089 	old = sdata_dereference(sdata->u.ap.beacon, sdata);
1090 	if (!old)
1091 		return -ENOENT;
1092 
1093 	err = ieee80211_assign_beacon(sdata, params);
1094 	if (err < 0)
1095 		return err;
1096 	ieee80211_bss_info_change_notify(sdata, err);
1097 	return 0;
1098 }
1099 
1100 bool ieee80211_csa_needs_block_tx(struct ieee80211_local *local)
1101 {
1102 	struct ieee80211_sub_if_data *sdata;
1103 
1104 	lockdep_assert_held(&local->mtx);
1105 
1106 	rcu_read_lock();
1107 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1108 		if (!ieee80211_sdata_running(sdata))
1109 			continue;
1110 
1111 		if (!sdata->vif.csa_active)
1112 			continue;
1113 
1114 		if (!sdata->csa_block_tx)
1115 			continue;
1116 
1117 		rcu_read_unlock();
1118 		return true;
1119 	}
1120 	rcu_read_unlock();
1121 
1122 	return false;
1123 }
1124 
1125 static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
1126 {
1127 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1128 	struct ieee80211_sub_if_data *vlan;
1129 	struct ieee80211_local *local = sdata->local;
1130 	struct beacon_data *old_beacon;
1131 	struct probe_resp *old_probe_resp;
1132 	struct cfg80211_chan_def chandef;
1133 
1134 	sdata_assert_lock(sdata);
1135 
1136 	old_beacon = sdata_dereference(sdata->u.ap.beacon, sdata);
1137 	if (!old_beacon)
1138 		return -ENOENT;
1139 	old_probe_resp = sdata_dereference(sdata->u.ap.probe_resp, sdata);
1140 
1141 	/* abort any running channel switch */
1142 	mutex_lock(&local->mtx);
1143 	sdata->vif.csa_active = false;
1144 	if (!ieee80211_csa_needs_block_tx(local))
1145 		ieee80211_wake_queues_by_reason(&local->hw,
1146 					IEEE80211_MAX_QUEUE_MAP,
1147 					IEEE80211_QUEUE_STOP_REASON_CSA);
1148 	mutex_unlock(&local->mtx);
1149 
1150 	kfree(sdata->u.ap.next_beacon);
1151 	sdata->u.ap.next_beacon = NULL;
1152 
1153 	/* turn off carrier for this interface and dependent VLANs */
1154 	list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
1155 		netif_carrier_off(vlan->dev);
1156 	netif_carrier_off(dev);
1157 
1158 	/* remove beacon and probe response */
1159 	RCU_INIT_POINTER(sdata->u.ap.beacon, NULL);
1160 	RCU_INIT_POINTER(sdata->u.ap.probe_resp, NULL);
1161 	kfree_rcu(old_beacon, rcu_head);
1162 	if (old_probe_resp)
1163 		kfree_rcu(old_probe_resp, rcu_head);
1164 	sdata->u.ap.driver_smps_mode = IEEE80211_SMPS_OFF;
1165 
1166 	__sta_info_flush(sdata, true);
1167 	ieee80211_free_keys(sdata, true);
1168 
1169 	sdata->vif.bss_conf.enable_beacon = false;
1170 	sdata->vif.bss_conf.ssid_len = 0;
1171 	clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
1172 	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
1173 
1174 	if (sdata->wdev.cac_started) {
1175 		chandef = sdata->vif.bss_conf.chandef;
1176 		cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
1177 		cfg80211_cac_event(sdata->dev, &chandef,
1178 				   NL80211_RADAR_CAC_ABORTED,
1179 				   GFP_KERNEL);
1180 	}
1181 
1182 	drv_stop_ap(sdata->local, sdata);
1183 
1184 	/* free all potentially still buffered bcast frames */
1185 	local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf);
1186 	skb_queue_purge(&sdata->u.ap.ps.bc_buf);
1187 
1188 	mutex_lock(&local->mtx);
1189 	ieee80211_vif_copy_chanctx_to_vlans(sdata, true);
1190 	ieee80211_vif_release_channel(sdata);
1191 	mutex_unlock(&local->mtx);
1192 
1193 	return 0;
1194 }
1195 
1196 /* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
1197 struct iapp_layer2_update {
1198 	u8 da[ETH_ALEN];	/* broadcast */
1199 	u8 sa[ETH_ALEN];	/* STA addr */
1200 	__be16 len;		/* 6 */
1201 	u8 dsap;		/* 0 */
1202 	u8 ssap;		/* 0 */
1203 	u8 control;
1204 	u8 xid_info[3];
1205 } __packed;
1206 
1207 static void ieee80211_send_layer2_update(struct sta_info *sta)
1208 {
1209 	struct iapp_layer2_update *msg;
1210 	struct sk_buff *skb;
1211 
1212 	/* Send Level 2 Update Frame to update forwarding tables in layer 2
1213 	 * bridge devices */
1214 
1215 	skb = dev_alloc_skb(sizeof(*msg));
1216 	if (!skb)
1217 		return;
1218 	msg = (struct iapp_layer2_update *)skb_put(skb, sizeof(*msg));
1219 
1220 	/* 802.2 Type 1 Logical Link Control (LLC) Exchange Identifier (XID)
1221 	 * Update response frame; IEEE Std 802.2-1998, 5.4.1.2.1 */
1222 
1223 	eth_broadcast_addr(msg->da);
1224 	memcpy(msg->sa, sta->sta.addr, ETH_ALEN);
1225 	msg->len = htons(6);
1226 	msg->dsap = 0;
1227 	msg->ssap = 0x01;	/* NULL LSAP, CR Bit: Response */
1228 	msg->control = 0xaf;	/* XID response lsb.1111F101.
1229 				 * F=0 (no poll command; unsolicited frame) */
1230 	msg->xid_info[0] = 0x81;	/* XID format identifier */
1231 	msg->xid_info[1] = 1;	/* LLC types/classes: Type 1 LLC */
1232 	msg->xid_info[2] = 0;	/* XID sender's receive window size (RW) */
1233 
1234 	skb->dev = sta->sdata->dev;
1235 	skb->protocol = eth_type_trans(skb, sta->sdata->dev);
1236 	memset(skb->cb, 0, sizeof(skb->cb));
1237 	netif_rx_ni(skb);
1238 }
1239 
1240 static int sta_apply_auth_flags(struct ieee80211_local *local,
1241 				struct sta_info *sta,
1242 				u32 mask, u32 set)
1243 {
1244 	int ret;
1245 
1246 	if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED) &&
1247 	    set & BIT(NL80211_STA_FLAG_AUTHENTICATED) &&
1248 	    !test_sta_flag(sta, WLAN_STA_AUTH)) {
1249 		ret = sta_info_move_state(sta, IEEE80211_STA_AUTH);
1250 		if (ret)
1251 			return ret;
1252 	}
1253 
1254 	if (mask & BIT(NL80211_STA_FLAG_ASSOCIATED) &&
1255 	    set & BIT(NL80211_STA_FLAG_ASSOCIATED) &&
1256 	    !test_sta_flag(sta, WLAN_STA_ASSOC)) {
1257 		ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
1258 		if (ret)
1259 			return ret;
1260 	}
1261 
1262 	if (mask & BIT(NL80211_STA_FLAG_AUTHORIZED)) {
1263 		if (set & BIT(NL80211_STA_FLAG_AUTHORIZED))
1264 			ret = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
1265 		else if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
1266 			ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
1267 		else
1268 			ret = 0;
1269 		if (ret)
1270 			return ret;
1271 	}
1272 
1273 	if (mask & BIT(NL80211_STA_FLAG_ASSOCIATED) &&
1274 	    !(set & BIT(NL80211_STA_FLAG_ASSOCIATED)) &&
1275 	    test_sta_flag(sta, WLAN_STA_ASSOC)) {
1276 		ret = sta_info_move_state(sta, IEEE80211_STA_AUTH);
1277 		if (ret)
1278 			return ret;
1279 	}
1280 
1281 	if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED) &&
1282 	    !(set & BIT(NL80211_STA_FLAG_AUTHENTICATED)) &&
1283 	    test_sta_flag(sta, WLAN_STA_AUTH)) {
1284 		ret = sta_info_move_state(sta, IEEE80211_STA_NONE);
1285 		if (ret)
1286 			return ret;
1287 	}
1288 
1289 	return 0;
1290 }
1291 
1292 static int sta_apply_parameters(struct ieee80211_local *local,
1293 				struct sta_info *sta,
1294 				struct station_parameters *params)
1295 {
1296 	int ret = 0;
1297 	struct ieee80211_supported_band *sband;
1298 	struct ieee80211_sub_if_data *sdata = sta->sdata;
1299 	enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
1300 	u32 mask, set;
1301 
1302 	sband = local->hw.wiphy->bands[band];
1303 
1304 	mask = params->sta_flags_mask;
1305 	set = params->sta_flags_set;
1306 
1307 	if (ieee80211_vif_is_mesh(&sdata->vif)) {
1308 		/*
1309 		 * In mesh mode, ASSOCIATED isn't part of the nl80211
1310 		 * API but must follow AUTHENTICATED for driver state.
1311 		 */
1312 		if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED))
1313 			mask |= BIT(NL80211_STA_FLAG_ASSOCIATED);
1314 		if (set & BIT(NL80211_STA_FLAG_AUTHENTICATED))
1315 			set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
1316 	} else if (test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
1317 		/*
1318 		 * TDLS -- everything follows authorized, but
1319 		 * only becoming authorized is possible, not
1320 		 * going back
1321 		 */
1322 		if (set & BIT(NL80211_STA_FLAG_AUTHORIZED)) {
1323 			set |= BIT(NL80211_STA_FLAG_AUTHENTICATED) |
1324 			       BIT(NL80211_STA_FLAG_ASSOCIATED);
1325 			mask |= BIT(NL80211_STA_FLAG_AUTHENTICATED) |
1326 				BIT(NL80211_STA_FLAG_ASSOCIATED);
1327 		}
1328 	}
1329 
1330 	ret = sta_apply_auth_flags(local, sta, mask, set);
1331 	if (ret)
1332 		return ret;
1333 
1334 	if (mask & BIT(NL80211_STA_FLAG_SHORT_PREAMBLE)) {
1335 		if (set & BIT(NL80211_STA_FLAG_SHORT_PREAMBLE))
1336 			set_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE);
1337 		else
1338 			clear_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE);
1339 	}
1340 
1341 	if (mask & BIT(NL80211_STA_FLAG_WME)) {
1342 		if (set & BIT(NL80211_STA_FLAG_WME)) {
1343 			set_sta_flag(sta, WLAN_STA_WME);
1344 			sta->sta.wme = true;
1345 		} else {
1346 			clear_sta_flag(sta, WLAN_STA_WME);
1347 			sta->sta.wme = false;
1348 		}
1349 	}
1350 
1351 	if (mask & BIT(NL80211_STA_FLAG_MFP)) {
1352 		if (set & BIT(NL80211_STA_FLAG_MFP))
1353 			set_sta_flag(sta, WLAN_STA_MFP);
1354 		else
1355 			clear_sta_flag(sta, WLAN_STA_MFP);
1356 	}
1357 
1358 	if (mask & BIT(NL80211_STA_FLAG_TDLS_PEER)) {
1359 		if (set & BIT(NL80211_STA_FLAG_TDLS_PEER))
1360 			set_sta_flag(sta, WLAN_STA_TDLS_PEER);
1361 		else
1362 			clear_sta_flag(sta, WLAN_STA_TDLS_PEER);
1363 	}
1364 
1365 	if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD) {
1366 		sta->sta.uapsd_queues = params->uapsd_queues;
1367 		sta->sta.max_sp = params->max_sp;
1368 	}
1369 
1370 	/*
1371 	 * cfg80211 validates this (1-2007) and allows setting the AID
1372 	 * only when creating a new station entry
1373 	 */
1374 	if (params->aid)
1375 		sta->sta.aid = params->aid;
1376 
1377 	/*
1378 	 * Some of the following updates would be racy if called on an
1379 	 * existing station, via ieee80211_change_station(). However,
1380 	 * all such changes are rejected by cfg80211 except for updates
1381 	 * changing the supported rates on an existing but not yet used
1382 	 * TDLS peer.
1383 	 */
1384 
1385 	if (params->listen_interval >= 0)
1386 		sta->listen_interval = params->listen_interval;
1387 
1388 	if (params->supported_rates) {
1389 		ieee80211_parse_bitrates(&sdata->vif.bss_conf.chandef,
1390 					 sband, params->supported_rates,
1391 					 params->supported_rates_len,
1392 					 &sta->sta.supp_rates[band]);
1393 	}
1394 
1395 	if (params->ht_capa)
1396 		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
1397 						  params->ht_capa, sta);
1398 
1399 	if (params->vht_capa)
1400 		ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
1401 						    params->vht_capa, sta);
1402 
1403 	if (params->opmode_notif_used) {
1404 		/* returned value is only needed for rc update, but the
1405 		 * rc isn't initialized here yet, so ignore it
1406 		 */
1407 		__ieee80211_vht_handle_opmode(sdata, sta,
1408 					      params->opmode_notif,
1409 					      band, false);
1410 	}
1411 
1412 	if (ieee80211_vif_is_mesh(&sdata->vif)) {
1413 #ifdef CONFIG_MAC80211_MESH
1414 		u32 changed = 0;
1415 
1416 		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) {
1417 			switch (params->plink_state) {
1418 			case NL80211_PLINK_ESTAB:
1419 				if (sta->plink_state != NL80211_PLINK_ESTAB)
1420 					changed = mesh_plink_inc_estab_count(
1421 							sdata);
1422 				sta->plink_state = params->plink_state;
1423 
1424 				ieee80211_mps_sta_status_update(sta);
1425 				changed |= ieee80211_mps_set_sta_local_pm(sta,
1426 					      sdata->u.mesh.mshcfg.power_mode);
1427 				break;
1428 			case NL80211_PLINK_LISTEN:
1429 			case NL80211_PLINK_BLOCKED:
1430 			case NL80211_PLINK_OPN_SNT:
1431 			case NL80211_PLINK_OPN_RCVD:
1432 			case NL80211_PLINK_CNF_RCVD:
1433 			case NL80211_PLINK_HOLDING:
1434 				if (sta->plink_state == NL80211_PLINK_ESTAB)
1435 					changed = mesh_plink_dec_estab_count(
1436 							sdata);
1437 				sta->plink_state = params->plink_state;
1438 
1439 				ieee80211_mps_sta_status_update(sta);
1440 				changed |= ieee80211_mps_set_sta_local_pm(sta,
1441 						NL80211_MESH_POWER_UNKNOWN);
1442 				break;
1443 			default:
1444 				/*  nothing  */
1445 				break;
1446 			}
1447 		}
1448 
1449 		switch (params->plink_action) {
1450 		case NL80211_PLINK_ACTION_NO_ACTION:
1451 			/* nothing */
1452 			break;
1453 		case NL80211_PLINK_ACTION_OPEN:
1454 			changed |= mesh_plink_open(sta);
1455 			break;
1456 		case NL80211_PLINK_ACTION_BLOCK:
1457 			changed |= mesh_plink_block(sta);
1458 			break;
1459 		}
1460 
1461 		if (params->local_pm)
1462 			changed |=
1463 			      ieee80211_mps_set_sta_local_pm(sta,
1464 							     params->local_pm);
1465 		ieee80211_mbss_info_change_notify(sdata, changed);
1466 #endif
1467 	}
1468 
1469 	return 0;
1470 }
1471 
1472 static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
1473 				 const u8 *mac,
1474 				 struct station_parameters *params)
1475 {
1476 	struct ieee80211_local *local = wiphy_priv(wiphy);
1477 	struct sta_info *sta;
1478 	struct ieee80211_sub_if_data *sdata;
1479 	int err;
1480 	int layer2_update;
1481 
1482 	if (params->vlan) {
1483 		sdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
1484 
1485 		if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
1486 		    sdata->vif.type != NL80211_IFTYPE_AP)
1487 			return -EINVAL;
1488 	} else
1489 		sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1490 
1491 	if (ether_addr_equal(mac, sdata->vif.addr))
1492 		return -EINVAL;
1493 
1494 	if (is_multicast_ether_addr(mac))
1495 		return -EINVAL;
1496 
1497 	sta = sta_info_alloc(sdata, mac, GFP_KERNEL);
1498 	if (!sta)
1499 		return -ENOMEM;
1500 
1501 	/*
1502 	 * defaults -- if userspace wants something else we'll
1503 	 * change it accordingly in sta_apply_parameters()
1504 	 */
1505 	if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) {
1506 		sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
1507 		sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
1508 	} else {
1509 		sta->sta.tdls = true;
1510 	}
1511 
1512 	err = sta_apply_parameters(local, sta, params);
1513 	if (err) {
1514 		sta_info_free(local, sta);
1515 		return err;
1516 	}
1517 
1518 	/*
1519 	 * for TDLS, rate control should be initialized only when
1520 	 * rates are known and station is marked authorized
1521 	 */
1522 	if (!test_sta_flag(sta, WLAN_STA_TDLS_PEER))
1523 		rate_control_rate_init(sta);
1524 
1525 	layer2_update = sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
1526 		sdata->vif.type == NL80211_IFTYPE_AP;
1527 
1528 	err = sta_info_insert_rcu(sta);
1529 	if (err) {
1530 		rcu_read_unlock();
1531 		return err;
1532 	}
1533 
1534 	if (layer2_update)
1535 		ieee80211_send_layer2_update(sta);
1536 
1537 	rcu_read_unlock();
1538 
1539 	return 0;
1540 }
1541 
1542 static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
1543 				 const u8 *mac)
1544 {
1545 	struct ieee80211_sub_if_data *sdata;
1546 
1547 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1548 
1549 	if (mac)
1550 		return sta_info_destroy_addr_bss(sdata, mac);
1551 
1552 	sta_info_flush(sdata);
1553 	return 0;
1554 }
1555 
1556 static int ieee80211_change_station(struct wiphy *wiphy,
1557 				    struct net_device *dev, const u8 *mac,
1558 				    struct station_parameters *params)
1559 {
1560 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1561 	struct ieee80211_local *local = wiphy_priv(wiphy);
1562 	struct sta_info *sta;
1563 	struct ieee80211_sub_if_data *vlansdata;
1564 	enum cfg80211_station_type statype;
1565 	int err;
1566 
1567 	mutex_lock(&local->sta_mtx);
1568 
1569 	sta = sta_info_get_bss(sdata, mac);
1570 	if (!sta) {
1571 		err = -ENOENT;
1572 		goto out_err;
1573 	}
1574 
1575 	switch (sdata->vif.type) {
1576 	case NL80211_IFTYPE_MESH_POINT:
1577 		if (sdata->u.mesh.user_mpm)
1578 			statype = CFG80211_STA_MESH_PEER_USER;
1579 		else
1580 			statype = CFG80211_STA_MESH_PEER_KERNEL;
1581 		break;
1582 	case NL80211_IFTYPE_ADHOC:
1583 		statype = CFG80211_STA_IBSS;
1584 		break;
1585 	case NL80211_IFTYPE_STATION:
1586 		if (!test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
1587 			statype = CFG80211_STA_AP_STA;
1588 			break;
1589 		}
1590 		if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
1591 			statype = CFG80211_STA_TDLS_PEER_ACTIVE;
1592 		else
1593 			statype = CFG80211_STA_TDLS_PEER_SETUP;
1594 		break;
1595 	case NL80211_IFTYPE_AP:
1596 	case NL80211_IFTYPE_AP_VLAN:
1597 		statype = CFG80211_STA_AP_CLIENT;
1598 		break;
1599 	default:
1600 		err = -EOPNOTSUPP;
1601 		goto out_err;
1602 	}
1603 
1604 	err = cfg80211_check_station_change(wiphy, params, statype);
1605 	if (err)
1606 		goto out_err;
1607 
1608 	if (params->vlan && params->vlan != sta->sdata->dev) {
1609 		bool prev_4addr = false;
1610 		bool new_4addr = false;
1611 
1612 		vlansdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
1613 
1614 		if (params->vlan->ieee80211_ptr->use_4addr) {
1615 			if (vlansdata->u.vlan.sta) {
1616 				err = -EBUSY;
1617 				goto out_err;
1618 			}
1619 
1620 			rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
1621 			new_4addr = true;
1622 		}
1623 
1624 		if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1625 		    sta->sdata->u.vlan.sta) {
1626 			RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL);
1627 			prev_4addr = true;
1628 		}
1629 
1630 		sta->sdata = vlansdata;
1631 
1632 		if (sta->sta_state == IEEE80211_STA_AUTHORIZED &&
1633 		    prev_4addr != new_4addr) {
1634 			if (new_4addr)
1635 				atomic_dec(&sta->sdata->bss->num_mcast_sta);
1636 			else
1637 				atomic_inc(&sta->sdata->bss->num_mcast_sta);
1638 		}
1639 
1640 		ieee80211_send_layer2_update(sta);
1641 	}
1642 
1643 	err = sta_apply_parameters(local, sta, params);
1644 	if (err)
1645 		goto out_err;
1646 
1647 	/* When peer becomes authorized, init rate control as well */
1648 	if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) &&
1649 	    test_sta_flag(sta, WLAN_STA_AUTHORIZED))
1650 		rate_control_rate_init(sta);
1651 
1652 	mutex_unlock(&local->sta_mtx);
1653 
1654 	if ((sdata->vif.type == NL80211_IFTYPE_AP ||
1655 	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1656 	    sta->known_smps_mode != sta->sdata->bss->req_smps &&
1657 	    test_sta_flag(sta, WLAN_STA_AUTHORIZED) &&
1658 	    sta_info_tx_streams(sta) != 1) {
1659 		ht_dbg(sta->sdata,
1660 		       "%pM just authorized and MIMO capable - update SMPS\n",
1661 		       sta->sta.addr);
1662 		ieee80211_send_smps_action(sta->sdata,
1663 			sta->sdata->bss->req_smps,
1664 			sta->sta.addr,
1665 			sta->sdata->vif.bss_conf.bssid);
1666 	}
1667 
1668 	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
1669 	    params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)) {
1670 		ieee80211_recalc_ps(local, -1);
1671 		ieee80211_recalc_ps_vif(sdata);
1672 	}
1673 
1674 	return 0;
1675 out_err:
1676 	mutex_unlock(&local->sta_mtx);
1677 	return err;
1678 }
1679 
1680 #ifdef CONFIG_MAC80211_MESH
1681 static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
1682 			       const u8 *dst, const u8 *next_hop)
1683 {
1684 	struct ieee80211_sub_if_data *sdata;
1685 	struct mesh_path *mpath;
1686 	struct sta_info *sta;
1687 
1688 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1689 
1690 	rcu_read_lock();
1691 	sta = sta_info_get(sdata, next_hop);
1692 	if (!sta) {
1693 		rcu_read_unlock();
1694 		return -ENOENT;
1695 	}
1696 
1697 	mpath = mesh_path_add(sdata, dst);
1698 	if (IS_ERR(mpath)) {
1699 		rcu_read_unlock();
1700 		return PTR_ERR(mpath);
1701 	}
1702 
1703 	mesh_path_fix_nexthop(mpath, sta);
1704 
1705 	rcu_read_unlock();
1706 	return 0;
1707 }
1708 
1709 static int ieee80211_del_mpath(struct wiphy *wiphy, struct net_device *dev,
1710 			       const u8 *dst)
1711 {
1712 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1713 
1714 	if (dst)
1715 		return mesh_path_del(sdata, dst);
1716 
1717 	mesh_path_flush_by_iface(sdata);
1718 	return 0;
1719 }
1720 
1721 static int ieee80211_change_mpath(struct wiphy *wiphy, struct net_device *dev,
1722 				  const u8 *dst, const u8 *next_hop)
1723 {
1724 	struct ieee80211_sub_if_data *sdata;
1725 	struct mesh_path *mpath;
1726 	struct sta_info *sta;
1727 
1728 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1729 
1730 	rcu_read_lock();
1731 
1732 	sta = sta_info_get(sdata, next_hop);
1733 	if (!sta) {
1734 		rcu_read_unlock();
1735 		return -ENOENT;
1736 	}
1737 
1738 	mpath = mesh_path_lookup(sdata, dst);
1739 	if (!mpath) {
1740 		rcu_read_unlock();
1741 		return -ENOENT;
1742 	}
1743 
1744 	mesh_path_fix_nexthop(mpath, sta);
1745 
1746 	rcu_read_unlock();
1747 	return 0;
1748 }
1749 
1750 static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
1751 			    struct mpath_info *pinfo)
1752 {
1753 	struct sta_info *next_hop_sta = rcu_dereference(mpath->next_hop);
1754 
1755 	if (next_hop_sta)
1756 		memcpy(next_hop, next_hop_sta->sta.addr, ETH_ALEN);
1757 	else
1758 		memset(next_hop, 0, ETH_ALEN);
1759 
1760 	memset(pinfo, 0, sizeof(*pinfo));
1761 
1762 	pinfo->generation = mesh_paths_generation;
1763 
1764 	pinfo->filled = MPATH_INFO_FRAME_QLEN |
1765 			MPATH_INFO_SN |
1766 			MPATH_INFO_METRIC |
1767 			MPATH_INFO_EXPTIME |
1768 			MPATH_INFO_DISCOVERY_TIMEOUT |
1769 			MPATH_INFO_DISCOVERY_RETRIES |
1770 			MPATH_INFO_FLAGS;
1771 
1772 	pinfo->frame_qlen = mpath->frame_queue.qlen;
1773 	pinfo->sn = mpath->sn;
1774 	pinfo->metric = mpath->metric;
1775 	if (time_before(jiffies, mpath->exp_time))
1776 		pinfo->exptime = jiffies_to_msecs(mpath->exp_time - jiffies);
1777 	pinfo->discovery_timeout =
1778 			jiffies_to_msecs(mpath->discovery_timeout);
1779 	pinfo->discovery_retries = mpath->discovery_retries;
1780 	if (mpath->flags & MESH_PATH_ACTIVE)
1781 		pinfo->flags |= NL80211_MPATH_FLAG_ACTIVE;
1782 	if (mpath->flags & MESH_PATH_RESOLVING)
1783 		pinfo->flags |= NL80211_MPATH_FLAG_RESOLVING;
1784 	if (mpath->flags & MESH_PATH_SN_VALID)
1785 		pinfo->flags |= NL80211_MPATH_FLAG_SN_VALID;
1786 	if (mpath->flags & MESH_PATH_FIXED)
1787 		pinfo->flags |= NL80211_MPATH_FLAG_FIXED;
1788 	if (mpath->flags & MESH_PATH_RESOLVED)
1789 		pinfo->flags |= NL80211_MPATH_FLAG_RESOLVED;
1790 }
1791 
1792 static int ieee80211_get_mpath(struct wiphy *wiphy, struct net_device *dev,
1793 			       u8 *dst, u8 *next_hop, struct mpath_info *pinfo)
1794 
1795 {
1796 	struct ieee80211_sub_if_data *sdata;
1797 	struct mesh_path *mpath;
1798 
1799 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1800 
1801 	rcu_read_lock();
1802 	mpath = mesh_path_lookup(sdata, dst);
1803 	if (!mpath) {
1804 		rcu_read_unlock();
1805 		return -ENOENT;
1806 	}
1807 	memcpy(dst, mpath->dst, ETH_ALEN);
1808 	mpath_set_pinfo(mpath, next_hop, pinfo);
1809 	rcu_read_unlock();
1810 	return 0;
1811 }
1812 
1813 static int ieee80211_dump_mpath(struct wiphy *wiphy, struct net_device *dev,
1814 				int idx, u8 *dst, u8 *next_hop,
1815 				struct mpath_info *pinfo)
1816 {
1817 	struct ieee80211_sub_if_data *sdata;
1818 	struct mesh_path *mpath;
1819 
1820 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1821 
1822 	rcu_read_lock();
1823 	mpath = mesh_path_lookup_by_idx(sdata, idx);
1824 	if (!mpath) {
1825 		rcu_read_unlock();
1826 		return -ENOENT;
1827 	}
1828 	memcpy(dst, mpath->dst, ETH_ALEN);
1829 	mpath_set_pinfo(mpath, next_hop, pinfo);
1830 	rcu_read_unlock();
1831 	return 0;
1832 }
1833 
1834 static int ieee80211_get_mesh_config(struct wiphy *wiphy,
1835 				struct net_device *dev,
1836 				struct mesh_config *conf)
1837 {
1838 	struct ieee80211_sub_if_data *sdata;
1839 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1840 
1841 	memcpy(conf, &(sdata->u.mesh.mshcfg), sizeof(struct mesh_config));
1842 	return 0;
1843 }
1844 
1845 static inline bool _chg_mesh_attr(enum nl80211_meshconf_params parm, u32 mask)
1846 {
1847 	return (mask >> (parm-1)) & 0x1;
1848 }
1849 
1850 static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh,
1851 		const struct mesh_setup *setup)
1852 {
1853 	u8 *new_ie;
1854 	const u8 *old_ie;
1855 	struct ieee80211_sub_if_data *sdata = container_of(ifmsh,
1856 					struct ieee80211_sub_if_data, u.mesh);
1857 
1858 	/* allocate information elements */
1859 	new_ie = NULL;
1860 	old_ie = ifmsh->ie;
1861 
1862 	if (setup->ie_len) {
1863 		new_ie = kmemdup(setup->ie, setup->ie_len,
1864 				GFP_KERNEL);
1865 		if (!new_ie)
1866 			return -ENOMEM;
1867 	}
1868 	ifmsh->ie_len = setup->ie_len;
1869 	ifmsh->ie = new_ie;
1870 	kfree(old_ie);
1871 
1872 	/* now copy the rest of the setup parameters */
1873 	ifmsh->mesh_id_len = setup->mesh_id_len;
1874 	memcpy(ifmsh->mesh_id, setup->mesh_id, ifmsh->mesh_id_len);
1875 	ifmsh->mesh_sp_id = setup->sync_method;
1876 	ifmsh->mesh_pp_id = setup->path_sel_proto;
1877 	ifmsh->mesh_pm_id = setup->path_metric;
1878 	ifmsh->user_mpm = setup->user_mpm;
1879 	ifmsh->mesh_auth_id = setup->auth_id;
1880 	ifmsh->security = IEEE80211_MESH_SEC_NONE;
1881 	if (setup->is_authenticated)
1882 		ifmsh->security |= IEEE80211_MESH_SEC_AUTHED;
1883 	if (setup->is_secure)
1884 		ifmsh->security |= IEEE80211_MESH_SEC_SECURED;
1885 
1886 	/* mcast rate setting in Mesh Node */
1887 	memcpy(sdata->vif.bss_conf.mcast_rate, setup->mcast_rate,
1888 						sizeof(setup->mcast_rate));
1889 	sdata->vif.bss_conf.basic_rates = setup->basic_rates;
1890 
1891 	sdata->vif.bss_conf.beacon_int = setup->beacon_interval;
1892 	sdata->vif.bss_conf.dtim_period = setup->dtim_period;
1893 
1894 	return 0;
1895 }
1896 
1897 static int ieee80211_update_mesh_config(struct wiphy *wiphy,
1898 					struct net_device *dev, u32 mask,
1899 					const struct mesh_config *nconf)
1900 {
1901 	struct mesh_config *conf;
1902 	struct ieee80211_sub_if_data *sdata;
1903 	struct ieee80211_if_mesh *ifmsh;
1904 
1905 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1906 	ifmsh = &sdata->u.mesh;
1907 
1908 	/* Set the config options which we are interested in setting */
1909 	conf = &(sdata->u.mesh.mshcfg);
1910 	if (_chg_mesh_attr(NL80211_MESHCONF_RETRY_TIMEOUT, mask))
1911 		conf->dot11MeshRetryTimeout = nconf->dot11MeshRetryTimeout;
1912 	if (_chg_mesh_attr(NL80211_MESHCONF_CONFIRM_TIMEOUT, mask))
1913 		conf->dot11MeshConfirmTimeout = nconf->dot11MeshConfirmTimeout;
1914 	if (_chg_mesh_attr(NL80211_MESHCONF_HOLDING_TIMEOUT, mask))
1915 		conf->dot11MeshHoldingTimeout = nconf->dot11MeshHoldingTimeout;
1916 	if (_chg_mesh_attr(NL80211_MESHCONF_MAX_PEER_LINKS, mask))
1917 		conf->dot11MeshMaxPeerLinks = nconf->dot11MeshMaxPeerLinks;
1918 	if (_chg_mesh_attr(NL80211_MESHCONF_MAX_RETRIES, mask))
1919 		conf->dot11MeshMaxRetries = nconf->dot11MeshMaxRetries;
1920 	if (_chg_mesh_attr(NL80211_MESHCONF_TTL, mask))
1921 		conf->dot11MeshTTL = nconf->dot11MeshTTL;
1922 	if (_chg_mesh_attr(NL80211_MESHCONF_ELEMENT_TTL, mask))
1923 		conf->element_ttl = nconf->element_ttl;
1924 	if (_chg_mesh_attr(NL80211_MESHCONF_AUTO_OPEN_PLINKS, mask)) {
1925 		if (ifmsh->user_mpm)
1926 			return -EBUSY;
1927 		conf->auto_open_plinks = nconf->auto_open_plinks;
1928 	}
1929 	if (_chg_mesh_attr(NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, mask))
1930 		conf->dot11MeshNbrOffsetMaxNeighbor =
1931 			nconf->dot11MeshNbrOffsetMaxNeighbor;
1932 	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, mask))
1933 		conf->dot11MeshHWMPmaxPREQretries =
1934 			nconf->dot11MeshHWMPmaxPREQretries;
1935 	if (_chg_mesh_attr(NL80211_MESHCONF_PATH_REFRESH_TIME, mask))
1936 		conf->path_refresh_time = nconf->path_refresh_time;
1937 	if (_chg_mesh_attr(NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, mask))
1938 		conf->min_discovery_timeout = nconf->min_discovery_timeout;
1939 	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, mask))
1940 		conf->dot11MeshHWMPactivePathTimeout =
1941 			nconf->dot11MeshHWMPactivePathTimeout;
1942 	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, mask))
1943 		conf->dot11MeshHWMPpreqMinInterval =
1944 			nconf->dot11MeshHWMPpreqMinInterval;
1945 	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, mask))
1946 		conf->dot11MeshHWMPperrMinInterval =
1947 			nconf->dot11MeshHWMPperrMinInterval;
1948 	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
1949 			   mask))
1950 		conf->dot11MeshHWMPnetDiameterTraversalTime =
1951 			nconf->dot11MeshHWMPnetDiameterTraversalTime;
1952 	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_ROOTMODE, mask)) {
1953 		conf->dot11MeshHWMPRootMode = nconf->dot11MeshHWMPRootMode;
1954 		ieee80211_mesh_root_setup(ifmsh);
1955 	}
1956 	if (_chg_mesh_attr(NL80211_MESHCONF_GATE_ANNOUNCEMENTS, mask)) {
1957 		/* our current gate announcement implementation rides on root
1958 		 * announcements, so require this ifmsh to also be a root node
1959 		 * */
1960 		if (nconf->dot11MeshGateAnnouncementProtocol &&
1961 		    !(conf->dot11MeshHWMPRootMode > IEEE80211_ROOTMODE_ROOT)) {
1962 			conf->dot11MeshHWMPRootMode = IEEE80211_PROACTIVE_RANN;
1963 			ieee80211_mesh_root_setup(ifmsh);
1964 		}
1965 		conf->dot11MeshGateAnnouncementProtocol =
1966 			nconf->dot11MeshGateAnnouncementProtocol;
1967 	}
1968 	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_RANN_INTERVAL, mask))
1969 		conf->dot11MeshHWMPRannInterval =
1970 			nconf->dot11MeshHWMPRannInterval;
1971 	if (_chg_mesh_attr(NL80211_MESHCONF_FORWARDING, mask))
1972 		conf->dot11MeshForwarding = nconf->dot11MeshForwarding;
1973 	if (_chg_mesh_attr(NL80211_MESHCONF_RSSI_THRESHOLD, mask)) {
1974 		/* our RSSI threshold implementation is supported only for
1975 		 * devices that report signal in dBm.
1976 		 */
1977 		if (!(sdata->local->hw.flags & IEEE80211_HW_SIGNAL_DBM))
1978 			return -ENOTSUPP;
1979 		conf->rssi_threshold = nconf->rssi_threshold;
1980 	}
1981 	if (_chg_mesh_attr(NL80211_MESHCONF_HT_OPMODE, mask)) {
1982 		conf->ht_opmode = nconf->ht_opmode;
1983 		sdata->vif.bss_conf.ht_operation_mode = nconf->ht_opmode;
1984 		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_HT);
1985 	}
1986 	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, mask))
1987 		conf->dot11MeshHWMPactivePathToRootTimeout =
1988 			nconf->dot11MeshHWMPactivePathToRootTimeout;
1989 	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_ROOT_INTERVAL, mask))
1990 		conf->dot11MeshHWMProotInterval =
1991 			nconf->dot11MeshHWMProotInterval;
1992 	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, mask))
1993 		conf->dot11MeshHWMPconfirmationInterval =
1994 			nconf->dot11MeshHWMPconfirmationInterval;
1995 	if (_chg_mesh_attr(NL80211_MESHCONF_POWER_MODE, mask)) {
1996 		conf->power_mode = nconf->power_mode;
1997 		ieee80211_mps_local_status_update(sdata);
1998 	}
1999 	if (_chg_mesh_attr(NL80211_MESHCONF_AWAKE_WINDOW, mask))
2000 		conf->dot11MeshAwakeWindowDuration =
2001 			nconf->dot11MeshAwakeWindowDuration;
2002 	if (_chg_mesh_attr(NL80211_MESHCONF_PLINK_TIMEOUT, mask))
2003 		conf->plink_timeout = nconf->plink_timeout;
2004 	ieee80211_mbss_info_change_notify(sdata, BSS_CHANGED_BEACON);
2005 	return 0;
2006 }
2007 
2008 static int ieee80211_join_mesh(struct wiphy *wiphy, struct net_device *dev,
2009 			       const struct mesh_config *conf,
2010 			       const struct mesh_setup *setup)
2011 {
2012 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2013 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2014 	int err;
2015 
2016 	memcpy(&ifmsh->mshcfg, conf, sizeof(struct mesh_config));
2017 	err = copy_mesh_setup(ifmsh, setup);
2018 	if (err)
2019 		return err;
2020 
2021 	/* can mesh use other SMPS modes? */
2022 	sdata->smps_mode = IEEE80211_SMPS_OFF;
2023 	sdata->needed_rx_chains = sdata->local->rx_chains;
2024 
2025 	mutex_lock(&sdata->local->mtx);
2026 	err = ieee80211_vif_use_channel(sdata, &setup->chandef,
2027 					IEEE80211_CHANCTX_SHARED);
2028 	mutex_unlock(&sdata->local->mtx);
2029 	if (err)
2030 		return err;
2031 
2032 	return ieee80211_start_mesh(sdata);
2033 }
2034 
2035 static int ieee80211_leave_mesh(struct wiphy *wiphy, struct net_device *dev)
2036 {
2037 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2038 
2039 	ieee80211_stop_mesh(sdata);
2040 	mutex_lock(&sdata->local->mtx);
2041 	ieee80211_vif_release_channel(sdata);
2042 	mutex_unlock(&sdata->local->mtx);
2043 
2044 	return 0;
2045 }
2046 #endif
2047 
2048 static int ieee80211_change_bss(struct wiphy *wiphy,
2049 				struct net_device *dev,
2050 				struct bss_parameters *params)
2051 {
2052 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2053 	enum ieee80211_band band;
2054 	u32 changed = 0;
2055 
2056 	if (!sdata_dereference(sdata->u.ap.beacon, sdata))
2057 		return -ENOENT;
2058 
2059 	band = ieee80211_get_sdata_band(sdata);
2060 
2061 	if (params->use_cts_prot >= 0) {
2062 		sdata->vif.bss_conf.use_cts_prot = params->use_cts_prot;
2063 		changed |= BSS_CHANGED_ERP_CTS_PROT;
2064 	}
2065 	if (params->use_short_preamble >= 0) {
2066 		sdata->vif.bss_conf.use_short_preamble =
2067 			params->use_short_preamble;
2068 		changed |= BSS_CHANGED_ERP_PREAMBLE;
2069 	}
2070 
2071 	if (!sdata->vif.bss_conf.use_short_slot &&
2072 	    band == IEEE80211_BAND_5GHZ) {
2073 		sdata->vif.bss_conf.use_short_slot = true;
2074 		changed |= BSS_CHANGED_ERP_SLOT;
2075 	}
2076 
2077 	if (params->use_short_slot_time >= 0) {
2078 		sdata->vif.bss_conf.use_short_slot =
2079 			params->use_short_slot_time;
2080 		changed |= BSS_CHANGED_ERP_SLOT;
2081 	}
2082 
2083 	if (params->basic_rates) {
2084 		ieee80211_parse_bitrates(&sdata->vif.bss_conf.chandef,
2085 					 wiphy->bands[band],
2086 					 params->basic_rates,
2087 					 params->basic_rates_len,
2088 					 &sdata->vif.bss_conf.basic_rates);
2089 		changed |= BSS_CHANGED_BASIC_RATES;
2090 	}
2091 
2092 	if (params->ap_isolate >= 0) {
2093 		if (params->ap_isolate)
2094 			sdata->flags |= IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
2095 		else
2096 			sdata->flags &= ~IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
2097 	}
2098 
2099 	if (params->ht_opmode >= 0) {
2100 		sdata->vif.bss_conf.ht_operation_mode =
2101 			(u16) params->ht_opmode;
2102 		changed |= BSS_CHANGED_HT;
2103 	}
2104 
2105 	if (params->p2p_ctwindow >= 0) {
2106 		sdata->vif.bss_conf.p2p_noa_attr.oppps_ctwindow &=
2107 					~IEEE80211_P2P_OPPPS_CTWINDOW_MASK;
2108 		sdata->vif.bss_conf.p2p_noa_attr.oppps_ctwindow |=
2109 			params->p2p_ctwindow & IEEE80211_P2P_OPPPS_CTWINDOW_MASK;
2110 		changed |= BSS_CHANGED_P2P_PS;
2111 	}
2112 
2113 	if (params->p2p_opp_ps > 0) {
2114 		sdata->vif.bss_conf.p2p_noa_attr.oppps_ctwindow |=
2115 					IEEE80211_P2P_OPPPS_ENABLE_BIT;
2116 		changed |= BSS_CHANGED_P2P_PS;
2117 	} else if (params->p2p_opp_ps == 0) {
2118 		sdata->vif.bss_conf.p2p_noa_attr.oppps_ctwindow &=
2119 					~IEEE80211_P2P_OPPPS_ENABLE_BIT;
2120 		changed |= BSS_CHANGED_P2P_PS;
2121 	}
2122 
2123 	ieee80211_bss_info_change_notify(sdata, changed);
2124 
2125 	return 0;
2126 }
2127 
2128 static int ieee80211_set_txq_params(struct wiphy *wiphy,
2129 				    struct net_device *dev,
2130 				    struct ieee80211_txq_params *params)
2131 {
2132 	struct ieee80211_local *local = wiphy_priv(wiphy);
2133 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2134 	struct ieee80211_tx_queue_params p;
2135 
2136 	if (!local->ops->conf_tx)
2137 		return -EOPNOTSUPP;
2138 
2139 	if (local->hw.queues < IEEE80211_NUM_ACS)
2140 		return -EOPNOTSUPP;
2141 
2142 	memset(&p, 0, sizeof(p));
2143 	p.aifs = params->aifs;
2144 	p.cw_max = params->cwmax;
2145 	p.cw_min = params->cwmin;
2146 	p.txop = params->txop;
2147 
2148 	/*
2149 	 * Setting tx queue params disables u-apsd because it's only
2150 	 * called in master mode.
2151 	 */
2152 	p.uapsd = false;
2153 
2154 	sdata->tx_conf[params->ac] = p;
2155 	if (drv_conf_tx(local, sdata, params->ac, &p)) {
2156 		wiphy_debug(local->hw.wiphy,
2157 			    "failed to set TX queue parameters for AC %d\n",
2158 			    params->ac);
2159 		return -EINVAL;
2160 	}
2161 
2162 	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
2163 
2164 	return 0;
2165 }
2166 
2167 #ifdef CONFIG_PM
2168 static int ieee80211_suspend(struct wiphy *wiphy,
2169 			     struct cfg80211_wowlan *wowlan)
2170 {
2171 	return __ieee80211_suspend(wiphy_priv(wiphy), wowlan);
2172 }
2173 
2174 static int ieee80211_resume(struct wiphy *wiphy)
2175 {
2176 	return __ieee80211_resume(wiphy_priv(wiphy));
2177 }
2178 #else
2179 #define ieee80211_suspend NULL
2180 #define ieee80211_resume NULL
2181 #endif
2182 
2183 static int ieee80211_scan(struct wiphy *wiphy,
2184 			  struct cfg80211_scan_request *req)
2185 {
2186 	struct ieee80211_sub_if_data *sdata;
2187 
2188 	sdata = IEEE80211_WDEV_TO_SUB_IF(req->wdev);
2189 
2190 	switch (ieee80211_vif_type_p2p(&sdata->vif)) {
2191 	case NL80211_IFTYPE_STATION:
2192 	case NL80211_IFTYPE_ADHOC:
2193 	case NL80211_IFTYPE_MESH_POINT:
2194 	case NL80211_IFTYPE_P2P_CLIENT:
2195 	case NL80211_IFTYPE_P2P_DEVICE:
2196 		break;
2197 	case NL80211_IFTYPE_P2P_GO:
2198 		if (sdata->local->ops->hw_scan)
2199 			break;
2200 		/*
2201 		 * FIXME: implement NoA while scanning in software,
2202 		 * for now fall through to allow scanning only when
2203 		 * beaconing hasn't been configured yet
2204 		 */
2205 	case NL80211_IFTYPE_AP:
2206 		/*
2207 		 * If the scan has been forced (and the driver supports
2208 		 * forcing), don't care about being beaconing already.
2209 		 * This will create problems to the attached stations (e.g. all
2210 		 * the  frames sent while scanning on other channel will be
2211 		 * lost)
2212 		 */
2213 		if (sdata->u.ap.beacon &&
2214 		    (!(wiphy->features & NL80211_FEATURE_AP_SCAN) ||
2215 		     !(req->flags & NL80211_SCAN_FLAG_AP)))
2216 			return -EOPNOTSUPP;
2217 		break;
2218 	default:
2219 		return -EOPNOTSUPP;
2220 	}
2221 
2222 	return ieee80211_request_scan(sdata, req);
2223 }
2224 
2225 static int
2226 ieee80211_sched_scan_start(struct wiphy *wiphy,
2227 			   struct net_device *dev,
2228 			   struct cfg80211_sched_scan_request *req)
2229 {
2230 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2231 
2232 	if (!sdata->local->ops->sched_scan_start)
2233 		return -EOPNOTSUPP;
2234 
2235 	return ieee80211_request_sched_scan_start(sdata, req);
2236 }
2237 
2238 static int
2239 ieee80211_sched_scan_stop(struct wiphy *wiphy, struct net_device *dev)
2240 {
2241 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2242 
2243 	if (!sdata->local->ops->sched_scan_stop)
2244 		return -EOPNOTSUPP;
2245 
2246 	return ieee80211_request_sched_scan_stop(sdata);
2247 }
2248 
2249 static int ieee80211_auth(struct wiphy *wiphy, struct net_device *dev,
2250 			  struct cfg80211_auth_request *req)
2251 {
2252 	return ieee80211_mgd_auth(IEEE80211_DEV_TO_SUB_IF(dev), req);
2253 }
2254 
2255 static int ieee80211_assoc(struct wiphy *wiphy, struct net_device *dev,
2256 			   struct cfg80211_assoc_request *req)
2257 {
2258 	return ieee80211_mgd_assoc(IEEE80211_DEV_TO_SUB_IF(dev), req);
2259 }
2260 
2261 static int ieee80211_deauth(struct wiphy *wiphy, struct net_device *dev,
2262 			    struct cfg80211_deauth_request *req)
2263 {
2264 	return ieee80211_mgd_deauth(IEEE80211_DEV_TO_SUB_IF(dev), req);
2265 }
2266 
2267 static int ieee80211_disassoc(struct wiphy *wiphy, struct net_device *dev,
2268 			      struct cfg80211_disassoc_request *req)
2269 {
2270 	return ieee80211_mgd_disassoc(IEEE80211_DEV_TO_SUB_IF(dev), req);
2271 }
2272 
2273 static int ieee80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
2274 			       struct cfg80211_ibss_params *params)
2275 {
2276 	return ieee80211_ibss_join(IEEE80211_DEV_TO_SUB_IF(dev), params);
2277 }
2278 
2279 static int ieee80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
2280 {
2281 	return ieee80211_ibss_leave(IEEE80211_DEV_TO_SUB_IF(dev));
2282 }
2283 
2284 static int ieee80211_set_mcast_rate(struct wiphy *wiphy, struct net_device *dev,
2285 				    int rate[IEEE80211_NUM_BANDS])
2286 {
2287 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2288 
2289 	memcpy(sdata->vif.bss_conf.mcast_rate, rate,
2290 	       sizeof(int) * IEEE80211_NUM_BANDS);
2291 
2292 	return 0;
2293 }
2294 
2295 static int ieee80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
2296 {
2297 	struct ieee80211_local *local = wiphy_priv(wiphy);
2298 	int err;
2299 
2300 	if (changed & WIPHY_PARAM_FRAG_THRESHOLD) {
2301 		err = drv_set_frag_threshold(local, wiphy->frag_threshold);
2302 
2303 		if (err)
2304 			return err;
2305 	}
2306 
2307 	if (changed & WIPHY_PARAM_COVERAGE_CLASS) {
2308 		err = drv_set_coverage_class(local, wiphy->coverage_class);
2309 
2310 		if (err)
2311 			return err;
2312 	}
2313 
2314 	if (changed & WIPHY_PARAM_RTS_THRESHOLD) {
2315 		err = drv_set_rts_threshold(local, wiphy->rts_threshold);
2316 
2317 		if (err)
2318 			return err;
2319 	}
2320 
2321 	if (changed & WIPHY_PARAM_RETRY_SHORT) {
2322 		if (wiphy->retry_short > IEEE80211_MAX_TX_RETRY)
2323 			return -EINVAL;
2324 		local->hw.conf.short_frame_max_tx_count = wiphy->retry_short;
2325 	}
2326 	if (changed & WIPHY_PARAM_RETRY_LONG) {
2327 		if (wiphy->retry_long > IEEE80211_MAX_TX_RETRY)
2328 			return -EINVAL;
2329 		local->hw.conf.long_frame_max_tx_count = wiphy->retry_long;
2330 	}
2331 	if (changed &
2332 	    (WIPHY_PARAM_RETRY_SHORT | WIPHY_PARAM_RETRY_LONG))
2333 		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_RETRY_LIMITS);
2334 
2335 	return 0;
2336 }
2337 
2338 static int ieee80211_set_tx_power(struct wiphy *wiphy,
2339 				  struct wireless_dev *wdev,
2340 				  enum nl80211_tx_power_setting type, int mbm)
2341 {
2342 	struct ieee80211_local *local = wiphy_priv(wiphy);
2343 	struct ieee80211_sub_if_data *sdata;
2344 
2345 	if (wdev) {
2346 		sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
2347 
2348 		switch (type) {
2349 		case NL80211_TX_POWER_AUTOMATIC:
2350 			sdata->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
2351 			break;
2352 		case NL80211_TX_POWER_LIMITED:
2353 		case NL80211_TX_POWER_FIXED:
2354 			if (mbm < 0 || (mbm % 100))
2355 				return -EOPNOTSUPP;
2356 			sdata->user_power_level = MBM_TO_DBM(mbm);
2357 			break;
2358 		}
2359 
2360 		ieee80211_recalc_txpower(sdata);
2361 
2362 		return 0;
2363 	}
2364 
2365 	switch (type) {
2366 	case NL80211_TX_POWER_AUTOMATIC:
2367 		local->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
2368 		break;
2369 	case NL80211_TX_POWER_LIMITED:
2370 	case NL80211_TX_POWER_FIXED:
2371 		if (mbm < 0 || (mbm % 100))
2372 			return -EOPNOTSUPP;
2373 		local->user_power_level = MBM_TO_DBM(mbm);
2374 		break;
2375 	}
2376 
2377 	mutex_lock(&local->iflist_mtx);
2378 	list_for_each_entry(sdata, &local->interfaces, list)
2379 		sdata->user_power_level = local->user_power_level;
2380 	list_for_each_entry(sdata, &local->interfaces, list)
2381 		ieee80211_recalc_txpower(sdata);
2382 	mutex_unlock(&local->iflist_mtx);
2383 
2384 	return 0;
2385 }
2386 
2387 static int ieee80211_get_tx_power(struct wiphy *wiphy,
2388 				  struct wireless_dev *wdev,
2389 				  int *dbm)
2390 {
2391 	struct ieee80211_local *local = wiphy_priv(wiphy);
2392 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
2393 
2394 	if (!local->use_chanctx)
2395 		*dbm = local->hw.conf.power_level;
2396 	else
2397 		*dbm = sdata->vif.bss_conf.txpower;
2398 
2399 	return 0;
2400 }
2401 
2402 static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
2403 				  const u8 *addr)
2404 {
2405 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2406 
2407 	memcpy(&sdata->u.wds.remote_addr, addr, ETH_ALEN);
2408 
2409 	return 0;
2410 }
2411 
2412 static void ieee80211_rfkill_poll(struct wiphy *wiphy)
2413 {
2414 	struct ieee80211_local *local = wiphy_priv(wiphy);
2415 
2416 	drv_rfkill_poll(local);
2417 }
2418 
2419 #ifdef CONFIG_NL80211_TESTMODE
2420 static int ieee80211_testmode_cmd(struct wiphy *wiphy,
2421 				  struct wireless_dev *wdev,
2422 				  void *data, int len)
2423 {
2424 	struct ieee80211_local *local = wiphy_priv(wiphy);
2425 	struct ieee80211_vif *vif = NULL;
2426 
2427 	if (!local->ops->testmode_cmd)
2428 		return -EOPNOTSUPP;
2429 
2430 	if (wdev) {
2431 		struct ieee80211_sub_if_data *sdata;
2432 
2433 		sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
2434 		if (sdata->flags & IEEE80211_SDATA_IN_DRIVER)
2435 			vif = &sdata->vif;
2436 	}
2437 
2438 	return local->ops->testmode_cmd(&local->hw, vif, data, len);
2439 }
2440 
2441 static int ieee80211_testmode_dump(struct wiphy *wiphy,
2442 				   struct sk_buff *skb,
2443 				   struct netlink_callback *cb,
2444 				   void *data, int len)
2445 {
2446 	struct ieee80211_local *local = wiphy_priv(wiphy);
2447 
2448 	if (!local->ops->testmode_dump)
2449 		return -EOPNOTSUPP;
2450 
2451 	return local->ops->testmode_dump(&local->hw, skb, cb, data, len);
2452 }
2453 #endif
2454 
2455 int __ieee80211_request_smps_ap(struct ieee80211_sub_if_data *sdata,
2456 				enum ieee80211_smps_mode smps_mode)
2457 {
2458 	struct sta_info *sta;
2459 	enum ieee80211_smps_mode old_req;
2460 	int i;
2461 
2462 	if (WARN_ON_ONCE(sdata->vif.type != NL80211_IFTYPE_AP))
2463 		return -EINVAL;
2464 
2465 	if (sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_20_NOHT)
2466 		return 0;
2467 
2468 	old_req = sdata->u.ap.req_smps;
2469 	sdata->u.ap.req_smps = smps_mode;
2470 
2471 	/* AUTOMATIC doesn't mean much for AP - don't allow it */
2472 	if (old_req == smps_mode ||
2473 	    smps_mode == IEEE80211_SMPS_AUTOMATIC)
2474 		return 0;
2475 
2476 	 /* If no associated stations, there's no need to do anything */
2477 	if (!atomic_read(&sdata->u.ap.num_mcast_sta)) {
2478 		sdata->smps_mode = smps_mode;
2479 		ieee80211_queue_work(&sdata->local->hw, &sdata->recalc_smps);
2480 		return 0;
2481 	}
2482 
2483 	ht_dbg(sdata,
2484 	       "SMSP %d requested in AP mode, sending Action frame to %d stations\n",
2485 	       smps_mode, atomic_read(&sdata->u.ap.num_mcast_sta));
2486 
2487 	mutex_lock(&sdata->local->sta_mtx);
2488 	for (i = 0; i < STA_HASH_SIZE; i++) {
2489 		for (sta = rcu_dereference_protected(sdata->local->sta_hash[i],
2490 				lockdep_is_held(&sdata->local->sta_mtx));
2491 		     sta;
2492 		     sta = rcu_dereference_protected(sta->hnext,
2493 				lockdep_is_held(&sdata->local->sta_mtx))) {
2494 			/*
2495 			 * Only stations associated to our AP and
2496 			 * associated VLANs
2497 			 */
2498 			if (sta->sdata->bss != &sdata->u.ap)
2499 				continue;
2500 
2501 			/* This station doesn't support MIMO - skip it */
2502 			if (sta_info_tx_streams(sta) == 1)
2503 				continue;
2504 
2505 			/*
2506 			 * Don't wake up a STA just to send the action frame
2507 			 * unless we are getting more restrictive.
2508 			 */
2509 			if (test_sta_flag(sta, WLAN_STA_PS_STA) &&
2510 			    !ieee80211_smps_is_restrictive(sta->known_smps_mode,
2511 							   smps_mode)) {
2512 				ht_dbg(sdata,
2513 				       "Won't send SMPS to sleeping STA %pM\n",
2514 				       sta->sta.addr);
2515 				continue;
2516 			}
2517 
2518 			/*
2519 			 * If the STA is not authorized, wait until it gets
2520 			 * authorized and the action frame will be sent then.
2521 			 */
2522 			if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
2523 				continue;
2524 
2525 			ht_dbg(sdata, "Sending SMPS to %pM\n", sta->sta.addr);
2526 			ieee80211_send_smps_action(sdata, smps_mode,
2527 						   sta->sta.addr,
2528 						   sdata->vif.bss_conf.bssid);
2529 		}
2530 	}
2531 	mutex_unlock(&sdata->local->sta_mtx);
2532 
2533 	sdata->smps_mode = smps_mode;
2534 	ieee80211_queue_work(&sdata->local->hw, &sdata->recalc_smps);
2535 
2536 	return 0;
2537 }
2538 
2539 int __ieee80211_request_smps_mgd(struct ieee80211_sub_if_data *sdata,
2540 				 enum ieee80211_smps_mode smps_mode)
2541 {
2542 	const u8 *ap;
2543 	enum ieee80211_smps_mode old_req;
2544 	int err;
2545 
2546 	lockdep_assert_held(&sdata->wdev.mtx);
2547 
2548 	if (WARN_ON_ONCE(sdata->vif.type != NL80211_IFTYPE_STATION))
2549 		return -EINVAL;
2550 
2551 	old_req = sdata->u.mgd.req_smps;
2552 	sdata->u.mgd.req_smps = smps_mode;
2553 
2554 	if (old_req == smps_mode &&
2555 	    smps_mode != IEEE80211_SMPS_AUTOMATIC)
2556 		return 0;
2557 
2558 	/*
2559 	 * If not associated, or current association is not an HT
2560 	 * association, there's no need to do anything, just store
2561 	 * the new value until we associate.
2562 	 */
2563 	if (!sdata->u.mgd.associated ||
2564 	    sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_20_NOHT)
2565 		return 0;
2566 
2567 	ap = sdata->u.mgd.associated->bssid;
2568 
2569 	if (smps_mode == IEEE80211_SMPS_AUTOMATIC) {
2570 		if (sdata->u.mgd.powersave)
2571 			smps_mode = IEEE80211_SMPS_DYNAMIC;
2572 		else
2573 			smps_mode = IEEE80211_SMPS_OFF;
2574 	}
2575 
2576 	/* send SM PS frame to AP */
2577 	err = ieee80211_send_smps_action(sdata, smps_mode,
2578 					 ap, ap);
2579 	if (err)
2580 		sdata->u.mgd.req_smps = old_req;
2581 
2582 	return err;
2583 }
2584 
2585 static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
2586 				    bool enabled, int timeout)
2587 {
2588 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2589 	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2590 
2591 	if (sdata->vif.type != NL80211_IFTYPE_STATION)
2592 		return -EOPNOTSUPP;
2593 
2594 	if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
2595 		return -EOPNOTSUPP;
2596 
2597 	if (enabled == sdata->u.mgd.powersave &&
2598 	    timeout == local->dynamic_ps_forced_timeout)
2599 		return 0;
2600 
2601 	sdata->u.mgd.powersave = enabled;
2602 	local->dynamic_ps_forced_timeout = timeout;
2603 
2604 	/* no change, but if automatic follow powersave */
2605 	sdata_lock(sdata);
2606 	__ieee80211_request_smps_mgd(sdata, sdata->u.mgd.req_smps);
2607 	sdata_unlock(sdata);
2608 
2609 	if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
2610 		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
2611 
2612 	ieee80211_recalc_ps(local, -1);
2613 	ieee80211_recalc_ps_vif(sdata);
2614 
2615 	return 0;
2616 }
2617 
2618 static int ieee80211_set_cqm_rssi_config(struct wiphy *wiphy,
2619 					 struct net_device *dev,
2620 					 s32 rssi_thold, u32 rssi_hyst)
2621 {
2622 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2623 	struct ieee80211_vif *vif = &sdata->vif;
2624 	struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
2625 
2626 	if (rssi_thold == bss_conf->cqm_rssi_thold &&
2627 	    rssi_hyst == bss_conf->cqm_rssi_hyst)
2628 		return 0;
2629 
2630 	bss_conf->cqm_rssi_thold = rssi_thold;
2631 	bss_conf->cqm_rssi_hyst = rssi_hyst;
2632 
2633 	/* tell the driver upon association, unless already associated */
2634 	if (sdata->u.mgd.associated &&
2635 	    sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)
2636 		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_CQM);
2637 
2638 	return 0;
2639 }
2640 
2641 static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
2642 				      struct net_device *dev,
2643 				      const u8 *addr,
2644 				      const struct cfg80211_bitrate_mask *mask)
2645 {
2646 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2647 	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2648 	int i, ret;
2649 
2650 	if (!ieee80211_sdata_running(sdata))
2651 		return -ENETDOWN;
2652 
2653 	if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
2654 		ret = drv_set_bitrate_mask(local, sdata, mask);
2655 		if (ret)
2656 			return ret;
2657 	}
2658 
2659 	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
2660 		struct ieee80211_supported_band *sband = wiphy->bands[i];
2661 		int j;
2662 
2663 		sdata->rc_rateidx_mask[i] = mask->control[i].legacy;
2664 		memcpy(sdata->rc_rateidx_mcs_mask[i], mask->control[i].ht_mcs,
2665 		       sizeof(mask->control[i].ht_mcs));
2666 
2667 		sdata->rc_has_mcs_mask[i] = false;
2668 		if (!sband)
2669 			continue;
2670 
2671 		for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++)
2672 			if (~sdata->rc_rateidx_mcs_mask[i][j]) {
2673 				sdata->rc_has_mcs_mask[i] = true;
2674 				break;
2675 			}
2676 	}
2677 
2678 	return 0;
2679 }
2680 
2681 static int ieee80211_start_roc_work(struct ieee80211_local *local,
2682 				    struct ieee80211_sub_if_data *sdata,
2683 				    struct ieee80211_channel *channel,
2684 				    unsigned int duration, u64 *cookie,
2685 				    struct sk_buff *txskb,
2686 				    enum ieee80211_roc_type type)
2687 {
2688 	struct ieee80211_roc_work *roc, *tmp;
2689 	bool queued = false;
2690 	int ret;
2691 
2692 	lockdep_assert_held(&local->mtx);
2693 
2694 	if (local->use_chanctx && !local->ops->remain_on_channel)
2695 		return -EOPNOTSUPP;
2696 
2697 	roc = kzalloc(sizeof(*roc), GFP_KERNEL);
2698 	if (!roc)
2699 		return -ENOMEM;
2700 
2701 	/*
2702 	 * If the duration is zero, then the driver
2703 	 * wouldn't actually do anything. Set it to
2704 	 * 10 for now.
2705 	 *
2706 	 * TODO: cancel the off-channel operation
2707 	 *       when we get the SKB's TX status and
2708 	 *       the wait time was zero before.
2709 	 */
2710 	if (!duration)
2711 		duration = 10;
2712 
2713 	roc->chan = channel;
2714 	roc->duration = duration;
2715 	roc->req_duration = duration;
2716 	roc->frame = txskb;
2717 	roc->type = type;
2718 	roc->mgmt_tx_cookie = (unsigned long)txskb;
2719 	roc->sdata = sdata;
2720 	INIT_DELAYED_WORK(&roc->work, ieee80211_sw_roc_work);
2721 	INIT_LIST_HEAD(&roc->dependents);
2722 
2723 	/*
2724 	 * cookie is either the roc cookie (for normal roc)
2725 	 * or the SKB (for mgmt TX)
2726 	 */
2727 	if (!txskb) {
2728 		/* local->mtx protects this */
2729 		local->roc_cookie_counter++;
2730 		roc->cookie = local->roc_cookie_counter;
2731 		/* wow, you wrapped 64 bits ... more likely a bug */
2732 		if (WARN_ON(roc->cookie == 0)) {
2733 			roc->cookie = 1;
2734 			local->roc_cookie_counter++;
2735 		}
2736 		*cookie = roc->cookie;
2737 	} else {
2738 		*cookie = (unsigned long)txskb;
2739 	}
2740 
2741 	/* if there's one pending or we're scanning, queue this one */
2742 	if (!list_empty(&local->roc_list) ||
2743 	    local->scanning || local->radar_detect_enabled)
2744 		goto out_check_combine;
2745 
2746 	/* if not HW assist, just queue & schedule work */
2747 	if (!local->ops->remain_on_channel) {
2748 		ieee80211_queue_delayed_work(&local->hw, &roc->work, 0);
2749 		goto out_queue;
2750 	}
2751 
2752 	/* otherwise actually kick it off here (for error handling) */
2753 
2754 	ret = drv_remain_on_channel(local, sdata, channel, duration, type);
2755 	if (ret) {
2756 		kfree(roc);
2757 		return ret;
2758 	}
2759 
2760 	roc->started = true;
2761 	goto out_queue;
2762 
2763  out_check_combine:
2764 	list_for_each_entry(tmp, &local->roc_list, list) {
2765 		if (tmp->chan != channel || tmp->sdata != sdata)
2766 			continue;
2767 
2768 		/*
2769 		 * Extend this ROC if possible:
2770 		 *
2771 		 * If it hasn't started yet, just increase the duration
2772 		 * and add the new one to the list of dependents.
2773 		 * If the type of the new ROC has higher priority, modify the
2774 		 * type of the previous one to match that of the new one.
2775 		 */
2776 		if (!tmp->started) {
2777 			list_add_tail(&roc->list, &tmp->dependents);
2778 			tmp->duration = max(tmp->duration, roc->duration);
2779 			tmp->type = max(tmp->type, roc->type);
2780 			queued = true;
2781 			break;
2782 		}
2783 
2784 		/* If it has already started, it's more difficult ... */
2785 		if (local->ops->remain_on_channel) {
2786 			unsigned long j = jiffies;
2787 
2788 			/*
2789 			 * In the offloaded ROC case, if it hasn't begun, add
2790 			 * this new one to the dependent list to be handled
2791 			 * when the master one begins. If it has begun,
2792 			 * check that there's still a minimum time left and
2793 			 * if so, start this one, transmitting the frame, but
2794 			 * add it to the list directly after this one with
2795 			 * a reduced time so we'll ask the driver to execute
2796 			 * it right after finishing the previous one, in the
2797 			 * hope that it'll also be executed right afterwards,
2798 			 * effectively extending the old one.
2799 			 * If there's no minimum time left, just add it to the
2800 			 * normal list.
2801 			 * TODO: the ROC type is ignored here, assuming that it
2802 			 * is better to immediately use the current ROC.
2803 			 */
2804 			if (!tmp->hw_begun) {
2805 				list_add_tail(&roc->list, &tmp->dependents);
2806 				queued = true;
2807 				break;
2808 			}
2809 
2810 			if (time_before(j + IEEE80211_ROC_MIN_LEFT,
2811 					tmp->hw_start_time +
2812 					msecs_to_jiffies(tmp->duration))) {
2813 				int new_dur;
2814 
2815 				ieee80211_handle_roc_started(roc);
2816 
2817 				new_dur = roc->duration -
2818 					  jiffies_to_msecs(tmp->hw_start_time +
2819 							   msecs_to_jiffies(
2820 								tmp->duration) -
2821 							   j);
2822 
2823 				if (new_dur > 0) {
2824 					/* add right after tmp */
2825 					list_add(&roc->list, &tmp->list);
2826 				} else {
2827 					list_add_tail(&roc->list,
2828 						      &tmp->dependents);
2829 				}
2830 				queued = true;
2831 			}
2832 		} else if (del_timer_sync(&tmp->work.timer)) {
2833 			unsigned long new_end;
2834 
2835 			/*
2836 			 * In the software ROC case, cancel the timer, if
2837 			 * that fails then the finish work is already
2838 			 * queued/pending and thus we queue the new ROC
2839 			 * normally, if that succeeds then we can extend
2840 			 * the timer duration and TX the frame (if any.)
2841 			 */
2842 
2843 			list_add_tail(&roc->list, &tmp->dependents);
2844 			queued = true;
2845 
2846 			new_end = jiffies + msecs_to_jiffies(roc->duration);
2847 
2848 			/* ok, it was started & we canceled timer */
2849 			if (time_after(new_end, tmp->work.timer.expires))
2850 				mod_timer(&tmp->work.timer, new_end);
2851 			else
2852 				add_timer(&tmp->work.timer);
2853 
2854 			ieee80211_handle_roc_started(roc);
2855 		}
2856 		break;
2857 	}
2858 
2859  out_queue:
2860 	if (!queued)
2861 		list_add_tail(&roc->list, &local->roc_list);
2862 
2863 	return 0;
2864 }
2865 
2866 static int ieee80211_remain_on_channel(struct wiphy *wiphy,
2867 				       struct wireless_dev *wdev,
2868 				       struct ieee80211_channel *chan,
2869 				       unsigned int duration,
2870 				       u64 *cookie)
2871 {
2872 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
2873 	struct ieee80211_local *local = sdata->local;
2874 	int ret;
2875 
2876 	mutex_lock(&local->mtx);
2877 	ret = ieee80211_start_roc_work(local, sdata, chan,
2878 				       duration, cookie, NULL,
2879 				       IEEE80211_ROC_TYPE_NORMAL);
2880 	mutex_unlock(&local->mtx);
2881 
2882 	return ret;
2883 }
2884 
2885 static int ieee80211_cancel_roc(struct ieee80211_local *local,
2886 				u64 cookie, bool mgmt_tx)
2887 {
2888 	struct ieee80211_roc_work *roc, *tmp, *found = NULL;
2889 	int ret;
2890 
2891 	mutex_lock(&local->mtx);
2892 	list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
2893 		struct ieee80211_roc_work *dep, *tmp2;
2894 
2895 		list_for_each_entry_safe(dep, tmp2, &roc->dependents, list) {
2896 			if (!mgmt_tx && dep->cookie != cookie)
2897 				continue;
2898 			else if (mgmt_tx && dep->mgmt_tx_cookie != cookie)
2899 				continue;
2900 			/* found dependent item -- just remove it */
2901 			list_del(&dep->list);
2902 			mutex_unlock(&local->mtx);
2903 
2904 			ieee80211_roc_notify_destroy(dep, true);
2905 			return 0;
2906 		}
2907 
2908 		if (!mgmt_tx && roc->cookie != cookie)
2909 			continue;
2910 		else if (mgmt_tx && roc->mgmt_tx_cookie != cookie)
2911 			continue;
2912 
2913 		found = roc;
2914 		break;
2915 	}
2916 
2917 	if (!found) {
2918 		mutex_unlock(&local->mtx);
2919 		return -ENOENT;
2920 	}
2921 
2922 	/*
2923 	 * We found the item to cancel, so do that. Note that it
2924 	 * may have dependents, which we also cancel (and send
2925 	 * the expired signal for.) Not doing so would be quite
2926 	 * tricky here, but we may need to fix it later.
2927 	 */
2928 
2929 	if (local->ops->remain_on_channel) {
2930 		if (found->started) {
2931 			ret = drv_cancel_remain_on_channel(local);
2932 			if (WARN_ON_ONCE(ret)) {
2933 				mutex_unlock(&local->mtx);
2934 				return ret;
2935 			}
2936 		}
2937 
2938 		list_del(&found->list);
2939 
2940 		if (found->started)
2941 			ieee80211_start_next_roc(local);
2942 		mutex_unlock(&local->mtx);
2943 
2944 		ieee80211_roc_notify_destroy(found, true);
2945 	} else {
2946 		/* work may be pending so use it all the time */
2947 		found->abort = true;
2948 		ieee80211_queue_delayed_work(&local->hw, &found->work, 0);
2949 
2950 		mutex_unlock(&local->mtx);
2951 
2952 		/* work will clean up etc */
2953 		flush_delayed_work(&found->work);
2954 		WARN_ON(!found->to_be_freed);
2955 		kfree(found);
2956 	}
2957 
2958 	return 0;
2959 }
2960 
2961 static int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
2962 					      struct wireless_dev *wdev,
2963 					      u64 cookie)
2964 {
2965 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
2966 	struct ieee80211_local *local = sdata->local;
2967 
2968 	return ieee80211_cancel_roc(local, cookie, false);
2969 }
2970 
2971 static int ieee80211_start_radar_detection(struct wiphy *wiphy,
2972 					   struct net_device *dev,
2973 					   struct cfg80211_chan_def *chandef,
2974 					   u32 cac_time_ms)
2975 {
2976 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2977 	struct ieee80211_local *local = sdata->local;
2978 	int err;
2979 
2980 	mutex_lock(&local->mtx);
2981 	if (!list_empty(&local->roc_list) || local->scanning) {
2982 		err = -EBUSY;
2983 		goto out_unlock;
2984 	}
2985 
2986 	/* whatever, but channel contexts should not complain about that one */
2987 	sdata->smps_mode = IEEE80211_SMPS_OFF;
2988 	sdata->needed_rx_chains = local->rx_chains;
2989 
2990 	err = ieee80211_vif_use_channel(sdata, chandef,
2991 					IEEE80211_CHANCTX_SHARED);
2992 	if (err)
2993 		goto out_unlock;
2994 
2995 	ieee80211_queue_delayed_work(&sdata->local->hw,
2996 				     &sdata->dfs_cac_timer_work,
2997 				     msecs_to_jiffies(cac_time_ms));
2998 
2999  out_unlock:
3000 	mutex_unlock(&local->mtx);
3001 	return err;
3002 }
3003 
3004 static struct cfg80211_beacon_data *
3005 cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon)
3006 {
3007 	struct cfg80211_beacon_data *new_beacon;
3008 	u8 *pos;
3009 	int len;
3010 
3011 	len = beacon->head_len + beacon->tail_len + beacon->beacon_ies_len +
3012 	      beacon->proberesp_ies_len + beacon->assocresp_ies_len +
3013 	      beacon->probe_resp_len;
3014 
3015 	new_beacon = kzalloc(sizeof(*new_beacon) + len, GFP_KERNEL);
3016 	if (!new_beacon)
3017 		return NULL;
3018 
3019 	pos = (u8 *)(new_beacon + 1);
3020 	if (beacon->head_len) {
3021 		new_beacon->head_len = beacon->head_len;
3022 		new_beacon->head = pos;
3023 		memcpy(pos, beacon->head, beacon->head_len);
3024 		pos += beacon->head_len;
3025 	}
3026 	if (beacon->tail_len) {
3027 		new_beacon->tail_len = beacon->tail_len;
3028 		new_beacon->tail = pos;
3029 		memcpy(pos, beacon->tail, beacon->tail_len);
3030 		pos += beacon->tail_len;
3031 	}
3032 	if (beacon->beacon_ies_len) {
3033 		new_beacon->beacon_ies_len = beacon->beacon_ies_len;
3034 		new_beacon->beacon_ies = pos;
3035 		memcpy(pos, beacon->beacon_ies, beacon->beacon_ies_len);
3036 		pos += beacon->beacon_ies_len;
3037 	}
3038 	if (beacon->proberesp_ies_len) {
3039 		new_beacon->proberesp_ies_len = beacon->proberesp_ies_len;
3040 		new_beacon->proberesp_ies = pos;
3041 		memcpy(pos, beacon->proberesp_ies, beacon->proberesp_ies_len);
3042 		pos += beacon->proberesp_ies_len;
3043 	}
3044 	if (beacon->assocresp_ies_len) {
3045 		new_beacon->assocresp_ies_len = beacon->assocresp_ies_len;
3046 		new_beacon->assocresp_ies = pos;
3047 		memcpy(pos, beacon->assocresp_ies, beacon->assocresp_ies_len);
3048 		pos += beacon->assocresp_ies_len;
3049 	}
3050 	if (beacon->probe_resp_len) {
3051 		new_beacon->probe_resp_len = beacon->probe_resp_len;
3052 		beacon->probe_resp = pos;
3053 		memcpy(pos, beacon->probe_resp, beacon->probe_resp_len);
3054 		pos += beacon->probe_resp_len;
3055 	}
3056 
3057 	return new_beacon;
3058 }
3059 
3060 void ieee80211_csa_finish(struct ieee80211_vif *vif)
3061 {
3062 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3063 
3064 	ieee80211_queue_work(&sdata->local->hw,
3065 			     &sdata->csa_finalize_work);
3066 }
3067 EXPORT_SYMBOL(ieee80211_csa_finish);
3068 
3069 static int ieee80211_set_after_csa_beacon(struct ieee80211_sub_if_data *sdata,
3070 					  u32 *changed)
3071 {
3072 	int err;
3073 
3074 	switch (sdata->vif.type) {
3075 	case NL80211_IFTYPE_AP:
3076 		err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
3077 		kfree(sdata->u.ap.next_beacon);
3078 		sdata->u.ap.next_beacon = NULL;
3079 
3080 		if (err < 0)
3081 			return err;
3082 		*changed |= err;
3083 		break;
3084 	case NL80211_IFTYPE_ADHOC:
3085 		err = ieee80211_ibss_finish_csa(sdata);
3086 		if (err < 0)
3087 			return err;
3088 		*changed |= err;
3089 		break;
3090 #ifdef CONFIG_MAC80211_MESH
3091 	case NL80211_IFTYPE_MESH_POINT:
3092 		err = ieee80211_mesh_finish_csa(sdata);
3093 		if (err < 0)
3094 			return err;
3095 		*changed |= err;
3096 		break;
3097 #endif
3098 	default:
3099 		WARN_ON(1);
3100 		return -EINVAL;
3101 	}
3102 
3103 	return 0;
3104 }
3105 
3106 static int __ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
3107 {
3108 	struct ieee80211_local *local = sdata->local;
3109 	u32 changed = 0;
3110 	int err;
3111 
3112 	sdata_assert_lock(sdata);
3113 	lockdep_assert_held(&local->mtx);
3114 
3115 	sdata->radar_required = sdata->csa_radar_required;
3116 	err = ieee80211_vif_change_channel(sdata, &changed);
3117 	if (err < 0)
3118 		return err;
3119 
3120 	if (!local->use_chanctx) {
3121 		local->_oper_chandef = sdata->csa_chandef;
3122 		ieee80211_hw_config(local, 0);
3123 	}
3124 
3125 	sdata->vif.csa_active = false;
3126 
3127 	err = ieee80211_set_after_csa_beacon(sdata, &changed);
3128 	if (err)
3129 		return err;
3130 
3131 	ieee80211_bss_info_change_notify(sdata, changed);
3132 	cfg80211_ch_switch_notify(sdata->dev, &sdata->csa_chandef);
3133 
3134 	if (!ieee80211_csa_needs_block_tx(local))
3135 		ieee80211_wake_queues_by_reason(&local->hw,
3136 					IEEE80211_MAX_QUEUE_MAP,
3137 					IEEE80211_QUEUE_STOP_REASON_CSA);
3138 
3139 	return 0;
3140 }
3141 
3142 static void ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
3143 {
3144 	if (__ieee80211_csa_finalize(sdata)) {
3145 		sdata_info(sdata, "failed to finalize CSA, disconnecting\n");
3146 		cfg80211_stop_iface(sdata->local->hw.wiphy, &sdata->wdev,
3147 				    GFP_KERNEL);
3148 	}
3149 }
3150 
3151 void ieee80211_csa_finalize_work(struct work_struct *work)
3152 {
3153 	struct ieee80211_sub_if_data *sdata =
3154 		container_of(work, struct ieee80211_sub_if_data,
3155 			     csa_finalize_work);
3156 	struct ieee80211_local *local = sdata->local;
3157 
3158 	sdata_lock(sdata);
3159 	mutex_lock(&local->mtx);
3160 
3161 	/* AP might have been stopped while waiting for the lock. */
3162 	if (!sdata->vif.csa_active)
3163 		goto unlock;
3164 
3165 	if (!ieee80211_sdata_running(sdata))
3166 		goto unlock;
3167 
3168 	ieee80211_csa_finalize(sdata);
3169 
3170 unlock:
3171 	mutex_unlock(&local->mtx);
3172 	sdata_unlock(sdata);
3173 }
3174 
3175 static int ieee80211_set_csa_beacon(struct ieee80211_sub_if_data *sdata,
3176 				    struct cfg80211_csa_settings *params,
3177 				    u32 *changed)
3178 {
3179 	int err;
3180 
3181 	switch (sdata->vif.type) {
3182 	case NL80211_IFTYPE_AP:
3183 		sdata->u.ap.next_beacon =
3184 			cfg80211_beacon_dup(&params->beacon_after);
3185 		if (!sdata->u.ap.next_beacon)
3186 			return -ENOMEM;
3187 
3188 		/*
3189 		 * With a count of 0, we don't have to wait for any
3190 		 * TBTT before switching, so complete the CSA
3191 		 * immediately.  In theory, with a count == 1 we
3192 		 * should delay the switch until just before the next
3193 		 * TBTT, but that would complicate things so we switch
3194 		 * immediately too.  If we would delay the switch
3195 		 * until the next TBTT, we would have to set the probe
3196 		 * response here.
3197 		 *
3198 		 * TODO: A channel switch with count <= 1 without
3199 		 * sending a CSA action frame is kind of useless,
3200 		 * because the clients won't know we're changing
3201 		 * channels.  The action frame must be implemented
3202 		 * either here or in the userspace.
3203 		 */
3204 		if (params->count <= 1)
3205 			break;
3206 
3207 		if ((params->n_counter_offsets_beacon >
3208 		     IEEE80211_MAX_CSA_COUNTERS_NUM) ||
3209 		    (params->n_counter_offsets_presp >
3210 		     IEEE80211_MAX_CSA_COUNTERS_NUM))
3211 			return -EINVAL;
3212 
3213 		/* make sure we don't have garbage in other counters */
3214 		memset(sdata->csa_counter_offset_beacon, 0,
3215 		       sizeof(sdata->csa_counter_offset_beacon));
3216 		memset(sdata->csa_counter_offset_presp, 0,
3217 		       sizeof(sdata->csa_counter_offset_presp));
3218 
3219 		memcpy(sdata->csa_counter_offset_beacon,
3220 		       params->counter_offsets_beacon,
3221 		       params->n_counter_offsets_beacon * sizeof(u16));
3222 		memcpy(sdata->csa_counter_offset_presp,
3223 		       params->counter_offsets_presp,
3224 		       params->n_counter_offsets_presp * sizeof(u16));
3225 
3226 		err = ieee80211_assign_beacon(sdata, &params->beacon_csa);
3227 		if (err < 0) {
3228 			kfree(sdata->u.ap.next_beacon);
3229 			return err;
3230 		}
3231 		*changed |= err;
3232 
3233 		break;
3234 	case NL80211_IFTYPE_ADHOC:
3235 		if (!sdata->vif.bss_conf.ibss_joined)
3236 			return -EINVAL;
3237 
3238 		if (params->chandef.width != sdata->u.ibss.chandef.width)
3239 			return -EINVAL;
3240 
3241 		switch (params->chandef.width) {
3242 		case NL80211_CHAN_WIDTH_40:
3243 			if (cfg80211_get_chandef_type(&params->chandef) !=
3244 			    cfg80211_get_chandef_type(&sdata->u.ibss.chandef))
3245 				return -EINVAL;
3246 		case NL80211_CHAN_WIDTH_5:
3247 		case NL80211_CHAN_WIDTH_10:
3248 		case NL80211_CHAN_WIDTH_20_NOHT:
3249 		case NL80211_CHAN_WIDTH_20:
3250 			break;
3251 		default:
3252 			return -EINVAL;
3253 		}
3254 
3255 		/* changes into another band are not supported */
3256 		if (sdata->u.ibss.chandef.chan->band !=
3257 		    params->chandef.chan->band)
3258 			return -EINVAL;
3259 
3260 		/* see comments in the NL80211_IFTYPE_AP block */
3261 		if (params->count > 1) {
3262 			err = ieee80211_ibss_csa_beacon(sdata, params);
3263 			if (err < 0)
3264 				return err;
3265 			*changed |= err;
3266 		}
3267 
3268 		ieee80211_send_action_csa(sdata, params);
3269 
3270 		break;
3271 #ifdef CONFIG_MAC80211_MESH
3272 	case NL80211_IFTYPE_MESH_POINT: {
3273 		struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
3274 
3275 		if (params->chandef.width != sdata->vif.bss_conf.chandef.width)
3276 			return -EINVAL;
3277 
3278 		/* changes into another band are not supported */
3279 		if (sdata->vif.bss_conf.chandef.chan->band !=
3280 		    params->chandef.chan->band)
3281 			return -EINVAL;
3282 
3283 		if (ifmsh->csa_role == IEEE80211_MESH_CSA_ROLE_NONE) {
3284 			ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_INIT;
3285 			if (!ifmsh->pre_value)
3286 				ifmsh->pre_value = 1;
3287 			else
3288 				ifmsh->pre_value++;
3289 		}
3290 
3291 		/* see comments in the NL80211_IFTYPE_AP block */
3292 		if (params->count > 1) {
3293 			err = ieee80211_mesh_csa_beacon(sdata, params);
3294 			if (err < 0) {
3295 				ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_NONE;
3296 				return err;
3297 			}
3298 			*changed |= err;
3299 		}
3300 
3301 		if (ifmsh->csa_role == IEEE80211_MESH_CSA_ROLE_INIT)
3302 			ieee80211_send_action_csa(sdata, params);
3303 
3304 		break;
3305 		}
3306 #endif
3307 	default:
3308 		return -EOPNOTSUPP;
3309 	}
3310 
3311 	return 0;
3312 }
3313 
3314 static int
3315 __ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
3316 			   struct cfg80211_csa_settings *params)
3317 {
3318 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3319 	struct ieee80211_local *local = sdata->local;
3320 	struct ieee80211_chanctx_conf *conf;
3321 	struct ieee80211_chanctx *chanctx;
3322 	int err, num_chanctx, changed = 0;
3323 
3324 	sdata_assert_lock(sdata);
3325 	lockdep_assert_held(&local->mtx);
3326 
3327 	if (!list_empty(&local->roc_list) || local->scanning)
3328 		return -EBUSY;
3329 
3330 	if (sdata->wdev.cac_started)
3331 		return -EBUSY;
3332 
3333 	if (cfg80211_chandef_identical(&params->chandef,
3334 				       &sdata->vif.bss_conf.chandef))
3335 		return -EINVAL;
3336 
3337 	mutex_lock(&local->chanctx_mtx);
3338 	conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
3339 					 lockdep_is_held(&local->chanctx_mtx));
3340 	if (!conf) {
3341 		mutex_unlock(&local->chanctx_mtx);
3342 		return -EBUSY;
3343 	}
3344 
3345 	/* don't handle for multi-VIF cases */
3346 	chanctx = container_of(conf, struct ieee80211_chanctx, conf);
3347 	if (ieee80211_chanctx_refcount(local, chanctx) > 1) {
3348 		mutex_unlock(&local->chanctx_mtx);
3349 		return -EBUSY;
3350 	}
3351 	num_chanctx = 0;
3352 	list_for_each_entry_rcu(chanctx, &local->chanctx_list, list)
3353 		num_chanctx++;
3354 	mutex_unlock(&local->chanctx_mtx);
3355 
3356 	if (num_chanctx > 1)
3357 		return -EBUSY;
3358 
3359 	/* don't allow another channel switch if one is already active. */
3360 	if (sdata->vif.csa_active)
3361 		return -EBUSY;
3362 
3363 	err = ieee80211_set_csa_beacon(sdata, params, &changed);
3364 	if (err)
3365 		return err;
3366 
3367 	sdata->csa_radar_required = params->radar_required;
3368 	sdata->csa_chandef = params->chandef;
3369 	sdata->csa_block_tx = params->block_tx;
3370 	sdata->csa_current_counter = params->count;
3371 	sdata->vif.csa_active = true;
3372 
3373 	if (sdata->csa_block_tx)
3374 		ieee80211_stop_queues_by_reason(&local->hw,
3375 					IEEE80211_MAX_QUEUE_MAP,
3376 					IEEE80211_QUEUE_STOP_REASON_CSA);
3377 
3378 	if (changed) {
3379 		ieee80211_bss_info_change_notify(sdata, changed);
3380 		drv_channel_switch_beacon(sdata, &params->chandef);
3381 	} else {
3382 		/* if the beacon didn't change, we can finalize immediately */
3383 		ieee80211_csa_finalize(sdata);
3384 	}
3385 
3386 	return 0;
3387 }
3388 
3389 int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
3390 			     struct cfg80211_csa_settings *params)
3391 {
3392 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3393 	struct ieee80211_local *local = sdata->local;
3394 	int err;
3395 
3396 	mutex_lock(&local->mtx);
3397 	err = __ieee80211_channel_switch(wiphy, dev, params);
3398 	mutex_unlock(&local->mtx);
3399 
3400 	return err;
3401 }
3402 
3403 static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
3404 			     struct cfg80211_mgmt_tx_params *params,
3405 			     u64 *cookie)
3406 {
3407 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
3408 	struct ieee80211_local *local = sdata->local;
3409 	struct sk_buff *skb;
3410 	struct sta_info *sta;
3411 	const struct ieee80211_mgmt *mgmt = (void *)params->buf;
3412 	bool need_offchan = false;
3413 	u32 flags;
3414 	int ret;
3415 	u8 *data;
3416 
3417 	if (params->dont_wait_for_ack)
3418 		flags = IEEE80211_TX_CTL_NO_ACK;
3419 	else
3420 		flags = IEEE80211_TX_INTFL_NL80211_FRAME_TX |
3421 			IEEE80211_TX_CTL_REQ_TX_STATUS;
3422 
3423 	if (params->no_cck)
3424 		flags |= IEEE80211_TX_CTL_NO_CCK_RATE;
3425 
3426 	switch (sdata->vif.type) {
3427 	case NL80211_IFTYPE_ADHOC:
3428 		if (!sdata->vif.bss_conf.ibss_joined)
3429 			need_offchan = true;
3430 		/* fall through */
3431 #ifdef CONFIG_MAC80211_MESH
3432 	case NL80211_IFTYPE_MESH_POINT:
3433 		if (ieee80211_vif_is_mesh(&sdata->vif) &&
3434 		    !sdata->u.mesh.mesh_id_len)
3435 			need_offchan = true;
3436 		/* fall through */
3437 #endif
3438 	case NL80211_IFTYPE_AP:
3439 	case NL80211_IFTYPE_AP_VLAN:
3440 	case NL80211_IFTYPE_P2P_GO:
3441 		if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3442 		    !ieee80211_vif_is_mesh(&sdata->vif) &&
3443 		    !rcu_access_pointer(sdata->bss->beacon))
3444 			need_offchan = true;
3445 		if (!ieee80211_is_action(mgmt->frame_control) ||
3446 		    mgmt->u.action.category == WLAN_CATEGORY_PUBLIC ||
3447 		    mgmt->u.action.category == WLAN_CATEGORY_SELF_PROTECTED ||
3448 		    mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT)
3449 			break;
3450 		rcu_read_lock();
3451 		sta = sta_info_get(sdata, mgmt->da);
3452 		rcu_read_unlock();
3453 		if (!sta)
3454 			return -ENOLINK;
3455 		break;
3456 	case NL80211_IFTYPE_STATION:
3457 	case NL80211_IFTYPE_P2P_CLIENT:
3458 		if (!sdata->u.mgd.associated)
3459 			need_offchan = true;
3460 		break;
3461 	case NL80211_IFTYPE_P2P_DEVICE:
3462 		need_offchan = true;
3463 		break;
3464 	default:
3465 		return -EOPNOTSUPP;
3466 	}
3467 
3468 	/* configurations requiring offchan cannot work if no channel has been
3469 	 * specified
3470 	 */
3471 	if (need_offchan && !params->chan)
3472 		return -EINVAL;
3473 
3474 	mutex_lock(&local->mtx);
3475 
3476 	/* Check if the operating channel is the requested channel */
3477 	if (!need_offchan) {
3478 		struct ieee80211_chanctx_conf *chanctx_conf;
3479 
3480 		rcu_read_lock();
3481 		chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
3482 
3483 		if (chanctx_conf) {
3484 			need_offchan = params->chan &&
3485 				       (params->chan !=
3486 					chanctx_conf->def.chan);
3487 		} else if (!params->chan) {
3488 			ret = -EINVAL;
3489 			rcu_read_unlock();
3490 			goto out_unlock;
3491 		} else {
3492 			need_offchan = true;
3493 		}
3494 		rcu_read_unlock();
3495 	}
3496 
3497 	if (need_offchan && !params->offchan) {
3498 		ret = -EBUSY;
3499 		goto out_unlock;
3500 	}
3501 
3502 	skb = dev_alloc_skb(local->hw.extra_tx_headroom + params->len);
3503 	if (!skb) {
3504 		ret = -ENOMEM;
3505 		goto out_unlock;
3506 	}
3507 	skb_reserve(skb, local->hw.extra_tx_headroom);
3508 
3509 	data = skb_put(skb, params->len);
3510 	memcpy(data, params->buf, params->len);
3511 
3512 	/* Update CSA counters */
3513 	if (sdata->vif.csa_active &&
3514 	    (sdata->vif.type == NL80211_IFTYPE_AP ||
3515 	     sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
3516 	    params->n_csa_offsets) {
3517 		int i;
3518 		u8 c = sdata->csa_current_counter;
3519 
3520 		for (i = 0; i < params->n_csa_offsets; i++)
3521 			data[params->csa_offsets[i]] = c;
3522 	}
3523 
3524 	IEEE80211_SKB_CB(skb)->flags = flags;
3525 
3526 	skb->dev = sdata->dev;
3527 
3528 	if (!need_offchan) {
3529 		*cookie = (unsigned long) skb;
3530 		ieee80211_tx_skb(sdata, skb);
3531 		ret = 0;
3532 		goto out_unlock;
3533 	}
3534 
3535 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN |
3536 					IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
3537 	if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
3538 		IEEE80211_SKB_CB(skb)->hw_queue =
3539 			local->hw.offchannel_tx_hw_queue;
3540 
3541 	/* This will handle all kinds of coalescing and immediate TX */
3542 	ret = ieee80211_start_roc_work(local, sdata, params->chan,
3543 				       params->wait, cookie, skb,
3544 				       IEEE80211_ROC_TYPE_MGMT_TX);
3545 	if (ret)
3546 		kfree_skb(skb);
3547  out_unlock:
3548 	mutex_unlock(&local->mtx);
3549 	return ret;
3550 }
3551 
3552 static int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
3553 					 struct wireless_dev *wdev,
3554 					 u64 cookie)
3555 {
3556 	struct ieee80211_local *local = wiphy_priv(wiphy);
3557 
3558 	return ieee80211_cancel_roc(local, cookie, true);
3559 }
3560 
3561 static void ieee80211_mgmt_frame_register(struct wiphy *wiphy,
3562 					  struct wireless_dev *wdev,
3563 					  u16 frame_type, bool reg)
3564 {
3565 	struct ieee80211_local *local = wiphy_priv(wiphy);
3566 
3567 	switch (frame_type) {
3568 	case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_REQ:
3569 		if (reg)
3570 			local->probe_req_reg++;
3571 		else
3572 			local->probe_req_reg--;
3573 
3574 		if (!local->open_count)
3575 			break;
3576 
3577 		ieee80211_queue_work(&local->hw, &local->reconfig_filter);
3578 		break;
3579 	default:
3580 		break;
3581 	}
3582 }
3583 
3584 static int ieee80211_set_antenna(struct wiphy *wiphy, u32 tx_ant, u32 rx_ant)
3585 {
3586 	struct ieee80211_local *local = wiphy_priv(wiphy);
3587 
3588 	if (local->started)
3589 		return -EOPNOTSUPP;
3590 
3591 	return drv_set_antenna(local, tx_ant, rx_ant);
3592 }
3593 
3594 static int ieee80211_get_antenna(struct wiphy *wiphy, u32 *tx_ant, u32 *rx_ant)
3595 {
3596 	struct ieee80211_local *local = wiphy_priv(wiphy);
3597 
3598 	return drv_get_antenna(local, tx_ant, rx_ant);
3599 }
3600 
3601 static int ieee80211_set_ringparam(struct wiphy *wiphy, u32 tx, u32 rx)
3602 {
3603 	struct ieee80211_local *local = wiphy_priv(wiphy);
3604 
3605 	return drv_set_ringparam(local, tx, rx);
3606 }
3607 
3608 static void ieee80211_get_ringparam(struct wiphy *wiphy,
3609 				    u32 *tx, u32 *tx_max, u32 *rx, u32 *rx_max)
3610 {
3611 	struct ieee80211_local *local = wiphy_priv(wiphy);
3612 
3613 	drv_get_ringparam(local, tx, tx_max, rx, rx_max);
3614 }
3615 
3616 static int ieee80211_set_rekey_data(struct wiphy *wiphy,
3617 				    struct net_device *dev,
3618 				    struct cfg80211_gtk_rekey_data *data)
3619 {
3620 	struct ieee80211_local *local = wiphy_priv(wiphy);
3621 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3622 
3623 	if (!local->ops->set_rekey_data)
3624 		return -EOPNOTSUPP;
3625 
3626 	drv_set_rekey_data(local, sdata, data);
3627 
3628 	return 0;
3629 }
3630 
3631 static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
3632 				  const u8 *peer, u64 *cookie)
3633 {
3634 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3635 	struct ieee80211_local *local = sdata->local;
3636 	struct ieee80211_qos_hdr *nullfunc;
3637 	struct sk_buff *skb;
3638 	int size = sizeof(*nullfunc);
3639 	__le16 fc;
3640 	bool qos;
3641 	struct ieee80211_tx_info *info;
3642 	struct sta_info *sta;
3643 	struct ieee80211_chanctx_conf *chanctx_conf;
3644 	enum ieee80211_band band;
3645 
3646 	rcu_read_lock();
3647 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
3648 	if (WARN_ON(!chanctx_conf)) {
3649 		rcu_read_unlock();
3650 		return -EINVAL;
3651 	}
3652 	band = chanctx_conf->def.chan->band;
3653 	sta = sta_info_get_bss(sdata, peer);
3654 	if (sta) {
3655 		qos = test_sta_flag(sta, WLAN_STA_WME);
3656 	} else {
3657 		rcu_read_unlock();
3658 		return -ENOLINK;
3659 	}
3660 
3661 	if (qos) {
3662 		fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
3663 				 IEEE80211_STYPE_QOS_NULLFUNC |
3664 				 IEEE80211_FCTL_FROMDS);
3665 	} else {
3666 		size -= 2;
3667 		fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
3668 				 IEEE80211_STYPE_NULLFUNC |
3669 				 IEEE80211_FCTL_FROMDS);
3670 	}
3671 
3672 	skb = dev_alloc_skb(local->hw.extra_tx_headroom + size);
3673 	if (!skb) {
3674 		rcu_read_unlock();
3675 		return -ENOMEM;
3676 	}
3677 
3678 	skb->dev = dev;
3679 
3680 	skb_reserve(skb, local->hw.extra_tx_headroom);
3681 
3682 	nullfunc = (void *) skb_put(skb, size);
3683 	nullfunc->frame_control = fc;
3684 	nullfunc->duration_id = 0;
3685 	memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
3686 	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
3687 	memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);
3688 	nullfunc->seq_ctrl = 0;
3689 
3690 	info = IEEE80211_SKB_CB(skb);
3691 
3692 	info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
3693 		       IEEE80211_TX_INTFL_NL80211_FRAME_TX;
3694 
3695 	skb_set_queue_mapping(skb, IEEE80211_AC_VO);
3696 	skb->priority = 7;
3697 	if (qos)
3698 		nullfunc->qos_ctrl = cpu_to_le16(7);
3699 
3700 	local_bh_disable();
3701 	ieee80211_xmit(sdata, skb, band);
3702 	local_bh_enable();
3703 	rcu_read_unlock();
3704 
3705 	*cookie = (unsigned long) skb;
3706 	return 0;
3707 }
3708 
3709 static int ieee80211_cfg_get_channel(struct wiphy *wiphy,
3710 				     struct wireless_dev *wdev,
3711 				     struct cfg80211_chan_def *chandef)
3712 {
3713 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
3714 	struct ieee80211_local *local = wiphy_priv(wiphy);
3715 	struct ieee80211_chanctx_conf *chanctx_conf;
3716 	int ret = -ENODATA;
3717 
3718 	rcu_read_lock();
3719 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
3720 	if (chanctx_conf) {
3721 		*chandef = chanctx_conf->def;
3722 		ret = 0;
3723 	} else if (local->open_count > 0 &&
3724 		   local->open_count == local->monitors &&
3725 		   sdata->vif.type == NL80211_IFTYPE_MONITOR) {
3726 		if (local->use_chanctx)
3727 			*chandef = local->monitor_chandef;
3728 		else
3729 			*chandef = local->_oper_chandef;
3730 		ret = 0;
3731 	}
3732 	rcu_read_unlock();
3733 
3734 	return ret;
3735 }
3736 
3737 #ifdef CONFIG_PM
3738 static void ieee80211_set_wakeup(struct wiphy *wiphy, bool enabled)
3739 {
3740 	drv_set_wakeup(wiphy_priv(wiphy), enabled);
3741 }
3742 #endif
3743 
3744 static int ieee80211_set_qos_map(struct wiphy *wiphy,
3745 				 struct net_device *dev,
3746 				 struct cfg80211_qos_map *qos_map)
3747 {
3748 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3749 	struct mac80211_qos_map *new_qos_map, *old_qos_map;
3750 
3751 	if (qos_map) {
3752 		new_qos_map = kzalloc(sizeof(*new_qos_map), GFP_KERNEL);
3753 		if (!new_qos_map)
3754 			return -ENOMEM;
3755 		memcpy(&new_qos_map->qos_map, qos_map, sizeof(*qos_map));
3756 	} else {
3757 		/* A NULL qos_map was passed to disable QoS mapping */
3758 		new_qos_map = NULL;
3759 	}
3760 
3761 	old_qos_map = sdata_dereference(sdata->qos_map, sdata);
3762 	rcu_assign_pointer(sdata->qos_map, new_qos_map);
3763 	if (old_qos_map)
3764 		kfree_rcu(old_qos_map, rcu_head);
3765 
3766 	return 0;
3767 }
3768 
3769 static int ieee80211_set_ap_chanwidth(struct wiphy *wiphy,
3770 				      struct net_device *dev,
3771 				      struct cfg80211_chan_def *chandef)
3772 {
3773 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3774 	int ret;
3775 	u32 changed = 0;
3776 
3777 	ret = ieee80211_vif_change_bandwidth(sdata, chandef, &changed);
3778 	if (ret == 0)
3779 		ieee80211_bss_info_change_notify(sdata, changed);
3780 
3781 	return ret;
3782 }
3783 
3784 const struct cfg80211_ops mac80211_config_ops = {
3785 	.add_virtual_intf = ieee80211_add_iface,
3786 	.del_virtual_intf = ieee80211_del_iface,
3787 	.change_virtual_intf = ieee80211_change_iface,
3788 	.start_p2p_device = ieee80211_start_p2p_device,
3789 	.stop_p2p_device = ieee80211_stop_p2p_device,
3790 	.add_key = ieee80211_add_key,
3791 	.del_key = ieee80211_del_key,
3792 	.get_key = ieee80211_get_key,
3793 	.set_default_key = ieee80211_config_default_key,
3794 	.set_default_mgmt_key = ieee80211_config_default_mgmt_key,
3795 	.start_ap = ieee80211_start_ap,
3796 	.change_beacon = ieee80211_change_beacon,
3797 	.stop_ap = ieee80211_stop_ap,
3798 	.add_station = ieee80211_add_station,
3799 	.del_station = ieee80211_del_station,
3800 	.change_station = ieee80211_change_station,
3801 	.get_station = ieee80211_get_station,
3802 	.dump_station = ieee80211_dump_station,
3803 	.dump_survey = ieee80211_dump_survey,
3804 #ifdef CONFIG_MAC80211_MESH
3805 	.add_mpath = ieee80211_add_mpath,
3806 	.del_mpath = ieee80211_del_mpath,
3807 	.change_mpath = ieee80211_change_mpath,
3808 	.get_mpath = ieee80211_get_mpath,
3809 	.dump_mpath = ieee80211_dump_mpath,
3810 	.update_mesh_config = ieee80211_update_mesh_config,
3811 	.get_mesh_config = ieee80211_get_mesh_config,
3812 	.join_mesh = ieee80211_join_mesh,
3813 	.leave_mesh = ieee80211_leave_mesh,
3814 #endif
3815 	.change_bss = ieee80211_change_bss,
3816 	.set_txq_params = ieee80211_set_txq_params,
3817 	.set_monitor_channel = ieee80211_set_monitor_channel,
3818 	.suspend = ieee80211_suspend,
3819 	.resume = ieee80211_resume,
3820 	.scan = ieee80211_scan,
3821 	.sched_scan_start = ieee80211_sched_scan_start,
3822 	.sched_scan_stop = ieee80211_sched_scan_stop,
3823 	.auth = ieee80211_auth,
3824 	.assoc = ieee80211_assoc,
3825 	.deauth = ieee80211_deauth,
3826 	.disassoc = ieee80211_disassoc,
3827 	.join_ibss = ieee80211_join_ibss,
3828 	.leave_ibss = ieee80211_leave_ibss,
3829 	.set_mcast_rate = ieee80211_set_mcast_rate,
3830 	.set_wiphy_params = ieee80211_set_wiphy_params,
3831 	.set_tx_power = ieee80211_set_tx_power,
3832 	.get_tx_power = ieee80211_get_tx_power,
3833 	.set_wds_peer = ieee80211_set_wds_peer,
3834 	.rfkill_poll = ieee80211_rfkill_poll,
3835 	CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
3836 	CFG80211_TESTMODE_DUMP(ieee80211_testmode_dump)
3837 	.set_power_mgmt = ieee80211_set_power_mgmt,
3838 	.set_bitrate_mask = ieee80211_set_bitrate_mask,
3839 	.remain_on_channel = ieee80211_remain_on_channel,
3840 	.cancel_remain_on_channel = ieee80211_cancel_remain_on_channel,
3841 	.mgmt_tx = ieee80211_mgmt_tx,
3842 	.mgmt_tx_cancel_wait = ieee80211_mgmt_tx_cancel_wait,
3843 	.set_cqm_rssi_config = ieee80211_set_cqm_rssi_config,
3844 	.mgmt_frame_register = ieee80211_mgmt_frame_register,
3845 	.set_antenna = ieee80211_set_antenna,
3846 	.get_antenna = ieee80211_get_antenna,
3847 	.set_ringparam = ieee80211_set_ringparam,
3848 	.get_ringparam = ieee80211_get_ringparam,
3849 	.set_rekey_data = ieee80211_set_rekey_data,
3850 	.tdls_oper = ieee80211_tdls_oper,
3851 	.tdls_mgmt = ieee80211_tdls_mgmt,
3852 	.probe_client = ieee80211_probe_client,
3853 	.set_noack_map = ieee80211_set_noack_map,
3854 #ifdef CONFIG_PM
3855 	.set_wakeup = ieee80211_set_wakeup,
3856 #endif
3857 	.get_et_sset_count = ieee80211_get_et_sset_count,
3858 	.get_et_stats = ieee80211_get_et_stats,
3859 	.get_et_strings = ieee80211_get_et_strings,
3860 	.get_channel = ieee80211_cfg_get_channel,
3861 	.start_radar_detection = ieee80211_start_radar_detection,
3862 	.channel_switch = ieee80211_channel_switch,
3863 	.set_qos_map = ieee80211_set_qos_map,
3864 	.set_ap_chanwidth = ieee80211_set_ap_chanwidth,
3865 };
3866