net/mac80211/iface.c

   1 /*
   2  * Interface handling
   3  *
   4  * Copyright 2002-2005, Instant802 Networks, Inc.
   5  * Copyright 2005-2006, Devicescape Software, Inc.
   6  * Copyright (c) 2006 Jiri Benc <jbenc@suse.cz>
   7  * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
   8  * Copyright 2013-2014  Intel Mobile Communications GmbH
   9  * Copyright (c) 2016        Intel Deutschland GmbH
  10  * Copyright (C) 2018 Intel Corporation
  11  *
  12  * This program is free software; you can redistribute it and/or modify
  13  * it under the terms of the GNU General Public License version 2 as
  14  * published by the Free Software Foundation.
  15  */
  16 #include <linux/slab.h>
  17 #include <linux/kernel.h>
  18 #include <linux/if_arp.h>
  19 #include <linux/netdevice.h>
  20 #include <linux/rtnetlink.h>
  21 #include <net/mac80211.h>
  22 #include <net/ieee80211_radiotap.h>
  23 #include "ieee80211_i.h"
  24 #include "sta_info.h"
  25 #include "debugfs_netdev.h"
  26 #include "mesh.h"
  27 #include "led.h"
  28 #include "driver-ops.h"
  29 #include "wme.h"
  30 #include "rate.h"
  31
  32 /**
  33  * DOC: Interface list locking
  34  *
  35  * The interface list in each struct ieee80211_local is protected
  36  * three-fold:
  37  *
  38  * (1) modifications may only be done under the RTNL
  39  * (2) modifications and readers are protected against each other by
  40  *     the iflist_mtx.
  41  * (3) modifications are done in an RCU manner so atomic readers
  42  *     can traverse the list in RCU-safe blocks.
  43  *
  44  * As a consequence, reads (traversals) of the list can be protected
  45  * by either the RTNL, the iflist_mtx or RCU.
  46  */
  47
  48 static void ieee80211_iface_work(struct work_struct *work);
  49
  50 bool __ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata)
  51 {
  52         struct ieee80211_chanctx_conf *chanctx_conf;
  53         int power;
  54
  55         rcu_read_lock();
  56         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
  57         if (!chanctx_conf) {
  58                 rcu_read_unlock();
  59                 return false;
  60         }
  61
  62         power = ieee80211_chandef_max_power(&chanctx_conf->def);
  63         rcu_read_unlock();
  64
  65         if (sdata->user_power_level != IEEE80211_UNSET_POWER_LEVEL)
  66                 power = min(power, sdata->user_power_level);
  67
  68         if (sdata->ap_power_level != IEEE80211_UNSET_POWER_LEVEL)
  69                 power = min(power, sdata->ap_power_level);
  70
  71         if (power != sdata->vif.bss_conf.txpower) {
  72                 sdata->vif.bss_conf.txpower = power;
  73                 ieee80211_hw_config(sdata->local, 0);
  74                 return true;
  75         }
  76
  77         return false;
  78 }
  79
  80 void ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata,
  81                               bool update_bss)
  82 {
  83         if (__ieee80211_recalc_txpower(sdata) ||
  84             (update_bss && ieee80211_sdata_running(sdata)))
  85                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_TXPOWER);
  86 }
  87
  88 static u32 __ieee80211_idle_off(struct ieee80211_local *local)
  89 {
  90         if (!(local->hw.conf.flags & IEEE80211_CONF_IDLE))
  91                 return 0;
  92
  93         local->hw.conf.flags &= ~IEEE80211_CONF_IDLE;
  94         return IEEE80211_CONF_CHANGE_IDLE;
  95 }
  96
  97 static u32 __ieee80211_idle_on(struct ieee80211_local *local)
  98 {
  99         if (local->hw.conf.flags & IEEE80211_CONF_IDLE)
 100                 return 0;
 101
 102         ieee80211_flush_queues(local, NULL, false);
 103
 104         local->hw.conf.flags |= IEEE80211_CONF_IDLE;
 105         return IEEE80211_CONF_CHANGE_IDLE;
 106 }
 107
 108 static u32 __ieee80211_recalc_idle(struct ieee80211_local *local,
 109                                    bool force_active)
 110 {
 111         bool working, scanning, active;
 112         unsigned int led_trig_start = 0, led_trig_stop = 0;
 113
 114         lockdep_assert_held(&local->mtx);
 115
 116         active = force_active ||
 117                  !list_empty(&local->chanctx_list) ||
 118                  local->monitors;
 119
 120         working = !local->ops->remain_on_channel &&
 121                   !list_empty(&local->roc_list);
 122
 123         scanning = test_bit(SCAN_SW_SCANNING, &local->scanning) ||
 124                    test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning);
 125
 126         if (working || scanning)
 127                 led_trig_start |= IEEE80211_TPT_LEDTRIG_FL_WORK;
 128         else
 129                 led_trig_stop |= IEEE80211_TPT_LEDTRIG_FL_WORK;
 130
 131         if (active)
 132                 led_trig_start |= IEEE80211_TPT_LEDTRIG_FL_CONNECTED;
 133         else
 134                 led_trig_stop |= IEEE80211_TPT_LEDTRIG_FL_CONNECTED;
 135
 136         ieee80211_mod_tpt_led_trig(local, led_trig_start, led_trig_stop);
 137
 138         if (working || scanning || active)
 139                 return __ieee80211_idle_off(local);
 140         return __ieee80211_idle_on(local);
 141 }
 142
 143 u32 ieee80211_idle_off(struct ieee80211_local *local)
 144 {
 145         return __ieee80211_recalc_idle(local, true);
 146 }
 147
 148 void ieee80211_recalc_idle(struct ieee80211_local *local)
 149 {
 150         u32 change = __ieee80211_recalc_idle(local, false);
 151         if (change)
 152                 ieee80211_hw_config(local, change);
 153 }
 154
 155 static int ieee80211_verify_mac(struct ieee80211_sub_if_data *sdata, u8 *addr,
 156                                 bool check_dup)
 157 {
 158         struct ieee80211_local *local = sdata->local;
 159         struct ieee80211_sub_if_data *iter;
 160         u64 new, mask, tmp;
 161         u8 *m;
 162         int ret = 0;
 163
 164         if (is_zero_ether_addr(local->hw.wiphy->addr_mask))
 165                 return 0;
 166
 167         m = addr;
 168         new =   ((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
 169                 ((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
 170                 ((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
 171
 172         m = local->hw.wiphy->addr_mask;
 173         mask =  ((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
 174                 ((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
 175                 ((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
 176
 177         if (!check_dup)
 178                 return ret;
 179
 180         mutex_lock(&local->iflist_mtx);
 181         list_for_each_entry(iter, &local->interfaces, list) {
 182                 if (iter == sdata)
 183                         continue;
 184
 185                 if (iter->vif.type == NL80211_IFTYPE_MONITOR &&
 186                     !(iter->u.mntr.flags & MONITOR_FLAG_ACTIVE))
 187                         continue;
 188
 189                 m = iter->vif.addr;
 190                 tmp =   ((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
 191                         ((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
 192                         ((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
 193
 194                 if ((new & ~mask) != (tmp & ~mask)) {
 195                         ret = -EINVAL;
 196                         break;
 197                 }
 198         }
 199         mutex_unlock(&local->iflist_mtx);
 200
 201         return ret;
 202 }
 203
 204 static int ieee80211_change_mac(struct net_device *dev, void *addr)
 205 {
 206         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 207         struct sockaddr *sa = addr;
 208         bool check_dup = true;
 209         int ret;
 210
 211         if (ieee80211_sdata_running(sdata))
 212                 return -EBUSY;
 213
 214         if (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
 215             !(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE))
 216                 check_dup = false;
 217
 218         ret = ieee80211_verify_mac(sdata, sa->sa_data, check_dup);
 219         if (ret)
 220                 return ret;
 221
 222         ret = eth_mac_addr(dev, sa);
 223
 224         if (ret == 0)
 225                 memcpy(sdata->vif.addr, sa->sa_data, ETH_ALEN);
 226
 227         return ret;
 228 }
 229
 230 static inline int identical_mac_addr_allowed(int type1, int type2)
 231 {
 232         return type1 == NL80211_IFTYPE_MONITOR ||
 233                 type2 == NL80211_IFTYPE_MONITOR ||
 234                 type1 == NL80211_IFTYPE_P2P_DEVICE ||
 235                 type2 == NL80211_IFTYPE_P2P_DEVICE ||
 236                 (type1 == NL80211_IFTYPE_AP && type2 == NL80211_IFTYPE_WDS) ||
 237                 (type1 == NL80211_IFTYPE_WDS &&
 238                         (type2 == NL80211_IFTYPE_WDS ||
 239                          type2 == NL80211_IFTYPE_AP)) ||
 240                 (type1 == NL80211_IFTYPE_AP && type2 == NL80211_IFTYPE_AP_VLAN) ||
 241                 (type1 == NL80211_IFTYPE_AP_VLAN &&
 242                         (type2 == NL80211_IFTYPE_AP ||
 243                          type2 == NL80211_IFTYPE_AP_VLAN));
 244 }
 245
 246 static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,
 247                                             enum nl80211_iftype iftype)
 248 {
 249         struct ieee80211_local *local = sdata->local;
 250         struct ieee80211_sub_if_data *nsdata;
 251         int ret;
 252
 253         ASSERT_RTNL();
 254
 255         /* we hold the RTNL here so can safely walk the list */
 256         list_for_each_entry(nsdata, &local->interfaces, list) {
 257                 if (nsdata != sdata && ieee80211_sdata_running(nsdata)) {
 258                         /*
 259                          * Only OCB and monitor mode may coexist
 260                          */
 261                         if ((sdata->vif.type == NL80211_IFTYPE_OCB &&
 262                              nsdata->vif.type != NL80211_IFTYPE_MONITOR) ||
 263                             (sdata->vif.type != NL80211_IFTYPE_MONITOR &&
 264                              nsdata->vif.type == NL80211_IFTYPE_OCB))
 265                                 return -EBUSY;
 266
 267                         /*
 268                          * Allow only a single IBSS interface to be up at any
 269                          * time. This is restricted because beacon distribution
 270                          * cannot work properly if both are in the same IBSS.
 271                          *
 272                          * To remove this restriction we'd have to disallow them
 273                          * from setting the same SSID on different IBSS interfaces
 274                          * belonging to the same hardware. Then, however, we're
 275                          * faced with having to adopt two different TSF timers...
 276                          */
 277                         if (iftype == NL80211_IFTYPE_ADHOC &&
 278                             nsdata->vif.type == NL80211_IFTYPE_ADHOC)
 279                                 return -EBUSY;
 280                         /*
 281                          * will not add another interface while any channel
 282                          * switch is active.
 283                          */
 284                         if (nsdata->vif.csa_active)
 285                                 return -EBUSY;
 286
 287                         /*
 288                          * The remaining checks are only performed for interfaces
 289                          * with the same MAC address.
 290                          */
 291                         if (!ether_addr_equal(sdata->vif.addr,
 292                                               nsdata->vif.addr))
 293                                 continue;
 294
 295                         /*
 296                          * check whether it may have the same address
 297                          */
 298                         if (!identical_mac_addr_allowed(iftype,
 299                                                         nsdata->vif.type))
 300                                 return -ENOTUNIQ;
 301
 302                         /*
 303                          * can only add VLANs to enabled APs
 304                          */
 305                         if (iftype == NL80211_IFTYPE_AP_VLAN &&
 306                             nsdata->vif.type == NL80211_IFTYPE_AP)
 307                                 sdata->bss = &nsdata->u.ap;
 308                 }
 309         }
 310
 311         mutex_lock(&local->chanctx_mtx);
 312         ret = ieee80211_check_combinations(sdata, NULL, 0, 0);
 313         mutex_unlock(&local->chanctx_mtx);
 314         return ret;
 315 }
 316
 317 static int ieee80211_check_queues(struct ieee80211_sub_if_data *sdata,
 318                                   enum nl80211_iftype iftype)
 319 {
 320         int n_queues = sdata->local->hw.queues;
 321         int i;
 322
 323         if (iftype == NL80211_IFTYPE_NAN)
 324                 return 0;
 325
 326         if (iftype != NL80211_IFTYPE_P2P_DEVICE) {
 327                 for (i = 0; i < IEEE80211_NUM_ACS; i++) {
 328                         if (WARN_ON_ONCE(sdata->vif.hw_queue[i] ==
 329                                          IEEE80211_INVAL_HW_QUEUE))
 330                                 return -EINVAL;
 331                         if (WARN_ON_ONCE(sdata->vif.hw_queue[i] >=
 332                                          n_queues))
 333                                 return -EINVAL;
 334                 }
 335         }
 336
 337         if ((iftype != NL80211_IFTYPE_AP &&
 338              iftype != NL80211_IFTYPE_P2P_GO &&
 339              iftype != NL80211_IFTYPE_MESH_POINT) ||
 340             !ieee80211_hw_check(&sdata->local->hw, QUEUE_CONTROL)) {
 341                 sdata->vif.cab_queue = IEEE80211_INVAL_HW_QUEUE;
 342                 return 0;
 343         }
 344
 345         if (WARN_ON_ONCE(sdata->vif.cab_queue == IEEE80211_INVAL_HW_QUEUE))
 346                 return -EINVAL;
 347
 348         if (WARN_ON_ONCE(sdata->vif.cab_queue >= n_queues))
 349                 return -EINVAL;
 350
 351         return 0;
 352 }
 353
 354 void ieee80211_adjust_monitor_flags(struct ieee80211_sub_if_data *sdata,
 355                                     const int offset)
 356 {
 357         struct ieee80211_local *local = sdata->local;
 358         u32 flags = sdata->u.mntr.flags;
 359
 360 #define ADJUST(_f, _s)  do {                                    \
 361         if (flags & MONITOR_FLAG_##_f)                          \
 362                 local->fif_##_s += offset;                      \
 363         } while (0)
 364
 365         ADJUST(FCSFAIL, fcsfail);
 366         ADJUST(PLCPFAIL, plcpfail);
 367         ADJUST(CONTROL, control);
 368         ADJUST(CONTROL, pspoll);
 369         ADJUST(OTHER_BSS, other_bss);
 370
 371 #undef ADJUST
 372 }
 373
 374 static void ieee80211_set_default_queues(struct ieee80211_sub_if_data *sdata)
 375 {
 376         struct ieee80211_local *local = sdata->local;
 377         int i;
 378
 379         for (i = 0; i < IEEE80211_NUM_ACS; i++) {
 380                 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
 381                         sdata->vif.hw_queue[i] = IEEE80211_INVAL_HW_QUEUE;
 382                 else if (local->hw.queues >= IEEE80211_NUM_ACS)
 383                         sdata->vif.hw_queue[i] = i;
 384                 else
 385                         sdata->vif.hw_queue[i] = 0;
 386         }
 387         sdata->vif.cab_queue = IEEE80211_INVAL_HW_QUEUE;
 388 }
 389
 390 int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
 391 {
 392         struct ieee80211_sub_if_data *sdata;
 393         int ret;
 394
 395         if (!ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF))
 396                 return 0;
 397
 398         ASSERT_RTNL();
 399
 400         if (local->monitor_sdata)
 401                 return 0;
 402
 403         sdata = kzalloc(sizeof(*sdata) + local->hw.vif_data_size, GFP_KERNEL);
 404         if (!sdata)
 405                 return -ENOMEM;
 406
 407         /* set up data */
 408         sdata->local = local;
 409         sdata->vif.type = NL80211_IFTYPE_MONITOR;
 410         snprintf(sdata->name, IFNAMSIZ, "%s-monitor",
 411                  wiphy_name(local->hw.wiphy));
 412         sdata->wdev.iftype = NL80211_IFTYPE_MONITOR;
 413
 414         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
 415
 416         ieee80211_set_default_queues(sdata);
 417
 418         ret = drv_add_interface(local, sdata);
 419         if (WARN_ON(ret)) {
 420                 /* ok .. stupid driver, it asked for this! */
 421                 kfree(sdata);
 422                 return ret;
 423         }
 424
 425         ret = ieee80211_check_queues(sdata, NL80211_IFTYPE_MONITOR);
 426         if (ret) {
 427                 kfree(sdata);
 428                 return ret;
 429         }
 430
 431         mutex_lock(&local->iflist_mtx);
 432         rcu_assign_pointer(local->monitor_sdata, sdata);
 433         mutex_unlock(&local->iflist_mtx);
 434
 435         mutex_lock(&local->mtx);
 436         ret = ieee80211_vif_use_channel(sdata, &local->monitor_chandef,
 437                                         IEEE80211_CHANCTX_EXCLUSIVE);
 438         mutex_unlock(&local->mtx);
 439         if (ret) {
 440                 mutex_lock(&local->iflist_mtx);
 441                 RCU_INIT_POINTER(local->monitor_sdata, NULL);
 442                 mutex_unlock(&local->iflist_mtx);
 443                 synchronize_net();
 444                 drv_remove_interface(local, sdata);
 445                 kfree(sdata);
 446                 return ret;
 447         }
 448
 449         skb_queue_head_init(&sdata->skb_queue);
 450         INIT_WORK(&sdata->work, ieee80211_iface_work);
 451
 452         return 0;
 453 }
 454
 455 void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
 456 {
 457         struct ieee80211_sub_if_data *sdata;
 458
 459         if (!ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF))
 460                 return;
 461
 462         ASSERT_RTNL();
 463
 464         mutex_lock(&local->iflist_mtx);
 465
 466         sdata = rcu_dereference_protected(local->monitor_sdata,
 467                                           lockdep_is_held(&local->iflist_mtx));
 468         if (!sdata) {
 469                 mutex_unlock(&local->iflist_mtx);
 470                 return;
 471         }
 472
 473         RCU_INIT_POINTER(local->monitor_sdata, NULL);
 474         mutex_unlock(&local->iflist_mtx);
 475
 476         synchronize_net();
 477
 478         mutex_lock(&local->mtx);
 479         ieee80211_vif_release_channel(sdata);
 480         mutex_unlock(&local->mtx);
 481
 482         drv_remove_interface(local, sdata);
 483
 484         kfree(sdata);
 485 }
 486
 487 /*
 488  * NOTE: Be very careful when changing this function, it must NOT return
 489  * an error on interface type changes that have been pre-checked, so most
 490  * checks should be in ieee80211_check_concurrent_iface.
 491  */
 492 int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
 493 {
 494         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 495         struct net_device *dev = wdev->netdev;
 496         struct ieee80211_local *local = sdata->local;
 497         struct sta_info *sta;
 498         u32 changed = 0;
 499         int res;
 500         u32 hw_reconf_flags = 0;
 501
 502         switch (sdata->vif.type) {
 503         case NL80211_IFTYPE_WDS:
 504                 if (!is_valid_ether_addr(sdata->u.wds.remote_addr))
 505                         return -ENOLINK;
 506                 break;
 507         case NL80211_IFTYPE_AP_VLAN: {
 508                 struct ieee80211_sub_if_data *master;
 509
 510                 if (!sdata->bss)
 511                         return -ENOLINK;
 512
 513                 mutex_lock(&local->mtx);
 514                 list_add(&sdata->u.vlan.list, &sdata->bss->vlans);
 515                 mutex_unlock(&local->mtx);
 516
 517                 master = container_of(sdata->bss,
 518                                       struct ieee80211_sub_if_data, u.ap);
 519                 sdata->control_port_protocol =
 520                         master->control_port_protocol;
 521                 sdata->control_port_no_encrypt =
 522                         master->control_port_no_encrypt;
 523                 sdata->control_port_over_nl80211 =
 524                         master->control_port_over_nl80211;
 525                 sdata->vif.cab_queue = master->vif.cab_queue;
 526                 memcpy(sdata->vif.hw_queue, master->vif.hw_queue,
 527                        sizeof(sdata->vif.hw_queue));
 528                 sdata->vif.bss_conf.chandef = master->vif.bss_conf.chandef;
 529
 530                 mutex_lock(&local->key_mtx);
 531                 sdata->crypto_tx_tailroom_needed_cnt +=
 532                         master->crypto_tx_tailroom_needed_cnt;
 533                 mutex_unlock(&local->key_mtx);
 534
 535                 break;
 536                 }
 537         case NL80211_IFTYPE_AP:
 538                 sdata->bss = &sdata->u.ap;
 539                 break;
 540         case NL80211_IFTYPE_MESH_POINT:
 541         case NL80211_IFTYPE_STATION:
 542         case NL80211_IFTYPE_MONITOR:
 543         case NL80211_IFTYPE_ADHOC:
 544         case NL80211_IFTYPE_P2P_DEVICE:
 545         case NL80211_IFTYPE_OCB:
 546         case NL80211_IFTYPE_NAN:
 547                 /* no special treatment */
 548                 break;
 549         case NL80211_IFTYPE_UNSPECIFIED:
 550         case NUM_NL80211_IFTYPES:
 551         case NL80211_IFTYPE_P2P_CLIENT:
 552         case NL80211_IFTYPE_P2P_GO:
 553                 /* cannot happen */
 554                 WARN_ON(1);
 555                 break;
 556         }
 557
 558         if (local->open_count == 0) {
 559                 res = drv_start(local);
 560                 if (res)
 561                         goto err_del_bss;
 562                 /* we're brought up, everything changes */
 563                 hw_reconf_flags = ~0;
 564                 ieee80211_led_radio(local, true);
 565                 ieee80211_mod_tpt_led_trig(local,
 566                                            IEEE80211_TPT_LEDTRIG_FL_RADIO, 0);
 567         }
 568
 569         /*
 570          * Copy the hopefully now-present MAC address to
 571          * this interface, if it has the special null one.
 572          */
 573         if (dev && is_zero_ether_addr(dev->dev_addr)) {
 574                 memcpy(dev->dev_addr,
 575                        local->hw.wiphy->perm_addr,
 576                        ETH_ALEN);
 577                 memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
 578
 579                 if (!is_valid_ether_addr(dev->dev_addr)) {
 580                         res = -EADDRNOTAVAIL;
 581                         goto err_stop;
 582                 }
 583         }
 584
 585         switch (sdata->vif.type) {
 586         case NL80211_IFTYPE_AP_VLAN:
 587                 /* no need to tell driver, but set carrier and chanctx */
 588                 if (rtnl_dereference(sdata->bss->beacon)) {
 589                         ieee80211_vif_vlan_copy_chanctx(sdata);
 590                         netif_carrier_on(dev);
 591                 } else {
 592                         netif_carrier_off(dev);
 593                 }
 594                 break;
 595         case NL80211_IFTYPE_MONITOR:
 596                 if (sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES) {
 597                         local->cooked_mntrs++;
 598                         break;
 599                 }
 600
 601                 if (sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE) {
 602                         res = drv_add_interface(local, sdata);
 603                         if (res)
 604                                 goto err_stop;
 605                 } else if (local->monitors == 0 && local->open_count == 0) {
 606                         res = ieee80211_add_virtual_monitor(local);
 607                         if (res)
 608                                 goto err_stop;
 609                 }
 610
 611                 /* must be before the call to ieee80211_configure_filter */
 612                 local->monitors++;
 613                 if (local->monitors == 1) {
 614                         local->hw.conf.flags |= IEEE80211_CONF_MONITOR;
 615                         hw_reconf_flags |= IEEE80211_CONF_CHANGE_MONITOR;
 616                 }
 617
 618                 ieee80211_adjust_monitor_flags(sdata, 1);
 619                 ieee80211_configure_filter(local);
 620                 mutex_lock(&local->mtx);
 621                 ieee80211_recalc_idle(local);
 622                 mutex_unlock(&local->mtx);
 623
 624                 netif_carrier_on(dev);
 625                 break;
 626         default:
 627                 if (coming_up) {
 628                         ieee80211_del_virtual_monitor(local);
 629
 630                         res = drv_add_interface(local, sdata);
 631                         if (res)
 632                                 goto err_stop;
 633                         res = ieee80211_check_queues(sdata,
 634                                 ieee80211_vif_type_p2p(&sdata->vif));
 635                         if (res)
 636                                 goto err_del_interface;
 637                 }
 638
 639                 if (sdata->vif.type == NL80211_IFTYPE_AP) {
 640                         local->fif_pspoll++;
 641                         local->fif_probe_req++;
 642
 643                         ieee80211_configure_filter(local);
 644                 } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
 645                         local->fif_probe_req++;
 646                 }
 647
 648                 if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
 649                     sdata->vif.type != NL80211_IFTYPE_NAN)
 650                         changed |= ieee80211_reset_erp_info(sdata);
 651                 ieee80211_bss_info_change_notify(sdata, changed);
 652
 653                 switch (sdata->vif.type) {
 654                 case NL80211_IFTYPE_STATION:
 655                 case NL80211_IFTYPE_ADHOC:
 656                 case NL80211_IFTYPE_AP:
 657                 case NL80211_IFTYPE_MESH_POINT:
 658                 case NL80211_IFTYPE_OCB:
 659                         netif_carrier_off(dev);
 660                         break;
 661                 case NL80211_IFTYPE_WDS:
 662                 case NL80211_IFTYPE_P2P_DEVICE:
 663                 case NL80211_IFTYPE_NAN:
 664                         break;
 665                 default:
 666                         /* not reached */
 667                         WARN_ON(1);
 668                 }
 669
 670                 /*
 671                  * Set default queue parameters so drivers don't
 672                  * need to initialise the hardware if the hardware
 673                  * doesn't start up with sane defaults.
 674                  * Enable QoS for anything but station interfaces.
 675                  */
 676                 ieee80211_set_wmm_default(sdata, true,
 677                         sdata->vif.type != NL80211_IFTYPE_STATION);
 678         }
 679
 680         set_bit(SDATA_STATE_RUNNING, &sdata->state);
 681
 682         switch (sdata->vif.type) {
 683         case NL80211_IFTYPE_WDS:
 684                 /* Create STA entry for the WDS peer */
 685                 sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
 686                                      GFP_KERNEL);
 687                 if (!sta) {
 688                         res = -ENOMEM;
 689                         goto err_del_interface;
 690                 }
 691
 692                 sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
 693                 sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
 694                 sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 695
 696                 res = sta_info_insert(sta);
 697                 if (res) {
 698                         /* STA has been freed */
 699                         goto err_del_interface;
 700                 }
 701
 702                 rate_control_rate_init(sta);
 703                 netif_carrier_on(dev);
 704                 break;
 705         case NL80211_IFTYPE_P2P_DEVICE:
 706                 rcu_assign_pointer(local->p2p_sdata, sdata);
 707                 break;
 708         case NL80211_IFTYPE_MONITOR:
 709                 if (sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES)
 710                         break;
 711                 list_add_tail_rcu(&sdata->u.mntr.list, &local->mon_list);
 712                 break;
 713         default:
 714                 break;
 715         }
 716
 717         /*
 718          * set_multicast_list will be invoked by the networking core
 719          * which will check whether any increments here were done in
 720          * error and sync them down to the hardware as filter flags.
 721          */
 722         if (sdata->flags & IEEE80211_SDATA_ALLMULTI)
 723                 atomic_inc(&local->iff_allmultis);
 724
 725         if (coming_up)
 726                 local->open_count++;
 727
 728         if (hw_reconf_flags)
 729                 ieee80211_hw_config(local, hw_reconf_flags);
 730
 731         ieee80211_recalc_ps(local);
 732
 733         if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
 734             sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
 735             local->ops->wake_tx_queue) {
 736                 /* XXX: for AP_VLAN, actually track AP queues */
 737                 if (dev)
 738                         netif_tx_start_all_queues(dev);
 739         } else if (dev) {
 740                 unsigned long flags;
 741                 int n_acs = IEEE80211_NUM_ACS;
 742                 int ac;
 743
 744                 if (local->hw.queues < IEEE80211_NUM_ACS)
 745                         n_acs = 1;
 746
 747                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 748                 if (sdata->vif.cab_queue == IEEE80211_INVAL_HW_QUEUE ||
 749                     (local->queue_stop_reasons[sdata->vif.cab_queue] == 0 &&
 750                      skb_queue_empty(&local->pending[sdata->vif.cab_queue]))) {
 751                         for (ac = 0; ac < n_acs; ac++) {
 752                                 int ac_queue = sdata->vif.hw_queue[ac];
 753
 754                                 if (local->queue_stop_reasons[ac_queue] == 0 &&
 755                                     skb_queue_empty(&local->pending[ac_queue]))
 756                                         netif_start_subqueue(dev, ac);
 757                         }
 758                 }
 759                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 760         }
 761
 762         return 0;
 763  err_del_interface:
 764         drv_remove_interface(local, sdata);
 765  err_stop:
 766         if (!local->open_count)
 767                 drv_stop(local);
 768  err_del_bss:
 769         sdata->bss = NULL;
 770         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
 771                 mutex_lock(&local->mtx);
 772                 list_del(&sdata->u.vlan.list);
 773                 mutex_unlock(&local->mtx);
 774         }
 775         /* might already be clear but that doesn't matter */
 776         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
 777         return res;
 778 }
 779
 780 static int ieee80211_open(struct net_device *dev)
 781 {
 782         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 783         int err;
 784
 785         /* fail early if user set an invalid address */
 786         if (!is_valid_ether_addr(dev->dev_addr))
 787                 return -EADDRNOTAVAIL;
 788
 789         err = ieee80211_check_concurrent_iface(sdata, sdata->vif.type);
 790         if (err)
 791                 return err;
 792
 793         return ieee80211_do_open(&sdata->wdev, true);
 794 }
 795
 796 static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
 797                               bool going_down)
 798 {
 799         struct ieee80211_local *local = sdata->local;
 800         unsigned long flags;
 801         struct sk_buff *skb, *tmp;
 802         u32 hw_reconf_flags = 0;
 803         int i, flushed;
 804         struct ps_data *ps;
 805         struct cfg80211_chan_def chandef;
 806         bool cancel_scan;
 807         struct cfg80211_nan_func *func;
 808
 809         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
 810
 811         cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
 812         if (cancel_scan)
 813                 ieee80211_scan_cancel(local);
 814
 815         /*
 816          * Stop TX on this interface first.
 817          */
 818         if (sdata->dev)
 819                 netif_tx_stop_all_queues(sdata->dev);
 820
 821         ieee80211_roc_purge(local, sdata);
 822
 823         switch (sdata->vif.type) {
 824         case NL80211_IFTYPE_STATION:
 825                 ieee80211_mgd_stop(sdata);
 826                 break;
 827         case NL80211_IFTYPE_ADHOC:
 828                 ieee80211_ibss_stop(sdata);
 829                 break;
 830         case NL80211_IFTYPE_AP:
 831                 cancel_work_sync(&sdata->u.ap.request_smps_work);
 832                 break;
 833         case NL80211_IFTYPE_MONITOR:
 834                 if (sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES)
 835                         break;
 836                 list_del_rcu(&sdata->u.mntr.list);
 837                 break;
 838         default:
 839                 break;
 840         }
 841
 842         /*
 843          * Remove all stations associated with this interface.
 844          *
 845          * This must be done before calling ops->remove_interface()
 846          * because otherwise we can later invoke ops->sta_notify()
 847          * whenever the STAs are removed, and that invalidates driver
 848          * assumptions about always getting a vif pointer that is valid
 849          * (because if we remove a STA after ops->remove_interface()
 850          * the driver will have removed the vif info already!)
 851          *
 852          * In WDS mode a station must exist here and be flushed, for
 853          * AP_VLANs stations may exist since there's nothing else that
 854          * would have removed them, but in other modes there shouldn't
 855          * be any stations.
 856          */
 857         flushed = sta_info_flush(sdata);
 858         WARN_ON_ONCE(sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
 859                      ((sdata->vif.type != NL80211_IFTYPE_WDS && flushed > 0) ||
 860                       (sdata->vif.type == NL80211_IFTYPE_WDS && flushed != 1)));
 861
 862         /* don't count this interface for allmulti while it is down */
 863         if (sdata->flags & IEEE80211_SDATA_ALLMULTI)
 864                 atomic_dec(&local->iff_allmultis);
 865
 866         if (sdata->vif.type == NL80211_IFTYPE_AP) {
 867                 local->fif_pspoll--;
 868                 local->fif_probe_req--;
 869         } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
 870                 local->fif_probe_req--;
 871         }
 872
 873         if (sdata->dev) {
 874                 netif_addr_lock_bh(sdata->dev);
 875                 spin_lock_bh(&local->filter_lock);
 876                 __hw_addr_unsync(&local->mc_list, &sdata->dev->mc,
 877                                  sdata->dev->addr_len);
 878                 spin_unlock_bh(&local->filter_lock);
 879                 netif_addr_unlock_bh(sdata->dev);
 880         }
 881
 882         del_timer_sync(&local->dynamic_ps_timer);
 883         cancel_work_sync(&local->dynamic_ps_enable_work);
 884
 885         cancel_work_sync(&sdata->recalc_smps);
 886         sdata_lock(sdata);
 887         mutex_lock(&local->mtx);
 888         sdata->vif.csa_active = false;
 889         if (sdata->vif.type == NL80211_IFTYPE_STATION)
 890                 sdata->u.mgd.csa_waiting_bcn = false;
 891         if (sdata->csa_block_tx) {
 892                 ieee80211_wake_vif_queues(local, sdata,
 893                                           IEEE80211_QUEUE_STOP_REASON_CSA);
 894                 sdata->csa_block_tx = false;
 895         }
 896         mutex_unlock(&local->mtx);
 897         sdata_unlock(sdata);
 898
 899         cancel_work_sync(&sdata->csa_finalize_work);
 900
 901         cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
 902
 903         if (sdata->wdev.cac_started) {
 904                 chandef = sdata->vif.bss_conf.chandef;
 905                 WARN_ON(local->suspended);
 906                 mutex_lock(&local->mtx);
 907                 ieee80211_vif_release_channel(sdata);
 908                 mutex_unlock(&local->mtx);
 909                 cfg80211_cac_event(sdata->dev, &chandef,
 910                                    NL80211_RADAR_CAC_ABORTED,
 911                                    GFP_KERNEL);
 912         }
 913
 914         /* APs need special treatment */
 915         if (sdata->vif.type == NL80211_IFTYPE_AP) {
 916                 struct ieee80211_sub_if_data *vlan, *tmpsdata;
 917
 918                 /* down all dependent devices, that is VLANs */
 919                 list_for_each_entry_safe(vlan, tmpsdata, &sdata->u.ap.vlans,
 920                                          u.vlan.list)
 921                         dev_close(vlan->dev);
 922                 WARN_ON(!list_empty(&sdata->u.ap.vlans));
 923         } else if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
 924                 /* remove all packets in parent bc_buf pointing to this dev */
 925                 ps = &sdata->bss->ps;
 926
 927                 spin_lock_irqsave(&ps->bc_buf.lock, flags);
 928                 skb_queue_walk_safe(&ps->bc_buf, skb, tmp) {
 929                         if (skb->dev == sdata->dev) {
 930                                 __skb_unlink(skb, &ps->bc_buf);
 931                                 local->total_ps_buffered--;
 932                                 ieee80211_free_txskb(&local->hw, skb);
 933                         }
 934                 }
 935                 spin_unlock_irqrestore(&ps->bc_buf.lock, flags);
 936         }
 937
 938         if (going_down)
 939                 local->open_count--;
 940
 941         switch (sdata->vif.type) {
 942         case NL80211_IFTYPE_AP_VLAN:
 943                 mutex_lock(&local->mtx);
 944                 list_del(&sdata->u.vlan.list);
 945                 mutex_unlock(&local->mtx);
 946                 RCU_INIT_POINTER(sdata->vif.chanctx_conf, NULL);
 947                 /* see comment in the default case below */
 948                 ieee80211_free_keys(sdata, true);
 949                 /* no need to tell driver */
 950                 break;
 951         case NL80211_IFTYPE_MONITOR:
 952                 if (sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES) {
 953                         local->cooked_mntrs--;
 954                         break;
 955                 }
 956
 957                 local->monitors--;
 958                 if (local->monitors == 0) {
 959                         local->hw.conf.flags &= ~IEEE80211_CONF_MONITOR;
 960                         hw_reconf_flags |= IEEE80211_CONF_CHANGE_MONITOR;
 961                 }
 962
 963                 ieee80211_adjust_monitor_flags(sdata, -1);
 964                 break;
 965         case NL80211_IFTYPE_NAN:
 966                 /* clean all the functions */
 967                 spin_lock_bh(&sdata->u.nan.func_lock);
 968
 969                 idr_for_each_entry(&sdata->u.nan.function_inst_ids, func, i) {
 970                         idr_remove(&sdata->u.nan.function_inst_ids, i);
 971                         cfg80211_free_nan_func(func);
 972                 }
 973                 idr_destroy(&sdata->u.nan.function_inst_ids);
 974
 975                 spin_unlock_bh(&sdata->u.nan.func_lock);
 976                 break;
 977         case NL80211_IFTYPE_P2P_DEVICE:
 978                 /* relies on synchronize_rcu() below */
 979                 RCU_INIT_POINTER(local->p2p_sdata, NULL);
 980                 /* fall through */
 981         default:
 982                 cancel_work_sync(&sdata->work);
 983                 /*
 984                  * When we get here, the interface is marked down.
 985                  * Free the remaining keys, if there are any
 986                  * (which can happen in AP mode if userspace sets
 987                  * keys before the interface is operating, and maybe
 988                  * also in WDS mode)
 989                  *
 990                  * Force the key freeing to always synchronize_net()
 991                  * to wait for the RX path in case it is using this
 992                  * interface enqueuing frames at this very time on
 993                  * another CPU.
 994                  */
 995                 ieee80211_free_keys(sdata, true);
 996                 skb_queue_purge(&sdata->skb_queue);
 997         }
 998
 999         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
1000         for (i = 0; i < IEEE80211_MAX_QUEUES; i++) {
1001                 skb_queue_walk_safe(&local->pending[i], skb, tmp) {
1002                         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1003                         if (info->control.vif == &sdata->vif) {
1004                                 __skb_unlink(skb, &local->pending[i]);
1005                                 ieee80211_free_txskb(&local->hw, skb);
1006                         }
1007                 }
1008         }
1009         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1010
1011         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1012                 ieee80211_txq_remove_vlan(local, sdata);
1013
1014         sdata->bss = NULL;
1015
1016         if (local->open_count == 0)
1017                 ieee80211_clear_tx_pending(local);
1018
1019         sdata->vif.bss_conf.beacon_int = 0;
1020
1021         /*
1022          * If the interface goes down while suspended, presumably because
1023          * the device was unplugged and that happens before our resume,
1024          * then the driver is already unconfigured and the remainder of
1025          * this function isn't needed.
1026          * XXX: what about WoWLAN? If the device has software state, e.g.
1027          *      memory allocated, it might expect teardown commands from
1028          *      mac80211 here?
1029          */
1030         if (local->suspended) {
1031                 WARN_ON(local->wowlan);
1032                 WARN_ON(rtnl_dereference(local->monitor_sdata));
1033                 return;
1034         }
1035
1036         switch (sdata->vif.type) {
1037         case NL80211_IFTYPE_AP_VLAN:
1038                 break;
1039         case NL80211_IFTYPE_MONITOR:
1040                 if (local->monitors == 0)
1041                         ieee80211_del_virtual_monitor(local);
1042
1043                 mutex_lock(&local->mtx);
1044                 ieee80211_recalc_idle(local);
1045                 mutex_unlock(&local->mtx);
1046
1047                 if (!(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE))
1048                         break;
1049
1050                 /* fall through */
1051         default:
1052                 if (going_down)
1053                         drv_remove_interface(local, sdata);
1054         }
1055
1056         ieee80211_recalc_ps(local);
1057
1058         if (cancel_scan)
1059                 flush_delayed_work(&local->scan_work);
1060
1061         if (local->open_count == 0) {
1062                 ieee80211_stop_device(local);
1063
1064                 /* no reconfiguring after stop! */
1065                 return;
1066         }
1067
1068         /* do after stop to avoid reconfiguring when we stop anyway */
1069         ieee80211_configure_filter(local);
1070         ieee80211_hw_config(local, hw_reconf_flags);
1071
1072         if (local->monitors == local->open_count)
1073                 ieee80211_add_virtual_monitor(local);
1074 }
1075
1076 static int ieee80211_stop(struct net_device *dev)
1077 {
1078         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1079
1080         ieee80211_do_stop(sdata, true);
1081
1082         return 0;
1083 }
1084
1085 static void ieee80211_set_multicast_list(struct net_device *dev)
1086 {
1087         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1088         struct ieee80211_local *local = sdata->local;
1089         int allmulti, sdata_allmulti;
1090
1091         allmulti = !!(dev->flags & IFF_ALLMULTI);
1092         sdata_allmulti = !!(sdata->flags & IEEE80211_SDATA_ALLMULTI);
1093
1094         if (allmulti != sdata_allmulti) {
1095                 if (dev->flags & IFF_ALLMULTI)
1096                         atomic_inc(&local->iff_allmultis);
1097                 else
1098                         atomic_dec(&local->iff_allmultis);
1099                 sdata->flags ^= IEEE80211_SDATA_ALLMULTI;
1100         }
1101
1102         spin_lock_bh(&local->filter_lock);
1103         __hw_addr_sync(&local->mc_list, &dev->mc, dev->addr_len);
1104         spin_unlock_bh(&local->filter_lock);
1105         ieee80211_queue_work(&local->hw, &local->reconfig_filter);
1106 }
1107
1108 /*
1109  * Called when the netdev is removed or, by the code below, before
1110  * the interface type changes.
1111  */
1112 static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata)
1113 {
1114         int i;
1115
1116         /* free extra data */
1117         ieee80211_free_keys(sdata, false);
1118
1119         ieee80211_debugfs_remove_netdev(sdata);
1120
1121         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++)
1122                 __skb_queue_purge(&sdata->fragments[i].skb_list);
1123         sdata->fragment_next = 0;
1124
1125         if (ieee80211_vif_is_mesh(&sdata->vif))
1126                 ieee80211_mesh_teardown_sdata(sdata);
1127 }
1128
1129 static void ieee80211_uninit(struct net_device *dev)
1130 {
1131         ieee80211_teardown_sdata(IEEE80211_DEV_TO_SUB_IF(dev));
1132 }
1133
1134 static u16 ieee80211_netdev_select_queue(struct net_device *dev,
1135                                          struct sk_buff *skb,
1136                                          struct net_device *sb_dev,
1137                                          select_queue_fallback_t fallback)
1138 {
1139         return ieee80211_select_queue(IEEE80211_DEV_TO_SUB_IF(dev), skb);
1140 }
1141
1142 static void
1143 ieee80211_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
1144 {
1145         int i;
1146
1147         for_each_possible_cpu(i) {
1148                 const struct pcpu_sw_netstats *tstats;
1149                 u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
1150                 unsigned int start;
1151
1152                 tstats = per_cpu_ptr(dev->tstats, i);
1153
1154                 do {
1155                         start = u64_stats_fetch_begin_irq(&tstats->syncp);
1156                         rx_packets = tstats->rx_packets;
1157                         tx_packets = tstats->tx_packets;
1158                         rx_bytes = tstats->rx_bytes;
1159                         tx_bytes = tstats->tx_bytes;
1160                 } while (u64_stats_fetch_retry_irq(&tstats->syncp, start));
1161
1162                 stats->rx_packets += rx_packets;
1163                 stats->tx_packets += tx_packets;
1164                 stats->rx_bytes   += rx_bytes;
1165                 stats->tx_bytes   += tx_bytes;
1166         }
1167 }
1168
1169 static const struct net_device_ops ieee80211_dataif_ops = {
1170         .ndo_open               = ieee80211_open,
1171         .ndo_stop               = ieee80211_stop,
1172         .ndo_uninit             = ieee80211_uninit,
1173         .ndo_start_xmit         = ieee80211_subif_start_xmit,
1174         .ndo_set_rx_mode        = ieee80211_set_multicast_list,
1175         .ndo_set_mac_address    = ieee80211_change_mac,
1176         .ndo_select_queue       = ieee80211_netdev_select_queue,
1177         .ndo_get_stats64        = ieee80211_get_stats64,
1178 };
1179
1180 static u16 ieee80211_monitor_select_queue(struct net_device *dev,
1181                                           struct sk_buff *skb,
1182                                           struct net_device *sb_dev,
1183                                           select_queue_fallback_t fallback)
1184 {
1185         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1186         struct ieee80211_local *local = sdata->local;
1187         struct ieee80211_hdr *hdr;
1188         struct ieee80211_radiotap_header *rtap = (void *)skb->data;
1189
1190         if (local->hw.queues < IEEE80211_NUM_ACS)
1191                 return 0;
1192
1193         if (skb->len < 4 ||
1194             skb->len < le16_to_cpu(rtap->it_len) + 2 /* frame control */)
1195                 return 0; /* doesn't matter, frame will be dropped */
1196
1197         hdr = (void *)((u8 *)skb->data + le16_to_cpu(rtap->it_len));
1198
1199         return ieee80211_select_queue_80211(sdata, skb, hdr);
1200 }
1201
1202 static const struct net_device_ops ieee80211_monitorif_ops = {
1203         .ndo_open               = ieee80211_open,
1204         .ndo_stop               = ieee80211_stop,
1205         .ndo_uninit             = ieee80211_uninit,
1206         .ndo_start_xmit         = ieee80211_monitor_start_xmit,
1207         .ndo_set_rx_mode        = ieee80211_set_multicast_list,
1208         .ndo_set_mac_address    = ieee80211_change_mac,
1209         .ndo_select_queue       = ieee80211_monitor_select_queue,
1210         .ndo_get_stats64        = ieee80211_get_stats64,
1211 };
1212
1213 static void ieee80211_if_free(struct net_device *dev)
1214 {
1215         free_percpu(dev->tstats);
1216 }
1217
1218 static void ieee80211_if_setup(struct net_device *dev)
1219 {
1220         ether_setup(dev);
1221         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
1222         dev->netdev_ops = &ieee80211_dataif_ops;
1223         dev->needs_free_netdev = true;
1224         dev->priv_destructor = ieee80211_if_free;
1225 }
1226
1227 static void ieee80211_if_setup_no_queue(struct net_device *dev)
1228 {
1229         ieee80211_if_setup(dev);
1230         dev->priv_flags |= IFF_NO_QUEUE;
1231 }
1232
1233 static void ieee80211_iface_work(struct work_struct *work)
1234 {
1235         struct ieee80211_sub_if_data *sdata =
1236                 container_of(work, struct ieee80211_sub_if_data, work);
1237         struct ieee80211_local *local = sdata->local;
1238         struct sk_buff *skb;
1239         struct sta_info *sta;
1240
1241         if (!ieee80211_sdata_running(sdata))
1242                 return;
1243
1244         if (test_bit(SCAN_SW_SCANNING, &local->scanning))
1245                 return;
1246
1247         if (!ieee80211_can_run_worker(local))
1248                 return;
1249
1250         /* first process frames */
1251         while ((skb = skb_dequeue(&sdata->skb_queue))) {
1252                 struct ieee80211_mgmt *mgmt = (void *)skb->data;
1253
1254                 if (ieee80211_is_action(mgmt->frame_control) &&
1255                     mgmt->u.action.category == WLAN_CATEGORY_BACK) {
1256                         int len = skb->len;
1257
1258                         mutex_lock(&local->sta_mtx);
1259                         sta = sta_info_get_bss(sdata, mgmt->sa);
1260                         if (sta) {
1261                                 switch (mgmt->u.action.u.addba_req.action_code) {
1262                                 case WLAN_ACTION_ADDBA_REQ:
1263                                         ieee80211_process_addba_request(
1264                                                         local, sta, mgmt, len);
1265                                         break;
1266                                 case WLAN_ACTION_ADDBA_RESP:
1267                                         ieee80211_process_addba_resp(local, sta,
1268                                                                      mgmt, len);
1269                                         break;
1270                                 case WLAN_ACTION_DELBA:
1271                                         ieee80211_process_delba(sdata, sta,
1272                                                                 mgmt, len);
1273                                         break;
1274                                 default:
1275                                         WARN_ON(1);
1276                                         break;
1277                                 }
1278                         }
1279                         mutex_unlock(&local->sta_mtx);
1280                 } else if (ieee80211_is_action(mgmt->frame_control) &&
1281                            mgmt->u.action.category == WLAN_CATEGORY_VHT) {
1282                         switch (mgmt->u.action.u.vht_group_notif.action_code) {
1283                         case WLAN_VHT_ACTION_OPMODE_NOTIF: {
1284                                 struct ieee80211_rx_status *status;
1285                                 enum nl80211_band band;
1286                                 u8 opmode;
1287
1288                                 status = IEEE80211_SKB_RXCB(skb);
1289                                 band = status->band;
1290                                 opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;
1291
1292                                 mutex_lock(&local->sta_mtx);
1293                                 sta = sta_info_get_bss(sdata, mgmt->sa);
1294
1295                                 if (sta)
1296                                         ieee80211_vht_handle_opmode(sdata, sta,
1297                                                                     opmode,
1298                                                                     band);
1299
1300                                 mutex_unlock(&local->sta_mtx);
1301                                 break;
1302                         }
1303                         case WLAN_VHT_ACTION_GROUPID_MGMT:
1304                                 ieee80211_process_mu_groups(sdata, mgmt);
1305                                 break;
1306                         default:
1307                                 WARN_ON(1);
1308                                 break;
1309                         }
1310                 } else if (ieee80211_is_data_qos(mgmt->frame_control)) {
1311                         struct ieee80211_hdr *hdr = (void *)mgmt;
1312                         /*
1313                          * So the frame isn't mgmt, but frame_control
1314                          * is at the right place anyway, of course, so
1315                          * the if statement is correct.
1316                          *
1317                          * Warn if we have other data frame types here,
1318                          * they must not get here.
1319                          */
1320                         WARN_ON(hdr->frame_control &
1321                                         cpu_to_le16(IEEE80211_STYPE_NULLFUNC));
1322                         WARN_ON(!(hdr->seq_ctrl &
1323                                         cpu_to_le16(IEEE80211_SCTL_FRAG)));
1324                         /*
1325                          * This was a fragment of a frame, received while
1326                          * a block-ack session was active. That cannot be
1327                          * right, so terminate the session.
1328                          */
1329                         mutex_lock(&local->sta_mtx);
1330                         sta = sta_info_get_bss(sdata, mgmt->sa);
1331                         if (sta) {
1332                                 u16 tid = ieee80211_get_tid(hdr);
1333
1334                                 __ieee80211_stop_rx_ba_session(
1335                                         sta, tid, WLAN_BACK_RECIPIENT,
1336                                         WLAN_REASON_QSTA_REQUIRE_SETUP,
1337                                         true);
1338                         }
1339                         mutex_unlock(&local->sta_mtx);
1340                 } else switch (sdata->vif.type) {
1341                 case NL80211_IFTYPE_STATION:
1342                         ieee80211_sta_rx_queued_mgmt(sdata, skb);
1343                         break;
1344                 case NL80211_IFTYPE_ADHOC:
1345                         ieee80211_ibss_rx_queued_mgmt(sdata, skb);
1346                         break;
1347                 case NL80211_IFTYPE_MESH_POINT:
1348                         if (!ieee80211_vif_is_mesh(&sdata->vif))
1349                                 break;
1350                         ieee80211_mesh_rx_queued_mgmt(sdata, skb);
1351                         break;
1352                 default:
1353                         WARN(1, "frame for unexpected interface type");
1354                         break;
1355                 }
1356
1357                 kfree_skb(skb);
1358         }
1359
1360         /* then other type-dependent work */
1361         switch (sdata->vif.type) {
1362         case NL80211_IFTYPE_STATION:
1363                 ieee80211_sta_work(sdata);
1364                 break;
1365         case NL80211_IFTYPE_ADHOC:
1366                 ieee80211_ibss_work(sdata);
1367                 break;
1368         case NL80211_IFTYPE_MESH_POINT:
1369                 if (!ieee80211_vif_is_mesh(&sdata->vif))
1370                         break;
1371                 ieee80211_mesh_work(sdata);
1372                 break;
1373         case NL80211_IFTYPE_OCB:
1374                 ieee80211_ocb_work(sdata);
1375                 break;
1376         default:
1377                 break;
1378         }
1379 }
1380
1381 static void ieee80211_recalc_smps_work(struct work_struct *work)
1382 {
1383         struct ieee80211_sub_if_data *sdata =
1384                 container_of(work, struct ieee80211_sub_if_data, recalc_smps);
1385
1386         ieee80211_recalc_smps(sdata);
1387 }
1388
1389 /*
1390  * Helper function to initialise an interface to a specific type.
1391  */
1392 static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
1393                                   enum nl80211_iftype type)
1394 {
1395         static const u8 bssid_wildcard[ETH_ALEN] = {0xff, 0xff, 0xff,
1396                                                     0xff, 0xff, 0xff};
1397
1398         /* clear type-dependent union */
1399         memset(&sdata->u, 0, sizeof(sdata->u));
1400
1401         /* and set some type-dependent values */
1402         sdata->vif.type = type;
1403         sdata->vif.p2p = false;
1404         sdata->wdev.iftype = type;
1405
1406         sdata->control_port_protocol = cpu_to_be16(ETH_P_PAE);
1407         sdata->control_port_no_encrypt = false;
1408         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
1409         sdata->vif.bss_conf.idle = true;
1410
1411         sdata->noack_map = 0;
1412
1413         /* only monitor/p2p-device differ */
1414         if (sdata->dev) {
1415                 sdata->dev->netdev_ops = &ieee80211_dataif_ops;
1416                 sdata->dev->type = ARPHRD_ETHER;
1417         }
1418
1419         skb_queue_head_init(&sdata->skb_queue);
1420         INIT_WORK(&sdata->work, ieee80211_iface_work);
1421         INIT_WORK(&sdata->recalc_smps, ieee80211_recalc_smps_work);
1422         INIT_WORK(&sdata->csa_finalize_work, ieee80211_csa_finalize_work);
1423         INIT_LIST_HEAD(&sdata->assigned_chanctx_list);
1424         INIT_LIST_HEAD(&sdata->reserved_chanctx_list);
1425
1426         switch (type) {
1427         case NL80211_IFTYPE_P2P_GO:
1428                 type = NL80211_IFTYPE_AP;
1429                 sdata->vif.type = type;
1430                 sdata->vif.p2p = true;
1431                 /* fall through */
1432         case NL80211_IFTYPE_AP:
1433                 skb_queue_head_init(&sdata->u.ap.ps.bc_buf);
1434                 INIT_LIST_HEAD(&sdata->u.ap.vlans);
1435                 INIT_WORK(&sdata->u.ap.request_smps_work,
1436                           ieee80211_request_smps_ap_work);
1437                 sdata->vif.bss_conf.bssid = sdata->vif.addr;
1438                 sdata->u.ap.req_smps = IEEE80211_SMPS_OFF;
1439                 break;
1440         case NL80211_IFTYPE_P2P_CLIENT:
1441                 type = NL80211_IFTYPE_STATION;
1442                 sdata->vif.type = type;
1443                 sdata->vif.p2p = true;
1444                 /* fall through */
1445         case NL80211_IFTYPE_STATION:
1446                 sdata->vif.bss_conf.bssid = sdata->u.mgd.bssid;
1447                 ieee80211_sta_setup_sdata(sdata);
1448                 break;
1449         case NL80211_IFTYPE_OCB:
1450                 sdata->vif.bss_conf.bssid = bssid_wildcard;
1451                 ieee80211_ocb_setup_sdata(sdata);
1452                 break;
1453         case NL80211_IFTYPE_ADHOC:
1454                 sdata->vif.bss_conf.bssid = sdata->u.ibss.bssid;
1455                 ieee80211_ibss_setup_sdata(sdata);
1456                 break;
1457         case NL80211_IFTYPE_MESH_POINT:
1458                 if (ieee80211_vif_is_mesh(&sdata->vif))
1459                         ieee80211_mesh_init_sdata(sdata);
1460                 break;
1461         case NL80211_IFTYPE_MONITOR:
1462                 sdata->dev->type = ARPHRD_IEEE80211_RADIOTAP;
1463                 sdata->dev->netdev_ops = &ieee80211_monitorif_ops;
1464                 sdata->u.mntr.flags = MONITOR_FLAG_CONTROL |
1465                                       MONITOR_FLAG_OTHER_BSS;
1466                 break;
1467         case NL80211_IFTYPE_WDS:
1468                 sdata->vif.bss_conf.bssid = NULL;
1469                 break;
1470         case NL80211_IFTYPE_NAN:
1471                 idr_init(&sdata->u.nan.function_inst_ids);
1472                 spin_lock_init(&sdata->u.nan.func_lock);
1473                 sdata->vif.bss_conf.bssid = sdata->vif.addr;
1474                 break;
1475         case NL80211_IFTYPE_AP_VLAN:
1476         case NL80211_IFTYPE_P2P_DEVICE:
1477                 sdata->vif.bss_conf.bssid = sdata->vif.addr;
1478                 break;
1479         case NL80211_IFTYPE_UNSPECIFIED:
1480         case NUM_NL80211_IFTYPES:
1481                 WARN_ON(1);
1482                 break;
1483         }
1484
1485         ieee80211_debugfs_add_netdev(sdata);
1486 }
1487
1488 static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
1489                                            enum nl80211_iftype type)
1490 {
1491         struct ieee80211_local *local = sdata->local;
1492         int ret, err;
1493         enum nl80211_iftype internal_type = type;
1494         bool p2p = false;
1495
1496         ASSERT_RTNL();
1497
1498         if (!local->ops->change_interface)
1499                 return -EBUSY;
1500
1501         switch (sdata->vif.type) {
1502         case NL80211_IFTYPE_AP:
1503         case NL80211_IFTYPE_STATION:
1504         case NL80211_IFTYPE_ADHOC:
1505         case NL80211_IFTYPE_OCB:
1506                 /*
1507                  * Could maybe also all others here?
1508                  * Just not sure how that interacts
1509                  * with the RX/config path e.g. for
1510                  * mesh.
1511                  */
1512                 break;
1513         default:
1514                 return -EBUSY;
1515         }
1516
1517         switch (type) {
1518         case NL80211_IFTYPE_AP:
1519         case NL80211_IFTYPE_STATION:
1520         case NL80211_IFTYPE_ADHOC:
1521         case NL80211_IFTYPE_OCB:
1522                 /*
1523                  * Could probably support everything
1524                  * but WDS here (WDS do_open can fail
1525                  * under memory pressure, which this
1526                  * code isn't prepared to handle).
1527                  */
1528                 break;
1529         case NL80211_IFTYPE_P2P_CLIENT:
1530                 p2p = true;
1531                 internal_type = NL80211_IFTYPE_STATION;
1532                 break;
1533         case NL80211_IFTYPE_P2P_GO:
1534                 p2p = true;
1535                 internal_type = NL80211_IFTYPE_AP;
1536                 break;
1537         default:
1538                 return -EBUSY;
1539         }
1540
1541         ret = ieee80211_check_concurrent_iface(sdata, internal_type);
1542         if (ret)
1543                 return ret;
1544
1545         ieee80211_do_stop(sdata, false);
1546
1547         ieee80211_teardown_sdata(sdata);
1548
1549         ret = drv_change_interface(local, sdata, internal_type, p2p);
1550         if (ret)
1551                 type = ieee80211_vif_type_p2p(&sdata->vif);
1552
1553         /*
1554          * Ignore return value here, there's not much we can do since
1555          * the driver changed the interface type internally already.
1556          * The warnings will hopefully make driver authors fix it :-)
1557          */
1558         ieee80211_check_queues(sdata, type);
1559
1560         ieee80211_setup_sdata(sdata, type);
1561
1562         err = ieee80211_do_open(&sdata->wdev, false);
1563         WARN(err, "type change: do_open returned %d", err);
1564
1565         return ret;
1566 }
1567
1568 int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
1569                              enum nl80211_iftype type)
1570 {
1571         int ret;
1572
1573         ASSERT_RTNL();
1574
1575         if (type == ieee80211_vif_type_p2p(&sdata->vif))
1576                 return 0;
1577
1578         if (ieee80211_sdata_running(sdata)) {
1579                 ret = ieee80211_runtime_change_iftype(sdata, type);
1580                 if (ret)
1581                         return ret;
1582         } else {
1583                 /* Purge and reset type-dependent state. */
1584                 ieee80211_teardown_sdata(sdata);
1585                 ieee80211_setup_sdata(sdata, type);
1586         }
1587
1588         /* reset some values that shouldn't be kept across type changes */
1589         if (type == NL80211_IFTYPE_STATION)
1590                 sdata->u.mgd.use_4addr = false;
1591
1592         return 0;
1593 }
1594
1595 static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
1596                                        u8 *perm_addr, enum nl80211_iftype type)
1597 {
1598         struct ieee80211_sub_if_data *sdata;
1599         u64 mask, start, addr, val, inc;
1600         u8 *m;
1601         u8 tmp_addr[ETH_ALEN];
1602         int i;
1603
1604         /* default ... something at least */
1605         memcpy(perm_addr, local->hw.wiphy->perm_addr, ETH_ALEN);
1606
1607         if (is_zero_ether_addr(local->hw.wiphy->addr_mask) &&
1608             local->hw.wiphy->n_addresses <= 1)
1609                 return;
1610
1611         mutex_lock(&local->iflist_mtx);
1612
1613         switch (type) {
1614         case NL80211_IFTYPE_MONITOR:
1615                 /* doesn't matter */
1616                 break;
1617         case NL80211_IFTYPE_WDS:
1618         case NL80211_IFTYPE_AP_VLAN:
1619                 /* match up with an AP interface */
1620                 list_for_each_entry(sdata, &local->interfaces, list) {
1621                         if (sdata->vif.type != NL80211_IFTYPE_AP)
1622                                 continue;
1623                         memcpy(perm_addr, sdata->vif.addr, ETH_ALEN);
1624                         break;
1625                 }
1626                 /* keep default if no AP interface present */
1627                 break;
1628         case NL80211_IFTYPE_P2P_CLIENT:
1629         case NL80211_IFTYPE_P2P_GO:
1630                 if (ieee80211_hw_check(&local->hw, P2P_DEV_ADDR_FOR_INTF)) {
1631                         list_for_each_entry(sdata, &local->interfaces, list) {
1632                                 if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE)
1633                                         continue;
1634                                 if (!ieee80211_sdata_running(sdata))
1635                                         continue;
1636                                 memcpy(perm_addr, sdata->vif.addr, ETH_ALEN);
1637                                 goto out_unlock;
1638                         }
1639                 }
1640                 /* fall through */
1641         default:
1642                 /* assign a new address if possible -- try n_addresses first */
1643                 for (i = 0; i < local->hw.wiphy->n_addresses; i++) {
1644                         bool used = false;
1645
1646                         list_for_each_entry(sdata, &local->interfaces, list) {
1647                                 if (ether_addr_equal(local->hw.wiphy->addresses[i].addr,
1648                                                      sdata->vif.addr)) {
1649                                         used = true;
1650                                         break;
1651                                 }
1652                         }
1653
1654                         if (!used) {
1655                                 memcpy(perm_addr,
1656                                        local->hw.wiphy->addresses[i].addr,
1657                                        ETH_ALEN);
1658                                 break;
1659                         }
1660                 }
1661
1662                 /* try mask if available */
1663                 if (is_zero_ether_addr(local->hw.wiphy->addr_mask))
1664                         break;
1665
1666                 m = local->hw.wiphy->addr_mask;
1667                 mask =  ((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
1668                         ((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
1669                         ((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
1670
1671                 if (__ffs64(mask) + hweight64(mask) != fls64(mask)) {
1672                         /* not a contiguous mask ... not handled now! */
1673                         pr_info("not contiguous\n");
1674                         break;
1675                 }
1676
1677                 /*
1678                  * Pick address of existing interface in case user changed
1679                  * MAC address manually, default to perm_addr.
1680                  */
1681                 m = local->hw.wiphy->perm_addr;
1682                 list_for_each_entry(sdata, &local->interfaces, list) {
1683                         if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
1684                                 continue;
1685                         m = sdata->vif.addr;
1686                         break;
1687                 }
1688                 start = ((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
1689                         ((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
1690                         ((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
1691
1692                 inc = 1ULL<<__ffs64(mask);
1693                 val = (start & mask);
1694                 addr = (start & ~mask) | (val & mask);
1695                 do {
1696                         bool used = false;
1697
1698                         tmp_addr[5] = addr >> 0*8;
1699                         tmp_addr[4] = addr >> 1*8;
1700                         tmp_addr[3] = addr >> 2*8;
1701                         tmp_addr[2] = addr >> 3*8;
1702                         tmp_addr[1] = addr >> 4*8;
1703                         tmp_addr[0] = addr >> 5*8;
1704
1705                         val += inc;
1706
1707                         list_for_each_entry(sdata, &local->interfaces, list) {
1708                                 if (ether_addr_equal(tmp_addr, sdata->vif.addr)) {
1709                                         used = true;
1710                                         break;
1711                                 }
1712                         }
1713
1714                         if (!used) {
1715                                 memcpy(perm_addr, tmp_addr, ETH_ALEN);
1716                                 break;
1717                         }
1718                         addr = (start & ~mask) | (val & mask);
1719                 } while (addr != start);
1720
1721                 break;
1722         }
1723
1724  out_unlock:
1725         mutex_unlock(&local->iflist_mtx);
1726 }
1727
1728 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
1729                      unsigned char name_assign_type,
1730                      struct wireless_dev **new_wdev, enum nl80211_iftype type,
1731                      struct vif_params *params)
1732 {
1733         struct net_device *ndev = NULL;
1734         struct ieee80211_sub_if_data *sdata = NULL;
1735         struct txq_info *txqi;
1736         void (*if_setup)(struct net_device *dev);
1737         int ret, i;
1738         int txqs = 1;
1739
1740         ASSERT_RTNL();
1741
1742         if (type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN) {
1743                 struct wireless_dev *wdev;
1744
1745                 sdata = kzalloc(sizeof(*sdata) + local->hw.vif_data_size,
1746                                 GFP_KERNEL);
1747                 if (!sdata)
1748                         return -ENOMEM;
1749                 wdev = &sdata->wdev;
1750
1751                 sdata->dev = NULL;
1752                 strlcpy(sdata->name, name, IFNAMSIZ);
1753                 ieee80211_assign_perm_addr(local, wdev->address, type);
1754                 memcpy(sdata->vif.addr, wdev->address, ETH_ALEN);
1755         } else {
1756                 int size = ALIGN(sizeof(*sdata) + local->hw.vif_data_size,
1757                                  sizeof(void *));
1758                 int txq_size = 0;
1759
1760                 if (local->ops->wake_tx_queue &&
1761                     type != NL80211_IFTYPE_AP_VLAN &&
1762                     (type != NL80211_IFTYPE_MONITOR ||
1763                      (params->flags & MONITOR_FLAG_ACTIVE)))
1764                         txq_size += sizeof(struct txq_info) +
1765                                     local->hw.txq_data_size;
1766
1767                 if (local->ops->wake_tx_queue)
1768                         if_setup = ieee80211_if_setup_no_queue;
1769                 else
1770                         if_setup = ieee80211_if_setup;
1771
1772                 if (local->hw.queues >= IEEE80211_NUM_ACS)
1773                         txqs = IEEE80211_NUM_ACS;
1774
1775                 ndev = alloc_netdev_mqs(size + txq_size,
1776                                         name, name_assign_type,
1777                                         if_setup, txqs, 1);
1778                 if (!ndev)
1779                         return -ENOMEM;
1780                 dev_net_set(ndev, wiphy_net(local->hw.wiphy));
1781
1782                 ndev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
1783                 if (!ndev->tstats) {
1784                         free_netdev(ndev);
1785                         return -ENOMEM;
1786                 }
1787
1788                 ndev->needed_headroom = local->tx_headroom +
1789                                         4*6 /* four MAC addresses */
1790                                         + 2 + 2 + 2 + 2 /* ctl, dur, seq, qos */
1791                                         + 6 /* mesh */
1792                                         + 8 /* rfc1042/bridge tunnel */
1793                                         - ETH_HLEN /* ethernet hard_header_len */
1794                                         + IEEE80211_ENCRYPT_HEADROOM;
1795                 ndev->needed_tailroom = IEEE80211_ENCRYPT_TAILROOM;
1796
1797                 ret = dev_alloc_name(ndev, ndev->name);
1798                 if (ret < 0) {
1799                         ieee80211_if_free(ndev);
1800                         free_netdev(ndev);
1801                         return ret;
1802                 }
1803
1804                 ieee80211_assign_perm_addr(local, ndev->perm_addr, type);
1805                 if (is_valid_ether_addr(params->macaddr))
1806                         memcpy(ndev->dev_addr, params->macaddr, ETH_ALEN);
1807                 else
1808                         memcpy(ndev->dev_addr, ndev->perm_addr, ETH_ALEN);
1809                 SET_NETDEV_DEV(ndev, wiphy_dev(local->hw.wiphy));
1810
1811                 /* don't use IEEE80211_DEV_TO_SUB_IF -- it checks too much */
1812                 sdata = netdev_priv(ndev);
1813                 ndev->ieee80211_ptr = &sdata->wdev;
1814                 memcpy(sdata->vif.addr, ndev->dev_addr, ETH_ALEN);
1815                 memcpy(sdata->name, ndev->name, IFNAMSIZ);
1816
1817                 if (txq_size) {
1818                         txqi = netdev_priv(ndev) + size;
1819                         ieee80211_txq_init(sdata, NULL, txqi, 0);
1820                 }
1821
1822                 sdata->dev = ndev;
1823         }
1824
1825         /* initialise type-independent data */
1826         sdata->wdev.wiphy = local->hw.wiphy;
1827         sdata->local = local;
1828
1829         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++)
1830                 skb_queue_head_init(&sdata->fragments[i].skb_list);
1831
1832         INIT_LIST_HEAD(&sdata->key_list);
1833
1834         INIT_DELAYED_WORK(&sdata->dfs_cac_timer_work,
1835                           ieee80211_dfs_cac_timer_work);
1836         INIT_DELAYED_WORK(&sdata->dec_tailroom_needed_wk,
1837                           ieee80211_delayed_tailroom_dec);
1838
1839         for (i = 0; i < NUM_NL80211_BANDS; i++) {
1840                 struct ieee80211_supported_band *sband;
1841                 sband = local->hw.wiphy->bands[i];
1842                 sdata->rc_rateidx_mask[i] =
1843                         sband ? (1 << sband->n_bitrates) - 1 : 0;
1844                 if (sband) {
1845                         __le16 cap;
1846                         u16 *vht_rate_mask;
1847
1848                         memcpy(sdata->rc_rateidx_mcs_mask[i],
1849                                sband->ht_cap.mcs.rx_mask,
1850                                sizeof(sdata->rc_rateidx_mcs_mask[i]));
1851
1852                         cap = sband->vht_cap.vht_mcs.rx_mcs_map;
1853                         vht_rate_mask = sdata->rc_rateidx_vht_mcs_mask[i];
1854                         ieee80211_get_vht_mask_from_cap(cap, vht_rate_mask);
1855                 } else {
1856                         memset(sdata->rc_rateidx_mcs_mask[i], 0,
1857                                sizeof(sdata->rc_rateidx_mcs_mask[i]));
1858                         memset(sdata->rc_rateidx_vht_mcs_mask[i], 0,
1859                                sizeof(sdata->rc_rateidx_vht_mcs_mask[i]));
1860                 }
1861         }
1862
1863         ieee80211_set_default_queues(sdata);
1864
1865         sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
1866         sdata->user_power_level = local->user_power_level;
1867
1868         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
1869
1870         /* setup type-dependent data */
1871         ieee80211_setup_sdata(sdata, type);
1872
1873         if (ndev) {
1874                 ndev->ieee80211_ptr->use_4addr = params->use_4addr;
1875                 if (type == NL80211_IFTYPE_STATION)
1876                         sdata->u.mgd.use_4addr = params->use_4addr;
1877
1878                 ndev->features |= local->hw.netdev_features;
1879
1880                 netdev_set_default_ethtool_ops(ndev, &ieee80211_ethtool_ops);
1881
1882                 /* MTU range: 256 - 2304 */
1883                 ndev->min_mtu = 256;
1884                 ndev->max_mtu = IEEE80211_MAX_DATA_LEN;
1885
1886                 ret = register_netdevice(ndev);
1887                 if (ret) {
1888                         free_netdev(ndev);
1889                         return ret;
1890                 }
1891         }
1892
1893         mutex_lock(&local->iflist_mtx);
1894         list_add_tail_rcu(&sdata->list, &local->interfaces);
1895         mutex_unlock(&local->iflist_mtx);
1896
1897         if (new_wdev)
1898                 *new_wdev = &sdata->wdev;
1899
1900         return 0;
1901 }
1902
1903 void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata)
1904 {
1905         ASSERT_RTNL();
1906
1907         mutex_lock(&sdata->local->iflist_mtx);
1908         list_del_rcu(&sdata->list);
1909         mutex_unlock(&sdata->local->iflist_mtx);
1910
1911         synchronize_rcu();
1912
1913         if (sdata->dev) {
1914                 unregister_netdevice(sdata->dev);
1915         } else {
1916                 cfg80211_unregister_wdev(&sdata->wdev);
1917                 ieee80211_teardown_sdata(sdata);
1918                 kfree(sdata);
1919         }
1920 }
1921
1922 void ieee80211_sdata_stop(struct ieee80211_sub_if_data *sdata)
1923 {
1924         if (WARN_ON_ONCE(!test_bit(SDATA_STATE_RUNNING, &sdata->state)))
1925                 return;
1926         ieee80211_do_stop(sdata, true);
1927 }
1928
1929 void ieee80211_remove_interfaces(struct ieee80211_local *local)
1930 {
1931         struct ieee80211_sub_if_data *sdata, *tmp;
1932         LIST_HEAD(unreg_list);
1933         LIST_HEAD(wdev_list);
1934
1935         ASSERT_RTNL();
1936
1937         /* Before destroying the interfaces, make sure they're all stopped so
1938          * that the hardware is stopped. Otherwise, the driver might still be
1939          * iterating the interfaces during the shutdown, e.g. from a worker
1940          * or from RX processing or similar, and if it does so (using atomic
1941          * iteration) while we're manipulating the list, the iteration will
1942          * crash.
1943          *
1944          * After this, the hardware should be stopped and the driver should
1945          * have stopped all of its activities, so that we can do RCU-unaware
1946          * manipulations of the interface list below.
1947          */
1948         cfg80211_shutdown_all_interfaces(local->hw.wiphy);
1949
1950         WARN(local->open_count, "%s: open count remains %d\n",
1951              wiphy_name(local->hw.wiphy), local->open_count);
1952
1953         ieee80211_txq_teardown_flows(local);
1954
1955         mutex_lock(&local->iflist_mtx);
1956         list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
1957                 list_del(&sdata->list);
1958
1959                 if (sdata->dev)
1960                         unregister_netdevice_queue(sdata->dev, &unreg_list);
1961                 else
1962                         list_add(&sdata->list, &wdev_list);
1963         }
1964         mutex_unlock(&local->iflist_mtx);
1965         unregister_netdevice_many(&unreg_list);
1966
1967         list_for_each_entry_safe(sdata, tmp, &wdev_list, list) {
1968                 list_del(&sdata->list);
1969                 cfg80211_unregister_wdev(&sdata->wdev);
1970                 kfree(sdata);
1971         }
1972 }
1973
1974 static int netdev_notify(struct notifier_block *nb,
1975                          unsigned long state, void *ptr)
1976 {
1977         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1978         struct ieee80211_sub_if_data *sdata;
1979
1980         if (state != NETDEV_CHANGENAME)
1981                 return NOTIFY_DONE;
1982
1983         if (!dev->ieee80211_ptr || !dev->ieee80211_ptr->wiphy)
1984                 return NOTIFY_DONE;
1985
1986         if (dev->ieee80211_ptr->wiphy->privid != mac80211_wiphy_privid)
1987                 return NOTIFY_DONE;
1988
1989         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1990         memcpy(sdata->name, dev->name, IFNAMSIZ);
1991         ieee80211_debugfs_rename_netdev(sdata);
1992
1993         return NOTIFY_OK;
1994 }
1995
1996 static struct notifier_block mac80211_netdev_notifier = {
1997         .notifier_call = netdev_notify,
1998 };
1999
2000 int ieee80211_iface_init(void)
2001 {
2002         return register_netdevice_notifier(&mac80211_netdev_notifier);
2003 }
2004
2005 void ieee80211_iface_exit(void)
2006 {
2007         unregister_netdevice_notifier(&mac80211_netdev_notifier);
2008 }
2009
2010 void ieee80211_vif_inc_num_mcast(struct ieee80211_sub_if_data *sdata)
2011 {
2012         if (sdata->vif.type == NL80211_IFTYPE_AP)
2013                 atomic_inc(&sdata->u.ap.num_mcast_sta);
2014         else if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
2015                 atomic_inc(&sdata->u.vlan.num_mcast_sta);
2016 }
2017
2018 void ieee80211_vif_dec_num_mcast(struct ieee80211_sub_if_data *sdata)
2019 {
2020         if (sdata->vif.type == NL80211_IFTYPE_AP)
2021                 atomic_dec(&sdata->u.ap.num_mcast_sta);
2022         else if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
2023                 atomic_dec(&sdata->u.vlan.num_mcast_sta);
2024 }