1	// SPDX-License-Identifier: GPL-2.0
2	/*
3	* Wireless utility functions
4	*
5	* Copyright 2007-2009 Johannes Berg <johannes@sipsolutions.net>
6	* Copyright 2013-2014 Intel Mobile Communications GmbH
7	* Copyright 2017 Intel Deutschland GmbH
8	* Copyright (C) 2018-2023 Intel Corporation
9	*/
10	#include <linux/export.h>
11	#include <linux/bitops.h>
12	#include <linux/etherdevice.h>
13	#include <linux/slab.h>
14	#include <linux/ieee80211.h>
15	#include <net/cfg80211.h>
16	#include <net/ip.h>
17	#include <net/dsfield.h>
18	#include <linux/if_vlan.h>
19	#include <linux/mpls.h>
20	#include <linux/gcd.h>
21	#include <linux/bitfield.h>
22	#include <linux/nospec.h>
23	#include "core.h"
24	#include "rdev-ops.h"
25
26
27	const struct ieee80211_rate *
28	ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
29	u32 basic_rates, int bitrate)
30	{
31	struct ieee80211_rate *result = &sband->bitrates[0];
32	int i;
33
34	for (i = 0; i < sband->n_bitrates; i++) {
35	if (!(basic_rates & BIT(i)))
36	continue;
37	if (sband->bitrates[i].bitrate > bitrate)
38	continue;
39	result = &sband->bitrates[i];
40	}
41
42	return result;
43	}
44	EXPORT_SYMBOL(ieee80211_get_response_rate);
45
46	u32 ieee80211_mandatory_rates(struct ieee80211_supported_band *sband)
47	{
48	struct ieee80211_rate *bitrates;
49	u32 mandatory_rates = 0;
50	enum ieee80211_rate_flags mandatory_flag;
51	int i;
52
53	if (WARN_ON(!sband))
54	return 1;
55
56	if (sband->band == NL80211_BAND_2GHZ)
57	mandatory_flag = IEEE80211_RATE_MANDATORY_B;
58	else
59	mandatory_flag = IEEE80211_RATE_MANDATORY_A;
60
61	bitrates = sband->bitrates;
62	for (i = 0; i < sband->n_bitrates; i++)
63	if (bitrates[i].flags & mandatory_flag)
64	mandatory_rates |= BIT(i);
65	return mandatory_rates;
66	}
67	EXPORT_SYMBOL(ieee80211_mandatory_rates);
68
69	u32 ieee80211_channel_to_freq_khz(int chan, enum nl80211_band band)
70	{
71	/* see 802.11 17.3.8.3.2 and Annex J
72	* there are overlapping channel numbers in 5GHz and 2GHz bands */
73	if (chan <= 0)
74	return 0; /* not supported */
75	switch (band) {
76	case NL80211_BAND_2GHZ:
77	case NL80211_BAND_LC:
78	if (chan == 14)
79	return MHZ_TO_KHZ(2484);
80	else if (chan < 14)
81	return MHZ_TO_KHZ(2407 + chan * 5);
82	break;
83	case NL80211_BAND_5GHZ:
84	if (chan >= 182 && chan <= 196)
85	return MHZ_TO_KHZ(4000 + chan * 5);
86	else
87	return MHZ_TO_KHZ(5000 + chan * 5);
88	break;
89	case NL80211_BAND_6GHZ:
90	/* see 802.11ax D6.1 27.3.23.2 */
91	if (chan == 2)
92	return MHZ_TO_KHZ(5935);
93	if (chan <= 233)
94	return MHZ_TO_KHZ(5950 + chan * 5);
95	break;
96	case NL80211_BAND_60GHZ:
97	if (chan < 7)
98	return MHZ_TO_KHZ(56160 + chan * 2160);
99	break;
100	case NL80211_BAND_S1GHZ:
101	return 902000 + chan * 500;
102	default:
103	;
104	}
105	return 0; /* not supported */
106	}
107	EXPORT_SYMBOL(ieee80211_channel_to_freq_khz);
108
109	enum nl80211_chan_width
110	ieee80211_s1g_channel_width(const struct ieee80211_channel *chan)
111	{
112	if (WARN_ON(!chan || chan->band != NL80211_BAND_S1GHZ))
113	return NL80211_CHAN_WIDTH_20_NOHT;
114
115	/*S1G defines a single allowed channel width per channel.
116	* Extract that width here.
117	*/
118	if (chan->flags & IEEE80211_CHAN_1MHZ)
119	return NL80211_CHAN_WIDTH_1;
120	else if (chan->flags & IEEE80211_CHAN_2MHZ)
121	return NL80211_CHAN_WIDTH_2;
122	else if (chan->flags & IEEE80211_CHAN_4MHZ)
123	return NL80211_CHAN_WIDTH_4;
124	else if (chan->flags & IEEE80211_CHAN_8MHZ)
125	return NL80211_CHAN_WIDTH_8;
126	else if (chan->flags & IEEE80211_CHAN_16MHZ)
127	return NL80211_CHAN_WIDTH_16;
128
129	pr_err("unknown channel width for channel at %dKHz?\n",
130	ieee80211_channel_to_khz(chan));
131
132	return NL80211_CHAN_WIDTH_1;
133	}
134	EXPORT_SYMBOL(ieee80211_s1g_channel_width);
135
136	int ieee80211_freq_khz_to_channel(u32 freq)
137	{
138	/* TODO: just handle MHz for now */
139	freq = KHZ_TO_MHZ(freq);
140
141	/* see 802.11 17.3.8.3.2 and Annex J */
142	if (freq == 2484)
143	return 14;
144	else if (freq < 2484)
145	return (freq - 2407) / 5;
146	else if (freq >= 4910 && freq <= 4980)
147	return (freq - 4000) / 5;
148	else if (freq < 5925)
149	return (freq - 5000) / 5;
150	else if (freq == 5935)
151	return 2;
152	else if (freq <= 45000) /* DMG band lower limit */
153	/* see 802.11ax D6.1 27.3.22.2 */
154	return (freq - 5950) / 5;
155	else if (freq >= 58320 && freq <= 70200)
156	return (freq - 56160) / 2160;
157	else
158	return 0;
159	}
160	EXPORT_SYMBOL(ieee80211_freq_khz_to_channel);
161
162	struct ieee80211_channel *ieee80211_get_channel_khz(struct wiphy *wiphy,
163	u32 freq)
164	{
165	enum nl80211_band band;
166	struct ieee80211_supported_band *sband;
167	int i;
168
169	for (band = 0; band < NUM_NL80211_BANDS; band++) {
170	sband = wiphy->bands[band];
171
172	if (!sband)
173	continue;
174
175	for (i = 0; i < sband->n_channels; i++) {
176	struct ieee80211_channel *chan = &sband->channels[i];
177
178	if (ieee80211_channel_to_khz(chan) == freq)
179	return chan;
180	}
181	}
182
183	return NULL;
184	}
185	EXPORT_SYMBOL(ieee80211_get_channel_khz);
186
187	static void set_mandatory_flags_band(struct ieee80211_supported_band *sband)
188	{
189	int i, want;
190
191	switch (sband->band) {
192	case NL80211_BAND_5GHZ:
193	case NL80211_BAND_6GHZ:
194	want = 3;
195	for (i = 0; i < sband->n_bitrates; i++) {
196	if (sband->bitrates[i].bitrate == 60 ||
197	sband->bitrates[i].bitrate == 120 ||
198	sband->bitrates[i].bitrate == 240) {
199	sband->bitrates[i].flags |=
200	IEEE80211_RATE_MANDATORY_A;
201	want--;
202	}
203	}
204	WARN_ON(want);
205	break;
206	case NL80211_BAND_2GHZ:
207	case NL80211_BAND_LC:
208	want = 7;
209	for (i = 0; i < sband->n_bitrates; i++) {
210	switch (sband->bitrates[i].bitrate) {
211	case 10:
212	case 20:
213	case 55:
214	case 110:
215	sband->bitrates[i].flags |=
216	IEEE80211_RATE_MANDATORY_B |
217	IEEE80211_RATE_MANDATORY_G;
218	want--;
219	break;
220	case 60:
221	case 120:
222	case 240:
223	sband->bitrates[i].flags |=
224	IEEE80211_RATE_MANDATORY_G;
225	want--;
226	fallthrough;
227	default:
228	sband->bitrates[i].flags |=
229	IEEE80211_RATE_ERP_G;
230	break;
231	}
232	}
233	WARN_ON(want != 0 && want != 3);
234	break;
235	case NL80211_BAND_60GHZ:
236	/* check for mandatory HT MCS 1..4 */
237	WARN_ON(!sband->ht_cap.ht_supported);
238	WARN_ON((sband->ht_cap.mcs.rx_mask[0] & 0x1e) != 0x1e);
239	break;
240	case NL80211_BAND_S1GHZ:
241	/* Figure 9-589bd: 3 means unsupported, so != 3 means at least
242	* mandatory is ok.
243	*/
244	WARN_ON((sband->s1g_cap.nss_mcs[0] & 0x3) == 0x3);
245	break;
246	case NUM_NL80211_BANDS:
247	default:
248	WARN_ON(1);
249	break;
250	}
251	}
252
253	void ieee80211_set_bitrate_flags(struct wiphy *wiphy)
254	{
255	enum nl80211_band band;
256
257	for (band = 0; band < NUM_NL80211_BANDS; band++)
258	if (wiphy->bands[band])
259	set_mandatory_flags_band(wiphy->bands[band]);
260	}
261
262	bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher)
263	{
264	int i;
265	for (i = 0; i < wiphy->n_cipher_suites; i++)
266	if (cipher == wiphy->cipher_suites[i])
267	return true;
268	return false;
269	}
270
271	static bool
272	cfg80211_igtk_cipher_supported(struct cfg80211_registered_device *rdev)
273	{
274	struct wiphy *wiphy = &rdev->wiphy;
275	int i;
276
277	for (i = 0; i < wiphy->n_cipher_suites; i++) {
278	switch (wiphy->cipher_suites[i]) {
279	case WLAN_CIPHER_SUITE_AES_CMAC:
280	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
281	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
282	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
283	return true;
284	}
285	}
286
287	return false;
288	}
289
290	bool cfg80211_valid_key_idx(struct cfg80211_registered_device *rdev,
291	int key_idx, bool pairwise)
292	{
293	int max_key_idx;
294
295	if (pairwise)
296	max_key_idx = 3;
297	else if (wiphy_ext_feature_isset(wiphy: &rdev->wiphy,
298	ftidx: NL80211_EXT_FEATURE_BEACON_PROTECTION) ||
299	wiphy_ext_feature_isset(wiphy: &rdev->wiphy,
300	ftidx: NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
301	max_key_idx = 7;
302	else if (cfg80211_igtk_cipher_supported(rdev))
303	max_key_idx = 5;
304	else
305	max_key_idx = 3;
306
307	if (key_idx < 0 || key_idx > max_key_idx)
308	return false;
309
310	return true;
311	}
312
313	int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
314	struct key_params *params, int key_idx,
315	bool pairwise, const u8 *mac_addr)
316	{
317	if (!cfg80211_valid_key_idx(rdev, key_idx, pairwise))
318	return -EINVAL;
319
320	if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
321	return -EINVAL;
322
323	if (pairwise && !mac_addr)
324	return -EINVAL;
325
326	switch (params->cipher) {
327	case WLAN_CIPHER_SUITE_TKIP:
328	/* Extended Key ID can only be used with CCMP/GCMP ciphers */
329	if ((pairwise && key_idx) ||
330	params->mode != NL80211_KEY_RX_TX)
331	return -EINVAL;
332	break;
333	case WLAN_CIPHER_SUITE_CCMP:
334	case WLAN_CIPHER_SUITE_CCMP_256:
335	case WLAN_CIPHER_SUITE_GCMP:
336	case WLAN_CIPHER_SUITE_GCMP_256:
337	/* IEEE802.11-2016 allows only 0 and - when supporting
338	* Extended Key ID - 1 as index for pairwise keys.
339	* @NL80211_KEY_NO_TX is only allowed for pairwise keys when
340	* the driver supports Extended Key ID.
341	* @NL80211_KEY_SET_TX can't be set when installing and
342	* validating a key.
343	*/
344	if ((params->mode == NL80211_KEY_NO_TX && !pairwise) ||
345	params->mode == NL80211_KEY_SET_TX)
346	return -EINVAL;
347	if (wiphy_ext_feature_isset(wiphy: &rdev->wiphy,
348	ftidx: NL80211_EXT_FEATURE_EXT_KEY_ID)) {
349	if (pairwise && (key_idx < 0 || key_idx > 1))
350	return -EINVAL;
351	} else if (pairwise && key_idx) {
352	return -EINVAL;
353	}
354	break;
355	case WLAN_CIPHER_SUITE_AES_CMAC:
356	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
357	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
358	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
359	/* Disallow BIP (group-only) cipher as pairwise cipher */
360	if (pairwise)
361	return -EINVAL;
362	if (key_idx < 4)
363	return -EINVAL;
364	break;
365	case WLAN_CIPHER_SUITE_WEP40:
366	case WLAN_CIPHER_SUITE_WEP104:
367	if (key_idx > 3)
368	return -EINVAL;
369	break;
370	default:
371	break;
372	}
373
374	switch (params->cipher) {
375	case WLAN_CIPHER_SUITE_WEP40:
376	if (params->key_len != WLAN_KEY_LEN_WEP40)
377	return -EINVAL;
378	break;
379	case WLAN_CIPHER_SUITE_TKIP:
380	if (params->key_len != WLAN_KEY_LEN_TKIP)
381	return -EINVAL;
382	break;
383	case WLAN_CIPHER_SUITE_CCMP:
384	if (params->key_len != WLAN_KEY_LEN_CCMP)
385	return -EINVAL;
386	break;
387	case WLAN_CIPHER_SUITE_CCMP_256:
388	if (params->key_len != WLAN_KEY_LEN_CCMP_256)
389	return -EINVAL;
390	break;
391	case WLAN_CIPHER_SUITE_GCMP:
392	if (params->key_len != WLAN_KEY_LEN_GCMP)
393	return -EINVAL;
394	break;
395	case WLAN_CIPHER_SUITE_GCMP_256:
396	if (params->key_len != WLAN_KEY_LEN_GCMP_256)
397	return -EINVAL;
398	break;
399	case WLAN_CIPHER_SUITE_WEP104:
400	if (params->key_len != WLAN_KEY_LEN_WEP104)
401	return -EINVAL;
402	break;
403	case WLAN_CIPHER_SUITE_AES_CMAC:
404	if (params->key_len != WLAN_KEY_LEN_AES_CMAC)
405	return -EINVAL;
406	break;
407	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
408	if (params->key_len != WLAN_KEY_LEN_BIP_CMAC_256)
409	return -EINVAL;
410	break;
411	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
412	if (params->key_len != WLAN_KEY_LEN_BIP_GMAC_128)
413	return -EINVAL;
414	break;
415	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
416	if (params->key_len != WLAN_KEY_LEN_BIP_GMAC_256)
417	return -EINVAL;
418	break;
419	default:
420	/*
421	* We don't know anything about this algorithm,
422	* allow using it -- but the driver must check
423	* all parameters! We still check below whether
424	* or not the driver supports this algorithm,
425	* of course.
426	*/
427	break;
428	}
429
430	if (params->seq) {
431	switch (params->cipher) {
432	case WLAN_CIPHER_SUITE_WEP40:
433	case WLAN_CIPHER_SUITE_WEP104:
434	/* These ciphers do not use key sequence */
435	return -EINVAL;
436	case WLAN_CIPHER_SUITE_TKIP:
437	case WLAN_CIPHER_SUITE_CCMP:
438	case WLAN_CIPHER_SUITE_CCMP_256:
439	case WLAN_CIPHER_SUITE_GCMP:
440	case WLAN_CIPHER_SUITE_GCMP_256:
441	case WLAN_CIPHER_SUITE_AES_CMAC:
442	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
443	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
444	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
445	if (params->seq_len != 6)
446	return -EINVAL;
447	break;
448	}
449	}
450
451	if (!cfg80211_supported_cipher_suite(wiphy: &rdev->wiphy, cipher: params->cipher))
452	return -EINVAL;
453
454	return 0;
455	}
456
457	unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc)
458	{
459	unsigned int hdrlen = 24;
460
461	if (ieee80211_is_ext(fc)) {
462	hdrlen = 4;
463	goto out;
464	}
465
466	if (ieee80211_is_data(fc)) {
467	if (ieee80211_has_a4(fc))
468	hdrlen = 30;
469	if (ieee80211_is_data_qos(fc)) {
470	hdrlen += IEEE80211_QOS_CTL_LEN;
471	if (ieee80211_has_order(fc))
472	hdrlen += IEEE80211_HT_CTL_LEN;
473	}
474	goto out;
475	}
476
477	if (ieee80211_is_mgmt(fc)) {
478	if (ieee80211_has_order(fc))
479	hdrlen += IEEE80211_HT_CTL_LEN;
480	goto out;
481	}
482
483	if (ieee80211_is_ctl(fc)) {
484	/*
485	* ACK and CTS are 10 bytes, all others 16. To see how
486	* to get this condition consider
487	* subtype mask: 0b0000000011110000 (0x00F0)
488	* ACK subtype: 0b0000000011010000 (0x00D0)
489	* CTS subtype: 0b0000000011000000 (0x00C0)
490	* bits that matter: ^^^ (0x00E0)
491	* value of those: 0b0000000011000000 (0x00C0)
492	*/
493	if ((fc & cpu_to_le16(0x00E0)) == cpu_to_le16(0x00C0))
494	hdrlen = 10;
495	else
496	hdrlen = 16;
497	}
498	out:
499	return hdrlen;
500	}
501	EXPORT_SYMBOL(ieee80211_hdrlen);
502
503	unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb)
504	{
505	const struct ieee80211_hdr *hdr =
506	(const struct ieee80211_hdr *)skb->data;
507	unsigned int hdrlen;
508
509	if (unlikely(skb->len < 10))
510	return 0;
511	hdrlen = ieee80211_hdrlen(hdr->frame_control);
512	if (unlikely(hdrlen > skb->len))
513	return 0;
514	return hdrlen;
515	}
516	EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
517
518	static unsigned int __ieee80211_get_mesh_hdrlen(u8 flags)
519	{
520	int ae = flags & MESH_FLAGS_AE;
521	/* 802.11-2012, 8.2.4.7.3 */
522	switch (ae) {
523	default:
524	case 0:
525	return 6;
526	case MESH_FLAGS_AE_A4:
527	return 12;
528	case MESH_FLAGS_AE_A5_A6:
529	return 18;
530	}
531	}
532
533	unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
534	{
535	return __ieee80211_get_mesh_hdrlen(flags: meshhdr->flags);
536	}
537	EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
538
539	bool ieee80211_get_8023_tunnel_proto(const void *hdr, __be16 *proto)
540	{
541	const __be16 *hdr_proto = hdr + ETH_ALEN;
542
543	if (!(ether_addr_equal(addr1: hdr, addr2: rfc1042_header) &&
544	*hdr_proto != htons(ETH_P_AARP) &&
545	*hdr_proto != htons(ETH_P_IPX)) &&
546	!ether_addr_equal(addr1: hdr, addr2: bridge_tunnel_header))
547	return false;
548
549	*proto = *hdr_proto;
550
551	return true;
552	}
553	EXPORT_SYMBOL(ieee80211_get_8023_tunnel_proto);
554
555	int ieee80211_strip_8023_mesh_hdr(struct sk_buff *skb)
556	{
557	const void *mesh_addr;
558	struct {
559	struct ethhdr eth;
560	u8 flags;
561	} payload;
562	int hdrlen;
563	int ret;
564
565	ret = skb_copy_bits(skb, offset: 0, to: &payload, len: sizeof(payload));
566	if (ret)
567	return ret;
568
569	hdrlen = sizeof(payload.eth) + __ieee80211_get_mesh_hdrlen(flags: payload.flags);
570
571	if (likely(pskb_may_pull(skb, hdrlen + 8) &&
572	ieee80211_get_8023_tunnel_proto(skb->data + hdrlen,
573	&payload.eth.h_proto)))
574	hdrlen += ETH_ALEN + 2;
575	else if (!pskb_may_pull(skb, len: hdrlen))
576	return -EINVAL;
577	else
578	payload.eth.h_proto = htons(skb->len - hdrlen);
579
580	mesh_addr = skb->data + sizeof(payload.eth) + ETH_ALEN;
581	switch (payload.flags & MESH_FLAGS_AE) {
582	case MESH_FLAGS_AE_A4:
583	memcpy(&payload.eth.h_source, mesh_addr, ETH_ALEN);
584	break;
585	case MESH_FLAGS_AE_A5_A6:
586	memcpy(&payload.eth, mesh_addr, 2 * ETH_ALEN);
587	break;
588	default:
589	break;
590	}
591
592	pskb_pull(skb, len: hdrlen - sizeof(payload.eth));
593	memcpy(skb->data, &payload.eth, sizeof(payload.eth));
594
595	return 0;
596	}
597	EXPORT_SYMBOL(ieee80211_strip_8023_mesh_hdr);
598
599	int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
600	const u8 *addr, enum nl80211_iftype iftype,
601	u8 data_offset, bool is_amsdu)
602	{
603	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
604	struct {
605	u8 hdr[ETH_ALEN] __aligned(2);
606	__be16 proto;
607	} payload;
608	struct ethhdr tmp;
609	u16 hdrlen;
610
611	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
612	return -1;
613
614	hdrlen = ieee80211_hdrlen(hdr->frame_control) + data_offset;
615	if (skb->len < hdrlen)
616	return -1;
617
618	/* convert IEEE 802.11 header + possible LLC headers into Ethernet
619	* header
620	* IEEE 802.11 address fields:
621	* ToDS FromDS Addr1 Addr2 Addr3 Addr4
622	* 0 0 DA SA BSSID n/a
623	* 0 1 DA BSSID SA n/a
624	* 1 0 BSSID SA DA n/a
625	* 1 1 RA TA DA SA
626	*/
627	memcpy(tmp.h_dest, ieee80211_get_DA(hdr), ETH_ALEN);
628	memcpy(tmp.h_source, ieee80211_get_SA(hdr), ETH_ALEN);
629
630	switch (hdr->frame_control &
631	cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
632	case cpu_to_le16(IEEE80211_FCTL_TODS):
633	if (unlikely(iftype != NL80211_IFTYPE_AP &&
634	iftype != NL80211_IFTYPE_AP_VLAN &&
635	iftype != NL80211_IFTYPE_P2P_GO))
636	return -1;
637	break;
638	case cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
639	if (unlikely(iftype != NL80211_IFTYPE_MESH_POINT &&
640	iftype != NL80211_IFTYPE_AP_VLAN &&
641	iftype != NL80211_IFTYPE_STATION))
642	return -1;
643	break;
644	case cpu_to_le16(IEEE80211_FCTL_FROMDS):
645	if ((iftype != NL80211_IFTYPE_STATION &&
646	iftype != NL80211_IFTYPE_P2P_CLIENT &&
647	iftype != NL80211_IFTYPE_MESH_POINT) ||
648	(is_multicast_ether_addr(addr: tmp.h_dest) &&
649	ether_addr_equal(addr1: tmp.h_source, addr2: addr)))
650	return -1;
651	break;
652	case cpu_to_le16(0):
653	if (iftype != NL80211_IFTYPE_ADHOC &&
654	iftype != NL80211_IFTYPE_STATION &&
655	iftype != NL80211_IFTYPE_OCB)
656	return -1;
657	break;
658	}
659
660	if (likely(!is_amsdu && iftype != NL80211_IFTYPE_MESH_POINT &&
661	skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
662	ieee80211_get_8023_tunnel_proto(&payload, &tmp.h_proto))) {
663	/* remove RFC1042 or Bridge-Tunnel encapsulation */
664	hdrlen += ETH_ALEN + 2;
665	skb_postpull_rcsum(skb, start: &payload, ETH_ALEN + 2);
666	} else {
667	tmp.h_proto = htons(skb->len - hdrlen);
668	}
669
670	pskb_pull(skb, len: hdrlen);
671
672	if (!ehdr)
673	ehdr = skb_push(skb, len: sizeof(struct ethhdr));
674	memcpy(ehdr, &tmp, sizeof(tmp));
675
676	return 0;
677	}
678	EXPORT_SYMBOL(ieee80211_data_to_8023_exthdr);
679
680	static void
681	__frame_add_frag(struct sk_buff *skb, struct page *page,
682	void *ptr, int len, int size)
683	{
684	struct skb_shared_info *sh = skb_shinfo(skb);
685	int page_offset;
686
687	get_page(page);
688	page_offset = ptr - page_address(page);
689	skb_add_rx_frag(skb, i: sh->nr_frags, page, off: page_offset, size: len, truesize: size);
690	}
691
692	static void
693	__ieee80211_amsdu_copy_frag(struct sk_buff *skb, struct sk_buff *frame,
694	int offset, int len)
695	{
696	struct skb_shared_info *sh = skb_shinfo(skb);
697	const skb_frag_t *frag = &sh->frags[0];
698	struct page *frag_page;
699	void *frag_ptr;
700	int frag_len, frag_size;
701	int head_size = skb->len - skb->data_len;
702	int cur_len;
703
704	frag_page = virt_to_head_page(x: skb->head);
705	frag_ptr = skb->data;
706	frag_size = head_size;
707
708	while (offset >= frag_size) {
709	offset -= frag_size;
710	frag_page = skb_frag_page(frag);
711	frag_ptr = skb_frag_address(frag);
712	frag_size = skb_frag_size(frag);
713	frag++;
714	}
715
716	frag_ptr += offset;
717	frag_len = frag_size - offset;
718
719	cur_len = min(len, frag_len);
720
721	__frame_add_frag(skb: frame, page: frag_page, ptr: frag_ptr, len: cur_len, size: frag_size);
722	len -= cur_len;
723
724	while (len > 0) {
725	frag_len = skb_frag_size(frag);
726	cur_len = min(len, frag_len);
727	__frame_add_frag(skb: frame, page: skb_frag_page(frag),
728	ptr: skb_frag_address(frag), len: cur_len, size: frag_len);
729	len -= cur_len;
730	frag++;
731	}
732	}
733
734	static struct sk_buff *
735	__ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen,
736	int offset, int len, bool reuse_frag,
737	int min_len)
738	{
739	struct sk_buff *frame;
740	int cur_len = len;
741
742	if (skb->len - offset < len)
743	return NULL;
744
745	/*
746	* When reusing framents, copy some data to the head to simplify
747	* ethernet header handling and speed up protocol header processing
748	* in the stack later.
749	*/
750	if (reuse_frag)
751	cur_len = min_t(int, len, min_len);
752
753	/*
754	* Allocate and reserve two bytes more for payload
755	* alignment since sizeof(struct ethhdr) is 14.
756	*/
757	frame = dev_alloc_skb(length: hlen + sizeof(struct ethhdr) + 2 + cur_len);
758	if (!frame)
759	return NULL;
760
761	frame->priority = skb->priority;
762	skb_reserve(skb: frame, len: hlen + sizeof(struct ethhdr) + 2);
763	skb_copy_bits(skb, offset, to: skb_put(skb: frame, len: cur_len), len: cur_len);
764
765	len -= cur_len;
766	if (!len)
767	return frame;
768
769	offset += cur_len;
770	__ieee80211_amsdu_copy_frag(skb, frame, offset, len);
771
772	return frame;
773	}
774
775	static u16
776	ieee80211_amsdu_subframe_length(void *field, u8 mesh_flags, u8 hdr_type)
777	{
778	__le16 *field_le = field;
779	__be16 *field_be = field;
780	u16 len;
781
782	if (hdr_type >= 2)
783	len = le16_to_cpu(*field_le);
784	else
785	len = be16_to_cpu(*field_be);
786	if (hdr_type)
787	len += __ieee80211_get_mesh_hdrlen(flags: mesh_flags);
788
789	return len;
790	}
791
792	bool ieee80211_is_valid_amsdu(struct sk_buff *skb, u8 mesh_hdr)
793	{
794	int offset = 0, subframe_len, padding;
795
796	for (offset = 0; offset < skb->len; offset += subframe_len + padding) {
797	int remaining = skb->len - offset;
798	struct {
799	__be16 len;
800	u8 mesh_flags;
801	} hdr;
802	u16 len;
803
804	if (sizeof(hdr) > remaining)
805	return false;
806
807	if (skb_copy_bits(skb, offset: offset + 2 * ETH_ALEN, to: &hdr, len: sizeof(hdr)) < 0)
808	return false;
809
810	len = ieee80211_amsdu_subframe_length(field: &hdr.len, mesh_flags: hdr.mesh_flags,
811	hdr_type: mesh_hdr);
812	subframe_len = sizeof(struct ethhdr) + len;
813	padding = (4 - subframe_len) & 0x3;
814
815	if (subframe_len > remaining)
816	return false;
817	}
818
819	return true;
820	}
821	EXPORT_SYMBOL(ieee80211_is_valid_amsdu);
822
823	void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
824	const u8 *addr, enum nl80211_iftype iftype,
825	const unsigned int extra_headroom,
826	const u8 *check_da, const u8 *check_sa,
827	u8 mesh_control)
828	{
829	unsigned int hlen = ALIGN(extra_headroom, 4);
830	struct sk_buff *frame = NULL;
831	int offset = 0;
832	struct {
833	struct ethhdr eth;
834	uint8_t flags;
835	} hdr;
836	bool reuse_frag = skb->head_frag && !skb_has_frag_list(skb);
837	bool reuse_skb = false;
838	bool last = false;
839	int copy_len = sizeof(hdr.eth);
840
841	if (iftype == NL80211_IFTYPE_MESH_POINT)
842	copy_len = sizeof(hdr);
843
844	while (!last) {
845	int remaining = skb->len - offset;
846	unsigned int subframe_len;
847	int len, mesh_len = 0;
848	u8 padding;
849
850	if (copy_len > remaining)
851	goto purge;
852
853	skb_copy_bits(skb, offset, to: &hdr, len: copy_len);
854	if (iftype == NL80211_IFTYPE_MESH_POINT)
855	mesh_len = __ieee80211_get_mesh_hdrlen(flags: hdr.flags);
856	len = ieee80211_amsdu_subframe_length(field: &hdr.eth.h_proto, mesh_flags: hdr.flags,
857	hdr_type: mesh_control);
858	subframe_len = sizeof(struct ethhdr) + len;
859	padding = (4 - subframe_len) & 0x3;
860
861	/* the last MSDU has no padding */
862	if (subframe_len > remaining)
863	goto purge;
864	/* mitigate A-MSDU aggregation injection attacks */
865	if (ether_addr_equal(addr1: hdr.eth.h_dest, addr2: rfc1042_header))
866	goto purge;
867
868	offset += sizeof(struct ethhdr);
869	last = remaining <= subframe_len + padding;
870
871	/* FIXME: should we really accept multicast DA? */
872	if ((check_da && !is_multicast_ether_addr(addr: hdr.eth.h_dest) &&
873	!ether_addr_equal(addr1: check_da, addr2: hdr.eth.h_dest)) ||
874	(check_sa && !ether_addr_equal(addr1: check_sa, addr2: hdr.eth.h_source))) {
875	offset += len + padding;
876	continue;
877	}
878
879	/* reuse skb for the last subframe */
880	if (!skb_is_nonlinear(skb) && !reuse_frag && last) {
881	skb_pull(skb, len: offset);
882	frame = skb;
883	reuse_skb = true;
884	} else {
885	frame = __ieee80211_amsdu_copy(skb, hlen, offset, len,
886	reuse_frag, min_len: 32 + mesh_len);
887	if (!frame)
888	goto purge;
889
890	offset += len + padding;
891	}
892
893	skb_reset_network_header(skb: frame);
894	frame->dev = skb->dev;
895	frame->priority = skb->priority;
896
897	if (likely(iftype != NL80211_IFTYPE_MESH_POINT &&
898	ieee80211_get_8023_tunnel_proto(frame->data, &hdr.eth.h_proto)))
899	skb_pull(skb: frame, ETH_ALEN + 2);
900
901	memcpy(skb_push(frame, sizeof(hdr.eth)), &hdr.eth, sizeof(hdr.eth));
902	__skb_queue_tail(list, newsk: frame);
903	}
904
905	if (!reuse_skb)
906	dev_kfree_skb(skb);
907
908	return;
909
910	purge:
911	__skb_queue_purge(list);
912	dev_kfree_skb(skb);
913	}
914	EXPORT_SYMBOL(ieee80211_amsdu_to_8023s);
915
916	/* Given a data frame determine the 802.1p/1d tag to use. */
917	unsigned int cfg80211_classify8021d(struct sk_buff *skb,
918	struct cfg80211_qos_map *qos_map)
919	{
920	unsigned int dscp;
921	unsigned char vlan_priority;
922	unsigned int ret;
923
924	/* skb->priority values from 256->263 are magic values to
925	* directly indicate a specific 802.1d priority. This is used
926	* to allow 802.1d priority to be passed directly in from VLAN
927	* tags, etc.
928	*/
929	if (skb->priority >= 256 && skb->priority <= 263) {
930	ret = skb->priority - 256;
931	goto out;
932	}
933
934	if (skb_vlan_tag_present(skb)) {
935	vlan_priority = (skb_vlan_tag_get(skb) & VLAN_PRIO_MASK)
936	>> VLAN_PRIO_SHIFT;
937	if (vlan_priority > 0) {
938	ret = vlan_priority;
939	goto out;
940	}
941	}
942
943	switch (skb->protocol) {
944	case htons(ETH_P_IP):
945	dscp = ipv4_get_dsfield(iph: ip_hdr(skb)) & 0xfc;
946	break;
947	case htons(ETH_P_IPV6):
948	dscp = ipv6_get_dsfield(ipv6h: ipv6_hdr(skb)) & 0xfc;
949	break;
950	case htons(ETH_P_MPLS_UC):
951	case htons(ETH_P_MPLS_MC): {
952	struct mpls_label mpls_tmp, *mpls;
953
954	mpls = skb_header_pointer(skb, offset: sizeof(struct ethhdr),
955	len: sizeof(*mpls), buffer: &mpls_tmp);
956	if (!mpls)
957	return 0;
958
959	ret = (ntohl(mpls->entry) & MPLS_LS_TC_MASK)
960	>> MPLS_LS_TC_SHIFT;
961	goto out;
962	}
963	case htons(ETH_P_80221):
964	/* 802.21 is always network control traffic */
965	return 7;
966	default:
967	return 0;
968	}
969
970	if (qos_map) {
971	unsigned int i, tmp_dscp = dscp >> 2;
972
973	for (i = 0; i < qos_map->num_des; i++) {
974	if (tmp_dscp == qos_map->dscp_exception[i].dscp) {
975	ret = qos_map->dscp_exception[i].up;
976	goto out;
977	}
978	}
979
980	for (i = 0; i < 8; i++) {
981	if (tmp_dscp >= qos_map->up[i].low &&
982	tmp_dscp <= qos_map->up[i].high) {
983	ret = i;
984	goto out;
985	}
986	}
987	}
988
989	/* The default mapping as defined Section 2.3 in RFC8325: The three
990	* Most Significant Bits (MSBs) of the DSCP are used as the
991	* corresponding L2 markings.
992	*/
993	ret = dscp >> 5;
994
995	/* Handle specific DSCP values for which the default mapping (as
996	* described above) doesn't adhere to the intended usage of the DSCP
997	* value. See section 4 in RFC8325. Specifically, for the following
998	* Diffserv Service Classes no update is needed:
999	* - Standard: DF
1000	* - Low Priority Data: CS1
1001	* - Multimedia Streaming: AF31, AF32, AF33
1002	* - Multimedia Conferencing: AF41, AF42, AF43
1003	* - Network Control Traffic: CS7
1004	* - Real-Time Interactive: CS4
1005	*/
1006	switch (dscp >> 2) {
1007	case 10:
1008	case 12:
1009	case 14:
1010	/* High throughput data: AF11, AF12, AF13 */
1011	ret = 0;
1012	break;
1013	case 16:
1014	/* Operations, Administration, and Maintenance and Provisioning:
1015	* CS2
1016	*/
1017	ret = 0;
1018	break;
1019	case 18:
1020	case 20:
1021	case 22:
1022	/* Low latency data: AF21, AF22, AF23 */
1023	ret = 3;
1024	break;
1025	case 24:
1026	/* Broadcasting video: CS3 */
1027	ret = 4;
1028	break;
1029	case 40:
1030	/* Signaling: CS5 */
1031	ret = 5;
1032	break;
1033	case 44:
1034	/* Voice Admit: VA */
1035	ret = 6;
1036	break;
1037	case 46:
1038	/* Telephony traffic: EF */
1039	ret = 6;
1040	break;
1041	case 48:
1042	/* Network Control Traffic: CS6 */
1043	ret = 7;
1044	break;
1045	}
1046	out:
1047	return array_index_nospec(ret, IEEE80211_NUM_TIDS);
1048	}
1049	EXPORT_SYMBOL(cfg80211_classify8021d);
1050
1051	const struct element *ieee80211_bss_get_elem(struct cfg80211_bss *bss, u8 id)
1052	{
1053	const struct cfg80211_bss_ies *ies;
1054
1055	ies = rcu_dereference(bss->ies);
1056	if (!ies)
1057	return NULL;
1058
1059	return cfg80211_find_elem(eid: id, ies: ies->data, len: ies->len);
1060	}
1061	EXPORT_SYMBOL(ieee80211_bss_get_elem);
1062
1063	void cfg80211_upload_connect_keys(struct wireless_dev *wdev)
1064	{
1065	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy: wdev->wiphy);
1066	struct net_device *dev = wdev->netdev;
1067	int i;
1068
1069	if (!wdev->connect_keys)
1070	return;
1071
1072	for (i = 0; i < 4; i++) {
1073	if (!wdev->connect_keys->params[i].cipher)
1074	continue;
1075	if (rdev_add_key(rdev, netdev: dev, link_id: -1, key_index: i, pairwise: false, NULL,
1076	params: &wdev->connect_keys->params[i])) {
1077	netdev_err(dev, format: "failed to set key %d\n", i);
1078	continue;
1079	}
1080	if (wdev->connect_keys->def == i &&
1081	rdev_set_default_key(rdev, netdev: dev, link_id: -1, key_index: i, unicast: true, multicast: true)) {
1082	netdev_err(dev, format: "failed to set defkey %d\n", i);
1083	continue;
1084	}
1085	}
1086
1087	kfree_sensitive(objp: wdev->connect_keys);
1088	wdev->connect_keys = NULL;
1089	}
1090
1091	void cfg80211_process_wdev_events(struct wireless_dev *wdev)
1092	{
1093	struct cfg80211_event *ev;
1094	unsigned long flags;
1095
1096	spin_lock_irqsave(&wdev->event_lock, flags);
1097	while (!list_empty(head: &wdev->event_list)) {
1098	ev = list_first_entry(&wdev->event_list,
1099	struct cfg80211_event, list);
1100	list_del(entry: &ev->list);
1101	spin_unlock_irqrestore(lock: &wdev->event_lock, flags);
1102
1103	switch (ev->type) {
1104	case EVENT_CONNECT_RESULT:
1105	__cfg80211_connect_result(
1106	dev: wdev->netdev,
1107	params: &ev->cr,
1108	wextev: ev->cr.status == WLAN_STATUS_SUCCESS);
1109	break;
1110	case EVENT_ROAMED:
1111	__cfg80211_roamed(wdev, info: &ev->rm);
1112	break;
1113	case EVENT_DISCONNECTED:
1114	__cfg80211_disconnected(dev: wdev->netdev,
1115	ie: ev->dc.ie, ie_len: ev->dc.ie_len,
1116	reason: ev->dc.reason,
1117	from_ap: !ev->dc.locally_generated);
1118	break;
1119	case EVENT_IBSS_JOINED:
1120	__cfg80211_ibss_joined(dev: wdev->netdev, bssid: ev->ij.bssid,
1121	channel: ev->ij.channel);
1122	break;
1123	case EVENT_STOPPED:
1124	cfg80211_leave(rdev: wiphy_to_rdev(wiphy: wdev->wiphy), wdev);
1125	break;
1126	case EVENT_PORT_AUTHORIZED:
1127	__cfg80211_port_authorized(wdev, peer_addr: ev->pa.peer_addr,
1128	td_bitmap: ev->pa.td_bitmap,
1129	td_bitmap_len: ev->pa.td_bitmap_len);
1130	break;
1131	}
1132
1133	kfree(objp: ev);
1134
1135	spin_lock_irqsave(&wdev->event_lock, flags);
1136	}
1137	spin_unlock_irqrestore(lock: &wdev->event_lock, flags);
1138	}
1139
1140	void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev)
1141	{
1142	struct wireless_dev *wdev;
1143
1144	lockdep_assert_held(&rdev->wiphy.mtx);
1145
1146	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list)
1147	cfg80211_process_wdev_events(wdev);
1148	}
1149
1150	int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
1151	struct net_device *dev, enum nl80211_iftype ntype,
1152	struct vif_params *params)
1153	{
1154	int err;
1155	enum nl80211_iftype otype = dev->ieee80211_ptr->iftype;
1156
1157	lockdep_assert_held(&rdev->wiphy.mtx);
1158
1159	/* don't support changing VLANs, you just re-create them */
1160	if (otype == NL80211_IFTYPE_AP_VLAN)
1161	return -EOPNOTSUPP;
1162
1163	/* cannot change into P2P device or NAN */
1164	if (ntype == NL80211_IFTYPE_P2P_DEVICE ||
1165	ntype == NL80211_IFTYPE_NAN)
1166	return -EOPNOTSUPP;
1167
1168	if (!rdev->ops->change_virtual_intf ||
1169	!(rdev->wiphy.interface_modes & (1 << ntype)))
1170	return -EOPNOTSUPP;
1171
1172	if (ntype != otype) {
1173	/* if it's part of a bridge, reject changing type to station/ibss */
1174	if (netif_is_bridge_port(dev) &&
1175	(ntype == NL80211_IFTYPE_ADHOC ||
1176	ntype == NL80211_IFTYPE_STATION ||
1177	ntype == NL80211_IFTYPE_P2P_CLIENT))
1178	return -EBUSY;
1179
1180	dev->ieee80211_ptr->use_4addr = false;
1181	rdev_set_qos_map(rdev, dev, NULL);
1182
1183	switch (otype) {
1184	case NL80211_IFTYPE_AP:
1185	case NL80211_IFTYPE_P2P_GO:
1186	cfg80211_stop_ap(rdev, dev, link: -1, notify: true);
1187	break;
1188	case NL80211_IFTYPE_ADHOC:
1189	cfg80211_leave_ibss(rdev, dev, nowext: false);
1190	break;
1191	case NL80211_IFTYPE_STATION:
1192	case NL80211_IFTYPE_P2P_CLIENT:
1193	cfg80211_disconnect(rdev, dev,
1194	reason: WLAN_REASON_DEAUTH_LEAVING, wextev: true);
1195	break;
1196	case NL80211_IFTYPE_MESH_POINT:
1197	/* mesh should be handled? */
1198	break;
1199	case NL80211_IFTYPE_OCB:
1200	cfg80211_leave_ocb(rdev, dev);
1201	break;
1202	default:
1203	break;
1204	}
1205
1206	cfg80211_process_rdev_events(rdev);
1207	cfg80211_mlme_purge_registrations(wdev: dev->ieee80211_ptr);
1208
1209	memset(&dev->ieee80211_ptr->u, 0,
1210	sizeof(dev->ieee80211_ptr->u));
1211	memset(&dev->ieee80211_ptr->links, 0,
1212	sizeof(dev->ieee80211_ptr->links));
1213	}
1214
1215	err = rdev_change_virtual_intf(rdev, dev, type: ntype, params);
1216
1217	WARN_ON(!err && dev->ieee80211_ptr->iftype != ntype);
1218
1219	if (!err && params && params->use_4addr != -1)
1220	dev->ieee80211_ptr->use_4addr = params->use_4addr;
1221
1222	if (!err) {
1223	dev->priv_flags &= ~IFF_DONT_BRIDGE;
1224	switch (ntype) {
1225	case NL80211_IFTYPE_STATION:
1226	if (dev->ieee80211_ptr->use_4addr)
1227	break;
1228	fallthrough;
1229	case NL80211_IFTYPE_OCB:
1230	case NL80211_IFTYPE_P2P_CLIENT:
1231	case NL80211_IFTYPE_ADHOC:
1232	dev->priv_flags |= IFF_DONT_BRIDGE;
1233	break;
1234	case NL80211_IFTYPE_P2P_GO:
1235	case NL80211_IFTYPE_AP:
1236	case NL80211_IFTYPE_AP_VLAN:
1237	case NL80211_IFTYPE_MESH_POINT:
1238	/* bridging OK */
1239	break;
1240	case NL80211_IFTYPE_MONITOR:
1241	/* monitor can't bridge anyway */
1242	break;
1243	case NL80211_IFTYPE_UNSPECIFIED:
1244	case NUM_NL80211_IFTYPES:
1245	/* not happening */
1246	break;
1247	case NL80211_IFTYPE_P2P_DEVICE:
1248	case NL80211_IFTYPE_WDS:
1249	case NL80211_IFTYPE_NAN:
1250	WARN_ON(1);
1251	break;
1252	}
1253	}
1254
1255	if (!err && ntype != otype && netif_running(dev)) {
1256	cfg80211_update_iface_num(rdev, iftype: ntype, num: 1);
1257	cfg80211_update_iface_num(rdev, iftype: otype, num: -1);
1258	}
1259
1260	return err;
1261	}
1262
1263	static u32 cfg80211_calculate_bitrate_ht(struct rate_info *rate)
1264	{
1265	int modulation, streams, bitrate;
1266
1267	/* the formula below does only work for MCS values smaller than 32 */
1268	if (WARN_ON_ONCE(rate->mcs >= 32))
1269	return 0;
1270
1271	modulation = rate->mcs & 7;
1272	streams = (rate->mcs >> 3) + 1;
1273
1274	bitrate = (rate->bw == RATE_INFO_BW_40) ? 13500000 : 6500000;
1275
1276	if (modulation < 4)
1277	bitrate *= (modulation + 1);
1278	else if (modulation == 4)
1279	bitrate *= (modulation + 2);
1280	else
1281	bitrate *= (modulation + 3);
1282
1283	bitrate *= streams;
1284
1285	if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1286	bitrate = (bitrate / 9) * 10;
1287
1288	/* do NOT round down here */
1289	return (bitrate + 50000) / 100000;
1290	}
1291
1292	static u32 cfg80211_calculate_bitrate_dmg(struct rate_info *rate)
1293	{
1294	static const u32 __mcs2bitrate[] = {
1295	/* control PHY */
1296	[0] = 275,
1297	/* SC PHY */
1298	[1] = 3850,
1299	[2] = 7700,
1300	[3] = 9625,
1301	[4] = 11550,
1302	[5] = 12512, /* 1251.25 mbps */
1303	[6] = 15400,
1304	[7] = 19250,
1305	[8] = 23100,
1306	[9] = 25025,
1307	[10] = 30800,
1308	[11] = 38500,
1309	[12] = 46200,
1310	/* OFDM PHY */
1311	[13] = 6930,
1312	[14] = 8662, /* 866.25 mbps */
1313	[15] = 13860,
1314	[16] = 17325,
1315	[17] = 20790,
1316	[18] = 27720,
1317	[19] = 34650,
1318	[20] = 41580,
1319	[21] = 45045,
1320	[22] = 51975,
1321	[23] = 62370,
1322	[24] = 67568, /* 6756.75 mbps */
1323	/* LP-SC PHY */
1324	[25] = 6260,
1325	[26] = 8340,
1326	[27] = 11120,
1327	[28] = 12510,
1328	[29] = 16680,
1329	[30] = 22240,
1330	[31] = 25030,
1331	};
1332
1333	if (WARN_ON_ONCE(rate->mcs >= ARRAY_SIZE(__mcs2bitrate)))
1334	return 0;
1335
1336	return __mcs2bitrate[rate->mcs];
1337	}
1338
1339	static u32 cfg80211_calculate_bitrate_extended_sc_dmg(struct rate_info *rate)
1340	{
1341	static const u32 __mcs2bitrate[] = {
1342	[6 - 6] = 26950, /* MCS 9.1 : 2695.0 mbps */
1343	[7 - 6] = 50050, /* MCS 12.1 */
1344	[8 - 6] = 53900,
1345	[9 - 6] = 57750,
1346	[10 - 6] = 63900,
1347	[11 - 6] = 75075,
1348	[12 - 6] = 80850,
1349	};
1350
1351	/* Extended SC MCS not defined for base MCS below 6 or above 12 */
1352	if (WARN_ON_ONCE(rate->mcs < 6 || rate->mcs > 12))
1353	return 0;
1354
1355	return __mcs2bitrate[rate->mcs - 6];
1356	}
1357
1358	static u32 cfg80211_calculate_bitrate_edmg(struct rate_info *rate)
1359	{
1360	static const u32 __mcs2bitrate[] = {
1361	/* control PHY */
1362	[0] = 275,
1363	/* SC PHY */
1364	[1] = 3850,
1365	[2] = 7700,
1366	[3] = 9625,
1367	[4] = 11550,
1368	[5] = 12512, /* 1251.25 mbps */
1369	[6] = 13475,
1370	[7] = 15400,
1371	[8] = 19250,
1372	[9] = 23100,
1373	[10] = 25025,
1374	[11] = 26950,
1375	[12] = 30800,
1376	[13] = 38500,
1377	[14] = 46200,
1378	[15] = 50050,
1379	[16] = 53900,
1380	[17] = 57750,
1381	[18] = 69300,
1382	[19] = 75075,
1383	[20] = 80850,
1384	};
1385
1386	if (WARN_ON_ONCE(rate->mcs >= ARRAY_SIZE(__mcs2bitrate)))
1387	return 0;
1388
1389	return __mcs2bitrate[rate->mcs] * rate->n_bonded_ch;
1390	}
1391
1392	static u32 cfg80211_calculate_bitrate_vht(struct rate_info *rate)
1393	{
1394	static const u32 base[4][12] = {
1395	{ 6500000,
1396	13000000,
1397	19500000,
1398	26000000,
1399	39000000,
1400	52000000,
1401	58500000,
1402	65000000,
1403	78000000,
1404	/* not in the spec, but some devices use this: */
1405	86700000,
1406	97500000,
1407	108300000,
1408	},
1409	{ 13500000,
1410	27000000,
1411	40500000,
1412	54000000,
1413	81000000,
1414	108000000,
1415	121500000,
1416	135000000,
1417	162000000,
1418	180000000,
1419	202500000,
1420	225000000,
1421	},
1422	{ 29300000,
1423	58500000,
1424	87800000,
1425	117000000,
1426	175500000,
1427	234000000,
1428	263300000,
1429	292500000,
1430	351000000,
1431	390000000,
1432	438800000,
1433	487500000,
1434	},
1435	{ 58500000,
1436	117000000,
1437	175500000,
1438	234000000,
1439	351000000,
1440	468000000,
1441	526500000,
1442	585000000,
1443	702000000,
1444	780000000,
1445	877500000,
1446	975000000,
1447	},
1448	};
1449	u32 bitrate;
1450	int idx;
1451
1452	if (rate->mcs > 11)
1453	goto warn;
1454
1455	switch (rate->bw) {
1456	case RATE_INFO_BW_160:
1457	idx = 3;
1458	break;
1459	case RATE_INFO_BW_80:
1460	idx = 2;
1461	break;
1462	case RATE_INFO_BW_40:
1463	idx = 1;
1464	break;
1465	case RATE_INFO_BW_5:
1466	case RATE_INFO_BW_10:
1467	default:
1468	goto warn;
1469	case RATE_INFO_BW_20:
1470	idx = 0;
1471	}
1472
1473	bitrate = base[idx][rate->mcs];
1474	bitrate *= rate->nss;
1475
1476	if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1477	bitrate = (bitrate / 9) * 10;
1478
1479	/* do NOT round down here */
1480	return (bitrate + 50000) / 100000;
1481	warn:
1482	WARN_ONCE(1, "invalid rate bw=%d, mcs=%d, nss=%d\n",
1483	rate->bw, rate->mcs, rate->nss);
1484	return 0;
1485	}
1486
1487	static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate)
1488	{
1489	#define SCALE 6144
1490	u32 mcs_divisors[14] = {
1491	102399, /* 16.666666... */
1492	51201, /* 8.333333... */
1493	34134, /* 5.555555... */
1494	25599, /* 4.166666... */
1495	17067, /* 2.777777... */
1496	12801, /* 2.083333... */
1497	11377, /* 1.851725... */
1498	10239, /* 1.666666... */
1499	8532, /* 1.388888... */
1500	7680, /* 1.250000... */
1501	6828, /* 1.111111... */
1502	6144, /* 1.000000... */
1503	5690, /* 0.926106... */
1504	5120, /* 0.833333... */
1505	};
1506	u32 rates_160M[3] = { 960777777, 907400000, 816666666 };
1507	u32 rates_969[3] = { 480388888, 453700000, 408333333 };
1508	u32 rates_484[3] = { 229411111, 216666666, 195000000 };
1509	u32 rates_242[3] = { 114711111, 108333333, 97500000 };
1510	u32 rates_106[3] = { 40000000, 37777777, 34000000 };
1511	u32 rates_52[3] = { 18820000, 17777777, 16000000 };
1512	u32 rates_26[3] = { 9411111, 8888888, 8000000 };
1513	u64 tmp;
1514	u32 result;
1515
1516	if (WARN_ON_ONCE(rate->mcs > 13))
1517	return 0;
1518
1519	if (WARN_ON_ONCE(rate->he_gi > NL80211_RATE_INFO_HE_GI_3_2))
1520	return 0;
1521	if (WARN_ON_ONCE(rate->he_ru_alloc >
1522	NL80211_RATE_INFO_HE_RU_ALLOC_2x996))
1523	return 0;
1524	if (WARN_ON_ONCE(rate->nss < 1 || rate->nss > 8))
1525	return 0;
1526
1527	if (rate->bw == RATE_INFO_BW_160)
1528	result = rates_160M[rate->he_gi];
1529	else if (rate->bw == RATE_INFO_BW_80 ||
1530	(rate->bw == RATE_INFO_BW_HE_RU &&
1531	rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_996))
1532	result = rates_969[rate->he_gi];
1533	else if (rate->bw == RATE_INFO_BW_40 ||
1534	(rate->bw == RATE_INFO_BW_HE_RU &&
1535	rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_484))
1536	result = rates_484[rate->he_gi];
1537	else if (rate->bw == RATE_INFO_BW_20 ||
1538	(rate->bw == RATE_INFO_BW_HE_RU &&
1539	rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_242))
1540	result = rates_242[rate->he_gi];
1541	else if (rate->bw == RATE_INFO_BW_HE_RU &&
1542	rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_106)
1543	result = rates_106[rate->he_gi];
1544	else if (rate->bw == RATE_INFO_BW_HE_RU &&
1545	rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_52)
1546	result = rates_52[rate->he_gi];
1547	else if (rate->bw == RATE_INFO_BW_HE_RU &&
1548	rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_26)
1549	result = rates_26[rate->he_gi];
1550	else {
1551	WARN(1, "invalid HE MCS: bw:%d, ru:%d\n",
1552	rate->bw, rate->he_ru_alloc);
1553	return 0;
1554	}
1555
1556	/* now scale to the appropriate MCS */
1557	tmp = result;
1558	tmp *= SCALE;
1559	do_div(tmp, mcs_divisors[rate->mcs]);
1560	result = tmp;
1561
1562	/* and take NSS, DCM into account */
1563	result = (result * rate->nss) / 8;
1564	if (rate->he_dcm)
1565	result /= 2;
1566
1567	return result / 10000;
1568	}
1569
1570	static u32 cfg80211_calculate_bitrate_eht(struct rate_info *rate)
1571	{
1572	#define SCALE 6144
1573	static const u32 mcs_divisors[16] = {
1574	102399, /* 16.666666... */
1575	51201, /* 8.333333... */
1576	34134, /* 5.555555... */
1577	25599, /* 4.166666... */
1578	17067, /* 2.777777... */
1579	12801, /* 2.083333... */
1580	11377, /* 1.851725... */
1581	10239, /* 1.666666... */
1582	8532, /* 1.388888... */
1583	7680, /* 1.250000... */
1584	6828, /* 1.111111... */
1585	6144, /* 1.000000... */
1586	5690, /* 0.926106... */
1587	5120, /* 0.833333... */
1588	409600, /* 66.666666... */
1589	204800, /* 33.333333... */
1590	};
1591	static const u32 rates_996[3] = { 480388888, 453700000, 408333333 };
1592	static const u32 rates_484[3] = { 229411111, 216666666, 195000000 };
1593	static const u32 rates_242[3] = { 114711111, 108333333, 97500000 };
1594	static const u32 rates_106[3] = { 40000000, 37777777, 34000000 };
1595	static const u32 rates_52[3] = { 18820000, 17777777, 16000000 };
1596	static const u32 rates_26[3] = { 9411111, 8888888, 8000000 };
1597	u64 tmp;
1598	u32 result;
1599
1600	if (WARN_ON_ONCE(rate->mcs > 15))
1601	return 0;
1602	if (WARN_ON_ONCE(rate->eht_gi > NL80211_RATE_INFO_EHT_GI_3_2))
1603	return 0;
1604	if (WARN_ON_ONCE(rate->eht_ru_alloc >
1605	NL80211_RATE_INFO_EHT_RU_ALLOC_4x996))
1606	return 0;
1607	if (WARN_ON_ONCE(rate->nss < 1 || rate->nss > 8))
1608	return 0;
1609
1610	/* Bandwidth checks for MCS 14 */
1611	if (rate->mcs == 14) {
1612	if ((rate->bw != RATE_INFO_BW_EHT_RU &&
1613	rate->bw != RATE_INFO_BW_80 &&
1614	rate->bw != RATE_INFO_BW_160 &&
1615	rate->bw != RATE_INFO_BW_320) ||
1616	(rate->bw == RATE_INFO_BW_EHT_RU &&
1617	rate->eht_ru_alloc != NL80211_RATE_INFO_EHT_RU_ALLOC_996 &&
1618	rate->eht_ru_alloc != NL80211_RATE_INFO_EHT_RU_ALLOC_2x996 &&
1619	rate->eht_ru_alloc != NL80211_RATE_INFO_EHT_RU_ALLOC_4x996)) {
1620	WARN(1, "invalid EHT BW for MCS 14: bw:%d, ru:%d\n",
1621	rate->bw, rate->eht_ru_alloc);
1622	return 0;
1623	}
1624	}
1625
1626	if (rate->bw == RATE_INFO_BW_320 ||
1627	(rate->bw == RATE_INFO_BW_EHT_RU &&
1628	rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_4x996))
1629	result = 4 * rates_996[rate->eht_gi];
1630	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1631	rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_3x996P484)
1632	result = 3 * rates_996[rate->eht_gi] + rates_484[rate->eht_gi];
1633	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1634	rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_3x996)
1635	result = 3 * rates_996[rate->eht_gi];
1636	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1637	rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_2x996P484)
1638	result = 2 * rates_996[rate->eht_gi] + rates_484[rate->eht_gi];
1639	else if (rate->bw == RATE_INFO_BW_160 ||
1640	(rate->bw == RATE_INFO_BW_EHT_RU &&
1641	rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_2x996))
1642	result = 2 * rates_996[rate->eht_gi];
1643	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1644	rate->eht_ru_alloc ==
1645	NL80211_RATE_INFO_EHT_RU_ALLOC_996P484P242)
1646	result = rates_996[rate->eht_gi] + rates_484[rate->eht_gi]
1647	+ rates_242[rate->eht_gi];
1648	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1649	rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_996P484)
1650	result = rates_996[rate->eht_gi] + rates_484[rate->eht_gi];
1651	else if (rate->bw == RATE_INFO_BW_80 ||
1652	(rate->bw == RATE_INFO_BW_EHT_RU &&
1653	rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_996))
1654	result = rates_996[rate->eht_gi];
1655	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1656	rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_484P242)
1657	result = rates_484[rate->eht_gi] + rates_242[rate->eht_gi];
1658	else if (rate->bw == RATE_INFO_BW_40 ||
1659	(rate->bw == RATE_INFO_BW_EHT_RU &&
1660	rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_484))
1661	result = rates_484[rate->eht_gi];
1662	else if (rate->bw == RATE_INFO_BW_20 ||
1663	(rate->bw == RATE_INFO_BW_EHT_RU &&
1664	rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_242))
1665	result = rates_242[rate->eht_gi];
1666	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1667	rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_106P26)
1668	result = rates_106[rate->eht_gi] + rates_26[rate->eht_gi];
1669	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1670	rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_106)
1671	result = rates_106[rate->eht_gi];
1672	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1673	rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_52P26)
1674	result = rates_52[rate->eht_gi] + rates_26[rate->eht_gi];
1675	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1676	rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_52)
1677	result = rates_52[rate->eht_gi];
1678	else if (rate->bw == RATE_INFO_BW_EHT_RU &&
1679	rate->eht_ru_alloc == NL80211_RATE_INFO_EHT_RU_ALLOC_26)
1680	result = rates_26[rate->eht_gi];
1681	else {
1682	WARN(1, "invalid EHT MCS: bw:%d, ru:%d\n",
1683	rate->bw, rate->eht_ru_alloc);
1684	return 0;
1685	}
1686
1687	/* now scale to the appropriate MCS */
1688	tmp = result;
1689	tmp *= SCALE;
1690	do_div(tmp, mcs_divisors[rate->mcs]);
1691
1692	/* and take NSS */
1693	tmp *= rate->nss;
1694	do_div(tmp, 8);
1695
1696	result = tmp;
1697
1698	return result / 10000;
1699	}
1700
1701	static u32 cfg80211_calculate_bitrate_s1g(struct rate_info *rate)
1702	{
1703	/* For 1, 2, 4, 8 and 16 MHz channels */
1704	static const u32 base[5][11] = {
1705	{ 300000,
1706	600000,
1707	900000,
1708	1200000,
1709	1800000,
1710	2400000,
1711	2700000,
1712	3000000,
1713	3600000,
1714	4000000,
1715	/* MCS 10 supported in 1 MHz only */
1716	150000,
1717	},
1718	{ 650000,
1719	1300000,
1720	1950000,
1721	2600000,
1722	3900000,
1723	5200000,
1724	5850000,
1725	6500000,
1726	7800000,
1727	/* MCS 9 not valid */
1728	},
1729	{ 1350000,
1730	2700000,
1731	4050000,
1732	5400000,
1733	8100000,
1734	10800000,
1735	12150000,
1736	13500000,
1737	16200000,
1738	18000000,
1739	},
1740	{ 2925000,
1741	5850000,
1742	8775000,
1743	11700000,
1744	17550000,
1745	23400000,
1746	26325000,
1747	29250000,
1748	35100000,
1749	39000000,
1750	},
1751	{ 8580000,
1752	11700000,
1753	17550000,
1754	23400000,
1755	35100000,
1756	46800000,
1757	52650000,
1758	58500000,
1759	70200000,
1760	78000000,
1761	},
1762	};
1763	u32 bitrate;
1764	/* default is 1 MHz index */
1765	int idx = 0;
1766
1767	if (rate->mcs >= 11)
1768	goto warn;
1769
1770	switch (rate->bw) {
1771	case RATE_INFO_BW_16:
1772	idx = 4;
1773	break;
1774	case RATE_INFO_BW_8:
1775	idx = 3;
1776	break;
1777	case RATE_INFO_BW_4:
1778	idx = 2;
1779	break;
1780	case RATE_INFO_BW_2:
1781	idx = 1;
1782	break;
1783	case RATE_INFO_BW_1:
1784	idx = 0;
1785	break;
1786	case RATE_INFO_BW_5:
1787	case RATE_INFO_BW_10:
1788	case RATE_INFO_BW_20:
1789	case RATE_INFO_BW_40:
1790	case RATE_INFO_BW_80:
1791	case RATE_INFO_BW_160:
1792	default:
1793	goto warn;
1794	}
1795
1796	bitrate = base[idx][rate->mcs];
1797	bitrate *= rate->nss;
1798
1799	if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1800	bitrate = (bitrate / 9) * 10;
1801	/* do NOT round down here */
1802	return (bitrate + 50000) / 100000;
1803	warn:
1804	WARN_ONCE(1, "invalid rate bw=%d, mcs=%d, nss=%d\n",
1805	rate->bw, rate->mcs, rate->nss);
1806	return 0;
1807	}
1808
1809	u32 cfg80211_calculate_bitrate(struct rate_info *rate)
1810	{
1811	if (rate->flags & RATE_INFO_FLAGS_MCS)
1812	return cfg80211_calculate_bitrate_ht(rate);
1813	if (rate->flags & RATE_INFO_FLAGS_DMG)
1814	return cfg80211_calculate_bitrate_dmg(rate);
1815	if (rate->flags & RATE_INFO_FLAGS_EXTENDED_SC_DMG)
1816	return cfg80211_calculate_bitrate_extended_sc_dmg(rate);
1817	if (rate->flags & RATE_INFO_FLAGS_EDMG)
1818	return cfg80211_calculate_bitrate_edmg(rate);
1819	if (rate->flags & RATE_INFO_FLAGS_VHT_MCS)
1820	return cfg80211_calculate_bitrate_vht(rate);
1821	if (rate->flags & RATE_INFO_FLAGS_HE_MCS)
1822	return cfg80211_calculate_bitrate_he(rate);
1823	if (rate->flags & RATE_INFO_FLAGS_EHT_MCS)
1824	return cfg80211_calculate_bitrate_eht(rate);
1825	if (rate->flags & RATE_INFO_FLAGS_S1G_MCS)
1826	return cfg80211_calculate_bitrate_s1g(rate);
1827
1828	return rate->legacy;
1829	}
1830	EXPORT_SYMBOL(cfg80211_calculate_bitrate);
1831
1832	int cfg80211_get_p2p_attr(const u8 *ies, unsigned int len,
1833	enum ieee80211_p2p_attr_id attr,
1834	u8 *buf, unsigned int bufsize)
1835	{
1836	u8 *out = buf;
1837	u16 attr_remaining = 0;
1838	bool desired_attr = false;
1839	u16 desired_len = 0;
1840
1841	while (len > 0) {
1842	unsigned int iedatalen;
1843	unsigned int copy;
1844	const u8 *iedata;
1845
1846	if (len < 2)
1847	return -EILSEQ;
1848	iedatalen = ies[1];
1849	if (iedatalen + 2 > len)
1850	return -EILSEQ;
1851
1852	if (ies[0] != WLAN_EID_VENDOR_SPECIFIC)
1853	goto cont;
1854
1855	if (iedatalen < 4)
1856	goto cont;
1857
1858	iedata = ies + 2;
1859
1860	/* check WFA OUI, P2P subtype */
1861	if (iedata[0] != 0x50 || iedata[1] != 0x6f ||
1862	iedata[2] != 0x9a || iedata[3] != 0x09)
1863	goto cont;
1864
1865	iedatalen -= 4;
1866	iedata += 4;
1867
1868	/* check attribute continuation into this IE */
1869	copy = min_t(unsigned int, attr_remaining, iedatalen);
1870	if (copy && desired_attr) {
1871	desired_len += copy;
1872	if (out) {
1873	memcpy(out, iedata, min(bufsize, copy));
1874	out += min(bufsize, copy);
1875	bufsize -= min(bufsize, copy);
1876	}
1877
1878
1879	if (copy == attr_remaining)
1880	return desired_len;
1881	}
1882
1883	attr_remaining -= copy;
1884	if (attr_remaining)
1885	goto cont;
1886
1887	iedatalen -= copy;
1888	iedata += copy;
1889
1890	while (iedatalen > 0) {
1891	u16 attr_len;
1892
1893	/* P2P attribute ID & size must fit */
1894	if (iedatalen < 3)
1895	return -EILSEQ;
1896	desired_attr = iedata[0] == attr;
1897	attr_len = get_unaligned_le16(p: iedata + 1);
1898	iedatalen -= 3;
1899	iedata += 3;
1900
1901	copy = min_t(unsigned int, attr_len, iedatalen);
1902
1903	if (desired_attr) {
1904	desired_len += copy;
1905	if (out) {
1906	memcpy(out, iedata, min(bufsize, copy));
1907	out += min(bufsize, copy);
1908	bufsize -= min(bufsize, copy);
1909	}
1910
1911	if (copy == attr_len)
1912	return desired_len;
1913	}
1914
1915	iedata += copy;
1916	iedatalen -= copy;
1917	attr_remaining = attr_len - copy;
1918	}
1919
1920	cont:
1921	len -= ies[1] + 2;
1922	ies += ies[1] + 2;
1923	}
1924
1925	if (attr_remaining && desired_attr)
1926	return -EILSEQ;
1927
1928	return -ENOENT;
1929	}
1930	EXPORT_SYMBOL(cfg80211_get_p2p_attr);
1931
1932	static bool ieee80211_id_in_list(const u8 *ids, int n_ids, u8 id, bool id_ext)
1933	{
1934	int i;
1935
1936	/* Make sure array values are legal */
1937	if (WARN_ON(ids[n_ids - 1] == WLAN_EID_EXTENSION))
1938	return false;
1939
1940	i = 0;
1941	while (i < n_ids) {
1942	if (ids[i] == WLAN_EID_EXTENSION) {
1943	if (id_ext && (ids[i + 1] == id))
1944	return true;
1945
1946	i += 2;
1947	continue;
1948	}
1949
1950	if (ids[i] == id && !id_ext)
1951	return true;
1952
1953	i++;
1954	}
1955	return false;
1956	}
1957
1958	static size_t skip_ie(const u8 *ies, size_t ielen, size_t pos)
1959	{
1960	/* we assume a validly formed IEs buffer */
1961	u8 len = ies[pos + 1];
1962
1963	pos += 2 + len;
1964
1965	/* the IE itself must have 255 bytes for fragments to follow */
1966	if (len < 255)
1967	return pos;
1968
1969	while (pos < ielen && ies[pos] == WLAN_EID_FRAGMENT) {
1970	len = ies[pos + 1];
1971	pos += 2 + len;
1972	}
1973
1974	return pos;
1975	}
1976
1977	size_t ieee80211_ie_split_ric(const u8 *ies, size_t ielen,
1978	const u8 *ids, int n_ids,
1979	const u8 *after_ric, int n_after_ric,
1980	size_t offset)
1981	{
1982	size_t pos = offset;
1983
1984	while (pos < ielen) {
1985	u8 ext = 0;
1986
1987	if (ies[pos] == WLAN_EID_EXTENSION)
1988	ext = 2;
1989	if ((pos + ext) >= ielen)
1990	break;
1991
1992	if (!ieee80211_id_in_list(ids, n_ids, id: ies[pos + ext],
1993	id_ext: ies[pos] == WLAN_EID_EXTENSION))
1994	break;
1995
1996	if (ies[pos] == WLAN_EID_RIC_DATA && n_after_ric) {
1997	pos = skip_ie(ies, ielen, pos);
1998
1999	while (pos < ielen) {
2000	if (ies[pos] == WLAN_EID_EXTENSION)
2001	ext = 2;
2002	else
2003	ext = 0;
2004
2005	if ((pos + ext) >= ielen)
2006	break;
2007
2008	if (!ieee80211_id_in_list(ids: after_ric,
2009	n_ids: n_after_ric,
2010	id: ies[pos + ext],
2011	id_ext: ext == 2))
2012	pos = skip_ie(ies, ielen, pos);
2013	else
2014	break;
2015	}
2016	} else {
2017	pos = skip_ie(ies, ielen, pos);
2018	}
2019	}
2020
2021	return pos;
2022	}
2023	EXPORT_SYMBOL(ieee80211_ie_split_ric);
2024
2025	void ieee80211_fragment_element(struct sk_buff *skb, u8 *len_pos, u8 frag_id)
2026	{
2027	unsigned int elem_len;
2028
2029	if (!len_pos)
2030	return;
2031
2032	elem_len = skb->data + skb->len - len_pos - 1;
2033
2034	while (elem_len > 255) {
2035	/* this one is 255 */
2036	*len_pos = 255;
2037	/* remaining data gets smaller */
2038	elem_len -= 255;
2039	/* make space for the fragment ID/len in SKB */
2040	skb_put(skb, len: 2);
2041	/* shift back the remaining data to place fragment ID/len */
2042	memmove(len_pos + 255 + 3, len_pos + 255 + 1, elem_len);
2043	/* place the fragment ID */
2044	len_pos += 255 + 1;
2045	*len_pos = frag_id;
2046	/* and point to fragment length to update later */
2047	len_pos++;
2048	}
2049
2050	*len_pos = elem_len;
2051	}
2052	EXPORT_SYMBOL(ieee80211_fragment_element);
2053
2054	bool ieee80211_operating_class_to_band(u8 operating_class,
2055	enum nl80211_band *band)
2056	{
2057	switch (operating_class) {
2058	case 112:
2059	case 115 ... 127:
2060	case 128 ... 130:
2061	*band = NL80211_BAND_5GHZ;
2062	return true;
2063	case 131 ... 135:
2064	case 137:
2065	*band = NL80211_BAND_6GHZ;
2066	return true;
2067	case 81:
2068	case 82:
2069	case 83:
2070	case 84:
2071	*band = NL80211_BAND_2GHZ;
2072	return true;
2073	case 180:
2074	*band = NL80211_BAND_60GHZ;
2075	return true;
2076	}
2077
2078	return false;
2079	}
2080	EXPORT_SYMBOL(ieee80211_operating_class_to_band);
2081
2082	bool ieee80211_operating_class_to_chandef(u8 operating_class,
2083	struct ieee80211_channel *chan,
2084	struct cfg80211_chan_def *chandef)
2085	{
2086	u32 control_freq, offset = 0;
2087	enum nl80211_band band;
2088
2089	if (!ieee80211_operating_class_to_band(operating_class, &band) ||
2090	!chan || band != chan->band)
2091	return false;
2092
2093	control_freq = chan->center_freq;
2094	chandef->chan = chan;
2095
2096	if (control_freq >= 5955)
2097	offset = control_freq - 5955;
2098	else if (control_freq >= 5745)
2099	offset = control_freq - 5745;
2100	else if (control_freq >= 5180)
2101	offset = control_freq - 5180;
2102	offset /= 20;
2103
2104	switch (operating_class) {
2105	case 81: /* 2 GHz band; 20 MHz; channels 1..13 */
2106	case 82: /* 2 GHz band; 20 MHz; channel 14 */
2107	case 115: /* 5 GHz band; 20 MHz; channels 36,40,44,48 */
2108	case 118: /* 5 GHz band; 20 MHz; channels 52,56,60,64 */
2109	case 121: /* 5 GHz band; 20 MHz; channels 100..144 */
2110	case 124: /* 5 GHz band; 20 MHz; channels 149,153,157,161 */
2111	case 125: /* 5 GHz band; 20 MHz; channels 149..177 */
2112	case 131: /* 6 GHz band; 20 MHz; channels 1..233*/
2113	case 136: /* 6 GHz band; 20 MHz; channel 2 */
2114	chandef->center_freq1 = control_freq;
2115	chandef->width = NL80211_CHAN_WIDTH_20;
2116	return true;
2117	case 83: /* 2 GHz band; 40 MHz; channels 1..9 */
2118	case 116: /* 5 GHz band; 40 MHz; channels 36,44 */
2119	case 119: /* 5 GHz band; 40 MHz; channels 52,60 */
2120	case 122: /* 5 GHz band; 40 MHz; channels 100,108,116,124,132,140 */
2121	case 126: /* 5 GHz band; 40 MHz; channels 149,157,165,173 */
2122	chandef->center_freq1 = control_freq + 10;
2123	chandef->width = NL80211_CHAN_WIDTH_40;
2124	return true;
2125	case 84: /* 2 GHz band; 40 MHz; channels 5..13 */
2126	case 117: /* 5 GHz band; 40 MHz; channels 40,48 */
2127	case 120: /* 5 GHz band; 40 MHz; channels 56,64 */
2128	case 123: /* 5 GHz band; 40 MHz; channels 104,112,120,128,136,144 */
2129	case 127: /* 5 GHz band; 40 MHz; channels 153,161,169,177 */
2130	chandef->center_freq1 = control_freq - 10;
2131	chandef->width = NL80211_CHAN_WIDTH_40;
2132	return true;
2133	case 132: /* 6 GHz band; 40 MHz; channels 1,5,..,229*/
2134	chandef->center_freq1 = control_freq + 10 - (offset & 1) * 20;
2135	chandef->width = NL80211_CHAN_WIDTH_40;
2136	return true;
2137	case 128: /* 5 GHz band; 80 MHz; channels 36..64,100..144,149..177 */
2138	case 133: /* 6 GHz band; 80 MHz; channels 1,5,..,229 */
2139	chandef->center_freq1 = control_freq + 30 - (offset & 3) * 20;
2140	chandef->width = NL80211_CHAN_WIDTH_80;
2141	return true;
2142	case 129: /* 5 GHz band; 160 MHz; channels 36..64,100..144,149..177 */
2143	case 134: /* 6 GHz band; 160 MHz; channels 1,5,..,229 */
2144	chandef->center_freq1 = control_freq + 70 - (offset & 7) * 20;
2145	chandef->width = NL80211_CHAN_WIDTH_160;
2146	return true;
2147	case 130: /* 5 GHz band; 80+80 MHz; channels 36..64,100..144,149..177 */
2148	case 135: /* 6 GHz band; 80+80 MHz; channels 1,5,..,229 */
2149	/* The center_freq2 of 80+80 MHz is unknown */
2150	case 137: /* 6 GHz band; 320 MHz; channels 1,5,..,229 */
2151	/* 320-1 or 320-2 channelization is unknown */
2152	default:
2153	return false;
2154	}
2155	}
2156	EXPORT_SYMBOL(ieee80211_operating_class_to_chandef);
2157
2158	bool ieee80211_chandef_to_operating_class(struct cfg80211_chan_def *chandef,
2159	u8 *op_class)
2160	{
2161	u8 vht_opclass;
2162	u32 freq = chandef->center_freq1;
2163
2164	if (freq >= 2412 && freq <= 2472) {
2165	if (chandef->width > NL80211_CHAN_WIDTH_40)
2166	return false;
2167
2168	/* 2.407 GHz, channels 1..13 */
2169	if (chandef->width == NL80211_CHAN_WIDTH_40) {
2170	if (freq > chandef->chan->center_freq)
2171	*op_class = 83; /* HT40+ */
2172	else
2173	*op_class = 84; /* HT40- */
2174	} else {
2175	*op_class = 81;
2176	}
2177
2178	return true;
2179	}
2180
2181	if (freq == 2484) {
2182	/* channel 14 is only for IEEE 802.11b */
2183	if (chandef->width != NL80211_CHAN_WIDTH_20_NOHT)
2184	return false;
2185
2186	*op_class = 82; /* channel 14 */
2187	return true;
2188	}
2189
2190	switch (chandef->width) {
2191	case NL80211_CHAN_WIDTH_80:
2192	vht_opclass = 128;
2193	break;
2194	case NL80211_CHAN_WIDTH_160:
2195	vht_opclass = 129;
2196	break;
2197	case NL80211_CHAN_WIDTH_80P80:
2198	vht_opclass = 130;
2199	break;
2200	case NL80211_CHAN_WIDTH_10:
2201	case NL80211_CHAN_WIDTH_5:
2202	return false; /* unsupported for now */
2203	default:
2204	vht_opclass = 0;
2205	break;
2206	}
2207
2208	/* 5 GHz, channels 36..48 */
2209	if (freq >= 5180 && freq <= 5240) {
2210	if (vht_opclass) {
2211	*op_class = vht_opclass;
2212	} else if (chandef->width == NL80211_CHAN_WIDTH_40) {
2213	if (freq > chandef->chan->center_freq)
2214	*op_class = 116;
2215	else
2216	*op_class = 117;
2217	} else {
2218	*op_class = 115;
2219	}
2220
2221	return true;
2222	}
2223
2224	/* 5 GHz, channels 52..64 */
2225	if (freq >= 5260 && freq <= 5320) {
2226	if (vht_opclass) {
2227	*op_class = vht_opclass;
2228	} else if (chandef->width == NL80211_CHAN_WIDTH_40) {
2229	if (freq > chandef->chan->center_freq)
2230	*op_class = 119;
2231	else
2232	*op_class = 120;
2233	} else {
2234	*op_class = 118;
2235	}
2236
2237	return true;
2238	}
2239
2240	/* 5 GHz, channels 100..144 */
2241	if (freq >= 5500 && freq <= 5720) {
2242	if (vht_opclass) {
2243	*op_class = vht_opclass;
2244	} else if (chandef->width == NL80211_CHAN_WIDTH_40) {
2245	if (freq > chandef->chan->center_freq)
2246	*op_class = 122;
2247	else
2248	*op_class = 123;
2249	} else {
2250	*op_class = 121;
2251	}
2252
2253	return true;
2254	}
2255
2256	/* 5 GHz, channels 149..169 */
2257	if (freq >= 5745 && freq <= 5845) {
2258	if (vht_opclass) {
2259	*op_class = vht_opclass;
2260	} else if (chandef->width == NL80211_CHAN_WIDTH_40) {
2261	if (freq > chandef->chan->center_freq)
2262	*op_class = 126;
2263	else
2264	*op_class = 127;
2265	} else if (freq <= 5805) {
2266	*op_class = 124;
2267	} else {
2268	*op_class = 125;
2269	}
2270
2271	return true;
2272	}
2273
2274	/* 56.16 GHz, channel 1..4 */
2275	if (freq >= 56160 + 2160 * 1 && freq <= 56160 + 2160 * 6) {
2276	if (chandef->width >= NL80211_CHAN_WIDTH_40)
2277	return false;
2278
2279	*op_class = 180;
2280	return true;
2281	}
2282
2283	/* not supported yet */
2284	return false;
2285	}
2286	EXPORT_SYMBOL(ieee80211_chandef_to_operating_class);
2287
2288	static int cfg80211_wdev_bi(struct wireless_dev *wdev)
2289	{
2290	switch (wdev->iftype) {
2291	case NL80211_IFTYPE_AP:
2292	case NL80211_IFTYPE_P2P_GO:
2293	WARN_ON(wdev->valid_links);
2294	return wdev->links[0].ap.beacon_interval;
2295	case NL80211_IFTYPE_MESH_POINT:
2296	return wdev->u.mesh.beacon_interval;
2297	case NL80211_IFTYPE_ADHOC:
2298	return wdev->u.ibss.beacon_interval;
2299	default:
2300	break;
2301	}
2302
2303	return 0;
2304	}
2305
2306	static void cfg80211_calculate_bi_data(struct wiphy *wiphy, u32 new_beacon_int,
2307	u32 *beacon_int_gcd,
2308	bool *beacon_int_different)
2309	{
2310	struct wireless_dev *wdev;
2311
2312	*beacon_int_gcd = 0;
2313	*beacon_int_different = false;
2314
2315	list_for_each_entry(wdev, &wiphy->wdev_list, list) {
2316	int wdev_bi;
2317
2318	/* this feature isn't supported with MLO */
2319	if (wdev->valid_links)
2320	continue;
2321
2322	wdev_bi = cfg80211_wdev_bi(wdev);
2323
2324	if (!wdev_bi)
2325	continue;
2326
2327	if (!*beacon_int_gcd) {
2328	*beacon_int_gcd = wdev_bi;
2329	continue;
2330	}
2331
2332	if (wdev_bi == *beacon_int_gcd)
2333	continue;
2334
2335	*beacon_int_different = true;
2336	*beacon_int_gcd = gcd(a: *beacon_int_gcd, b: wdev_bi);
2337	}
2338
2339	if (new_beacon_int && *beacon_int_gcd != new_beacon_int) {
2340	if (*beacon_int_gcd)
2341	*beacon_int_different = true;
2342	*beacon_int_gcd = gcd(a: *beacon_int_gcd, b: new_beacon_int);
2343	}
2344	}
2345
2346	int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
2347	enum nl80211_iftype iftype, u32 beacon_int)
2348	{
2349	/*
2350	* This is just a basic pre-condition check; if interface combinations
2351	* are possible the driver must already be checking those with a call
2352	* to cfg80211_check_combinations(), in which case we'll validate more
2353	* through the cfg80211_calculate_bi_data() call and code in
2354	* cfg80211_iter_combinations().
2355	*/
2356
2357	if (beacon_int < 10 || beacon_int > 10000)
2358	return -EINVAL;
2359
2360	return 0;
2361	}
2362
2363	int cfg80211_iter_combinations(struct wiphy *wiphy,
2364	struct iface_combination_params *params,
2365	void (*iter)(const struct ieee80211_iface_combination *c,
2366	void *data),
2367	void *data)
2368	{
2369	const struct ieee80211_regdomain *regdom;
2370	enum nl80211_dfs_regions region = 0;
2371	int i, j, iftype;
2372	int num_interfaces = 0;
2373	u32 used_iftypes = 0;
2374	u32 beacon_int_gcd;
2375	bool beacon_int_different;
2376
2377	/*
2378	* This is a bit strange, since the iteration used to rely only on
2379	* the data given by the driver, but here it now relies on context,
2380	* in form of the currently operating interfaces.
2381	* This is OK for all current users, and saves us from having to
2382	* push the GCD calculations into all the drivers.
2383	* In the future, this should probably rely more on data that's in
2384	* cfg80211 already - the only thing not would appear to be any new
2385	* interfaces (while being brought up) and channel/radar data.
2386	*/
2387	cfg80211_calculate_bi_data(wiphy, new_beacon_int: params->new_beacon_int,
2388	beacon_int_gcd: &beacon_int_gcd, beacon_int_different: &beacon_int_different);
2389
2390	if (params->radar_detect) {
2391	rcu_read_lock();
2392	regdom = rcu_dereference(cfg80211_regdomain);
2393	if (regdom)
2394	region = regdom->dfs_region;
2395	rcu_read_unlock();
2396	}
2397
2398	for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
2399	num_interfaces += params->iftype_num[iftype];
2400	if (params->iftype_num[iftype] > 0 &&
2401	!cfg80211_iftype_allowed(wiphy, iftype, is_4addr: 0, check_swif: 1))
2402	used_iftypes |= BIT(iftype);
2403	}
2404
2405	for (i = 0; i < wiphy->n_iface_combinations; i++) {
2406	const struct ieee80211_iface_combination *c;
2407	struct ieee80211_iface_limit *limits;
2408	u32 all_iftypes = 0;
2409
2410	c = &wiphy->iface_combinations[i];
2411
2412	if (num_interfaces > c->max_interfaces)
2413	continue;
2414	if (params->num_different_channels > c->num_different_channels)
2415	continue;
2416
2417	limits = kmemdup(p: c->limits, size: sizeof(limits[0]) * c->n_limits,
2418	GFP_KERNEL);
2419	if (!limits)
2420	return -ENOMEM;
2421
2422	for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
2423	if (cfg80211_iftype_allowed(wiphy, iftype, is_4addr: 0, check_swif: 1))
2424	continue;
2425	for (j = 0; j < c->n_limits; j++) {
2426	all_iftypes |= limits[j].types;
2427	if (!(limits[j].types & BIT(iftype)))
2428	continue;
2429	if (limits[j].max < params->iftype_num[iftype])
2430	goto cont;
2431	limits[j].max -= params->iftype_num[iftype];
2432	}
2433	}
2434
2435	if (params->radar_detect !=
2436	(c->radar_detect_widths & params->radar_detect))
2437	goto cont;
2438
2439	if (params->radar_detect && c->radar_detect_regions &&
2440	!(c->radar_detect_regions & BIT(region)))
2441	goto cont;
2442
2443	/* Finally check that all iftypes that we're currently
2444	* using are actually part of this combination. If they
2445	* aren't then we can't use this combination and have
2446	* to continue to the next.
2447	*/
2448	if ((all_iftypes & used_iftypes) != used_iftypes)
2449	goto cont;
2450
2451	if (beacon_int_gcd) {
2452	if (c->beacon_int_min_gcd &&
2453	beacon_int_gcd < c->beacon_int_min_gcd)
2454	goto cont;
2455	if (!c->beacon_int_min_gcd && beacon_int_different)
2456	goto cont;
2457	}
2458
2459	/* This combination covered all interface types and
2460	* supported the requested numbers, so we're good.
2461	*/
2462
2463	(*iter)(c, data);
2464	cont:
2465	kfree(objp: limits);
2466	}
2467
2468	return 0;
2469	}
2470	EXPORT_SYMBOL(cfg80211_iter_combinations);
2471
2472	static void
2473	cfg80211_iter_sum_ifcombs(const struct ieee80211_iface_combination *c,
2474	void *data)
2475	{
2476	int *num = data;
2477	(*num)++;
2478	}
2479
2480	int cfg80211_check_combinations(struct wiphy *wiphy,
2481	struct iface_combination_params *params)
2482	{
2483	int err, num = 0;
2484
2485	err = cfg80211_iter_combinations(wiphy, params,
2486	cfg80211_iter_sum_ifcombs, &num);
2487	if (err)
2488	return err;
2489	if (num == 0)
2490	return -EBUSY;
2491
2492	return 0;
2493	}
2494	EXPORT_SYMBOL(cfg80211_check_combinations);
2495
2496	int ieee80211_get_ratemask(struct ieee80211_supported_band *sband,
2497	const u8 *rates, unsigned int n_rates,
2498	u32 *mask)
2499	{
2500	int i, j;
2501
2502	if (!sband)
2503	return -EINVAL;
2504
2505	if (n_rates == 0 || n_rates > NL80211_MAX_SUPP_RATES)
2506	return -EINVAL;
2507
2508	*mask = 0;
2509
2510	for (i = 0; i < n_rates; i++) {
2511	int rate = (rates[i] & 0x7f) * 5;
2512	bool found = false;
2513
2514	for (j = 0; j < sband->n_bitrates; j++) {
2515	if (sband->bitrates[j].bitrate == rate) {
2516	found = true;
2517	*mask |= BIT(j);
2518	break;
2519	}
2520	}
2521	if (!found)
2522	return -EINVAL;
2523	}
2524
2525	/*
2526	* mask must have at least one bit set here since we
2527	* didn't accept a 0-length rates array nor allowed
2528	* entries in the array that didn't exist
2529	*/
2530
2531	return 0;
2532	}
2533
2534	unsigned int ieee80211_get_num_supported_channels(struct wiphy *wiphy)
2535	{
2536	enum nl80211_band band;
2537	unsigned int n_channels = 0;
2538
2539	for (band = 0; band < NUM_NL80211_BANDS; band++)
2540	if (wiphy->bands[band])
2541	n_channels += wiphy->bands[band]->n_channels;
2542
2543	return n_channels;
2544	}
2545	EXPORT_SYMBOL(ieee80211_get_num_supported_channels);
2546
2547	int cfg80211_get_station(struct net_device *dev, const u8 *mac_addr,
2548	struct station_info *sinfo)
2549	{
2550	struct cfg80211_registered_device *rdev;
2551	struct wireless_dev *wdev;
2552
2553	wdev = dev->ieee80211_ptr;
2554	if (!wdev)
2555	return -EOPNOTSUPP;
2556
2557	rdev = wiphy_to_rdev(wiphy: wdev->wiphy);
2558	if (!rdev->ops->get_station)
2559	return -EOPNOTSUPP;
2560
2561	memset(sinfo, 0, sizeof(*sinfo));
2562
2563	return rdev_get_station(rdev, dev, mac: mac_addr, sinfo);
2564	}
2565	EXPORT_SYMBOL(cfg80211_get_station);
2566
2567	void cfg80211_free_nan_func(struct cfg80211_nan_func *f)
2568	{
2569	int i;
2570
2571	if (!f)
2572	return;
2573
2574	kfree(objp: f->serv_spec_info);
2575	kfree(objp: f->srf_bf);
2576	kfree(objp: f->srf_macs);
2577	for (i = 0; i < f->num_rx_filters; i++)
2578	kfree(objp: f->rx_filters[i].filter);
2579
2580	for (i = 0; i < f->num_tx_filters; i++)
2581	kfree(objp: f->tx_filters[i].filter);
2582
2583	kfree(objp: f->rx_filters);
2584	kfree(objp: f->tx_filters);
2585	kfree(objp: f);
2586	}
2587	EXPORT_SYMBOL(cfg80211_free_nan_func);
2588
2589	bool cfg80211_does_bw_fit_range(const struct ieee80211_freq_range *freq_range,
2590	u32 center_freq_khz, u32 bw_khz)
2591	{
2592	u32 start_freq_khz, end_freq_khz;
2593
2594	start_freq_khz = center_freq_khz - (bw_khz / 2);
2595	end_freq_khz = center_freq_khz + (bw_khz / 2);
2596
2597	if (start_freq_khz >= freq_range->start_freq_khz &&
2598	end_freq_khz <= freq_range->end_freq_khz)
2599	return true;
2600
2601	return false;
2602	}
2603
2604	int cfg80211_sinfo_alloc_tid_stats(struct station_info *sinfo, gfp_t gfp)
2605	{
2606	sinfo->pertid = kcalloc(IEEE80211_NUM_TIDS + 1,
2607	size: sizeof(*(sinfo->pertid)),
2608	flags: gfp);
2609	if (!sinfo->pertid)
2610	return -ENOMEM;
2611
2612	return 0;
2613	}
2614	EXPORT_SYMBOL(cfg80211_sinfo_alloc_tid_stats);
2615
2616	/* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
2617	/* Ethernet-II snap header (RFC1042 for most EtherTypes) */
2618	const unsigned char rfc1042_header[] __aligned(2) =
2619	{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
2620	EXPORT_SYMBOL(rfc1042_header);
2621
2622	/* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
2623	const unsigned char bridge_tunnel_header[] __aligned(2) =
2624	{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
2625	EXPORT_SYMBOL(bridge_tunnel_header);
2626
2627	/* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
2628	struct iapp_layer2_update {
2629	u8 da[ETH_ALEN]; /* broadcast */
2630	u8 sa[ETH_ALEN]; /* STA addr */
2631	__be16 len; /* 6 */
2632	u8 dsap; /* 0 */
2633	u8 ssap; /* 0 */
2634	u8 control;
2635	u8 xid_info[3];
2636	} __packed;
2637
2638	void cfg80211_send_layer2_update(struct net_device *dev, const u8 *addr)
2639	{
2640	struct iapp_layer2_update *msg;
2641	struct sk_buff *skb;
2642
2643	/* Send Level 2 Update Frame to update forwarding tables in layer 2
2644	* bridge devices */
2645
2646	skb = dev_alloc_skb(length: sizeof(*msg));
2647	if (!skb)
2648	return;
2649	msg = skb_put(skb, len: sizeof(*msg));
2650
2651	/* 802.2 Type 1 Logical Link Control (LLC) Exchange Identifier (XID)
2652	* Update response frame; IEEE Std 802.2-1998, 5.4.1.2.1 */
2653
2654	eth_broadcast_addr(addr: msg->da);
2655	ether_addr_copy(dst: msg->sa, src: addr);
2656	msg->len = htons(6);
2657	msg->dsap = 0;
2658	msg->ssap = 0x01; /* NULL LSAP, CR Bit: Response */
2659	msg->control = 0xaf; /* XID response lsb.1111F101.
2660	* F=0 (no poll command; unsolicited frame) */
2661	msg->xid_info[0] = 0x81; /* XID format identifier */
2662	msg->xid_info[1] = 1; /* LLC types/classes: Type 1 LLC */
2663	msg->xid_info[2] = 0; /* XID sender's receive window size (RW) */
2664
2665	skb->dev = dev;
2666	skb->protocol = eth_type_trans(skb, dev);
2667	memset(skb->cb, 0, sizeof(skb->cb));
2668	netif_rx(skb);
2669	}
2670	EXPORT_SYMBOL(cfg80211_send_layer2_update);
2671
2672	int ieee80211_get_vht_max_nss(struct ieee80211_vht_cap *cap,
2673	enum ieee80211_vht_chanwidth bw,
2674	int mcs, bool ext_nss_bw_capable,
2675	unsigned int max_vht_nss)
2676	{
2677	u16 map = le16_to_cpu(cap->supp_mcs.rx_mcs_map);
2678	int ext_nss_bw;
2679	int supp_width;
2680	int i, mcs_encoding;
2681
2682	if (map == 0xffff)
2683	return 0;
2684
2685	if (WARN_ON(mcs > 9 || max_vht_nss > 8))
2686	return 0;
2687	if (mcs <= 7)
2688	mcs_encoding = 0;
2689	else if (mcs == 8)
2690	mcs_encoding = 1;
2691	else
2692	mcs_encoding = 2;
2693
2694	if (!max_vht_nss) {
2695	/* find max_vht_nss for the given MCS */
2696	for (i = 7; i >= 0; i--) {
2697	int supp = (map >> (2 * i)) & 3;
2698
2699	if (supp == 3)
2700	continue;
2701
2702	if (supp >= mcs_encoding) {
2703	max_vht_nss = i + 1;
2704	break;
2705	}
2706	}
2707	}
2708
2709	if (!(cap->supp_mcs.tx_mcs_map &
2710	cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE)))
2711	return max_vht_nss;
2712
2713	ext_nss_bw = le32_get_bits(v: cap->vht_cap_info,
2714	IEEE80211_VHT_CAP_EXT_NSS_BW_MASK);
2715	supp_width = le32_get_bits(v: cap->vht_cap_info,
2716	IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK);
2717
2718	/* if not capable, treat ext_nss_bw as 0 */
2719	if (!ext_nss_bw_capable)
2720	ext_nss_bw = 0;
2721
2722	/* This is invalid */
2723	if (supp_width == 3)
2724	return 0;
2725
2726	/* This is an invalid combination so pretend nothing is supported */
2727	if (supp_width == 2 && (ext_nss_bw == 1 || ext_nss_bw == 2))
2728	return 0;
2729
2730	/*
2731	* Cover all the special cases according to IEEE 802.11-2016
2732	* Table 9-250. All other cases are either factor of 1 or not
2733	* valid/supported.
2734	*/
2735	switch (bw) {
2736	case IEEE80211_VHT_CHANWIDTH_USE_HT:
2737	case IEEE80211_VHT_CHANWIDTH_80MHZ:
2738	if ((supp_width == 1 || supp_width == 2) &&
2739	ext_nss_bw == 3)
2740	return 2 * max_vht_nss;
2741	break;
2742	case IEEE80211_VHT_CHANWIDTH_160MHZ:
2743	if (supp_width == 0 &&
2744	(ext_nss_bw == 1 || ext_nss_bw == 2))
2745	return max_vht_nss / 2;
2746	if (supp_width == 0 &&
2747	ext_nss_bw == 3)
2748	return (3 * max_vht_nss) / 4;
2749	if (supp_width == 1 &&
2750	ext_nss_bw == 3)
2751	return 2 * max_vht_nss;
2752	break;
2753	case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
2754	if (supp_width == 0 && ext_nss_bw == 1)
2755	return 0; /* not possible */
2756	if (supp_width == 0 &&
2757	ext_nss_bw == 2)
2758	return max_vht_nss / 2;
2759	if (supp_width == 0 &&
2760	ext_nss_bw == 3)
2761	return (3 * max_vht_nss) / 4;
2762	if (supp_width == 1 &&
2763	ext_nss_bw == 0)
2764	return 0; /* not possible */
2765	if (supp_width == 1 &&
2766	ext_nss_bw == 1)
2767	return max_vht_nss / 2;
2768	if (supp_width == 1 &&
2769	ext_nss_bw == 2)
2770	return (3 * max_vht_nss) / 4;
2771	break;
2772	}
2773
2774	/* not covered or invalid combination received */
2775	return max_vht_nss;
2776	}
2777	EXPORT_SYMBOL(ieee80211_get_vht_max_nss);
2778
2779	bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype,
2780	bool is_4addr, u8 check_swif)
2781
2782	{
2783	bool is_vlan = iftype == NL80211_IFTYPE_AP_VLAN;
2784
2785	switch (check_swif) {
2786	case 0:
2787	if (is_vlan && is_4addr)
2788	return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
2789	return wiphy->interface_modes & BIT(iftype);
2790	case 1:
2791	if (!(wiphy->software_iftypes & BIT(iftype)) && is_vlan)
2792	return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
2793	return wiphy->software_iftypes & BIT(iftype);
2794	default:
2795	break;
2796	}
2797
2798	return false;
2799	}
2800	EXPORT_SYMBOL(cfg80211_iftype_allowed);
2801
2802	void cfg80211_remove_link(struct wireless_dev *wdev, unsigned int link_id)
2803	{
2804	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy: wdev->wiphy);
2805
2806	lockdep_assert_wiphy(wdev->wiphy);
2807
2808	switch (wdev->iftype) {
2809	case NL80211_IFTYPE_AP:
2810	case NL80211_IFTYPE_P2P_GO:
2811	cfg80211_stop_ap(rdev, dev: wdev->netdev, link: link_id, notify: true);
2812	break;
2813	default:
2814	/* per-link not relevant */
2815	break;
2816	}
2817
2818	wdev->valid_links &= ~BIT(link_id);
2819
2820	rdev_del_intf_link(rdev, wdev, link_id);
2821
2822	eth_zero_addr(addr: wdev->links[link_id].addr);
2823	}
2824
2825	void cfg80211_remove_links(struct wireless_dev *wdev)
2826	{
2827	unsigned int link_id;
2828
2829	/*
2830	* links are controlled by upper layers (userspace/cfg)
2831	* only for AP mode, so only remove them here for AP
2832	*/
2833	if (wdev->iftype != NL80211_IFTYPE_AP)
2834	return;
2835
2836	if (wdev->valid_links) {
2837	for_each_valid_link(wdev, link_id)
2838	cfg80211_remove_link(wdev, link_id);
2839	}
2840	}
2841
2842	int cfg80211_remove_virtual_intf(struct cfg80211_registered_device *rdev,
2843	struct wireless_dev *wdev)
2844	{
2845	cfg80211_remove_links(wdev);
2846
2847	return rdev_del_virtual_intf(rdev, wdev);
2848	}
2849
2850	const struct wiphy_iftype_ext_capab *
2851	cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type)
2852	{
2853	int i;
2854
2855	for (i = 0; i < wiphy->num_iftype_ext_capab; i++) {
2856	if (wiphy->iftype_ext_capab[i].iftype == type)
2857	return &wiphy->iftype_ext_capab[i];
2858	}
2859
2860	return NULL;
2861	}
2862	EXPORT_SYMBOL(cfg80211_get_iftype_ext_capa);
2863