xref: /openbmc/linux/net/mac80211/util.c (revision b593bce5)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright 2002-2005, Instant802 Networks, Inc.
4  * Copyright 2005-2006, Devicescape Software, Inc.
5  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
6  * Copyright 2007	Johannes Berg <johannes@sipsolutions.net>
7  * Copyright 2013-2014  Intel Mobile Communications GmbH
8  * Copyright (C) 2015-2017	Intel Deutschland GmbH
9  * Copyright (C) 2018-2019 Intel Corporation
10  *
11  * utilities for mac80211
12  */
13 
14 #include <net/mac80211.h>
15 #include <linux/netdevice.h>
16 #include <linux/export.h>
17 #include <linux/types.h>
18 #include <linux/slab.h>
19 #include <linux/skbuff.h>
20 #include <linux/etherdevice.h>
21 #include <linux/if_arp.h>
22 #include <linux/bitmap.h>
23 #include <linux/crc32.h>
24 #include <net/net_namespace.h>
25 #include <net/cfg80211.h>
26 #include <net/rtnetlink.h>
27 
28 #include "ieee80211_i.h"
29 #include "driver-ops.h"
30 #include "rate.h"
31 #include "mesh.h"
32 #include "wme.h"
33 #include "led.h"
34 #include "wep.h"
35 
36 /* privid for wiphys to determine whether they belong to us or not */
37 const void *const mac80211_wiphy_privid = &mac80211_wiphy_privid;
38 
39 struct ieee80211_hw *wiphy_to_ieee80211_hw(struct wiphy *wiphy)
40 {
41 	struct ieee80211_local *local;
42 	BUG_ON(!wiphy);
43 
44 	local = wiphy_priv(wiphy);
45 	return &local->hw;
46 }
47 EXPORT_SYMBOL(wiphy_to_ieee80211_hw);
48 
49 void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx)
50 {
51 	struct sk_buff *skb;
52 	struct ieee80211_hdr *hdr;
53 
54 	skb_queue_walk(&tx->skbs, skb) {
55 		hdr = (struct ieee80211_hdr *) skb->data;
56 		hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
57 	}
58 }
59 
60 int ieee80211_frame_duration(enum nl80211_band band, size_t len,
61 			     int rate, int erp, int short_preamble,
62 			     int shift)
63 {
64 	int dur;
65 
66 	/* calculate duration (in microseconds, rounded up to next higher
67 	 * integer if it includes a fractional microsecond) to send frame of
68 	 * len bytes (does not include FCS) at the given rate. Duration will
69 	 * also include SIFS.
70 	 *
71 	 * rate is in 100 kbps, so divident is multiplied by 10 in the
72 	 * DIV_ROUND_UP() operations.
73 	 *
74 	 * shift may be 2 for 5 MHz channels or 1 for 10 MHz channels, and
75 	 * is assumed to be 0 otherwise.
76 	 */
77 
78 	if (band == NL80211_BAND_5GHZ || erp) {
79 		/*
80 		 * OFDM:
81 		 *
82 		 * N_DBPS = DATARATE x 4
83 		 * N_SYM = Ceiling((16+8xLENGTH+6) / N_DBPS)
84 		 *	(16 = SIGNAL time, 6 = tail bits)
85 		 * TXTIME = T_PREAMBLE + T_SIGNAL + T_SYM x N_SYM + Signal Ext
86 		 *
87 		 * T_SYM = 4 usec
88 		 * 802.11a - 18.5.2: aSIFSTime = 16 usec
89 		 * 802.11g - 19.8.4: aSIFSTime = 10 usec +
90 		 *	signal ext = 6 usec
91 		 */
92 		dur = 16; /* SIFS + signal ext */
93 		dur += 16; /* IEEE 802.11-2012 18.3.2.4: T_PREAMBLE = 16 usec */
94 		dur += 4; /* IEEE 802.11-2012 18.3.2.4: T_SIGNAL = 4 usec */
95 
96 		/* IEEE 802.11-2012 18.3.2.4: all values above are:
97 		 *  * times 4 for 5 MHz
98 		 *  * times 2 for 10 MHz
99 		 */
100 		dur *= 1 << shift;
101 
102 		/* rates should already consider the channel bandwidth,
103 		 * don't apply divisor again.
104 		 */
105 		dur += 4 * DIV_ROUND_UP((16 + 8 * (len + 4) + 6) * 10,
106 					4 * rate); /* T_SYM x N_SYM */
107 	} else {
108 		/*
109 		 * 802.11b or 802.11g with 802.11b compatibility:
110 		 * 18.3.4: TXTIME = PreambleLength + PLCPHeaderTime +
111 		 * Ceiling(((LENGTH+PBCC)x8)/DATARATE). PBCC=0.
112 		 *
113 		 * 802.11 (DS): 15.3.3, 802.11b: 18.3.4
114 		 * aSIFSTime = 10 usec
115 		 * aPreambleLength = 144 usec or 72 usec with short preamble
116 		 * aPLCPHeaderLength = 48 usec or 24 usec with short preamble
117 		 */
118 		dur = 10; /* aSIFSTime = 10 usec */
119 		dur += short_preamble ? (72 + 24) : (144 + 48);
120 
121 		dur += DIV_ROUND_UP(8 * (len + 4) * 10, rate);
122 	}
123 
124 	return dur;
125 }
126 
127 /* Exported duration function for driver use */
128 __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
129 					struct ieee80211_vif *vif,
130 					enum nl80211_band band,
131 					size_t frame_len,
132 					struct ieee80211_rate *rate)
133 {
134 	struct ieee80211_sub_if_data *sdata;
135 	u16 dur;
136 	int erp, shift = 0;
137 	bool short_preamble = false;
138 
139 	erp = 0;
140 	if (vif) {
141 		sdata = vif_to_sdata(vif);
142 		short_preamble = sdata->vif.bss_conf.use_short_preamble;
143 		if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
144 			erp = rate->flags & IEEE80211_RATE_ERP_G;
145 		shift = ieee80211_vif_get_shift(vif);
146 	}
147 
148 	dur = ieee80211_frame_duration(band, frame_len, rate->bitrate, erp,
149 				       short_preamble, shift);
150 
151 	return cpu_to_le16(dur);
152 }
153 EXPORT_SYMBOL(ieee80211_generic_frame_duration);
154 
155 __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
156 			      struct ieee80211_vif *vif, size_t frame_len,
157 			      const struct ieee80211_tx_info *frame_txctl)
158 {
159 	struct ieee80211_local *local = hw_to_local(hw);
160 	struct ieee80211_rate *rate;
161 	struct ieee80211_sub_if_data *sdata;
162 	bool short_preamble;
163 	int erp, shift = 0, bitrate;
164 	u16 dur;
165 	struct ieee80211_supported_band *sband;
166 
167 	sband = local->hw.wiphy->bands[frame_txctl->band];
168 
169 	short_preamble = false;
170 
171 	rate = &sband->bitrates[frame_txctl->control.rts_cts_rate_idx];
172 
173 	erp = 0;
174 	if (vif) {
175 		sdata = vif_to_sdata(vif);
176 		short_preamble = sdata->vif.bss_conf.use_short_preamble;
177 		if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
178 			erp = rate->flags & IEEE80211_RATE_ERP_G;
179 		shift = ieee80211_vif_get_shift(vif);
180 	}
181 
182 	bitrate = DIV_ROUND_UP(rate->bitrate, 1 << shift);
183 
184 	/* CTS duration */
185 	dur = ieee80211_frame_duration(sband->band, 10, bitrate,
186 				       erp, short_preamble, shift);
187 	/* Data frame duration */
188 	dur += ieee80211_frame_duration(sband->band, frame_len, bitrate,
189 					erp, short_preamble, shift);
190 	/* ACK duration */
191 	dur += ieee80211_frame_duration(sband->band, 10, bitrate,
192 					erp, short_preamble, shift);
193 
194 	return cpu_to_le16(dur);
195 }
196 EXPORT_SYMBOL(ieee80211_rts_duration);
197 
198 __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
199 				    struct ieee80211_vif *vif,
200 				    size_t frame_len,
201 				    const struct ieee80211_tx_info *frame_txctl)
202 {
203 	struct ieee80211_local *local = hw_to_local(hw);
204 	struct ieee80211_rate *rate;
205 	struct ieee80211_sub_if_data *sdata;
206 	bool short_preamble;
207 	int erp, shift = 0, bitrate;
208 	u16 dur;
209 	struct ieee80211_supported_band *sband;
210 
211 	sband = local->hw.wiphy->bands[frame_txctl->band];
212 
213 	short_preamble = false;
214 
215 	rate = &sband->bitrates[frame_txctl->control.rts_cts_rate_idx];
216 	erp = 0;
217 	if (vif) {
218 		sdata = vif_to_sdata(vif);
219 		short_preamble = sdata->vif.bss_conf.use_short_preamble;
220 		if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
221 			erp = rate->flags & IEEE80211_RATE_ERP_G;
222 		shift = ieee80211_vif_get_shift(vif);
223 	}
224 
225 	bitrate = DIV_ROUND_UP(rate->bitrate, 1 << shift);
226 
227 	/* Data frame duration */
228 	dur = ieee80211_frame_duration(sband->band, frame_len, bitrate,
229 				       erp, short_preamble, shift);
230 	if (!(frame_txctl->flags & IEEE80211_TX_CTL_NO_ACK)) {
231 		/* ACK duration */
232 		dur += ieee80211_frame_duration(sband->band, 10, bitrate,
233 						erp, short_preamble, shift);
234 	}
235 
236 	return cpu_to_le16(dur);
237 }
238 EXPORT_SYMBOL(ieee80211_ctstoself_duration);
239 
240 static void __ieee80211_wake_txqs(struct ieee80211_sub_if_data *sdata, int ac)
241 {
242 	struct ieee80211_local *local = sdata->local;
243 	struct ieee80211_vif *vif = &sdata->vif;
244 	struct fq *fq = &local->fq;
245 	struct ps_data *ps = NULL;
246 	struct txq_info *txqi;
247 	struct sta_info *sta;
248 	int i;
249 
250 	spin_lock_bh(&fq->lock);
251 
252 	if (sdata->vif.type == NL80211_IFTYPE_AP)
253 		ps = &sdata->bss->ps;
254 
255 	sdata->vif.txqs_stopped[ac] = false;
256 
257 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
258 		if (sdata != sta->sdata)
259 			continue;
260 
261 		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
262 			struct ieee80211_txq *txq = sta->sta.txq[i];
263 
264 			if (!txq)
265 				continue;
266 
267 			txqi = to_txq_info(txq);
268 
269 			if (ac != txq->ac)
270 				continue;
271 
272 			if (!test_and_clear_bit(IEEE80211_TXQ_STOP_NETIF_TX,
273 						&txqi->flags))
274 				continue;
275 
276 			spin_unlock_bh(&fq->lock);
277 			drv_wake_tx_queue(local, txqi);
278 			spin_lock_bh(&fq->lock);
279 		}
280 	}
281 
282 	if (!vif->txq)
283 		goto out;
284 
285 	txqi = to_txq_info(vif->txq);
286 
287 	if (!test_and_clear_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txqi->flags) ||
288 	    (ps && atomic_read(&ps->num_sta_ps)) || ac != vif->txq->ac)
289 		goto out;
290 
291 	spin_unlock_bh(&fq->lock);
292 
293 	drv_wake_tx_queue(local, txqi);
294 	return;
295 out:
296 	spin_unlock_bh(&fq->lock);
297 }
298 
299 static void
300 __releases(&local->queue_stop_reason_lock)
301 __acquires(&local->queue_stop_reason_lock)
302 _ieee80211_wake_txqs(struct ieee80211_local *local, unsigned long *flags)
303 {
304 	struct ieee80211_sub_if_data *sdata;
305 	int n_acs = IEEE80211_NUM_ACS;
306 	int i;
307 
308 	rcu_read_lock();
309 
310 	if (local->hw.queues < IEEE80211_NUM_ACS)
311 		n_acs = 1;
312 
313 	for (i = 0; i < local->hw.queues; i++) {
314 		if (local->queue_stop_reasons[i])
315 			continue;
316 
317 		spin_unlock_irqrestore(&local->queue_stop_reason_lock, *flags);
318 		list_for_each_entry_rcu(sdata, &local->interfaces, list) {
319 			int ac;
320 
321 			for (ac = 0; ac < n_acs; ac++) {
322 				int ac_queue = sdata->vif.hw_queue[ac];
323 
324 				if (ac_queue == i ||
325 				    sdata->vif.cab_queue == i)
326 					__ieee80211_wake_txqs(sdata, ac);
327 			}
328 		}
329 		spin_lock_irqsave(&local->queue_stop_reason_lock, *flags);
330 	}
331 
332 	rcu_read_unlock();
333 }
334 
335 void ieee80211_wake_txqs(unsigned long data)
336 {
337 	struct ieee80211_local *local = (struct ieee80211_local *)data;
338 	unsigned long flags;
339 
340 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
341 	_ieee80211_wake_txqs(local, &flags);
342 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
343 }
344 
345 void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue)
346 {
347 	struct ieee80211_sub_if_data *sdata;
348 	int n_acs = IEEE80211_NUM_ACS;
349 
350 	if (local->ops->wake_tx_queue)
351 		return;
352 
353 	if (local->hw.queues < IEEE80211_NUM_ACS)
354 		n_acs = 1;
355 
356 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
357 		int ac;
358 
359 		if (!sdata->dev)
360 			continue;
361 
362 		if (sdata->vif.cab_queue != IEEE80211_INVAL_HW_QUEUE &&
363 		    local->queue_stop_reasons[sdata->vif.cab_queue] != 0)
364 			continue;
365 
366 		for (ac = 0; ac < n_acs; ac++) {
367 			int ac_queue = sdata->vif.hw_queue[ac];
368 
369 			if (ac_queue == queue ||
370 			    (sdata->vif.cab_queue == queue &&
371 			     local->queue_stop_reasons[ac_queue] == 0 &&
372 			     skb_queue_empty(&local->pending[ac_queue])))
373 				netif_wake_subqueue(sdata->dev, ac);
374 		}
375 	}
376 }
377 
378 static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
379 				   enum queue_stop_reason reason,
380 				   bool refcounted,
381 				   unsigned long *flags)
382 {
383 	struct ieee80211_local *local = hw_to_local(hw);
384 
385 	trace_wake_queue(local, queue, reason);
386 
387 	if (WARN_ON(queue >= hw->queues))
388 		return;
389 
390 	if (!test_bit(reason, &local->queue_stop_reasons[queue]))
391 		return;
392 
393 	if (!refcounted) {
394 		local->q_stop_reasons[queue][reason] = 0;
395 	} else {
396 		local->q_stop_reasons[queue][reason]--;
397 		if (WARN_ON(local->q_stop_reasons[queue][reason] < 0))
398 			local->q_stop_reasons[queue][reason] = 0;
399 	}
400 
401 	if (local->q_stop_reasons[queue][reason] == 0)
402 		__clear_bit(reason, &local->queue_stop_reasons[queue]);
403 
404 	if (local->queue_stop_reasons[queue] != 0)
405 		/* someone still has this queue stopped */
406 		return;
407 
408 	if (skb_queue_empty(&local->pending[queue])) {
409 		rcu_read_lock();
410 		ieee80211_propagate_queue_wake(local, queue);
411 		rcu_read_unlock();
412 	} else
413 		tasklet_schedule(&local->tx_pending_tasklet);
414 
415 	/*
416 	 * Calling _ieee80211_wake_txqs here can be a problem because it may
417 	 * release queue_stop_reason_lock which has been taken by
418 	 * __ieee80211_wake_queue's caller. It is certainly not very nice to
419 	 * release someone's lock, but it is fine because all the callers of
420 	 * __ieee80211_wake_queue call it right before releasing the lock.
421 	 */
422 	if (local->ops->wake_tx_queue) {
423 		if (reason == IEEE80211_QUEUE_STOP_REASON_DRIVER)
424 			tasklet_schedule(&local->wake_txqs_tasklet);
425 		else
426 			_ieee80211_wake_txqs(local, flags);
427 	}
428 }
429 
430 void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
431 				    enum queue_stop_reason reason,
432 				    bool refcounted)
433 {
434 	struct ieee80211_local *local = hw_to_local(hw);
435 	unsigned long flags;
436 
437 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
438 	__ieee80211_wake_queue(hw, queue, reason, refcounted, &flags);
439 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
440 }
441 
442 void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue)
443 {
444 	ieee80211_wake_queue_by_reason(hw, queue,
445 				       IEEE80211_QUEUE_STOP_REASON_DRIVER,
446 				       false);
447 }
448 EXPORT_SYMBOL(ieee80211_wake_queue);
449 
450 static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
451 				   enum queue_stop_reason reason,
452 				   bool refcounted)
453 {
454 	struct ieee80211_local *local = hw_to_local(hw);
455 	struct ieee80211_sub_if_data *sdata;
456 	int n_acs = IEEE80211_NUM_ACS;
457 
458 	trace_stop_queue(local, queue, reason);
459 
460 	if (WARN_ON(queue >= hw->queues))
461 		return;
462 
463 	if (!refcounted)
464 		local->q_stop_reasons[queue][reason] = 1;
465 	else
466 		local->q_stop_reasons[queue][reason]++;
467 
468 	if (__test_and_set_bit(reason, &local->queue_stop_reasons[queue]))
469 		return;
470 
471 	if (local->hw.queues < IEEE80211_NUM_ACS)
472 		n_acs = 1;
473 
474 	rcu_read_lock();
475 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
476 		int ac;
477 
478 		if (!sdata->dev)
479 			continue;
480 
481 		for (ac = 0; ac < n_acs; ac++) {
482 			if (sdata->vif.hw_queue[ac] == queue ||
483 			    sdata->vif.cab_queue == queue) {
484 				if (!local->ops->wake_tx_queue) {
485 					netif_stop_subqueue(sdata->dev, ac);
486 					continue;
487 				}
488 				spin_lock(&local->fq.lock);
489 				sdata->vif.txqs_stopped[ac] = true;
490 				spin_unlock(&local->fq.lock);
491 			}
492 		}
493 	}
494 	rcu_read_unlock();
495 }
496 
497 void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
498 				    enum queue_stop_reason reason,
499 				    bool refcounted)
500 {
501 	struct ieee80211_local *local = hw_to_local(hw);
502 	unsigned long flags;
503 
504 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
505 	__ieee80211_stop_queue(hw, queue, reason, refcounted);
506 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
507 }
508 
509 void ieee80211_stop_queue(struct ieee80211_hw *hw, int queue)
510 {
511 	ieee80211_stop_queue_by_reason(hw, queue,
512 				       IEEE80211_QUEUE_STOP_REASON_DRIVER,
513 				       false);
514 }
515 EXPORT_SYMBOL(ieee80211_stop_queue);
516 
517 void ieee80211_add_pending_skb(struct ieee80211_local *local,
518 			       struct sk_buff *skb)
519 {
520 	struct ieee80211_hw *hw = &local->hw;
521 	unsigned long flags;
522 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
523 	int queue = info->hw_queue;
524 
525 	if (WARN_ON(!info->control.vif)) {
526 		ieee80211_free_txskb(&local->hw, skb);
527 		return;
528 	}
529 
530 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
531 	__ieee80211_stop_queue(hw, queue, IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
532 			       false);
533 	__skb_queue_tail(&local->pending[queue], skb);
534 	__ieee80211_wake_queue(hw, queue, IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
535 			       false, &flags);
536 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
537 }
538 
539 void ieee80211_add_pending_skbs(struct ieee80211_local *local,
540 				struct sk_buff_head *skbs)
541 {
542 	struct ieee80211_hw *hw = &local->hw;
543 	struct sk_buff *skb;
544 	unsigned long flags;
545 	int queue, i;
546 
547 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
548 	while ((skb = skb_dequeue(skbs))) {
549 		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
550 
551 		if (WARN_ON(!info->control.vif)) {
552 			ieee80211_free_txskb(&local->hw, skb);
553 			continue;
554 		}
555 
556 		queue = info->hw_queue;
557 
558 		__ieee80211_stop_queue(hw, queue,
559 				IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
560 				false);
561 
562 		__skb_queue_tail(&local->pending[queue], skb);
563 	}
564 
565 	for (i = 0; i < hw->queues; i++)
566 		__ieee80211_wake_queue(hw, i,
567 			IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
568 			false, &flags);
569 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
570 }
571 
572 void ieee80211_stop_queues_by_reason(struct ieee80211_hw *hw,
573 				     unsigned long queues,
574 				     enum queue_stop_reason reason,
575 				     bool refcounted)
576 {
577 	struct ieee80211_local *local = hw_to_local(hw);
578 	unsigned long flags;
579 	int i;
580 
581 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
582 
583 	for_each_set_bit(i, &queues, hw->queues)
584 		__ieee80211_stop_queue(hw, i, reason, refcounted);
585 
586 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
587 }
588 
589 void ieee80211_stop_queues(struct ieee80211_hw *hw)
590 {
591 	ieee80211_stop_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP,
592 					IEEE80211_QUEUE_STOP_REASON_DRIVER,
593 					false);
594 }
595 EXPORT_SYMBOL(ieee80211_stop_queues);
596 
597 int ieee80211_queue_stopped(struct ieee80211_hw *hw, int queue)
598 {
599 	struct ieee80211_local *local = hw_to_local(hw);
600 	unsigned long flags;
601 	int ret;
602 
603 	if (WARN_ON(queue >= hw->queues))
604 		return true;
605 
606 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
607 	ret = test_bit(IEEE80211_QUEUE_STOP_REASON_DRIVER,
608 		       &local->queue_stop_reasons[queue]);
609 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
610 	return ret;
611 }
612 EXPORT_SYMBOL(ieee80211_queue_stopped);
613 
614 void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
615 				     unsigned long queues,
616 				     enum queue_stop_reason reason,
617 				     bool refcounted)
618 {
619 	struct ieee80211_local *local = hw_to_local(hw);
620 	unsigned long flags;
621 	int i;
622 
623 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
624 
625 	for_each_set_bit(i, &queues, hw->queues)
626 		__ieee80211_wake_queue(hw, i, reason, refcounted, &flags);
627 
628 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
629 }
630 
631 void ieee80211_wake_queues(struct ieee80211_hw *hw)
632 {
633 	ieee80211_wake_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP,
634 					IEEE80211_QUEUE_STOP_REASON_DRIVER,
635 					false);
636 }
637 EXPORT_SYMBOL(ieee80211_wake_queues);
638 
639 static unsigned int
640 ieee80211_get_vif_queues(struct ieee80211_local *local,
641 			 struct ieee80211_sub_if_data *sdata)
642 {
643 	unsigned int queues;
644 
645 	if (sdata && ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) {
646 		int ac;
647 
648 		queues = 0;
649 
650 		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
651 			queues |= BIT(sdata->vif.hw_queue[ac]);
652 		if (sdata->vif.cab_queue != IEEE80211_INVAL_HW_QUEUE)
653 			queues |= BIT(sdata->vif.cab_queue);
654 	} else {
655 		/* all queues */
656 		queues = BIT(local->hw.queues) - 1;
657 	}
658 
659 	return queues;
660 }
661 
662 void __ieee80211_flush_queues(struct ieee80211_local *local,
663 			      struct ieee80211_sub_if_data *sdata,
664 			      unsigned int queues, bool drop)
665 {
666 	if (!local->ops->flush)
667 		return;
668 
669 	/*
670 	 * If no queue was set, or if the HW doesn't support
671 	 * IEEE80211_HW_QUEUE_CONTROL - flush all queues
672 	 */
673 	if (!queues || !ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
674 		queues = ieee80211_get_vif_queues(local, sdata);
675 
676 	ieee80211_stop_queues_by_reason(&local->hw, queues,
677 					IEEE80211_QUEUE_STOP_REASON_FLUSH,
678 					false);
679 
680 	drv_flush(local, sdata, queues, drop);
681 
682 	ieee80211_wake_queues_by_reason(&local->hw, queues,
683 					IEEE80211_QUEUE_STOP_REASON_FLUSH,
684 					false);
685 }
686 
687 void ieee80211_flush_queues(struct ieee80211_local *local,
688 			    struct ieee80211_sub_if_data *sdata, bool drop)
689 {
690 	__ieee80211_flush_queues(local, sdata, 0, drop);
691 }
692 
693 void ieee80211_stop_vif_queues(struct ieee80211_local *local,
694 			       struct ieee80211_sub_if_data *sdata,
695 			       enum queue_stop_reason reason)
696 {
697 	ieee80211_stop_queues_by_reason(&local->hw,
698 					ieee80211_get_vif_queues(local, sdata),
699 					reason, true);
700 }
701 
702 void ieee80211_wake_vif_queues(struct ieee80211_local *local,
703 			       struct ieee80211_sub_if_data *sdata,
704 			       enum queue_stop_reason reason)
705 {
706 	ieee80211_wake_queues_by_reason(&local->hw,
707 					ieee80211_get_vif_queues(local, sdata),
708 					reason, true);
709 }
710 
711 static void __iterate_interfaces(struct ieee80211_local *local,
712 				 u32 iter_flags,
713 				 void (*iterator)(void *data, u8 *mac,
714 						  struct ieee80211_vif *vif),
715 				 void *data)
716 {
717 	struct ieee80211_sub_if_data *sdata;
718 	bool active_only = iter_flags & IEEE80211_IFACE_ITER_ACTIVE;
719 
720 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
721 		switch (sdata->vif.type) {
722 		case NL80211_IFTYPE_MONITOR:
723 			if (!(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE))
724 				continue;
725 			break;
726 		case NL80211_IFTYPE_AP_VLAN:
727 			continue;
728 		default:
729 			break;
730 		}
731 		if (!(iter_flags & IEEE80211_IFACE_ITER_RESUME_ALL) &&
732 		    active_only && !(sdata->flags & IEEE80211_SDATA_IN_DRIVER))
733 			continue;
734 		if (ieee80211_sdata_running(sdata) || !active_only)
735 			iterator(data, sdata->vif.addr,
736 				 &sdata->vif);
737 	}
738 
739 	sdata = rcu_dereference_check(local->monitor_sdata,
740 				      lockdep_is_held(&local->iflist_mtx) ||
741 				      lockdep_rtnl_is_held());
742 	if (sdata &&
743 	    (iter_flags & IEEE80211_IFACE_ITER_RESUME_ALL || !active_only ||
744 	     sdata->flags & IEEE80211_SDATA_IN_DRIVER))
745 		iterator(data, sdata->vif.addr, &sdata->vif);
746 }
747 
748 void ieee80211_iterate_interfaces(
749 	struct ieee80211_hw *hw, u32 iter_flags,
750 	void (*iterator)(void *data, u8 *mac,
751 			 struct ieee80211_vif *vif),
752 	void *data)
753 {
754 	struct ieee80211_local *local = hw_to_local(hw);
755 
756 	mutex_lock(&local->iflist_mtx);
757 	__iterate_interfaces(local, iter_flags, iterator, data);
758 	mutex_unlock(&local->iflist_mtx);
759 }
760 EXPORT_SYMBOL_GPL(ieee80211_iterate_interfaces);
761 
762 void ieee80211_iterate_active_interfaces_atomic(
763 	struct ieee80211_hw *hw, u32 iter_flags,
764 	void (*iterator)(void *data, u8 *mac,
765 			 struct ieee80211_vif *vif),
766 	void *data)
767 {
768 	struct ieee80211_local *local = hw_to_local(hw);
769 
770 	rcu_read_lock();
771 	__iterate_interfaces(local, iter_flags | IEEE80211_IFACE_ITER_ACTIVE,
772 			     iterator, data);
773 	rcu_read_unlock();
774 }
775 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
776 
777 void ieee80211_iterate_active_interfaces_rtnl(
778 	struct ieee80211_hw *hw, u32 iter_flags,
779 	void (*iterator)(void *data, u8 *mac,
780 			 struct ieee80211_vif *vif),
781 	void *data)
782 {
783 	struct ieee80211_local *local = hw_to_local(hw);
784 
785 	ASSERT_RTNL();
786 
787 	__iterate_interfaces(local, iter_flags | IEEE80211_IFACE_ITER_ACTIVE,
788 			     iterator, data);
789 }
790 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_rtnl);
791 
792 static void __iterate_stations(struct ieee80211_local *local,
793 			       void (*iterator)(void *data,
794 						struct ieee80211_sta *sta),
795 			       void *data)
796 {
797 	struct sta_info *sta;
798 
799 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
800 		if (!sta->uploaded)
801 			continue;
802 
803 		iterator(data, &sta->sta);
804 	}
805 }
806 
807 void ieee80211_iterate_stations_atomic(struct ieee80211_hw *hw,
808 			void (*iterator)(void *data,
809 					 struct ieee80211_sta *sta),
810 			void *data)
811 {
812 	struct ieee80211_local *local = hw_to_local(hw);
813 
814 	rcu_read_lock();
815 	__iterate_stations(local, iterator, data);
816 	rcu_read_unlock();
817 }
818 EXPORT_SYMBOL_GPL(ieee80211_iterate_stations_atomic);
819 
820 struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev)
821 {
822 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
823 
824 	if (!ieee80211_sdata_running(sdata) ||
825 	    !(sdata->flags & IEEE80211_SDATA_IN_DRIVER))
826 		return NULL;
827 	return &sdata->vif;
828 }
829 EXPORT_SYMBOL_GPL(wdev_to_ieee80211_vif);
830 
831 struct wireless_dev *ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
832 {
833 	struct ieee80211_sub_if_data *sdata;
834 
835 	if (!vif)
836 		return NULL;
837 
838 	sdata = vif_to_sdata(vif);
839 
840 	if (!ieee80211_sdata_running(sdata) ||
841 	    !(sdata->flags & IEEE80211_SDATA_IN_DRIVER))
842 		return NULL;
843 
844 	return &sdata->wdev;
845 }
846 EXPORT_SYMBOL_GPL(ieee80211_vif_to_wdev);
847 
848 /*
849  * Nothing should have been stuffed into the workqueue during
850  * the suspend->resume cycle. Since we can't check each caller
851  * of this function if we are already quiescing / suspended,
852  * check here and don't WARN since this can actually happen when
853  * the rx path (for example) is racing against __ieee80211_suspend
854  * and suspending / quiescing was set after the rx path checked
855  * them.
856  */
857 static bool ieee80211_can_queue_work(struct ieee80211_local *local)
858 {
859 	if (local->quiescing || (local->suspended && !local->resuming)) {
860 		pr_warn("queueing ieee80211 work while going to suspend\n");
861 		return false;
862 	}
863 
864 	return true;
865 }
866 
867 void ieee80211_queue_work(struct ieee80211_hw *hw, struct work_struct *work)
868 {
869 	struct ieee80211_local *local = hw_to_local(hw);
870 
871 	if (!ieee80211_can_queue_work(local))
872 		return;
873 
874 	queue_work(local->workqueue, work);
875 }
876 EXPORT_SYMBOL(ieee80211_queue_work);
877 
878 void ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
879 				  struct delayed_work *dwork,
880 				  unsigned long delay)
881 {
882 	struct ieee80211_local *local = hw_to_local(hw);
883 
884 	if (!ieee80211_can_queue_work(local))
885 		return;
886 
887 	queue_delayed_work(local->workqueue, dwork, delay);
888 }
889 EXPORT_SYMBOL(ieee80211_queue_delayed_work);
890 
891 static u32
892 _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
893 			    struct ieee802_11_elems *elems,
894 			    u64 filter, u32 crc,
895 			    const struct element *check_inherit)
896 {
897 	const struct element *elem;
898 	bool calc_crc = filter != 0;
899 	DECLARE_BITMAP(seen_elems, 256);
900 	const u8 *ie;
901 
902 	bitmap_zero(seen_elems, 256);
903 
904 	for_each_element(elem, start, len) {
905 		bool elem_parse_failed;
906 		u8 id = elem->id;
907 		u8 elen = elem->datalen;
908 		const u8 *pos = elem->data;
909 
910 		if (check_inherit &&
911 		    !cfg80211_is_element_inherited(elem,
912 						   check_inherit))
913 			continue;
914 
915 		switch (id) {
916 		case WLAN_EID_SSID:
917 		case WLAN_EID_SUPP_RATES:
918 		case WLAN_EID_FH_PARAMS:
919 		case WLAN_EID_DS_PARAMS:
920 		case WLAN_EID_CF_PARAMS:
921 		case WLAN_EID_TIM:
922 		case WLAN_EID_IBSS_PARAMS:
923 		case WLAN_EID_CHALLENGE:
924 		case WLAN_EID_RSN:
925 		case WLAN_EID_ERP_INFO:
926 		case WLAN_EID_EXT_SUPP_RATES:
927 		case WLAN_EID_HT_CAPABILITY:
928 		case WLAN_EID_HT_OPERATION:
929 		case WLAN_EID_VHT_CAPABILITY:
930 		case WLAN_EID_VHT_OPERATION:
931 		case WLAN_EID_MESH_ID:
932 		case WLAN_EID_MESH_CONFIG:
933 		case WLAN_EID_PEER_MGMT:
934 		case WLAN_EID_PREQ:
935 		case WLAN_EID_PREP:
936 		case WLAN_EID_PERR:
937 		case WLAN_EID_RANN:
938 		case WLAN_EID_CHANNEL_SWITCH:
939 		case WLAN_EID_EXT_CHANSWITCH_ANN:
940 		case WLAN_EID_COUNTRY:
941 		case WLAN_EID_PWR_CONSTRAINT:
942 		case WLAN_EID_TIMEOUT_INTERVAL:
943 		case WLAN_EID_SECONDARY_CHANNEL_OFFSET:
944 		case WLAN_EID_WIDE_BW_CHANNEL_SWITCH:
945 		case WLAN_EID_CHAN_SWITCH_PARAM:
946 		case WLAN_EID_EXT_CAPABILITY:
947 		case WLAN_EID_CHAN_SWITCH_TIMING:
948 		case WLAN_EID_LINK_ID:
949 		case WLAN_EID_BSS_MAX_IDLE_PERIOD:
950 		/*
951 		 * not listing WLAN_EID_CHANNEL_SWITCH_WRAPPER -- it seems possible
952 		 * that if the content gets bigger it might be needed more than once
953 		 */
954 			if (test_bit(id, seen_elems)) {
955 				elems->parse_error = true;
956 				continue;
957 			}
958 			break;
959 		}
960 
961 		if (calc_crc && id < 64 && (filter & (1ULL << id)))
962 			crc = crc32_be(crc, pos - 2, elen + 2);
963 
964 		elem_parse_failed = false;
965 
966 		switch (id) {
967 		case WLAN_EID_LINK_ID:
968 			if (elen + 2 != sizeof(struct ieee80211_tdls_lnkie)) {
969 				elem_parse_failed = true;
970 				break;
971 			}
972 			elems->lnk_id = (void *)(pos - 2);
973 			break;
974 		case WLAN_EID_CHAN_SWITCH_TIMING:
975 			if (elen != sizeof(struct ieee80211_ch_switch_timing)) {
976 				elem_parse_failed = true;
977 				break;
978 			}
979 			elems->ch_sw_timing = (void *)pos;
980 			break;
981 		case WLAN_EID_EXT_CAPABILITY:
982 			elems->ext_capab = pos;
983 			elems->ext_capab_len = elen;
984 			break;
985 		case WLAN_EID_SSID:
986 			elems->ssid = pos;
987 			elems->ssid_len = elen;
988 			break;
989 		case WLAN_EID_SUPP_RATES:
990 			elems->supp_rates = pos;
991 			elems->supp_rates_len = elen;
992 			break;
993 		case WLAN_EID_DS_PARAMS:
994 			if (elen >= 1)
995 				elems->ds_params = pos;
996 			else
997 				elem_parse_failed = true;
998 			break;
999 		case WLAN_EID_TIM:
1000 			if (elen >= sizeof(struct ieee80211_tim_ie)) {
1001 				elems->tim = (void *)pos;
1002 				elems->tim_len = elen;
1003 			} else
1004 				elem_parse_failed = true;
1005 			break;
1006 		case WLAN_EID_CHALLENGE:
1007 			elems->challenge = pos;
1008 			elems->challenge_len = elen;
1009 			break;
1010 		case WLAN_EID_VENDOR_SPECIFIC:
1011 			if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
1012 			    pos[2] == 0xf2) {
1013 				/* Microsoft OUI (00:50:F2) */
1014 
1015 				if (calc_crc)
1016 					crc = crc32_be(crc, pos - 2, elen + 2);
1017 
1018 				if (elen >= 5 && pos[3] == 2) {
1019 					/* OUI Type 2 - WMM IE */
1020 					if (pos[4] == 0) {
1021 						elems->wmm_info = pos;
1022 						elems->wmm_info_len = elen;
1023 					} else if (pos[4] == 1) {
1024 						elems->wmm_param = pos;
1025 						elems->wmm_param_len = elen;
1026 					}
1027 				}
1028 			}
1029 			break;
1030 		case WLAN_EID_RSN:
1031 			elems->rsn = pos;
1032 			elems->rsn_len = elen;
1033 			break;
1034 		case WLAN_EID_ERP_INFO:
1035 			if (elen >= 1)
1036 				elems->erp_info = pos;
1037 			else
1038 				elem_parse_failed = true;
1039 			break;
1040 		case WLAN_EID_EXT_SUPP_RATES:
1041 			elems->ext_supp_rates = pos;
1042 			elems->ext_supp_rates_len = elen;
1043 			break;
1044 		case WLAN_EID_HT_CAPABILITY:
1045 			if (elen >= sizeof(struct ieee80211_ht_cap))
1046 				elems->ht_cap_elem = (void *)pos;
1047 			else
1048 				elem_parse_failed = true;
1049 			break;
1050 		case WLAN_EID_HT_OPERATION:
1051 			if (elen >= sizeof(struct ieee80211_ht_operation))
1052 				elems->ht_operation = (void *)pos;
1053 			else
1054 				elem_parse_failed = true;
1055 			break;
1056 		case WLAN_EID_VHT_CAPABILITY:
1057 			if (elen >= sizeof(struct ieee80211_vht_cap))
1058 				elems->vht_cap_elem = (void *)pos;
1059 			else
1060 				elem_parse_failed = true;
1061 			break;
1062 		case WLAN_EID_VHT_OPERATION:
1063 			if (elen >= sizeof(struct ieee80211_vht_operation))
1064 				elems->vht_operation = (void *)pos;
1065 			else
1066 				elem_parse_failed = true;
1067 			break;
1068 		case WLAN_EID_OPMODE_NOTIF:
1069 			if (elen > 0)
1070 				elems->opmode_notif = pos;
1071 			else
1072 				elem_parse_failed = true;
1073 			break;
1074 		case WLAN_EID_MESH_ID:
1075 			elems->mesh_id = pos;
1076 			elems->mesh_id_len = elen;
1077 			break;
1078 		case WLAN_EID_MESH_CONFIG:
1079 			if (elen >= sizeof(struct ieee80211_meshconf_ie))
1080 				elems->mesh_config = (void *)pos;
1081 			else
1082 				elem_parse_failed = true;
1083 			break;
1084 		case WLAN_EID_PEER_MGMT:
1085 			elems->peering = pos;
1086 			elems->peering_len = elen;
1087 			break;
1088 		case WLAN_EID_MESH_AWAKE_WINDOW:
1089 			if (elen >= 2)
1090 				elems->awake_window = (void *)pos;
1091 			break;
1092 		case WLAN_EID_PREQ:
1093 			elems->preq = pos;
1094 			elems->preq_len = elen;
1095 			break;
1096 		case WLAN_EID_PREP:
1097 			elems->prep = pos;
1098 			elems->prep_len = elen;
1099 			break;
1100 		case WLAN_EID_PERR:
1101 			elems->perr = pos;
1102 			elems->perr_len = elen;
1103 			break;
1104 		case WLAN_EID_RANN:
1105 			if (elen >= sizeof(struct ieee80211_rann_ie))
1106 				elems->rann = (void *)pos;
1107 			else
1108 				elem_parse_failed = true;
1109 			break;
1110 		case WLAN_EID_CHANNEL_SWITCH:
1111 			if (elen != sizeof(struct ieee80211_channel_sw_ie)) {
1112 				elem_parse_failed = true;
1113 				break;
1114 			}
1115 			elems->ch_switch_ie = (void *)pos;
1116 			break;
1117 		case WLAN_EID_EXT_CHANSWITCH_ANN:
1118 			if (elen != sizeof(struct ieee80211_ext_chansw_ie)) {
1119 				elem_parse_failed = true;
1120 				break;
1121 			}
1122 			elems->ext_chansw_ie = (void *)pos;
1123 			break;
1124 		case WLAN_EID_SECONDARY_CHANNEL_OFFSET:
1125 			if (elen != sizeof(struct ieee80211_sec_chan_offs_ie)) {
1126 				elem_parse_failed = true;
1127 				break;
1128 			}
1129 			elems->sec_chan_offs = (void *)pos;
1130 			break;
1131 		case WLAN_EID_CHAN_SWITCH_PARAM:
1132 			if (elen !=
1133 			    sizeof(*elems->mesh_chansw_params_ie)) {
1134 				elem_parse_failed = true;
1135 				break;
1136 			}
1137 			elems->mesh_chansw_params_ie = (void *)pos;
1138 			break;
1139 		case WLAN_EID_WIDE_BW_CHANNEL_SWITCH:
1140 			if (!action ||
1141 			    elen != sizeof(*elems->wide_bw_chansw_ie)) {
1142 				elem_parse_failed = true;
1143 				break;
1144 			}
1145 			elems->wide_bw_chansw_ie = (void *)pos;
1146 			break;
1147 		case WLAN_EID_CHANNEL_SWITCH_WRAPPER:
1148 			if (action) {
1149 				elem_parse_failed = true;
1150 				break;
1151 			}
1152 			/*
1153 			 * This is a bit tricky, but as we only care about
1154 			 * the wide bandwidth channel switch element, so
1155 			 * just parse it out manually.
1156 			 */
1157 			ie = cfg80211_find_ie(WLAN_EID_WIDE_BW_CHANNEL_SWITCH,
1158 					      pos, elen);
1159 			if (ie) {
1160 				if (ie[1] == sizeof(*elems->wide_bw_chansw_ie))
1161 					elems->wide_bw_chansw_ie =
1162 						(void *)(ie + 2);
1163 				else
1164 					elem_parse_failed = true;
1165 			}
1166 			break;
1167 		case WLAN_EID_COUNTRY:
1168 			elems->country_elem = pos;
1169 			elems->country_elem_len = elen;
1170 			break;
1171 		case WLAN_EID_PWR_CONSTRAINT:
1172 			if (elen != 1) {
1173 				elem_parse_failed = true;
1174 				break;
1175 			}
1176 			elems->pwr_constr_elem = pos;
1177 			break;
1178 		case WLAN_EID_CISCO_VENDOR_SPECIFIC:
1179 			/* Lots of different options exist, but we only care
1180 			 * about the Dynamic Transmit Power Control element.
1181 			 * First check for the Cisco OUI, then for the DTPC
1182 			 * tag (0x00).
1183 			 */
1184 			if (elen < 4) {
1185 				elem_parse_failed = true;
1186 				break;
1187 			}
1188 
1189 			if (pos[0] != 0x00 || pos[1] != 0x40 ||
1190 			    pos[2] != 0x96 || pos[3] != 0x00)
1191 				break;
1192 
1193 			if (elen != 6) {
1194 				elem_parse_failed = true;
1195 				break;
1196 			}
1197 
1198 			if (calc_crc)
1199 				crc = crc32_be(crc, pos - 2, elen + 2);
1200 
1201 			elems->cisco_dtpc_elem = pos;
1202 			break;
1203 		case WLAN_EID_TIMEOUT_INTERVAL:
1204 			if (elen >= sizeof(struct ieee80211_timeout_interval_ie))
1205 				elems->timeout_int = (void *)pos;
1206 			else
1207 				elem_parse_failed = true;
1208 			break;
1209 		case WLAN_EID_BSS_MAX_IDLE_PERIOD:
1210 			if (elen >= sizeof(*elems->max_idle_period_ie))
1211 				elems->max_idle_period_ie = (void *)pos;
1212 			break;
1213 		case WLAN_EID_EXTENSION:
1214 			if (pos[0] == WLAN_EID_EXT_HE_MU_EDCA &&
1215 			    elen >= (sizeof(*elems->mu_edca_param_set) + 1)) {
1216 				elems->mu_edca_param_set = (void *)&pos[1];
1217 				if (calc_crc)
1218 					crc = crc32_be(crc, pos - 2, elen + 2);
1219 			} else if (pos[0] == WLAN_EID_EXT_HE_CAPABILITY) {
1220 				elems->he_cap = (void *)&pos[1];
1221 				elems->he_cap_len = elen - 1;
1222 			} else if (pos[0] == WLAN_EID_EXT_HE_OPERATION &&
1223 				   elen >= sizeof(*elems->he_operation) &&
1224 				   elen >= ieee80211_he_oper_size(&pos[1])) {
1225 				elems->he_operation = (void *)&pos[1];
1226 			} else if (pos[0] == WLAN_EID_EXT_UORA && elen >= 1) {
1227 				elems->uora_element = (void *)&pos[1];
1228 			} else if (pos[0] ==
1229 				   WLAN_EID_EXT_MAX_CHANNEL_SWITCH_TIME &&
1230 				   elen == 4) {
1231 				elems->max_channel_switch_time = pos + 1;
1232 			} else if (pos[0] ==
1233 				   WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION &&
1234 				   elen == 3) {
1235 				elems->mbssid_config_ie = (void *)&pos[1];
1236 			}
1237 			break;
1238 		default:
1239 			break;
1240 		}
1241 
1242 		if (elem_parse_failed)
1243 			elems->parse_error = true;
1244 		else
1245 			__set_bit(id, seen_elems);
1246 	}
1247 
1248 	if (!for_each_element_completed(elem, start, len))
1249 		elems->parse_error = true;
1250 
1251 	return crc;
1252 }
1253 
1254 static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len,
1255 					    struct ieee802_11_elems *elems,
1256 					    u8 *transmitter_bssid,
1257 					    u8 *bss_bssid,
1258 					    u8 *nontransmitted_profile)
1259 {
1260 	const struct element *elem, *sub;
1261 	size_t profile_len = 0;
1262 	bool found = false;
1263 
1264 	if (!bss_bssid || !transmitter_bssid)
1265 		return profile_len;
1266 
1267 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, start, len) {
1268 		if (elem->datalen < 2)
1269 			continue;
1270 
1271 		for_each_element(sub, elem->data + 1, elem->datalen - 1) {
1272 			u8 new_bssid[ETH_ALEN];
1273 			const u8 *index;
1274 
1275 			if (sub->id != 0 || sub->datalen < 4) {
1276 				/* not a valid BSS profile */
1277 				continue;
1278 			}
1279 
1280 			if (sub->data[0] != WLAN_EID_NON_TX_BSSID_CAP ||
1281 			    sub->data[1] != 2) {
1282 				/* The first element of the
1283 				 * Nontransmitted BSSID Profile is not
1284 				 * the Nontransmitted BSSID Capability
1285 				 * element.
1286 				 */
1287 				continue;
1288 			}
1289 
1290 			memset(nontransmitted_profile, 0, len);
1291 			profile_len = cfg80211_merge_profile(start, len,
1292 							     elem,
1293 							     sub,
1294 							     nontransmitted_profile,
1295 							     len);
1296 
1297 			/* found a Nontransmitted BSSID Profile */
1298 			index = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX,
1299 						 nontransmitted_profile,
1300 						 profile_len);
1301 			if (!index || index[1] < 1 || index[2] == 0) {
1302 				/* Invalid MBSSID Index element */
1303 				continue;
1304 			}
1305 
1306 			cfg80211_gen_new_bssid(transmitter_bssid,
1307 					       elem->data[0],
1308 					       index[2],
1309 					       new_bssid);
1310 			if (ether_addr_equal(new_bssid, bss_bssid)) {
1311 				found = true;
1312 				elems->bssid_index_len = index[1];
1313 				elems->bssid_index = (void *)&index[2];
1314 				break;
1315 			}
1316 		}
1317 	}
1318 
1319 	return found ? profile_len : 0;
1320 }
1321 
1322 u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
1323 			       struct ieee802_11_elems *elems,
1324 			       u64 filter, u32 crc, u8 *transmitter_bssid,
1325 			       u8 *bss_bssid)
1326 {
1327 	const struct element *non_inherit = NULL;
1328 	u8 *nontransmitted_profile;
1329 	int nontransmitted_profile_len = 0;
1330 
1331 	memset(elems, 0, sizeof(*elems));
1332 	elems->ie_start = start;
1333 	elems->total_len = len;
1334 
1335 	nontransmitted_profile = kmalloc(len, GFP_ATOMIC);
1336 	if (nontransmitted_profile) {
1337 		nontransmitted_profile_len =
1338 			ieee802_11_find_bssid_profile(start, len, elems,
1339 						      transmitter_bssid,
1340 						      bss_bssid,
1341 						      nontransmitted_profile);
1342 		non_inherit =
1343 			cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
1344 					       nontransmitted_profile,
1345 					       nontransmitted_profile_len);
1346 	}
1347 
1348 	crc = _ieee802_11_parse_elems_crc(start, len, action, elems, filter,
1349 					  crc, non_inherit);
1350 
1351 	/* Override with nontransmitted profile, if found */
1352 	if (nontransmitted_profile_len)
1353 		_ieee802_11_parse_elems_crc(nontransmitted_profile,
1354 					    nontransmitted_profile_len,
1355 					    action, elems, 0, 0, NULL);
1356 
1357 	if (elems->tim && !elems->parse_error) {
1358 		const struct ieee80211_tim_ie *tim_ie = elems->tim;
1359 
1360 		elems->dtim_period = tim_ie->dtim_period;
1361 		elems->dtim_count = tim_ie->dtim_count;
1362 	}
1363 
1364 	/* Override DTIM period and count if needed */
1365 	if (elems->bssid_index &&
1366 	    elems->bssid_index_len >=
1367 	    offsetofend(struct ieee80211_bssid_index, dtim_period))
1368 		elems->dtim_period = elems->bssid_index->dtim_period;
1369 
1370 	if (elems->bssid_index &&
1371 	    elems->bssid_index_len >=
1372 	    offsetofend(struct ieee80211_bssid_index, dtim_count))
1373 		elems->dtim_count = elems->bssid_index->dtim_count;
1374 
1375 	kfree(nontransmitted_profile);
1376 
1377 	return crc;
1378 }
1379 
1380 void ieee80211_regulatory_limit_wmm_params(struct ieee80211_sub_if_data *sdata,
1381 					   struct ieee80211_tx_queue_params
1382 					   *qparam, int ac)
1383 {
1384 	struct ieee80211_chanctx_conf *chanctx_conf;
1385 	const struct ieee80211_reg_rule *rrule;
1386 	const struct ieee80211_wmm_ac *wmm_ac;
1387 	u16 center_freq = 0;
1388 
1389 	if (sdata->vif.type != NL80211_IFTYPE_AP &&
1390 	    sdata->vif.type != NL80211_IFTYPE_STATION)
1391 		return;
1392 
1393 	rcu_read_lock();
1394 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
1395 	if (chanctx_conf)
1396 		center_freq = chanctx_conf->def.chan->center_freq;
1397 
1398 	if (!center_freq) {
1399 		rcu_read_unlock();
1400 		return;
1401 	}
1402 
1403 	rrule = freq_reg_info(sdata->wdev.wiphy, MHZ_TO_KHZ(center_freq));
1404 
1405 	if (IS_ERR_OR_NULL(rrule) || !rrule->has_wmm) {
1406 		rcu_read_unlock();
1407 		return;
1408 	}
1409 
1410 	if (sdata->vif.type == NL80211_IFTYPE_AP)
1411 		wmm_ac = &rrule->wmm_rule.ap[ac];
1412 	else
1413 		wmm_ac = &rrule->wmm_rule.client[ac];
1414 	qparam->cw_min = max_t(u16, qparam->cw_min, wmm_ac->cw_min);
1415 	qparam->cw_max = max_t(u16, qparam->cw_max, wmm_ac->cw_max);
1416 	qparam->aifs = max_t(u8, qparam->aifs, wmm_ac->aifsn);
1417 	qparam->txop = min_t(u16, qparam->txop, wmm_ac->cot / 32);
1418 	rcu_read_unlock();
1419 }
1420 
1421 void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
1422 			       bool bss_notify, bool enable_qos)
1423 {
1424 	struct ieee80211_local *local = sdata->local;
1425 	struct ieee80211_tx_queue_params qparam;
1426 	struct ieee80211_chanctx_conf *chanctx_conf;
1427 	int ac;
1428 	bool use_11b;
1429 	bool is_ocb; /* Use another EDCA parameters if dot11OCBActivated=true */
1430 	int aCWmin, aCWmax;
1431 
1432 	if (!local->ops->conf_tx)
1433 		return;
1434 
1435 	if (local->hw.queues < IEEE80211_NUM_ACS)
1436 		return;
1437 
1438 	memset(&qparam, 0, sizeof(qparam));
1439 
1440 	rcu_read_lock();
1441 	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
1442 	use_11b = (chanctx_conf &&
1443 		   chanctx_conf->def.chan->band == NL80211_BAND_2GHZ) &&
1444 		 !(sdata->flags & IEEE80211_SDATA_OPERATING_GMODE);
1445 	rcu_read_unlock();
1446 
1447 	is_ocb = (sdata->vif.type == NL80211_IFTYPE_OCB);
1448 
1449 	/* Set defaults according to 802.11-2007 Table 7-37 */
1450 	aCWmax = 1023;
1451 	if (use_11b)
1452 		aCWmin = 31;
1453 	else
1454 		aCWmin = 15;
1455 
1456 	/* Confiure old 802.11b/g medium access rules. */
1457 	qparam.cw_max = aCWmax;
1458 	qparam.cw_min = aCWmin;
1459 	qparam.txop = 0;
1460 	qparam.aifs = 2;
1461 
1462 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1463 		/* Update if QoS is enabled. */
1464 		if (enable_qos) {
1465 			switch (ac) {
1466 			case IEEE80211_AC_BK:
1467 				qparam.cw_max = aCWmax;
1468 				qparam.cw_min = aCWmin;
1469 				qparam.txop = 0;
1470 				if (is_ocb)
1471 					qparam.aifs = 9;
1472 				else
1473 					qparam.aifs = 7;
1474 				break;
1475 			/* never happens but let's not leave undefined */
1476 			default:
1477 			case IEEE80211_AC_BE:
1478 				qparam.cw_max = aCWmax;
1479 				qparam.cw_min = aCWmin;
1480 				qparam.txop = 0;
1481 				if (is_ocb)
1482 					qparam.aifs = 6;
1483 				else
1484 					qparam.aifs = 3;
1485 				break;
1486 			case IEEE80211_AC_VI:
1487 				qparam.cw_max = aCWmin;
1488 				qparam.cw_min = (aCWmin + 1) / 2 - 1;
1489 				if (is_ocb)
1490 					qparam.txop = 0;
1491 				else if (use_11b)
1492 					qparam.txop = 6016/32;
1493 				else
1494 					qparam.txop = 3008/32;
1495 
1496 				if (is_ocb)
1497 					qparam.aifs = 3;
1498 				else
1499 					qparam.aifs = 2;
1500 				break;
1501 			case IEEE80211_AC_VO:
1502 				qparam.cw_max = (aCWmin + 1) / 2 - 1;
1503 				qparam.cw_min = (aCWmin + 1) / 4 - 1;
1504 				if (is_ocb)
1505 					qparam.txop = 0;
1506 				else if (use_11b)
1507 					qparam.txop = 3264/32;
1508 				else
1509 					qparam.txop = 1504/32;
1510 				qparam.aifs = 2;
1511 				break;
1512 			}
1513 		}
1514 		ieee80211_regulatory_limit_wmm_params(sdata, &qparam, ac);
1515 
1516 		qparam.uapsd = false;
1517 
1518 		sdata->tx_conf[ac] = qparam;
1519 		drv_conf_tx(local, sdata, ac, &qparam);
1520 	}
1521 
1522 	if (sdata->vif.type != NL80211_IFTYPE_MONITOR &&
1523 	    sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
1524 	    sdata->vif.type != NL80211_IFTYPE_NAN) {
1525 		sdata->vif.bss_conf.qos = enable_qos;
1526 		if (bss_notify)
1527 			ieee80211_bss_info_change_notify(sdata,
1528 							 BSS_CHANGED_QOS);
1529 	}
1530 }
1531 
1532 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
1533 			 u16 transaction, u16 auth_alg, u16 status,
1534 			 const u8 *extra, size_t extra_len, const u8 *da,
1535 			 const u8 *bssid, const u8 *key, u8 key_len, u8 key_idx,
1536 			 u32 tx_flags)
1537 {
1538 	struct ieee80211_local *local = sdata->local;
1539 	struct sk_buff *skb;
1540 	struct ieee80211_mgmt *mgmt;
1541 	int err;
1542 
1543 	/* 24 + 6 = header + auth_algo + auth_transaction + status_code */
1544 	skb = dev_alloc_skb(local->hw.extra_tx_headroom + IEEE80211_WEP_IV_LEN +
1545 			    24 + 6 + extra_len + IEEE80211_WEP_ICV_LEN);
1546 	if (!skb)
1547 		return;
1548 
1549 	skb_reserve(skb, local->hw.extra_tx_headroom + IEEE80211_WEP_IV_LEN);
1550 
1551 	mgmt = skb_put_zero(skb, 24 + 6);
1552 	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1553 					  IEEE80211_STYPE_AUTH);
1554 	memcpy(mgmt->da, da, ETH_ALEN);
1555 	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
1556 	memcpy(mgmt->bssid, bssid, ETH_ALEN);
1557 	mgmt->u.auth.auth_alg = cpu_to_le16(auth_alg);
1558 	mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
1559 	mgmt->u.auth.status_code = cpu_to_le16(status);
1560 	if (extra)
1561 		skb_put_data(skb, extra, extra_len);
1562 
1563 	if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) {
1564 		mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
1565 		err = ieee80211_wep_encrypt(local, skb, key, key_len, key_idx);
1566 		WARN_ON(err);
1567 	}
1568 
1569 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
1570 					tx_flags;
1571 	ieee80211_tx_skb(sdata, skb);
1572 }
1573 
1574 void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
1575 				    const u8 *bssid, u16 stype, u16 reason,
1576 				    bool send_frame, u8 *frame_buf)
1577 {
1578 	struct ieee80211_local *local = sdata->local;
1579 	struct sk_buff *skb;
1580 	struct ieee80211_mgmt *mgmt = (void *)frame_buf;
1581 
1582 	/* build frame */
1583 	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype);
1584 	mgmt->duration = 0; /* initialize only */
1585 	mgmt->seq_ctrl = 0; /* initialize only */
1586 	memcpy(mgmt->da, bssid, ETH_ALEN);
1587 	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
1588 	memcpy(mgmt->bssid, bssid, ETH_ALEN);
1589 	/* u.deauth.reason_code == u.disassoc.reason_code */
1590 	mgmt->u.deauth.reason_code = cpu_to_le16(reason);
1591 
1592 	if (send_frame) {
1593 		skb = dev_alloc_skb(local->hw.extra_tx_headroom +
1594 				    IEEE80211_DEAUTH_FRAME_LEN);
1595 		if (!skb)
1596 			return;
1597 
1598 		skb_reserve(skb, local->hw.extra_tx_headroom);
1599 
1600 		/* copy in frame */
1601 		skb_put_data(skb, mgmt, IEEE80211_DEAUTH_FRAME_LEN);
1602 
1603 		if (sdata->vif.type != NL80211_IFTYPE_STATION ||
1604 		    !(sdata->u.mgd.flags & IEEE80211_STA_MFP_ENABLED))
1605 			IEEE80211_SKB_CB(skb)->flags |=
1606 				IEEE80211_TX_INTFL_DONT_ENCRYPT;
1607 
1608 		ieee80211_tx_skb(sdata, skb);
1609 	}
1610 }
1611 
1612 static int ieee80211_build_preq_ies_band(struct ieee80211_local *local,
1613 					 u8 *buffer, size_t buffer_len,
1614 					 const u8 *ie, size_t ie_len,
1615 					 enum nl80211_band band,
1616 					 u32 rate_mask,
1617 					 struct cfg80211_chan_def *chandef,
1618 					 size_t *offset, u32 flags)
1619 {
1620 	struct ieee80211_supported_band *sband;
1621 	const struct ieee80211_sta_he_cap *he_cap;
1622 	u8 *pos = buffer, *end = buffer + buffer_len;
1623 	size_t noffset;
1624 	int supp_rates_len, i;
1625 	u8 rates[32];
1626 	int num_rates;
1627 	int ext_rates_len;
1628 	int shift;
1629 	u32 rate_flags;
1630 	bool have_80mhz = false;
1631 
1632 	*offset = 0;
1633 
1634 	sband = local->hw.wiphy->bands[band];
1635 	if (WARN_ON_ONCE(!sband))
1636 		return 0;
1637 
1638 	rate_flags = ieee80211_chandef_rate_flags(chandef);
1639 	shift = ieee80211_chandef_get_shift(chandef);
1640 
1641 	num_rates = 0;
1642 	for (i = 0; i < sband->n_bitrates; i++) {
1643 		if ((BIT(i) & rate_mask) == 0)
1644 			continue; /* skip rate */
1645 		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
1646 			continue;
1647 
1648 		rates[num_rates++] =
1649 			(u8) DIV_ROUND_UP(sband->bitrates[i].bitrate,
1650 					  (1 << shift) * 5);
1651 	}
1652 
1653 	supp_rates_len = min_t(int, num_rates, 8);
1654 
1655 	if (end - pos < 2 + supp_rates_len)
1656 		goto out_err;
1657 	*pos++ = WLAN_EID_SUPP_RATES;
1658 	*pos++ = supp_rates_len;
1659 	memcpy(pos, rates, supp_rates_len);
1660 	pos += supp_rates_len;
1661 
1662 	/* insert "request information" if in custom IEs */
1663 	if (ie && ie_len) {
1664 		static const u8 before_extrates[] = {
1665 			WLAN_EID_SSID,
1666 			WLAN_EID_SUPP_RATES,
1667 			WLAN_EID_REQUEST,
1668 		};
1669 		noffset = ieee80211_ie_split(ie, ie_len,
1670 					     before_extrates,
1671 					     ARRAY_SIZE(before_extrates),
1672 					     *offset);
1673 		if (end - pos < noffset - *offset)
1674 			goto out_err;
1675 		memcpy(pos, ie + *offset, noffset - *offset);
1676 		pos += noffset - *offset;
1677 		*offset = noffset;
1678 	}
1679 
1680 	ext_rates_len = num_rates - supp_rates_len;
1681 	if (ext_rates_len > 0) {
1682 		if (end - pos < 2 + ext_rates_len)
1683 			goto out_err;
1684 		*pos++ = WLAN_EID_EXT_SUPP_RATES;
1685 		*pos++ = ext_rates_len;
1686 		memcpy(pos, rates + supp_rates_len, ext_rates_len);
1687 		pos += ext_rates_len;
1688 	}
1689 
1690 	if (chandef->chan && sband->band == NL80211_BAND_2GHZ) {
1691 		if (end - pos < 3)
1692 			goto out_err;
1693 		*pos++ = WLAN_EID_DS_PARAMS;
1694 		*pos++ = 1;
1695 		*pos++ = ieee80211_frequency_to_channel(
1696 				chandef->chan->center_freq);
1697 	}
1698 
1699 	if (flags & IEEE80211_PROBE_FLAG_MIN_CONTENT)
1700 		goto done;
1701 
1702 	/* insert custom IEs that go before HT */
1703 	if (ie && ie_len) {
1704 		static const u8 before_ht[] = {
1705 			/*
1706 			 * no need to list the ones split off already
1707 			 * (or generated here)
1708 			 */
1709 			WLAN_EID_DS_PARAMS,
1710 			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
1711 		};
1712 		noffset = ieee80211_ie_split(ie, ie_len,
1713 					     before_ht, ARRAY_SIZE(before_ht),
1714 					     *offset);
1715 		if (end - pos < noffset - *offset)
1716 			goto out_err;
1717 		memcpy(pos, ie + *offset, noffset - *offset);
1718 		pos += noffset - *offset;
1719 		*offset = noffset;
1720 	}
1721 
1722 	if (sband->ht_cap.ht_supported) {
1723 		if (end - pos < 2 + sizeof(struct ieee80211_ht_cap))
1724 			goto out_err;
1725 		pos = ieee80211_ie_build_ht_cap(pos, &sband->ht_cap,
1726 						sband->ht_cap.cap);
1727 	}
1728 
1729 	/* insert custom IEs that go before VHT */
1730 	if (ie && ie_len) {
1731 		static const u8 before_vht[] = {
1732 			/*
1733 			 * no need to list the ones split off already
1734 			 * (or generated here)
1735 			 */
1736 			WLAN_EID_BSS_COEX_2040,
1737 			WLAN_EID_EXT_CAPABILITY,
1738 			WLAN_EID_SSID_LIST,
1739 			WLAN_EID_CHANNEL_USAGE,
1740 			WLAN_EID_INTERWORKING,
1741 			WLAN_EID_MESH_ID,
1742 			/* 60 GHz (Multi-band, DMG, MMS) can't happen */
1743 		};
1744 		noffset = ieee80211_ie_split(ie, ie_len,
1745 					     before_vht, ARRAY_SIZE(before_vht),
1746 					     *offset);
1747 		if (end - pos < noffset - *offset)
1748 			goto out_err;
1749 		memcpy(pos, ie + *offset, noffset - *offset);
1750 		pos += noffset - *offset;
1751 		*offset = noffset;
1752 	}
1753 
1754 	/* Check if any channel in this sband supports at least 80 MHz */
1755 	for (i = 0; i < sband->n_channels; i++) {
1756 		if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
1757 						IEEE80211_CHAN_NO_80MHZ))
1758 			continue;
1759 
1760 		have_80mhz = true;
1761 		break;
1762 	}
1763 
1764 	if (sband->vht_cap.vht_supported && have_80mhz) {
1765 		if (end - pos < 2 + sizeof(struct ieee80211_vht_cap))
1766 			goto out_err;
1767 		pos = ieee80211_ie_build_vht_cap(pos, &sband->vht_cap,
1768 						 sband->vht_cap.cap);
1769 	}
1770 
1771 	/* insert custom IEs that go before HE */
1772 	if (ie && ie_len) {
1773 		static const u8 before_he[] = {
1774 			/*
1775 			 * no need to list the ones split off before VHT
1776 			 * or generated here
1777 			 */
1778 			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_REQ_PARAMS,
1779 			WLAN_EID_AP_CSN,
1780 			/* TODO: add 11ah/11aj/11ak elements */
1781 		};
1782 		noffset = ieee80211_ie_split(ie, ie_len,
1783 					     before_he, ARRAY_SIZE(before_he),
1784 					     *offset);
1785 		if (end - pos < noffset - *offset)
1786 			goto out_err;
1787 		memcpy(pos, ie + *offset, noffset - *offset);
1788 		pos += noffset - *offset;
1789 		*offset = noffset;
1790 	}
1791 
1792 	he_cap = ieee80211_get_he_sta_cap(sband);
1793 	if (he_cap) {
1794 		pos = ieee80211_ie_build_he_cap(pos, he_cap, end);
1795 		if (!pos)
1796 			goto out_err;
1797 	}
1798 
1799 	/*
1800 	 * If adding more here, adjust code in main.c
1801 	 * that calculates local->scan_ies_len.
1802 	 */
1803 
1804 	return pos - buffer;
1805  out_err:
1806 	WARN_ONCE(1, "not enough space for preq IEs\n");
1807  done:
1808 	return pos - buffer;
1809 }
1810 
1811 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
1812 			     size_t buffer_len,
1813 			     struct ieee80211_scan_ies *ie_desc,
1814 			     const u8 *ie, size_t ie_len,
1815 			     u8 bands_used, u32 *rate_masks,
1816 			     struct cfg80211_chan_def *chandef,
1817 			     u32 flags)
1818 {
1819 	size_t pos = 0, old_pos = 0, custom_ie_offset = 0;
1820 	int i;
1821 
1822 	memset(ie_desc, 0, sizeof(*ie_desc));
1823 
1824 	for (i = 0; i < NUM_NL80211_BANDS; i++) {
1825 		if (bands_used & BIT(i)) {
1826 			pos += ieee80211_build_preq_ies_band(local,
1827 							     buffer + pos,
1828 							     buffer_len - pos,
1829 							     ie, ie_len, i,
1830 							     rate_masks[i],
1831 							     chandef,
1832 							     &custom_ie_offset,
1833 							     flags);
1834 			ie_desc->ies[i] = buffer + old_pos;
1835 			ie_desc->len[i] = pos - old_pos;
1836 			old_pos = pos;
1837 		}
1838 	}
1839 
1840 	/* add any remaining custom IEs */
1841 	if (ie && ie_len) {
1842 		if (WARN_ONCE(buffer_len - pos < ie_len - custom_ie_offset,
1843 			      "not enough space for preq custom IEs\n"))
1844 			return pos;
1845 		memcpy(buffer + pos, ie + custom_ie_offset,
1846 		       ie_len - custom_ie_offset);
1847 		ie_desc->common_ies = buffer + pos;
1848 		ie_desc->common_ie_len = ie_len - custom_ie_offset;
1849 		pos += ie_len - custom_ie_offset;
1850 	}
1851 
1852 	return pos;
1853 };
1854 
1855 struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
1856 					  const u8 *src, const u8 *dst,
1857 					  u32 ratemask,
1858 					  struct ieee80211_channel *chan,
1859 					  const u8 *ssid, size_t ssid_len,
1860 					  const u8 *ie, size_t ie_len,
1861 					  u32 flags)
1862 {
1863 	struct ieee80211_local *local = sdata->local;
1864 	struct cfg80211_chan_def chandef;
1865 	struct sk_buff *skb;
1866 	struct ieee80211_mgmt *mgmt;
1867 	int ies_len;
1868 	u32 rate_masks[NUM_NL80211_BANDS] = {};
1869 	struct ieee80211_scan_ies dummy_ie_desc;
1870 
1871 	/*
1872 	 * Do not send DS Channel parameter for directed probe requests
1873 	 * in order to maximize the chance that we get a response.  Some
1874 	 * badly-behaved APs don't respond when this parameter is included.
1875 	 */
1876 	chandef.width = sdata->vif.bss_conf.chandef.width;
1877 	if (flags & IEEE80211_PROBE_FLAG_DIRECTED)
1878 		chandef.chan = NULL;
1879 	else
1880 		chandef.chan = chan;
1881 
1882 	skb = ieee80211_probereq_get(&local->hw, src, ssid, ssid_len,
1883 				     100 + ie_len);
1884 	if (!skb)
1885 		return NULL;
1886 
1887 	rate_masks[chan->band] = ratemask;
1888 	ies_len = ieee80211_build_preq_ies(local, skb_tail_pointer(skb),
1889 					   skb_tailroom(skb), &dummy_ie_desc,
1890 					   ie, ie_len, BIT(chan->band),
1891 					   rate_masks, &chandef, flags);
1892 	skb_put(skb, ies_len);
1893 
1894 	if (dst) {
1895 		mgmt = (struct ieee80211_mgmt *) skb->data;
1896 		memcpy(mgmt->da, dst, ETH_ALEN);
1897 		memcpy(mgmt->bssid, dst, ETH_ALEN);
1898 	}
1899 
1900 	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1901 
1902 	return skb;
1903 }
1904 
1905 u32 ieee80211_sta_get_rates(struct ieee80211_sub_if_data *sdata,
1906 			    struct ieee802_11_elems *elems,
1907 			    enum nl80211_band band, u32 *basic_rates)
1908 {
1909 	struct ieee80211_supported_band *sband;
1910 	size_t num_rates;
1911 	u32 supp_rates, rate_flags;
1912 	int i, j, shift;
1913 
1914 	sband = sdata->local->hw.wiphy->bands[band];
1915 	if (WARN_ON(!sband))
1916 		return 1;
1917 
1918 	rate_flags = ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chandef);
1919 	shift = ieee80211_vif_get_shift(&sdata->vif);
1920 
1921 	num_rates = sband->n_bitrates;
1922 	supp_rates = 0;
1923 	for (i = 0; i < elems->supp_rates_len +
1924 		     elems->ext_supp_rates_len; i++) {
1925 		u8 rate = 0;
1926 		int own_rate;
1927 		bool is_basic;
1928 		if (i < elems->supp_rates_len)
1929 			rate = elems->supp_rates[i];
1930 		else if (elems->ext_supp_rates)
1931 			rate = elems->ext_supp_rates
1932 				[i - elems->supp_rates_len];
1933 		own_rate = 5 * (rate & 0x7f);
1934 		is_basic = !!(rate & 0x80);
1935 
1936 		if (is_basic && (rate & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
1937 			continue;
1938 
1939 		for (j = 0; j < num_rates; j++) {
1940 			int brate;
1941 			if ((rate_flags & sband->bitrates[j].flags)
1942 			    != rate_flags)
1943 				continue;
1944 
1945 			brate = DIV_ROUND_UP(sband->bitrates[j].bitrate,
1946 					     1 << shift);
1947 
1948 			if (brate == own_rate) {
1949 				supp_rates |= BIT(j);
1950 				if (basic_rates && is_basic)
1951 					*basic_rates |= BIT(j);
1952 			}
1953 		}
1954 	}
1955 	return supp_rates;
1956 }
1957 
1958 void ieee80211_stop_device(struct ieee80211_local *local)
1959 {
1960 	ieee80211_led_radio(local, false);
1961 	ieee80211_mod_tpt_led_trig(local, 0, IEEE80211_TPT_LEDTRIG_FL_RADIO);
1962 
1963 	cancel_work_sync(&local->reconfig_filter);
1964 
1965 	flush_workqueue(local->workqueue);
1966 	drv_stop(local);
1967 }
1968 
1969 static void ieee80211_flush_completed_scan(struct ieee80211_local *local,
1970 					   bool aborted)
1971 {
1972 	/* It's possible that we don't handle the scan completion in
1973 	 * time during suspend, so if it's still marked as completed
1974 	 * here, queue the work and flush it to clean things up.
1975 	 * Instead of calling the worker function directly here, we
1976 	 * really queue it to avoid potential races with other flows
1977 	 * scheduling the same work.
1978 	 */
1979 	if (test_bit(SCAN_COMPLETED, &local->scanning)) {
1980 		/* If coming from reconfiguration failure, abort the scan so
1981 		 * we don't attempt to continue a partial HW scan - which is
1982 		 * possible otherwise if (e.g.) the 2.4 GHz portion was the
1983 		 * completed scan, and a 5 GHz portion is still pending.
1984 		 */
1985 		if (aborted)
1986 			set_bit(SCAN_ABORTED, &local->scanning);
1987 		ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 0);
1988 		flush_delayed_work(&local->scan_work);
1989 	}
1990 }
1991 
1992 static void ieee80211_handle_reconfig_failure(struct ieee80211_local *local)
1993 {
1994 	struct ieee80211_sub_if_data *sdata;
1995 	struct ieee80211_chanctx *ctx;
1996 
1997 	/*
1998 	 * We get here if during resume the device can't be restarted properly.
1999 	 * We might also get here if this happens during HW reset, which is a
2000 	 * slightly different situation and we need to drop all connections in
2001 	 * the latter case.
2002 	 *
2003 	 * Ask cfg80211 to turn off all interfaces, this will result in more
2004 	 * warnings but at least we'll then get into a clean stopped state.
2005 	 */
2006 
2007 	local->resuming = false;
2008 	local->suspended = false;
2009 	local->in_reconfig = false;
2010 
2011 	ieee80211_flush_completed_scan(local, true);
2012 
2013 	/* scheduled scan clearly can't be running any more, but tell
2014 	 * cfg80211 and clear local state
2015 	 */
2016 	ieee80211_sched_scan_end(local);
2017 
2018 	list_for_each_entry(sdata, &local->interfaces, list)
2019 		sdata->flags &= ~IEEE80211_SDATA_IN_DRIVER;
2020 
2021 	/* Mark channel contexts as not being in the driver any more to avoid
2022 	 * removing them from the driver during the shutdown process...
2023 	 */
2024 	mutex_lock(&local->chanctx_mtx);
2025 	list_for_each_entry(ctx, &local->chanctx_list, list)
2026 		ctx->driver_present = false;
2027 	mutex_unlock(&local->chanctx_mtx);
2028 
2029 	cfg80211_shutdown_all_interfaces(local->hw.wiphy);
2030 }
2031 
2032 static void ieee80211_assign_chanctx(struct ieee80211_local *local,
2033 				     struct ieee80211_sub_if_data *sdata)
2034 {
2035 	struct ieee80211_chanctx_conf *conf;
2036 	struct ieee80211_chanctx *ctx;
2037 
2038 	if (!local->use_chanctx)
2039 		return;
2040 
2041 	mutex_lock(&local->chanctx_mtx);
2042 	conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
2043 					 lockdep_is_held(&local->chanctx_mtx));
2044 	if (conf) {
2045 		ctx = container_of(conf, struct ieee80211_chanctx, conf);
2046 		drv_assign_vif_chanctx(local, sdata, ctx);
2047 	}
2048 	mutex_unlock(&local->chanctx_mtx);
2049 }
2050 
2051 static void ieee80211_reconfig_stations(struct ieee80211_sub_if_data *sdata)
2052 {
2053 	struct ieee80211_local *local = sdata->local;
2054 	struct sta_info *sta;
2055 
2056 	/* add STAs back */
2057 	mutex_lock(&local->sta_mtx);
2058 	list_for_each_entry(sta, &local->sta_list, list) {
2059 		enum ieee80211_sta_state state;
2060 
2061 		if (!sta->uploaded || sta->sdata != sdata)
2062 			continue;
2063 
2064 		for (state = IEEE80211_STA_NOTEXIST;
2065 		     state < sta->sta_state; state++)
2066 			WARN_ON(drv_sta_state(local, sta->sdata, sta, state,
2067 					      state + 1));
2068 	}
2069 	mutex_unlock(&local->sta_mtx);
2070 }
2071 
2072 static int ieee80211_reconfig_nan(struct ieee80211_sub_if_data *sdata)
2073 {
2074 	struct cfg80211_nan_func *func, **funcs;
2075 	int res, id, i = 0;
2076 
2077 	res = drv_start_nan(sdata->local, sdata,
2078 			    &sdata->u.nan.conf);
2079 	if (WARN_ON(res))
2080 		return res;
2081 
2082 	funcs = kcalloc(sdata->local->hw.max_nan_de_entries + 1,
2083 			sizeof(*funcs),
2084 			GFP_KERNEL);
2085 	if (!funcs)
2086 		return -ENOMEM;
2087 
2088 	/* Add all the functions:
2089 	 * This is a little bit ugly. We need to call a potentially sleeping
2090 	 * callback for each NAN function, so we can't hold the spinlock.
2091 	 */
2092 	spin_lock_bh(&sdata->u.nan.func_lock);
2093 
2094 	idr_for_each_entry(&sdata->u.nan.function_inst_ids, func, id)
2095 		funcs[i++] = func;
2096 
2097 	spin_unlock_bh(&sdata->u.nan.func_lock);
2098 
2099 	for (i = 0; funcs[i]; i++) {
2100 		res = drv_add_nan_func(sdata->local, sdata, funcs[i]);
2101 		if (WARN_ON(res))
2102 			ieee80211_nan_func_terminated(&sdata->vif,
2103 						      funcs[i]->instance_id,
2104 						      NL80211_NAN_FUNC_TERM_REASON_ERROR,
2105 						      GFP_KERNEL);
2106 	}
2107 
2108 	kfree(funcs);
2109 
2110 	return 0;
2111 }
2112 
2113 int ieee80211_reconfig(struct ieee80211_local *local)
2114 {
2115 	struct ieee80211_hw *hw = &local->hw;
2116 	struct ieee80211_sub_if_data *sdata;
2117 	struct ieee80211_chanctx *ctx;
2118 	struct sta_info *sta;
2119 	int res, i;
2120 	bool reconfig_due_to_wowlan = false;
2121 	struct ieee80211_sub_if_data *sched_scan_sdata;
2122 	struct cfg80211_sched_scan_request *sched_scan_req;
2123 	bool sched_scan_stopped = false;
2124 	bool suspended = local->suspended;
2125 
2126 	/* nothing to do if HW shouldn't run */
2127 	if (!local->open_count)
2128 		goto wake_up;
2129 
2130 #ifdef CONFIG_PM
2131 	if (suspended)
2132 		local->resuming = true;
2133 
2134 	if (local->wowlan) {
2135 		/*
2136 		 * In the wowlan case, both mac80211 and the device
2137 		 * are functional when the resume op is called, so
2138 		 * clear local->suspended so the device could operate
2139 		 * normally (e.g. pass rx frames).
2140 		 */
2141 		local->suspended = false;
2142 		res = drv_resume(local);
2143 		local->wowlan = false;
2144 		if (res < 0) {
2145 			local->resuming = false;
2146 			return res;
2147 		}
2148 		if (res == 0)
2149 			goto wake_up;
2150 		WARN_ON(res > 1);
2151 		/*
2152 		 * res is 1, which means the driver requested
2153 		 * to go through a regular reset on wakeup.
2154 		 * restore local->suspended in this case.
2155 		 */
2156 		reconfig_due_to_wowlan = true;
2157 		local->suspended = true;
2158 	}
2159 #endif
2160 
2161 	/*
2162 	 * In case of hw_restart during suspend (without wowlan),
2163 	 * cancel restart work, as we are reconfiguring the device
2164 	 * anyway.
2165 	 * Note that restart_work is scheduled on a frozen workqueue,
2166 	 * so we can't deadlock in this case.
2167 	 */
2168 	if (suspended && local->in_reconfig && !reconfig_due_to_wowlan)
2169 		cancel_work_sync(&local->restart_work);
2170 
2171 	local->started = false;
2172 
2173 	/*
2174 	 * Upon resume hardware can sometimes be goofy due to
2175 	 * various platform / driver / bus issues, so restarting
2176 	 * the device may at times not work immediately. Propagate
2177 	 * the error.
2178 	 */
2179 	res = drv_start(local);
2180 	if (res) {
2181 		if (suspended)
2182 			WARN(1, "Hardware became unavailable upon resume. This could be a software issue prior to suspend or a hardware issue.\n");
2183 		else
2184 			WARN(1, "Hardware became unavailable during restart.\n");
2185 		ieee80211_handle_reconfig_failure(local);
2186 		return res;
2187 	}
2188 
2189 	/* setup fragmentation threshold */
2190 	drv_set_frag_threshold(local, hw->wiphy->frag_threshold);
2191 
2192 	/* setup RTS threshold */
2193 	drv_set_rts_threshold(local, hw->wiphy->rts_threshold);
2194 
2195 	/* reset coverage class */
2196 	drv_set_coverage_class(local, hw->wiphy->coverage_class);
2197 
2198 	ieee80211_led_radio(local, true);
2199 	ieee80211_mod_tpt_led_trig(local,
2200 				   IEEE80211_TPT_LEDTRIG_FL_RADIO, 0);
2201 
2202 	/* add interfaces */
2203 	sdata = rtnl_dereference(local->monitor_sdata);
2204 	if (sdata) {
2205 		/* in HW restart it exists already */
2206 		WARN_ON(local->resuming);
2207 		res = drv_add_interface(local, sdata);
2208 		if (WARN_ON(res)) {
2209 			RCU_INIT_POINTER(local->monitor_sdata, NULL);
2210 			synchronize_net();
2211 			kfree(sdata);
2212 		}
2213 	}
2214 
2215 	list_for_each_entry(sdata, &local->interfaces, list) {
2216 		if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2217 		    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
2218 		    ieee80211_sdata_running(sdata)) {
2219 			res = drv_add_interface(local, sdata);
2220 			if (WARN_ON(res))
2221 				break;
2222 		}
2223 	}
2224 
2225 	/* If adding any of the interfaces failed above, roll back and
2226 	 * report failure.
2227 	 */
2228 	if (res) {
2229 		list_for_each_entry_continue_reverse(sdata, &local->interfaces,
2230 						     list)
2231 			if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2232 			    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
2233 			    ieee80211_sdata_running(sdata))
2234 				drv_remove_interface(local, sdata);
2235 		ieee80211_handle_reconfig_failure(local);
2236 		return res;
2237 	}
2238 
2239 	/* add channel contexts */
2240 	if (local->use_chanctx) {
2241 		mutex_lock(&local->chanctx_mtx);
2242 		list_for_each_entry(ctx, &local->chanctx_list, list)
2243 			if (ctx->replace_state !=
2244 			    IEEE80211_CHANCTX_REPLACES_OTHER)
2245 				WARN_ON(drv_add_chanctx(local, ctx));
2246 		mutex_unlock(&local->chanctx_mtx);
2247 
2248 		sdata = rtnl_dereference(local->monitor_sdata);
2249 		if (sdata && ieee80211_sdata_running(sdata))
2250 			ieee80211_assign_chanctx(local, sdata);
2251 	}
2252 
2253 	/* reconfigure hardware */
2254 	ieee80211_hw_config(local, ~0);
2255 
2256 	ieee80211_configure_filter(local);
2257 
2258 	/* Finally also reconfigure all the BSS information */
2259 	list_for_each_entry(sdata, &local->interfaces, list) {
2260 		u32 changed;
2261 
2262 		if (!ieee80211_sdata_running(sdata))
2263 			continue;
2264 
2265 		ieee80211_assign_chanctx(local, sdata);
2266 
2267 		switch (sdata->vif.type) {
2268 		case NL80211_IFTYPE_AP_VLAN:
2269 		case NL80211_IFTYPE_MONITOR:
2270 			break;
2271 		case NL80211_IFTYPE_ADHOC:
2272 			if (sdata->vif.bss_conf.ibss_joined)
2273 				WARN_ON(drv_join_ibss(local, sdata));
2274 			/* fall through */
2275 		default:
2276 			ieee80211_reconfig_stations(sdata);
2277 			/* fall through */
2278 		case NL80211_IFTYPE_AP: /* AP stations are handled later */
2279 			for (i = 0; i < IEEE80211_NUM_ACS; i++)
2280 				drv_conf_tx(local, sdata, i,
2281 					    &sdata->tx_conf[i]);
2282 			break;
2283 		}
2284 
2285 		/* common change flags for all interface types */
2286 		changed = BSS_CHANGED_ERP_CTS_PROT |
2287 			  BSS_CHANGED_ERP_PREAMBLE |
2288 			  BSS_CHANGED_ERP_SLOT |
2289 			  BSS_CHANGED_HT |
2290 			  BSS_CHANGED_BASIC_RATES |
2291 			  BSS_CHANGED_BEACON_INT |
2292 			  BSS_CHANGED_BSSID |
2293 			  BSS_CHANGED_CQM |
2294 			  BSS_CHANGED_QOS |
2295 			  BSS_CHANGED_IDLE |
2296 			  BSS_CHANGED_TXPOWER |
2297 			  BSS_CHANGED_MCAST_RATE;
2298 
2299 		if (sdata->vif.mu_mimo_owner)
2300 			changed |= BSS_CHANGED_MU_GROUPS;
2301 
2302 		switch (sdata->vif.type) {
2303 		case NL80211_IFTYPE_STATION:
2304 			changed |= BSS_CHANGED_ASSOC |
2305 				   BSS_CHANGED_ARP_FILTER |
2306 				   BSS_CHANGED_PS;
2307 
2308 			/* Re-send beacon info report to the driver */
2309 			if (sdata->u.mgd.have_beacon)
2310 				changed |= BSS_CHANGED_BEACON_INFO;
2311 
2312 			if (sdata->vif.bss_conf.max_idle_period ||
2313 			    sdata->vif.bss_conf.protected_keep_alive)
2314 				changed |= BSS_CHANGED_KEEP_ALIVE;
2315 
2316 			sdata_lock(sdata);
2317 			ieee80211_bss_info_change_notify(sdata, changed);
2318 			sdata_unlock(sdata);
2319 			break;
2320 		case NL80211_IFTYPE_OCB:
2321 			changed |= BSS_CHANGED_OCB;
2322 			ieee80211_bss_info_change_notify(sdata, changed);
2323 			break;
2324 		case NL80211_IFTYPE_ADHOC:
2325 			changed |= BSS_CHANGED_IBSS;
2326 			/* fall through */
2327 		case NL80211_IFTYPE_AP:
2328 			changed |= BSS_CHANGED_SSID | BSS_CHANGED_P2P_PS;
2329 
2330 			if (sdata->vif.bss_conf.ftm_responder == 1 &&
2331 			    wiphy_ext_feature_isset(sdata->local->hw.wiphy,
2332 					NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
2333 				changed |= BSS_CHANGED_FTM_RESPONDER;
2334 
2335 			if (sdata->vif.type == NL80211_IFTYPE_AP) {
2336 				changed |= BSS_CHANGED_AP_PROBE_RESP;
2337 
2338 				if (rcu_access_pointer(sdata->u.ap.beacon))
2339 					drv_start_ap(local, sdata);
2340 			}
2341 
2342 			/* fall through */
2343 		case NL80211_IFTYPE_MESH_POINT:
2344 			if (sdata->vif.bss_conf.enable_beacon) {
2345 				changed |= BSS_CHANGED_BEACON |
2346 					   BSS_CHANGED_BEACON_ENABLED;
2347 				ieee80211_bss_info_change_notify(sdata, changed);
2348 			}
2349 			break;
2350 		case NL80211_IFTYPE_NAN:
2351 			res = ieee80211_reconfig_nan(sdata);
2352 			if (res < 0) {
2353 				ieee80211_handle_reconfig_failure(local);
2354 				return res;
2355 			}
2356 			break;
2357 		case NL80211_IFTYPE_WDS:
2358 		case NL80211_IFTYPE_AP_VLAN:
2359 		case NL80211_IFTYPE_MONITOR:
2360 		case NL80211_IFTYPE_P2P_DEVICE:
2361 			/* nothing to do */
2362 			break;
2363 		case NL80211_IFTYPE_UNSPECIFIED:
2364 		case NUM_NL80211_IFTYPES:
2365 		case NL80211_IFTYPE_P2P_CLIENT:
2366 		case NL80211_IFTYPE_P2P_GO:
2367 			WARN_ON(1);
2368 			break;
2369 		}
2370 	}
2371 
2372 	ieee80211_recalc_ps(local);
2373 
2374 	/*
2375 	 * The sta might be in psm against the ap (e.g. because
2376 	 * this was the state before a hw restart), so we
2377 	 * explicitly send a null packet in order to make sure
2378 	 * it'll sync against the ap (and get out of psm).
2379 	 */
2380 	if (!(local->hw.conf.flags & IEEE80211_CONF_PS)) {
2381 		list_for_each_entry(sdata, &local->interfaces, list) {
2382 			if (sdata->vif.type != NL80211_IFTYPE_STATION)
2383 				continue;
2384 			if (!sdata->u.mgd.associated)
2385 				continue;
2386 
2387 			ieee80211_send_nullfunc(local, sdata, false);
2388 		}
2389 	}
2390 
2391 	/* APs are now beaconing, add back stations */
2392 	mutex_lock(&local->sta_mtx);
2393 	list_for_each_entry(sta, &local->sta_list, list) {
2394 		enum ieee80211_sta_state state;
2395 
2396 		if (!sta->uploaded)
2397 			continue;
2398 
2399 		if (sta->sdata->vif.type != NL80211_IFTYPE_AP &&
2400 		    sta->sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
2401 			continue;
2402 
2403 		for (state = IEEE80211_STA_NOTEXIST;
2404 		     state < sta->sta_state; state++)
2405 			WARN_ON(drv_sta_state(local, sta->sdata, sta, state,
2406 					      state + 1));
2407 	}
2408 	mutex_unlock(&local->sta_mtx);
2409 
2410 	/* add back keys */
2411 	list_for_each_entry(sdata, &local->interfaces, list)
2412 		ieee80211_reset_crypto_tx_tailroom(sdata);
2413 
2414 	list_for_each_entry(sdata, &local->interfaces, list)
2415 		if (ieee80211_sdata_running(sdata))
2416 			ieee80211_enable_keys(sdata);
2417 
2418 	/* Reconfigure sched scan if it was interrupted by FW restart */
2419 	mutex_lock(&local->mtx);
2420 	sched_scan_sdata = rcu_dereference_protected(local->sched_scan_sdata,
2421 						lockdep_is_held(&local->mtx));
2422 	sched_scan_req = rcu_dereference_protected(local->sched_scan_req,
2423 						lockdep_is_held(&local->mtx));
2424 	if (sched_scan_sdata && sched_scan_req)
2425 		/*
2426 		 * Sched scan stopped, but we don't want to report it. Instead,
2427 		 * we're trying to reschedule. However, if more than one scan
2428 		 * plan was set, we cannot reschedule since we don't know which
2429 		 * scan plan was currently running (and some scan plans may have
2430 		 * already finished).
2431 		 */
2432 		if (sched_scan_req->n_scan_plans > 1 ||
2433 		    __ieee80211_request_sched_scan_start(sched_scan_sdata,
2434 							 sched_scan_req)) {
2435 			RCU_INIT_POINTER(local->sched_scan_sdata, NULL);
2436 			RCU_INIT_POINTER(local->sched_scan_req, NULL);
2437 			sched_scan_stopped = true;
2438 		}
2439 	mutex_unlock(&local->mtx);
2440 
2441 	if (sched_scan_stopped)
2442 		cfg80211_sched_scan_stopped_rtnl(local->hw.wiphy, 0);
2443 
2444  wake_up:
2445 
2446 	if (local->monitors == local->open_count && local->monitors > 0)
2447 		ieee80211_add_virtual_monitor(local);
2448 
2449 	/*
2450 	 * Clear the WLAN_STA_BLOCK_BA flag so new aggregation
2451 	 * sessions can be established after a resume.
2452 	 *
2453 	 * Also tear down aggregation sessions since reconfiguring
2454 	 * them in a hardware restart scenario is not easily done
2455 	 * right now, and the hardware will have lost information
2456 	 * about the sessions, but we and the AP still think they
2457 	 * are active. This is really a workaround though.
2458 	 */
2459 	if (ieee80211_hw_check(hw, AMPDU_AGGREGATION)) {
2460 		mutex_lock(&local->sta_mtx);
2461 
2462 		list_for_each_entry(sta, &local->sta_list, list) {
2463 			if (!local->resuming)
2464 				ieee80211_sta_tear_down_BA_sessions(
2465 						sta, AGG_STOP_LOCAL_REQUEST);
2466 			clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
2467 		}
2468 
2469 		mutex_unlock(&local->sta_mtx);
2470 	}
2471 
2472 	if (local->in_reconfig) {
2473 		local->in_reconfig = false;
2474 		barrier();
2475 
2476 		/* Restart deferred ROCs */
2477 		mutex_lock(&local->mtx);
2478 		ieee80211_start_next_roc(local);
2479 		mutex_unlock(&local->mtx);
2480 
2481 		/* Requeue all works */
2482 		list_for_each_entry(sdata, &local->interfaces, list)
2483 			ieee80211_queue_work(&local->hw, &sdata->work);
2484 	}
2485 
2486 	ieee80211_wake_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP,
2487 					IEEE80211_QUEUE_STOP_REASON_SUSPEND,
2488 					false);
2489 
2490 	/*
2491 	 * If this is for hw restart things are still running.
2492 	 * We may want to change that later, however.
2493 	 */
2494 	if (local->open_count && (!suspended || reconfig_due_to_wowlan))
2495 		drv_reconfig_complete(local, IEEE80211_RECONFIG_TYPE_RESTART);
2496 
2497 	if (!suspended)
2498 		return 0;
2499 
2500 #ifdef CONFIG_PM
2501 	/* first set suspended false, then resuming */
2502 	local->suspended = false;
2503 	mb();
2504 	local->resuming = false;
2505 
2506 	ieee80211_flush_completed_scan(local, false);
2507 
2508 	if (local->open_count && !reconfig_due_to_wowlan)
2509 		drv_reconfig_complete(local, IEEE80211_RECONFIG_TYPE_SUSPEND);
2510 
2511 	list_for_each_entry(sdata, &local->interfaces, list) {
2512 		if (!ieee80211_sdata_running(sdata))
2513 			continue;
2514 		if (sdata->vif.type == NL80211_IFTYPE_STATION)
2515 			ieee80211_sta_restart(sdata);
2516 	}
2517 
2518 	mod_timer(&local->sta_cleanup, jiffies + 1);
2519 #else
2520 	WARN_ON(1);
2521 #endif
2522 
2523 	return 0;
2524 }
2525 
2526 void ieee80211_resume_disconnect(struct ieee80211_vif *vif)
2527 {
2528 	struct ieee80211_sub_if_data *sdata;
2529 	struct ieee80211_local *local;
2530 	struct ieee80211_key *key;
2531 
2532 	if (WARN_ON(!vif))
2533 		return;
2534 
2535 	sdata = vif_to_sdata(vif);
2536 	local = sdata->local;
2537 
2538 	if (WARN_ON(!local->resuming))
2539 		return;
2540 
2541 	if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
2542 		return;
2543 
2544 	sdata->flags |= IEEE80211_SDATA_DISCONNECT_RESUME;
2545 
2546 	mutex_lock(&local->key_mtx);
2547 	list_for_each_entry(key, &sdata->key_list, list)
2548 		key->flags |= KEY_FLAG_TAINTED;
2549 	mutex_unlock(&local->key_mtx);
2550 }
2551 EXPORT_SYMBOL_GPL(ieee80211_resume_disconnect);
2552 
2553 void ieee80211_recalc_smps(struct ieee80211_sub_if_data *sdata)
2554 {
2555 	struct ieee80211_local *local = sdata->local;
2556 	struct ieee80211_chanctx_conf *chanctx_conf;
2557 	struct ieee80211_chanctx *chanctx;
2558 
2559 	mutex_lock(&local->chanctx_mtx);
2560 
2561 	chanctx_conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
2562 					lockdep_is_held(&local->chanctx_mtx));
2563 
2564 	/*
2565 	 * This function can be called from a work, thus it may be possible
2566 	 * that the chanctx_conf is removed (due to a disconnection, for
2567 	 * example).
2568 	 * So nothing should be done in such case.
2569 	 */
2570 	if (!chanctx_conf)
2571 		goto unlock;
2572 
2573 	chanctx = container_of(chanctx_conf, struct ieee80211_chanctx, conf);
2574 	ieee80211_recalc_smps_chanctx(local, chanctx);
2575  unlock:
2576 	mutex_unlock(&local->chanctx_mtx);
2577 }
2578 
2579 void ieee80211_recalc_min_chandef(struct ieee80211_sub_if_data *sdata)
2580 {
2581 	struct ieee80211_local *local = sdata->local;
2582 	struct ieee80211_chanctx_conf *chanctx_conf;
2583 	struct ieee80211_chanctx *chanctx;
2584 
2585 	mutex_lock(&local->chanctx_mtx);
2586 
2587 	chanctx_conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
2588 					lockdep_is_held(&local->chanctx_mtx));
2589 
2590 	if (WARN_ON_ONCE(!chanctx_conf))
2591 		goto unlock;
2592 
2593 	chanctx = container_of(chanctx_conf, struct ieee80211_chanctx, conf);
2594 	ieee80211_recalc_chanctx_min_def(local, chanctx);
2595  unlock:
2596 	mutex_unlock(&local->chanctx_mtx);
2597 }
2598 
2599 size_t ieee80211_ie_split_vendor(const u8 *ies, size_t ielen, size_t offset)
2600 {
2601 	size_t pos = offset;
2602 
2603 	while (pos < ielen && ies[pos] != WLAN_EID_VENDOR_SPECIFIC)
2604 		pos += 2 + ies[pos + 1];
2605 
2606 	return pos;
2607 }
2608 
2609 static void _ieee80211_enable_rssi_reports(struct ieee80211_sub_if_data *sdata,
2610 					    int rssi_min_thold,
2611 					    int rssi_max_thold)
2612 {
2613 	trace_api_enable_rssi_reports(sdata, rssi_min_thold, rssi_max_thold);
2614 
2615 	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
2616 		return;
2617 
2618 	/*
2619 	 * Scale up threshold values before storing it, as the RSSI averaging
2620 	 * algorithm uses a scaled up value as well. Change this scaling
2621 	 * factor if the RSSI averaging algorithm changes.
2622 	 */
2623 	sdata->u.mgd.rssi_min_thold = rssi_min_thold*16;
2624 	sdata->u.mgd.rssi_max_thold = rssi_max_thold*16;
2625 }
2626 
2627 void ieee80211_enable_rssi_reports(struct ieee80211_vif *vif,
2628 				    int rssi_min_thold,
2629 				    int rssi_max_thold)
2630 {
2631 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2632 
2633 	WARN_ON(rssi_min_thold == rssi_max_thold ||
2634 		rssi_min_thold > rssi_max_thold);
2635 
2636 	_ieee80211_enable_rssi_reports(sdata, rssi_min_thold,
2637 				       rssi_max_thold);
2638 }
2639 EXPORT_SYMBOL(ieee80211_enable_rssi_reports);
2640 
2641 void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif)
2642 {
2643 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2644 
2645 	_ieee80211_enable_rssi_reports(sdata, 0, 0);
2646 }
2647 EXPORT_SYMBOL(ieee80211_disable_rssi_reports);
2648 
2649 u8 *ieee80211_ie_build_ht_cap(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
2650 			      u16 cap)
2651 {
2652 	__le16 tmp;
2653 
2654 	*pos++ = WLAN_EID_HT_CAPABILITY;
2655 	*pos++ = sizeof(struct ieee80211_ht_cap);
2656 	memset(pos, 0, sizeof(struct ieee80211_ht_cap));
2657 
2658 	/* capability flags */
2659 	tmp = cpu_to_le16(cap);
2660 	memcpy(pos, &tmp, sizeof(u16));
2661 	pos += sizeof(u16);
2662 
2663 	/* AMPDU parameters */
2664 	*pos++ = ht_cap->ampdu_factor |
2665 		 (ht_cap->ampdu_density <<
2666 			IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT);
2667 
2668 	/* MCS set */
2669 	memcpy(pos, &ht_cap->mcs, sizeof(ht_cap->mcs));
2670 	pos += sizeof(ht_cap->mcs);
2671 
2672 	/* extended capabilities */
2673 	pos += sizeof(__le16);
2674 
2675 	/* BF capabilities */
2676 	pos += sizeof(__le32);
2677 
2678 	/* antenna selection */
2679 	pos += sizeof(u8);
2680 
2681 	return pos;
2682 }
2683 
2684 u8 *ieee80211_ie_build_vht_cap(u8 *pos, struct ieee80211_sta_vht_cap *vht_cap,
2685 			       u32 cap)
2686 {
2687 	__le32 tmp;
2688 
2689 	*pos++ = WLAN_EID_VHT_CAPABILITY;
2690 	*pos++ = sizeof(struct ieee80211_vht_cap);
2691 	memset(pos, 0, sizeof(struct ieee80211_vht_cap));
2692 
2693 	/* capability flags */
2694 	tmp = cpu_to_le32(cap);
2695 	memcpy(pos, &tmp, sizeof(u32));
2696 	pos += sizeof(u32);
2697 
2698 	/* VHT MCS set */
2699 	memcpy(pos, &vht_cap->vht_mcs, sizeof(vht_cap->vht_mcs));
2700 	pos += sizeof(vht_cap->vht_mcs);
2701 
2702 	return pos;
2703 }
2704 
2705 u8 *ieee80211_ie_build_he_cap(u8 *pos,
2706 			      const struct ieee80211_sta_he_cap *he_cap,
2707 			      u8 *end)
2708 {
2709 	u8 n;
2710 	u8 ie_len;
2711 	u8 *orig_pos = pos;
2712 
2713 	/* Make sure we have place for the IE */
2714 	/*
2715 	 * TODO: the 1 added is because this temporarily is under the EXTENSION
2716 	 * IE. Get rid of it when it moves.
2717 	 */
2718 	if (!he_cap)
2719 		return orig_pos;
2720 
2721 	n = ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem);
2722 	ie_len = 2 + 1 +
2723 		 sizeof(he_cap->he_cap_elem) + n +
2724 		 ieee80211_he_ppe_size(he_cap->ppe_thres[0],
2725 				       he_cap->he_cap_elem.phy_cap_info);
2726 
2727 	if ((end - pos) < ie_len)
2728 		return orig_pos;
2729 
2730 	*pos++ = WLAN_EID_EXTENSION;
2731 	pos++; /* We'll set the size later below */
2732 	*pos++ = WLAN_EID_EXT_HE_CAPABILITY;
2733 
2734 	/* Fixed data */
2735 	memcpy(pos, &he_cap->he_cap_elem, sizeof(he_cap->he_cap_elem));
2736 	pos += sizeof(he_cap->he_cap_elem);
2737 
2738 	memcpy(pos, &he_cap->he_mcs_nss_supp, n);
2739 	pos += n;
2740 
2741 	/* Check if PPE Threshold should be present */
2742 	if ((he_cap->he_cap_elem.phy_cap_info[6] &
2743 	     IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) == 0)
2744 		goto end;
2745 
2746 	/*
2747 	 * Calculate how many PPET16/PPET8 pairs are to come. Algorithm:
2748 	 * (NSS_M1 + 1) x (num of 1 bits in RU_INDEX_BITMASK)
2749 	 */
2750 	n = hweight8(he_cap->ppe_thres[0] &
2751 		     IEEE80211_PPE_THRES_RU_INDEX_BITMASK_MASK);
2752 	n *= (1 + ((he_cap->ppe_thres[0] & IEEE80211_PPE_THRES_NSS_MASK) >>
2753 		   IEEE80211_PPE_THRES_NSS_POS));
2754 
2755 	/*
2756 	 * Each pair is 6 bits, and we need to add the 7 "header" bits to the
2757 	 * total size.
2758 	 */
2759 	n = (n * IEEE80211_PPE_THRES_INFO_PPET_SIZE * 2) + 7;
2760 	n = DIV_ROUND_UP(n, 8);
2761 
2762 	/* Copy PPE Thresholds */
2763 	memcpy(pos, &he_cap->ppe_thres, n);
2764 	pos += n;
2765 
2766 end:
2767 	orig_pos[1] = (pos - orig_pos) - 2;
2768 	return pos;
2769 }
2770 
2771 u8 *ieee80211_ie_build_ht_oper(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
2772 			       const struct cfg80211_chan_def *chandef,
2773 			       u16 prot_mode, bool rifs_mode)
2774 {
2775 	struct ieee80211_ht_operation *ht_oper;
2776 	/* Build HT Information */
2777 	*pos++ = WLAN_EID_HT_OPERATION;
2778 	*pos++ = sizeof(struct ieee80211_ht_operation);
2779 	ht_oper = (struct ieee80211_ht_operation *)pos;
2780 	ht_oper->primary_chan = ieee80211_frequency_to_channel(
2781 					chandef->chan->center_freq);
2782 	switch (chandef->width) {
2783 	case NL80211_CHAN_WIDTH_160:
2784 	case NL80211_CHAN_WIDTH_80P80:
2785 	case NL80211_CHAN_WIDTH_80:
2786 	case NL80211_CHAN_WIDTH_40:
2787 		if (chandef->center_freq1 > chandef->chan->center_freq)
2788 			ht_oper->ht_param = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
2789 		else
2790 			ht_oper->ht_param = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
2791 		break;
2792 	default:
2793 		ht_oper->ht_param = IEEE80211_HT_PARAM_CHA_SEC_NONE;
2794 		break;
2795 	}
2796 	if (ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 &&
2797 	    chandef->width != NL80211_CHAN_WIDTH_20_NOHT &&
2798 	    chandef->width != NL80211_CHAN_WIDTH_20)
2799 		ht_oper->ht_param |= IEEE80211_HT_PARAM_CHAN_WIDTH_ANY;
2800 
2801 	if (rifs_mode)
2802 		ht_oper->ht_param |= IEEE80211_HT_PARAM_RIFS_MODE;
2803 
2804 	ht_oper->operation_mode = cpu_to_le16(prot_mode);
2805 	ht_oper->stbc_param = 0x0000;
2806 
2807 	/* It seems that Basic MCS set and Supported MCS set
2808 	   are identical for the first 10 bytes */
2809 	memset(&ht_oper->basic_set, 0, 16);
2810 	memcpy(&ht_oper->basic_set, &ht_cap->mcs, 10);
2811 
2812 	return pos + sizeof(struct ieee80211_ht_operation);
2813 }
2814 
2815 void ieee80211_ie_build_wide_bw_cs(u8 *pos,
2816 				   const struct cfg80211_chan_def *chandef)
2817 {
2818 	*pos++ = WLAN_EID_WIDE_BW_CHANNEL_SWITCH;	/* EID */
2819 	*pos++ = 3;					/* IE length */
2820 	/* New channel width */
2821 	switch (chandef->width) {
2822 	case NL80211_CHAN_WIDTH_80:
2823 		*pos++ = IEEE80211_VHT_CHANWIDTH_80MHZ;
2824 		break;
2825 	case NL80211_CHAN_WIDTH_160:
2826 		*pos++ = IEEE80211_VHT_CHANWIDTH_160MHZ;
2827 		break;
2828 	case NL80211_CHAN_WIDTH_80P80:
2829 		*pos++ = IEEE80211_VHT_CHANWIDTH_80P80MHZ;
2830 		break;
2831 	default:
2832 		*pos++ = IEEE80211_VHT_CHANWIDTH_USE_HT;
2833 	}
2834 
2835 	/* new center frequency segment 0 */
2836 	*pos++ = ieee80211_frequency_to_channel(chandef->center_freq1);
2837 	/* new center frequency segment 1 */
2838 	if (chandef->center_freq2)
2839 		*pos++ = ieee80211_frequency_to_channel(chandef->center_freq2);
2840 	else
2841 		*pos++ = 0;
2842 }
2843 
2844 u8 *ieee80211_ie_build_vht_oper(u8 *pos, struct ieee80211_sta_vht_cap *vht_cap,
2845 				const struct cfg80211_chan_def *chandef)
2846 {
2847 	struct ieee80211_vht_operation *vht_oper;
2848 
2849 	*pos++ = WLAN_EID_VHT_OPERATION;
2850 	*pos++ = sizeof(struct ieee80211_vht_operation);
2851 	vht_oper = (struct ieee80211_vht_operation *)pos;
2852 	vht_oper->center_freq_seg0_idx = ieee80211_frequency_to_channel(
2853 							chandef->center_freq1);
2854 	if (chandef->center_freq2)
2855 		vht_oper->center_freq_seg1_idx =
2856 			ieee80211_frequency_to_channel(chandef->center_freq2);
2857 	else
2858 		vht_oper->center_freq_seg1_idx = 0x00;
2859 
2860 	switch (chandef->width) {
2861 	case NL80211_CHAN_WIDTH_160:
2862 		/*
2863 		 * Convert 160 MHz channel width to new style as interop
2864 		 * workaround.
2865 		 */
2866 		vht_oper->chan_width = IEEE80211_VHT_CHANWIDTH_80MHZ;
2867 		vht_oper->center_freq_seg1_idx = vht_oper->center_freq_seg0_idx;
2868 		if (chandef->chan->center_freq < chandef->center_freq1)
2869 			vht_oper->center_freq_seg0_idx -= 8;
2870 		else
2871 			vht_oper->center_freq_seg0_idx += 8;
2872 		break;
2873 	case NL80211_CHAN_WIDTH_80P80:
2874 		/*
2875 		 * Convert 80+80 MHz channel width to new style as interop
2876 		 * workaround.
2877 		 */
2878 		vht_oper->chan_width = IEEE80211_VHT_CHANWIDTH_80MHZ;
2879 		break;
2880 	case NL80211_CHAN_WIDTH_80:
2881 		vht_oper->chan_width = IEEE80211_VHT_CHANWIDTH_80MHZ;
2882 		break;
2883 	default:
2884 		vht_oper->chan_width = IEEE80211_VHT_CHANWIDTH_USE_HT;
2885 		break;
2886 	}
2887 
2888 	/* don't require special VHT peer rates */
2889 	vht_oper->basic_mcs_set = cpu_to_le16(0xffff);
2890 
2891 	return pos + sizeof(struct ieee80211_vht_operation);
2892 }
2893 
2894 bool ieee80211_chandef_ht_oper(const struct ieee80211_ht_operation *ht_oper,
2895 			       struct cfg80211_chan_def *chandef)
2896 {
2897 	enum nl80211_channel_type channel_type;
2898 
2899 	if (!ht_oper)
2900 		return false;
2901 
2902 	switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
2903 	case IEEE80211_HT_PARAM_CHA_SEC_NONE:
2904 		channel_type = NL80211_CHAN_HT20;
2905 		break;
2906 	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
2907 		channel_type = NL80211_CHAN_HT40PLUS;
2908 		break;
2909 	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
2910 		channel_type = NL80211_CHAN_HT40MINUS;
2911 		break;
2912 	default:
2913 		channel_type = NL80211_CHAN_NO_HT;
2914 		return false;
2915 	}
2916 
2917 	cfg80211_chandef_create(chandef, chandef->chan, channel_type);
2918 	return true;
2919 }
2920 
2921 bool ieee80211_chandef_vht_oper(struct ieee80211_hw *hw,
2922 				const struct ieee80211_vht_operation *oper,
2923 				const struct ieee80211_ht_operation *htop,
2924 				struct cfg80211_chan_def *chandef)
2925 {
2926 	struct cfg80211_chan_def new = *chandef;
2927 	int cf0, cf1;
2928 	int ccfs0, ccfs1, ccfs2;
2929 	int ccf0, ccf1;
2930 
2931 	if (!oper || !htop)
2932 		return false;
2933 
2934 	ccfs0 = oper->center_freq_seg0_idx;
2935 	ccfs1 = oper->center_freq_seg1_idx;
2936 	ccfs2 = (le16_to_cpu(htop->operation_mode) &
2937 				IEEE80211_HT_OP_MODE_CCFS2_MASK)
2938 			>> IEEE80211_HT_OP_MODE_CCFS2_SHIFT;
2939 
2940 	/* when parsing (and we know how to) CCFS1 and CCFS2 are equivalent */
2941 	ccf0 = ccfs0;
2942 	ccf1 = ccfs1;
2943 	if (!ccfs1 && ieee80211_hw_check(hw, SUPPORTS_VHT_EXT_NSS_BW))
2944 		ccf1 = ccfs2;
2945 
2946 	cf0 = ieee80211_channel_to_frequency(ccf0, chandef->chan->band);
2947 	cf1 = ieee80211_channel_to_frequency(ccf1, chandef->chan->band);
2948 
2949 	switch (oper->chan_width) {
2950 	case IEEE80211_VHT_CHANWIDTH_USE_HT:
2951 		/* just use HT information directly */
2952 		break;
2953 	case IEEE80211_VHT_CHANWIDTH_80MHZ:
2954 		new.width = NL80211_CHAN_WIDTH_80;
2955 		new.center_freq1 = cf0;
2956 		/* If needed, adjust based on the newer interop workaround. */
2957 		if (ccf1) {
2958 			unsigned int diff;
2959 
2960 			diff = abs(ccf1 - ccf0);
2961 			if (diff == 8) {
2962 				new.width = NL80211_CHAN_WIDTH_160;
2963 				new.center_freq1 = cf1;
2964 			} else if (diff > 8) {
2965 				new.width = NL80211_CHAN_WIDTH_80P80;
2966 				new.center_freq2 = cf1;
2967 			}
2968 		}
2969 		break;
2970 	case IEEE80211_VHT_CHANWIDTH_160MHZ:
2971 		/* deprecated encoding */
2972 		new.width = NL80211_CHAN_WIDTH_160;
2973 		new.center_freq1 = cf0;
2974 		break;
2975 	case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
2976 		/* deprecated encoding */
2977 		new.width = NL80211_CHAN_WIDTH_80P80;
2978 		new.center_freq1 = cf0;
2979 		new.center_freq2 = cf1;
2980 		break;
2981 	default:
2982 		return false;
2983 	}
2984 
2985 	if (!cfg80211_chandef_valid(&new))
2986 		return false;
2987 
2988 	*chandef = new;
2989 	return true;
2990 }
2991 
2992 int ieee80211_parse_bitrates(struct cfg80211_chan_def *chandef,
2993 			     const struct ieee80211_supported_band *sband,
2994 			     const u8 *srates, int srates_len, u32 *rates)
2995 {
2996 	u32 rate_flags = ieee80211_chandef_rate_flags(chandef);
2997 	int shift = ieee80211_chandef_get_shift(chandef);
2998 	struct ieee80211_rate *br;
2999 	int brate, rate, i, j, count = 0;
3000 
3001 	*rates = 0;
3002 
3003 	for (i = 0; i < srates_len; i++) {
3004 		rate = srates[i] & 0x7f;
3005 
3006 		for (j = 0; j < sband->n_bitrates; j++) {
3007 			br = &sband->bitrates[j];
3008 			if ((rate_flags & br->flags) != rate_flags)
3009 				continue;
3010 
3011 			brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
3012 			if (brate == rate) {
3013 				*rates |= BIT(j);
3014 				count++;
3015 				break;
3016 			}
3017 		}
3018 	}
3019 	return count;
3020 }
3021 
3022 int ieee80211_add_srates_ie(struct ieee80211_sub_if_data *sdata,
3023 			    struct sk_buff *skb, bool need_basic,
3024 			    enum nl80211_band band)
3025 {
3026 	struct ieee80211_local *local = sdata->local;
3027 	struct ieee80211_supported_band *sband;
3028 	int rate, shift;
3029 	u8 i, rates, *pos;
3030 	u32 basic_rates = sdata->vif.bss_conf.basic_rates;
3031 	u32 rate_flags;
3032 
3033 	shift = ieee80211_vif_get_shift(&sdata->vif);
3034 	rate_flags = ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chandef);
3035 	sband = local->hw.wiphy->bands[band];
3036 	rates = 0;
3037 	for (i = 0; i < sband->n_bitrates; i++) {
3038 		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
3039 			continue;
3040 		rates++;
3041 	}
3042 	if (rates > 8)
3043 		rates = 8;
3044 
3045 	if (skb_tailroom(skb) < rates + 2)
3046 		return -ENOMEM;
3047 
3048 	pos = skb_put(skb, rates + 2);
3049 	*pos++ = WLAN_EID_SUPP_RATES;
3050 	*pos++ = rates;
3051 	for (i = 0; i < rates; i++) {
3052 		u8 basic = 0;
3053 		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
3054 			continue;
3055 
3056 		if (need_basic && basic_rates & BIT(i))
3057 			basic = 0x80;
3058 		rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
3059 				    5 * (1 << shift));
3060 		*pos++ = basic | (u8) rate;
3061 	}
3062 
3063 	return 0;
3064 }
3065 
3066 int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
3067 				struct sk_buff *skb, bool need_basic,
3068 				enum nl80211_band band)
3069 {
3070 	struct ieee80211_local *local = sdata->local;
3071 	struct ieee80211_supported_band *sband;
3072 	int rate, shift;
3073 	u8 i, exrates, *pos;
3074 	u32 basic_rates = sdata->vif.bss_conf.basic_rates;
3075 	u32 rate_flags;
3076 
3077 	rate_flags = ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chandef);
3078 	shift = ieee80211_vif_get_shift(&sdata->vif);
3079 
3080 	sband = local->hw.wiphy->bands[band];
3081 	exrates = 0;
3082 	for (i = 0; i < sband->n_bitrates; i++) {
3083 		if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
3084 			continue;
3085 		exrates++;
3086 	}
3087 
3088 	if (exrates > 8)
3089 		exrates -= 8;
3090 	else
3091 		exrates = 0;
3092 
3093 	if (skb_tailroom(skb) < exrates + 2)
3094 		return -ENOMEM;
3095 
3096 	if (exrates) {
3097 		pos = skb_put(skb, exrates + 2);
3098 		*pos++ = WLAN_EID_EXT_SUPP_RATES;
3099 		*pos++ = exrates;
3100 		for (i = 8; i < sband->n_bitrates; i++) {
3101 			u8 basic = 0;
3102 			if ((rate_flags & sband->bitrates[i].flags)
3103 			    != rate_flags)
3104 				continue;
3105 			if (need_basic && basic_rates & BIT(i))
3106 				basic = 0x80;
3107 			rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
3108 					    5 * (1 << shift));
3109 			*pos++ = basic | (u8) rate;
3110 		}
3111 	}
3112 	return 0;
3113 }
3114 
3115 int ieee80211_ave_rssi(struct ieee80211_vif *vif)
3116 {
3117 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3118 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3119 
3120 	if (WARN_ON_ONCE(sdata->vif.type != NL80211_IFTYPE_STATION)) {
3121 		/* non-managed type inferfaces */
3122 		return 0;
3123 	}
3124 	return -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3125 }
3126 EXPORT_SYMBOL_GPL(ieee80211_ave_rssi);
3127 
3128 u8 ieee80211_mcs_to_chains(const struct ieee80211_mcs_info *mcs)
3129 {
3130 	if (!mcs)
3131 		return 1;
3132 
3133 	/* TODO: consider rx_highest */
3134 
3135 	if (mcs->rx_mask[3])
3136 		return 4;
3137 	if (mcs->rx_mask[2])
3138 		return 3;
3139 	if (mcs->rx_mask[1])
3140 		return 2;
3141 	return 1;
3142 }
3143 
3144 /**
3145  * ieee80211_calculate_rx_timestamp - calculate timestamp in frame
3146  * @local: mac80211 hw info struct
3147  * @status: RX status
3148  * @mpdu_len: total MPDU length (including FCS)
3149  * @mpdu_offset: offset into MPDU to calculate timestamp at
3150  *
3151  * This function calculates the RX timestamp at the given MPDU offset, taking
3152  * into account what the RX timestamp was. An offset of 0 will just normalize
3153  * the timestamp to TSF at beginning of MPDU reception.
3154  */
3155 u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
3156 				     struct ieee80211_rx_status *status,
3157 				     unsigned int mpdu_len,
3158 				     unsigned int mpdu_offset)
3159 {
3160 	u64 ts = status->mactime;
3161 	struct rate_info ri;
3162 	u16 rate;
3163 
3164 	if (WARN_ON(!ieee80211_have_rx_timestamp(status)))
3165 		return 0;
3166 
3167 	memset(&ri, 0, sizeof(ri));
3168 
3169 	ri.bw = status->bw;
3170 
3171 	/* Fill cfg80211 rate info */
3172 	switch (status->encoding) {
3173 	case RX_ENC_HT:
3174 		ri.mcs = status->rate_idx;
3175 		ri.flags |= RATE_INFO_FLAGS_MCS;
3176 		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
3177 			ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
3178 		break;
3179 	case RX_ENC_VHT:
3180 		ri.flags |= RATE_INFO_FLAGS_VHT_MCS;
3181 		ri.mcs = status->rate_idx;
3182 		ri.nss = status->nss;
3183 		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
3184 			ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
3185 		break;
3186 	default:
3187 		WARN_ON(1);
3188 		/* fall through */
3189 	case RX_ENC_LEGACY: {
3190 		struct ieee80211_supported_band *sband;
3191 		int shift = 0;
3192 		int bitrate;
3193 
3194 		switch (status->bw) {
3195 		case RATE_INFO_BW_10:
3196 			shift = 1;
3197 			break;
3198 		case RATE_INFO_BW_5:
3199 			shift = 2;
3200 			break;
3201 		}
3202 
3203 		sband = local->hw.wiphy->bands[status->band];
3204 		bitrate = sband->bitrates[status->rate_idx].bitrate;
3205 		ri.legacy = DIV_ROUND_UP(bitrate, (1 << shift));
3206 
3207 		if (status->flag & RX_FLAG_MACTIME_PLCP_START) {
3208 			/* TODO: handle HT/VHT preambles */
3209 			if (status->band == NL80211_BAND_5GHZ) {
3210 				ts += 20 << shift;
3211 				mpdu_offset += 2;
3212 			} else if (status->enc_flags & RX_ENC_FLAG_SHORTPRE) {
3213 				ts += 96;
3214 			} else {
3215 				ts += 192;
3216 			}
3217 		}
3218 		break;
3219 		}
3220 	}
3221 
3222 	rate = cfg80211_calculate_bitrate(&ri);
3223 	if (WARN_ONCE(!rate,
3224 		      "Invalid bitrate: flags=0x%llx, idx=%d, vht_nss=%d\n",
3225 		      (unsigned long long)status->flag, status->rate_idx,
3226 		      status->nss))
3227 		return 0;
3228 
3229 	/* rewind from end of MPDU */
3230 	if (status->flag & RX_FLAG_MACTIME_END)
3231 		ts -= mpdu_len * 8 * 10 / rate;
3232 
3233 	ts += mpdu_offset * 8 * 10 / rate;
3234 
3235 	return ts;
3236 }
3237 
3238 void ieee80211_dfs_cac_cancel(struct ieee80211_local *local)
3239 {
3240 	struct ieee80211_sub_if_data *sdata;
3241 	struct cfg80211_chan_def chandef;
3242 
3243 	/* for interface list, to avoid linking iflist_mtx and chanctx_mtx */
3244 	ASSERT_RTNL();
3245 
3246 	mutex_lock(&local->mtx);
3247 	list_for_each_entry(sdata, &local->interfaces, list) {
3248 		/* it might be waiting for the local->mtx, but then
3249 		 * by the time it gets it, sdata->wdev.cac_started
3250 		 * will no longer be true
3251 		 */
3252 		cancel_delayed_work(&sdata->dfs_cac_timer_work);
3253 
3254 		if (sdata->wdev.cac_started) {
3255 			chandef = sdata->vif.bss_conf.chandef;
3256 			ieee80211_vif_release_channel(sdata);
3257 			cfg80211_cac_event(sdata->dev,
3258 					   &chandef,
3259 					   NL80211_RADAR_CAC_ABORTED,
3260 					   GFP_KERNEL);
3261 		}
3262 	}
3263 	mutex_unlock(&local->mtx);
3264 }
3265 
3266 void ieee80211_dfs_radar_detected_work(struct work_struct *work)
3267 {
3268 	struct ieee80211_local *local =
3269 		container_of(work, struct ieee80211_local, radar_detected_work);
3270 	struct cfg80211_chan_def chandef = local->hw.conf.chandef;
3271 	struct ieee80211_chanctx *ctx;
3272 	int num_chanctx = 0;
3273 
3274 	mutex_lock(&local->chanctx_mtx);
3275 	list_for_each_entry(ctx, &local->chanctx_list, list) {
3276 		if (ctx->replace_state == IEEE80211_CHANCTX_REPLACES_OTHER)
3277 			continue;
3278 
3279 		num_chanctx++;
3280 		chandef = ctx->conf.def;
3281 	}
3282 	mutex_unlock(&local->chanctx_mtx);
3283 
3284 	rtnl_lock();
3285 	ieee80211_dfs_cac_cancel(local);
3286 	rtnl_unlock();
3287 
3288 	if (num_chanctx > 1)
3289 		/* XXX: multi-channel is not supported yet */
3290 		WARN_ON(1);
3291 	else
3292 		cfg80211_radar_event(local->hw.wiphy, &chandef, GFP_KERNEL);
3293 }
3294 
3295 void ieee80211_radar_detected(struct ieee80211_hw *hw)
3296 {
3297 	struct ieee80211_local *local = hw_to_local(hw);
3298 
3299 	trace_api_radar_detected(local);
3300 
3301 	schedule_work(&local->radar_detected_work);
3302 }
3303 EXPORT_SYMBOL(ieee80211_radar_detected);
3304 
3305 u32 ieee80211_chandef_downgrade(struct cfg80211_chan_def *c)
3306 {
3307 	u32 ret;
3308 	int tmp;
3309 
3310 	switch (c->width) {
3311 	case NL80211_CHAN_WIDTH_20:
3312 		c->width = NL80211_CHAN_WIDTH_20_NOHT;
3313 		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
3314 		break;
3315 	case NL80211_CHAN_WIDTH_40:
3316 		c->width = NL80211_CHAN_WIDTH_20;
3317 		c->center_freq1 = c->chan->center_freq;
3318 		ret = IEEE80211_STA_DISABLE_40MHZ |
3319 		      IEEE80211_STA_DISABLE_VHT;
3320 		break;
3321 	case NL80211_CHAN_WIDTH_80:
3322 		tmp = (30 + c->chan->center_freq - c->center_freq1)/20;
3323 		/* n_P40 */
3324 		tmp /= 2;
3325 		/* freq_P40 */
3326 		c->center_freq1 = c->center_freq1 - 20 + 40 * tmp;
3327 		c->width = NL80211_CHAN_WIDTH_40;
3328 		ret = IEEE80211_STA_DISABLE_VHT;
3329 		break;
3330 	case NL80211_CHAN_WIDTH_80P80:
3331 		c->center_freq2 = 0;
3332 		c->width = NL80211_CHAN_WIDTH_80;
3333 		ret = IEEE80211_STA_DISABLE_80P80MHZ |
3334 		      IEEE80211_STA_DISABLE_160MHZ;
3335 		break;
3336 	case NL80211_CHAN_WIDTH_160:
3337 		/* n_P20 */
3338 		tmp = (70 + c->chan->center_freq - c->center_freq1)/20;
3339 		/* n_P80 */
3340 		tmp /= 4;
3341 		c->center_freq1 = c->center_freq1 - 40 + 80 * tmp;
3342 		c->width = NL80211_CHAN_WIDTH_80;
3343 		ret = IEEE80211_STA_DISABLE_80P80MHZ |
3344 		      IEEE80211_STA_DISABLE_160MHZ;
3345 		break;
3346 	default:
3347 	case NL80211_CHAN_WIDTH_20_NOHT:
3348 		WARN_ON_ONCE(1);
3349 		c->width = NL80211_CHAN_WIDTH_20_NOHT;
3350 		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
3351 		break;
3352 	case NL80211_CHAN_WIDTH_5:
3353 	case NL80211_CHAN_WIDTH_10:
3354 		WARN_ON_ONCE(1);
3355 		/* keep c->width */
3356 		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
3357 		break;
3358 	}
3359 
3360 	WARN_ON_ONCE(!cfg80211_chandef_valid(c));
3361 
3362 	return ret;
3363 }
3364 
3365 /*
3366  * Returns true if smps_mode_new is strictly more restrictive than
3367  * smps_mode_old.
3368  */
3369 bool ieee80211_smps_is_restrictive(enum ieee80211_smps_mode smps_mode_old,
3370 				   enum ieee80211_smps_mode smps_mode_new)
3371 {
3372 	if (WARN_ON_ONCE(smps_mode_old == IEEE80211_SMPS_AUTOMATIC ||
3373 			 smps_mode_new == IEEE80211_SMPS_AUTOMATIC))
3374 		return false;
3375 
3376 	switch (smps_mode_old) {
3377 	case IEEE80211_SMPS_STATIC:
3378 		return false;
3379 	case IEEE80211_SMPS_DYNAMIC:
3380 		return smps_mode_new == IEEE80211_SMPS_STATIC;
3381 	case IEEE80211_SMPS_OFF:
3382 		return smps_mode_new != IEEE80211_SMPS_OFF;
3383 	default:
3384 		WARN_ON(1);
3385 	}
3386 
3387 	return false;
3388 }
3389 
3390 int ieee80211_send_action_csa(struct ieee80211_sub_if_data *sdata,
3391 			      struct cfg80211_csa_settings *csa_settings)
3392 {
3393 	struct sk_buff *skb;
3394 	struct ieee80211_mgmt *mgmt;
3395 	struct ieee80211_local *local = sdata->local;
3396 	int freq;
3397 	int hdr_len = offsetofend(struct ieee80211_mgmt,
3398 				  u.action.u.chan_switch);
3399 	u8 *pos;
3400 
3401 	if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3402 	    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
3403 		return -EOPNOTSUPP;
3404 
3405 	skb = dev_alloc_skb(local->tx_headroom + hdr_len +
3406 			    5 + /* channel switch announcement element */
3407 			    3 + /* secondary channel offset element */
3408 			    5 + /* wide bandwidth channel switch announcement */
3409 			    8); /* mesh channel switch parameters element */
3410 	if (!skb)
3411 		return -ENOMEM;
3412 
3413 	skb_reserve(skb, local->tx_headroom);
3414 	mgmt = skb_put_zero(skb, hdr_len);
3415 	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
3416 					  IEEE80211_STYPE_ACTION);
3417 
3418 	eth_broadcast_addr(mgmt->da);
3419 	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
3420 	if (ieee80211_vif_is_mesh(&sdata->vif)) {
3421 		memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
3422 	} else {
3423 		struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
3424 		memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
3425 	}
3426 	mgmt->u.action.category = WLAN_CATEGORY_SPECTRUM_MGMT;
3427 	mgmt->u.action.u.chan_switch.action_code = WLAN_ACTION_SPCT_CHL_SWITCH;
3428 	pos = skb_put(skb, 5);
3429 	*pos++ = WLAN_EID_CHANNEL_SWITCH;			/* EID */
3430 	*pos++ = 3;						/* IE length */
3431 	*pos++ = csa_settings->block_tx ? 1 : 0;		/* CSA mode */
3432 	freq = csa_settings->chandef.chan->center_freq;
3433 	*pos++ = ieee80211_frequency_to_channel(freq);		/* channel */
3434 	*pos++ = csa_settings->count;				/* count */
3435 
3436 	if (csa_settings->chandef.width == NL80211_CHAN_WIDTH_40) {
3437 		enum nl80211_channel_type ch_type;
3438 
3439 		skb_put(skb, 3);
3440 		*pos++ = WLAN_EID_SECONDARY_CHANNEL_OFFSET;	/* EID */
3441 		*pos++ = 1;					/* IE length */
3442 		ch_type = cfg80211_get_chandef_type(&csa_settings->chandef);
3443 		if (ch_type == NL80211_CHAN_HT40PLUS)
3444 			*pos++ = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
3445 		else
3446 			*pos++ = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
3447 	}
3448 
3449 	if (ieee80211_vif_is_mesh(&sdata->vif)) {
3450 		struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
3451 
3452 		skb_put(skb, 8);
3453 		*pos++ = WLAN_EID_CHAN_SWITCH_PARAM;		/* EID */
3454 		*pos++ = 6;					/* IE length */
3455 		*pos++ = sdata->u.mesh.mshcfg.dot11MeshTTL;	/* Mesh TTL */
3456 		*pos = 0x00;	/* Mesh Flag: Tx Restrict, Initiator, Reason */
3457 		*pos |= WLAN_EID_CHAN_SWITCH_PARAM_INITIATOR;
3458 		*pos++ |= csa_settings->block_tx ?
3459 			  WLAN_EID_CHAN_SWITCH_PARAM_TX_RESTRICT : 0x00;
3460 		put_unaligned_le16(WLAN_REASON_MESH_CHAN, pos); /* Reason Cd */
3461 		pos += 2;
3462 		put_unaligned_le16(ifmsh->pre_value, pos);/* Precedence Value */
3463 		pos += 2;
3464 	}
3465 
3466 	if (csa_settings->chandef.width == NL80211_CHAN_WIDTH_80 ||
3467 	    csa_settings->chandef.width == NL80211_CHAN_WIDTH_80P80 ||
3468 	    csa_settings->chandef.width == NL80211_CHAN_WIDTH_160) {
3469 		skb_put(skb, 5);
3470 		ieee80211_ie_build_wide_bw_cs(pos, &csa_settings->chandef);
3471 	}
3472 
3473 	ieee80211_tx_skb(sdata, skb);
3474 	return 0;
3475 }
3476 
3477 bool ieee80211_cs_valid(const struct ieee80211_cipher_scheme *cs)
3478 {
3479 	return !(cs == NULL || cs->cipher == 0 ||
3480 		 cs->hdr_len < cs->pn_len + cs->pn_off ||
3481 		 cs->hdr_len <= cs->key_idx_off ||
3482 		 cs->key_idx_shift > 7 ||
3483 		 cs->key_idx_mask == 0);
3484 }
3485 
3486 bool ieee80211_cs_list_valid(const struct ieee80211_cipher_scheme *cs, int n)
3487 {
3488 	int i;
3489 
3490 	/* Ensure we have enough iftype bitmap space for all iftype values */
3491 	WARN_ON((NUM_NL80211_IFTYPES / 8 + 1) > sizeof(cs[0].iftype));
3492 
3493 	for (i = 0; i < n; i++)
3494 		if (!ieee80211_cs_valid(&cs[i]))
3495 			return false;
3496 
3497 	return true;
3498 }
3499 
3500 const struct ieee80211_cipher_scheme *
3501 ieee80211_cs_get(struct ieee80211_local *local, u32 cipher,
3502 		 enum nl80211_iftype iftype)
3503 {
3504 	const struct ieee80211_cipher_scheme *l = local->hw.cipher_schemes;
3505 	int n = local->hw.n_cipher_schemes;
3506 	int i;
3507 	const struct ieee80211_cipher_scheme *cs = NULL;
3508 
3509 	for (i = 0; i < n; i++) {
3510 		if (l[i].cipher == cipher) {
3511 			cs = &l[i];
3512 			break;
3513 		}
3514 	}
3515 
3516 	if (!cs || !(cs->iftype & BIT(iftype)))
3517 		return NULL;
3518 
3519 	return cs;
3520 }
3521 
3522 int ieee80211_cs_headroom(struct ieee80211_local *local,
3523 			  struct cfg80211_crypto_settings *crypto,
3524 			  enum nl80211_iftype iftype)
3525 {
3526 	const struct ieee80211_cipher_scheme *cs;
3527 	int headroom = IEEE80211_ENCRYPT_HEADROOM;
3528 	int i;
3529 
3530 	for (i = 0; i < crypto->n_ciphers_pairwise; i++) {
3531 		cs = ieee80211_cs_get(local, crypto->ciphers_pairwise[i],
3532 				      iftype);
3533 
3534 		if (cs && headroom < cs->hdr_len)
3535 			headroom = cs->hdr_len;
3536 	}
3537 
3538 	cs = ieee80211_cs_get(local, crypto->cipher_group, iftype);
3539 	if (cs && headroom < cs->hdr_len)
3540 		headroom = cs->hdr_len;
3541 
3542 	return headroom;
3543 }
3544 
3545 static bool
3546 ieee80211_extend_noa_desc(struct ieee80211_noa_data *data, u32 tsf, int i)
3547 {
3548 	s32 end = data->desc[i].start + data->desc[i].duration - (tsf + 1);
3549 	int skip;
3550 
3551 	if (end > 0)
3552 		return false;
3553 
3554 	/* One shot NOA  */
3555 	if (data->count[i] == 1)
3556 		return false;
3557 
3558 	if (data->desc[i].interval == 0)
3559 		return false;
3560 
3561 	/* End time is in the past, check for repetitions */
3562 	skip = DIV_ROUND_UP(-end, data->desc[i].interval);
3563 	if (data->count[i] < 255) {
3564 		if (data->count[i] <= skip) {
3565 			data->count[i] = 0;
3566 			return false;
3567 		}
3568 
3569 		data->count[i] -= skip;
3570 	}
3571 
3572 	data->desc[i].start += skip * data->desc[i].interval;
3573 
3574 	return true;
3575 }
3576 
3577 static bool
3578 ieee80211_extend_absent_time(struct ieee80211_noa_data *data, u32 tsf,
3579 			     s32 *offset)
3580 {
3581 	bool ret = false;
3582 	int i;
3583 
3584 	for (i = 0; i < IEEE80211_P2P_NOA_DESC_MAX; i++) {
3585 		s32 cur;
3586 
3587 		if (!data->count[i])
3588 			continue;
3589 
3590 		if (ieee80211_extend_noa_desc(data, tsf + *offset, i))
3591 			ret = true;
3592 
3593 		cur = data->desc[i].start - tsf;
3594 		if (cur > *offset)
3595 			continue;
3596 
3597 		cur = data->desc[i].start + data->desc[i].duration - tsf;
3598 		if (cur > *offset)
3599 			*offset = cur;
3600 	}
3601 
3602 	return ret;
3603 }
3604 
3605 static u32
3606 ieee80211_get_noa_absent_time(struct ieee80211_noa_data *data, u32 tsf)
3607 {
3608 	s32 offset = 0;
3609 	int tries = 0;
3610 	/*
3611 	 * arbitrary limit, used to avoid infinite loops when combined NoA
3612 	 * descriptors cover the full time period.
3613 	 */
3614 	int max_tries = 5;
3615 
3616 	ieee80211_extend_absent_time(data, tsf, &offset);
3617 	do {
3618 		if (!ieee80211_extend_absent_time(data, tsf, &offset))
3619 			break;
3620 
3621 		tries++;
3622 	} while (tries < max_tries);
3623 
3624 	return offset;
3625 }
3626 
3627 void ieee80211_update_p2p_noa(struct ieee80211_noa_data *data, u32 tsf)
3628 {
3629 	u32 next_offset = BIT(31) - 1;
3630 	int i;
3631 
3632 	data->absent = 0;
3633 	data->has_next_tsf = false;
3634 	for (i = 0; i < IEEE80211_P2P_NOA_DESC_MAX; i++) {
3635 		s32 start;
3636 
3637 		if (!data->count[i])
3638 			continue;
3639 
3640 		ieee80211_extend_noa_desc(data, tsf, i);
3641 		start = data->desc[i].start - tsf;
3642 		if (start <= 0)
3643 			data->absent |= BIT(i);
3644 
3645 		if (next_offset > start)
3646 			next_offset = start;
3647 
3648 		data->has_next_tsf = true;
3649 	}
3650 
3651 	if (data->absent)
3652 		next_offset = ieee80211_get_noa_absent_time(data, tsf);
3653 
3654 	data->next_tsf = tsf + next_offset;
3655 }
3656 EXPORT_SYMBOL(ieee80211_update_p2p_noa);
3657 
3658 int ieee80211_parse_p2p_noa(const struct ieee80211_p2p_noa_attr *attr,
3659 			    struct ieee80211_noa_data *data, u32 tsf)
3660 {
3661 	int ret = 0;
3662 	int i;
3663 
3664 	memset(data, 0, sizeof(*data));
3665 
3666 	for (i = 0; i < IEEE80211_P2P_NOA_DESC_MAX; i++) {
3667 		const struct ieee80211_p2p_noa_desc *desc = &attr->desc[i];
3668 
3669 		if (!desc->count || !desc->duration)
3670 			continue;
3671 
3672 		data->count[i] = desc->count;
3673 		data->desc[i].start = le32_to_cpu(desc->start_time);
3674 		data->desc[i].duration = le32_to_cpu(desc->duration);
3675 		data->desc[i].interval = le32_to_cpu(desc->interval);
3676 
3677 		if (data->count[i] > 1 &&
3678 		    data->desc[i].interval < data->desc[i].duration)
3679 			continue;
3680 
3681 		ieee80211_extend_noa_desc(data, tsf, i);
3682 		ret++;
3683 	}
3684 
3685 	if (ret)
3686 		ieee80211_update_p2p_noa(data, tsf);
3687 
3688 	return ret;
3689 }
3690 EXPORT_SYMBOL(ieee80211_parse_p2p_noa);
3691 
3692 void ieee80211_recalc_dtim(struct ieee80211_local *local,
3693 			   struct ieee80211_sub_if_data *sdata)
3694 {
3695 	u64 tsf = drv_get_tsf(local, sdata);
3696 	u64 dtim_count = 0;
3697 	u16 beacon_int = sdata->vif.bss_conf.beacon_int * 1024;
3698 	u8 dtim_period = sdata->vif.bss_conf.dtim_period;
3699 	struct ps_data *ps;
3700 	u8 bcns_from_dtim;
3701 
3702 	if (tsf == -1ULL || !beacon_int || !dtim_period)
3703 		return;
3704 
3705 	if (sdata->vif.type == NL80211_IFTYPE_AP ||
3706 	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
3707 		if (!sdata->bss)
3708 			return;
3709 
3710 		ps = &sdata->bss->ps;
3711 	} else if (ieee80211_vif_is_mesh(&sdata->vif)) {
3712 		ps = &sdata->u.mesh.ps;
3713 	} else {
3714 		return;
3715 	}
3716 
3717 	/*
3718 	 * actually finds last dtim_count, mac80211 will update in
3719 	 * __beacon_add_tim().
3720 	 * dtim_count = dtim_period - (tsf / bcn_int) % dtim_period
3721 	 */
3722 	do_div(tsf, beacon_int);
3723 	bcns_from_dtim = do_div(tsf, dtim_period);
3724 	/* just had a DTIM */
3725 	if (!bcns_from_dtim)
3726 		dtim_count = 0;
3727 	else
3728 		dtim_count = dtim_period - bcns_from_dtim;
3729 
3730 	ps->dtim_count = dtim_count;
3731 }
3732 
3733 static u8 ieee80211_chanctx_radar_detect(struct ieee80211_local *local,
3734 					 struct ieee80211_chanctx *ctx)
3735 {
3736 	struct ieee80211_sub_if_data *sdata;
3737 	u8 radar_detect = 0;
3738 
3739 	lockdep_assert_held(&local->chanctx_mtx);
3740 
3741 	if (WARN_ON(ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED))
3742 		return 0;
3743 
3744 	list_for_each_entry(sdata, &ctx->reserved_vifs, reserved_chanctx_list)
3745 		if (sdata->reserved_radar_required)
3746 			radar_detect |= BIT(sdata->reserved_chandef.width);
3747 
3748 	/*
3749 	 * An in-place reservation context should not have any assigned vifs
3750 	 * until it replaces the other context.
3751 	 */
3752 	WARN_ON(ctx->replace_state == IEEE80211_CHANCTX_REPLACES_OTHER &&
3753 		!list_empty(&ctx->assigned_vifs));
3754 
3755 	list_for_each_entry(sdata, &ctx->assigned_vifs, assigned_chanctx_list)
3756 		if (sdata->radar_required)
3757 			radar_detect |= BIT(sdata->vif.bss_conf.chandef.width);
3758 
3759 	return radar_detect;
3760 }
3761 
3762 int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
3763 				 const struct cfg80211_chan_def *chandef,
3764 				 enum ieee80211_chanctx_mode chanmode,
3765 				 u8 radar_detect)
3766 {
3767 	struct ieee80211_local *local = sdata->local;
3768 	struct ieee80211_sub_if_data *sdata_iter;
3769 	enum nl80211_iftype iftype = sdata->wdev.iftype;
3770 	struct ieee80211_chanctx *ctx;
3771 	int total = 1;
3772 	struct iface_combination_params params = {
3773 		.radar_detect = radar_detect,
3774 	};
3775 
3776 	lockdep_assert_held(&local->chanctx_mtx);
3777 
3778 	if (WARN_ON(hweight32(radar_detect) > 1))
3779 		return -EINVAL;
3780 
3781 	if (WARN_ON(chandef && chanmode == IEEE80211_CHANCTX_SHARED &&
3782 		    !chandef->chan))
3783 		return -EINVAL;
3784 
3785 	if (WARN_ON(iftype >= NUM_NL80211_IFTYPES))
3786 		return -EINVAL;
3787 
3788 	if (sdata->vif.type == NL80211_IFTYPE_AP ||
3789 	    sdata->vif.type == NL80211_IFTYPE_MESH_POINT) {
3790 		/*
3791 		 * always passing this is harmless, since it'll be the
3792 		 * same value that cfg80211 finds if it finds the same
3793 		 * interface ... and that's always allowed
3794 		 */
3795 		params.new_beacon_int = sdata->vif.bss_conf.beacon_int;
3796 	}
3797 
3798 	/* Always allow software iftypes */
3799 	if (local->hw.wiphy->software_iftypes & BIT(iftype) ||
3800 	    (iftype == NL80211_IFTYPE_AP_VLAN &&
3801 	     local->hw.wiphy->flags & WIPHY_FLAG_4ADDR_AP)) {
3802 		if (radar_detect)
3803 			return -EINVAL;
3804 		return 0;
3805 	}
3806 
3807 	if (chandef)
3808 		params.num_different_channels = 1;
3809 
3810 	if (iftype != NL80211_IFTYPE_UNSPECIFIED)
3811 		params.iftype_num[iftype] = 1;
3812 
3813 	list_for_each_entry(ctx, &local->chanctx_list, list) {
3814 		if (ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
3815 			continue;
3816 		params.radar_detect |=
3817 			ieee80211_chanctx_radar_detect(local, ctx);
3818 		if (ctx->mode == IEEE80211_CHANCTX_EXCLUSIVE) {
3819 			params.num_different_channels++;
3820 			continue;
3821 		}
3822 		if (chandef && chanmode == IEEE80211_CHANCTX_SHARED &&
3823 		    cfg80211_chandef_compatible(chandef,
3824 						&ctx->conf.def))
3825 			continue;
3826 		params.num_different_channels++;
3827 	}
3828 
3829 	list_for_each_entry_rcu(sdata_iter, &local->interfaces, list) {
3830 		struct wireless_dev *wdev_iter;
3831 
3832 		wdev_iter = &sdata_iter->wdev;
3833 
3834 		if (sdata_iter == sdata ||
3835 		    !ieee80211_sdata_running(sdata_iter) ||
3836 		    local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype))
3837 			continue;
3838 
3839 		params.iftype_num[wdev_iter->iftype]++;
3840 		total++;
3841 	}
3842 
3843 	if (total == 1 && !params.radar_detect)
3844 		return 0;
3845 
3846 	return cfg80211_check_combinations(local->hw.wiphy, &params);
3847 }
3848 
3849 static void
3850 ieee80211_iter_max_chans(const struct ieee80211_iface_combination *c,
3851 			 void *data)
3852 {
3853 	u32 *max_num_different_channels = data;
3854 
3855 	*max_num_different_channels = max(*max_num_different_channels,
3856 					  c->num_different_channels);
3857 }
3858 
3859 int ieee80211_max_num_channels(struct ieee80211_local *local)
3860 {
3861 	struct ieee80211_sub_if_data *sdata;
3862 	struct ieee80211_chanctx *ctx;
3863 	u32 max_num_different_channels = 1;
3864 	int err;
3865 	struct iface_combination_params params = {0};
3866 
3867 	lockdep_assert_held(&local->chanctx_mtx);
3868 
3869 	list_for_each_entry(ctx, &local->chanctx_list, list) {
3870 		if (ctx->replace_state == IEEE80211_CHANCTX_WILL_BE_REPLACED)
3871 			continue;
3872 
3873 		params.num_different_channels++;
3874 
3875 		params.radar_detect |=
3876 			ieee80211_chanctx_radar_detect(local, ctx);
3877 	}
3878 
3879 	list_for_each_entry_rcu(sdata, &local->interfaces, list)
3880 		params.iftype_num[sdata->wdev.iftype]++;
3881 
3882 	err = cfg80211_iter_combinations(local->hw.wiphy, &params,
3883 					 ieee80211_iter_max_chans,
3884 					 &max_num_different_channels);
3885 	if (err < 0)
3886 		return err;
3887 
3888 	return max_num_different_channels;
3889 }
3890 
3891 u8 *ieee80211_add_wmm_info_ie(u8 *buf, u8 qosinfo)
3892 {
3893 	*buf++ = WLAN_EID_VENDOR_SPECIFIC;
3894 	*buf++ = 7; /* len */
3895 	*buf++ = 0x00; /* Microsoft OUI 00:50:F2 */
3896 	*buf++ = 0x50;
3897 	*buf++ = 0xf2;
3898 	*buf++ = 2; /* WME */
3899 	*buf++ = 0; /* WME info */
3900 	*buf++ = 1; /* WME ver */
3901 	*buf++ = qosinfo; /* U-APSD no in use */
3902 
3903 	return buf;
3904 }
3905 
3906 void ieee80211_txq_get_depth(struct ieee80211_txq *txq,
3907 			     unsigned long *frame_cnt,
3908 			     unsigned long *byte_cnt)
3909 {
3910 	struct txq_info *txqi = to_txq_info(txq);
3911 	u32 frag_cnt = 0, frag_bytes = 0;
3912 	struct sk_buff *skb;
3913 
3914 	skb_queue_walk(&txqi->frags, skb) {
3915 		frag_cnt++;
3916 		frag_bytes += skb->len;
3917 	}
3918 
3919 	if (frame_cnt)
3920 		*frame_cnt = txqi->tin.backlog_packets + frag_cnt;
3921 
3922 	if (byte_cnt)
3923 		*byte_cnt = txqi->tin.backlog_bytes + frag_bytes;
3924 }
3925 EXPORT_SYMBOL(ieee80211_txq_get_depth);
3926 
3927 const u8 ieee80211_ac_to_qos_mask[IEEE80211_NUM_ACS] = {
3928 	IEEE80211_WMM_IE_STA_QOSINFO_AC_VO,
3929 	IEEE80211_WMM_IE_STA_QOSINFO_AC_VI,
3930 	IEEE80211_WMM_IE_STA_QOSINFO_AC_BE,
3931 	IEEE80211_WMM_IE_STA_QOSINFO_AC_BK
3932 };
3933