1 /*
2  * Copyright 2002-2005, Instant802 Networks, Inc.
3  * Copyright 2005-2006, Devicescape Software, Inc.
4  * Copyright 2007	Johannes Berg <johannes@sipsolutions.net>
5  * Copyright 2008-2011	Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
6  * Copyright 2013-2014  Intel Mobile Communications GmbH
7  * Copyright      2017  Intel Deutschland GmbH
8  * Copyright (C) 2018 - 2019 Intel Corporation
9  *
10  * Permission to use, copy, modify, and/or distribute this software for any
11  * purpose with or without fee is hereby granted, provided that the above
12  * copyright notice and this permission notice appear in all copies.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21  */
22 
23 
24 /**
25  * DOC: Wireless regulatory infrastructure
26  *
27  * The usual implementation is for a driver to read a device EEPROM to
28  * determine which regulatory domain it should be operating under, then
29  * looking up the allowable channels in a driver-local table and finally
30  * registering those channels in the wiphy structure.
31  *
32  * Another set of compliance enforcement is for drivers to use their
33  * own compliance limits which can be stored on the EEPROM. The host
34  * driver or firmware may ensure these are used.
35  *
36  * In addition to all this we provide an extra layer of regulatory
37  * conformance. For drivers which do not have any regulatory
38  * information CRDA provides the complete regulatory solution.
39  * For others it provides a community effort on further restrictions
40  * to enhance compliance.
41  *
42  * Note: When number of rules --> infinity we will not be able to
43  * index on alpha2 any more, instead we'll probably have to
44  * rely on some SHA1 checksum of the regdomain for example.
45  *
46  */
47 
48 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
49 
50 #include <linux/kernel.h>
51 #include <linux/export.h>
52 #include <linux/slab.h>
53 #include <linux/list.h>
54 #include <linux/ctype.h>
55 #include <linux/nl80211.h>
56 #include <linux/platform_device.h>
57 #include <linux/verification.h>
58 #include <linux/moduleparam.h>
59 #include <linux/firmware.h>
60 #include <net/cfg80211.h>
61 #include "core.h"
62 #include "reg.h"
63 #include "rdev-ops.h"
64 #include "nl80211.h"
65 
66 /*
67  * Grace period we give before making sure all current interfaces reside on
68  * channels allowed by the current regulatory domain.
69  */
70 #define REG_ENFORCE_GRACE_MS 60000
71 
72 /**
73  * enum reg_request_treatment - regulatory request treatment
74  *
75  * @REG_REQ_OK: continue processing the regulatory request
76  * @REG_REQ_IGNORE: ignore the regulatory request
77  * @REG_REQ_INTERSECT: the regulatory domain resulting from this request should
78  *	be intersected with the current one.
79  * @REG_REQ_ALREADY_SET: the regulatory request will not change the current
80  *	regulatory settings, and no further processing is required.
81  */
82 enum reg_request_treatment {
83 	REG_REQ_OK,
84 	REG_REQ_IGNORE,
85 	REG_REQ_INTERSECT,
86 	REG_REQ_ALREADY_SET,
87 };
88 
89 static struct regulatory_request core_request_world = {
90 	.initiator = NL80211_REGDOM_SET_BY_CORE,
91 	.alpha2[0] = '0',
92 	.alpha2[1] = '0',
93 	.intersect = false,
94 	.processed = true,
95 	.country_ie_env = ENVIRON_ANY,
96 };
97 
98 /*
99  * Receipt of information from last regulatory request,
100  * protected by RTNL (and can be accessed with RCU protection)
101  */
102 static struct regulatory_request __rcu *last_request =
103 	(void __force __rcu *)&core_request_world;
104 
105 /* To trigger userspace events and load firmware */
106 static struct platform_device *reg_pdev;
107 
108 /*
109  * Central wireless core regulatory domains, we only need two,
110  * the current one and a world regulatory domain in case we have no
111  * information to give us an alpha2.
112  * (protected by RTNL, can be read under RCU)
113  */
114 const struct ieee80211_regdomain __rcu *cfg80211_regdomain;
115 
116 /*
117  * Number of devices that registered to the core
118  * that support cellular base station regulatory hints
119  * (protected by RTNL)
120  */
121 static int reg_num_devs_support_basehint;
122 
123 /*
124  * State variable indicating if the platform on which the devices
125  * are attached is operating in an indoor environment. The state variable
126  * is relevant for all registered devices.
127  */
128 static bool reg_is_indoor;
129 static spinlock_t reg_indoor_lock;
130 
131 /* Used to track the userspace process controlling the indoor setting */
132 static u32 reg_is_indoor_portid;
133 
134 static void restore_regulatory_settings(bool reset_user, bool cached);
135 static void print_regdomain(const struct ieee80211_regdomain *rd);
136 
get_cfg80211_regdom(void)137 static const struct ieee80211_regdomain *get_cfg80211_regdom(void)
138 {
139 	return rcu_dereference_rtnl(cfg80211_regdomain);
140 }
141 
get_wiphy_regdom(struct wiphy * wiphy)142 const struct ieee80211_regdomain *get_wiphy_regdom(struct wiphy *wiphy)
143 {
144 	return rcu_dereference_rtnl(wiphy->regd);
145 }
146 
reg_dfs_region_str(enum nl80211_dfs_regions dfs_region)147 static const char *reg_dfs_region_str(enum nl80211_dfs_regions dfs_region)
148 {
149 	switch (dfs_region) {
150 	case NL80211_DFS_UNSET:
151 		return "unset";
152 	case NL80211_DFS_FCC:
153 		return "FCC";
154 	case NL80211_DFS_ETSI:
155 		return "ETSI";
156 	case NL80211_DFS_JP:
157 		return "JP";
158 	}
159 	return "Unknown";
160 }
161 
reg_get_dfs_region(struct wiphy * wiphy)162 enum nl80211_dfs_regions reg_get_dfs_region(struct wiphy *wiphy)
163 {
164 	const struct ieee80211_regdomain *regd = NULL;
165 	const struct ieee80211_regdomain *wiphy_regd = NULL;
166 
167 	regd = get_cfg80211_regdom();
168 	if (!wiphy)
169 		goto out;
170 
171 	wiphy_regd = get_wiphy_regdom(wiphy);
172 	if (!wiphy_regd)
173 		goto out;
174 
175 	if (wiphy_regd->dfs_region == regd->dfs_region)
176 		goto out;
177 
178 	pr_debug("%s: device specific dfs_region (%s) disagrees with cfg80211's central dfs_region (%s)\n",
179 		 dev_name(&wiphy->dev),
180 		 reg_dfs_region_str(wiphy_regd->dfs_region),
181 		 reg_dfs_region_str(regd->dfs_region));
182 
183 out:
184 	return regd->dfs_region;
185 }
186 
rcu_free_regdom(const struct ieee80211_regdomain * r)187 static void rcu_free_regdom(const struct ieee80211_regdomain *r)
188 {
189 	if (!r)
190 		return;
191 	kfree_rcu((struct ieee80211_regdomain *)r, rcu_head);
192 }
193 
get_last_request(void)194 static struct regulatory_request *get_last_request(void)
195 {
196 	return rcu_dereference_rtnl(last_request);
197 }
198 
199 /* Used to queue up regulatory hints */
200 static LIST_HEAD(reg_requests_list);
201 static spinlock_t reg_requests_lock;
202 
203 /* Used to queue up beacon hints for review */
204 static LIST_HEAD(reg_pending_beacons);
205 static spinlock_t reg_pending_beacons_lock;
206 
207 /* Used to keep track of processed beacon hints */
208 static LIST_HEAD(reg_beacon_list);
209 
210 struct reg_beacon {
211 	struct list_head list;
212 	struct ieee80211_channel chan;
213 };
214 
215 static void reg_check_chans_work(struct work_struct *work);
216 static DECLARE_DELAYED_WORK(reg_check_chans, reg_check_chans_work);
217 
218 static void reg_todo(struct work_struct *work);
219 static DECLARE_WORK(reg_work, reg_todo);
220 
221 /* We keep a static world regulatory domain in case of the absence of CRDA */
222 static const struct ieee80211_regdomain world_regdom = {
223 	.n_reg_rules = 8,
224 	.alpha2 =  "00",
225 	.reg_rules = {
226 		/* IEEE 802.11b/g, channels 1..11 */
227 		REG_RULE(2412-10, 2462+10, 40, 6, 20, 0),
228 		/* IEEE 802.11b/g, channels 12..13. */
229 		REG_RULE(2467-10, 2472+10, 20, 6, 20,
230 			NL80211_RRF_NO_IR | NL80211_RRF_AUTO_BW),
231 		/* IEEE 802.11 channel 14 - Only JP enables
232 		 * this and for 802.11b only */
233 		REG_RULE(2484-10, 2484+10, 20, 6, 20,
234 			NL80211_RRF_NO_IR |
235 			NL80211_RRF_NO_OFDM),
236 		/* IEEE 802.11a, channel 36..48 */
237 		REG_RULE(5180-10, 5240+10, 80, 6, 20,
238                         NL80211_RRF_NO_IR |
239                         NL80211_RRF_AUTO_BW),
240 
241 		/* IEEE 802.11a, channel 52..64 - DFS required */
242 		REG_RULE(5260-10, 5320+10, 80, 6, 20,
243 			NL80211_RRF_NO_IR |
244 			NL80211_RRF_AUTO_BW |
245 			NL80211_RRF_DFS),
246 
247 		/* IEEE 802.11a, channel 100..144 - DFS required */
248 		REG_RULE(5500-10, 5720+10, 160, 6, 20,
249 			NL80211_RRF_NO_IR |
250 			NL80211_RRF_DFS),
251 
252 		/* IEEE 802.11a, channel 149..165 */
253 		REG_RULE(5745-10, 5825+10, 80, 6, 20,
254 			NL80211_RRF_NO_IR),
255 
256 		/* IEEE 802.11ad (60GHz), channels 1..3 */
257 		REG_RULE(56160+2160*1-1080, 56160+2160*3+1080, 2160, 0, 0, 0),
258 	}
259 };
260 
261 /* protected by RTNL */
262 static const struct ieee80211_regdomain *cfg80211_world_regdom =
263 	&world_regdom;
264 
265 static char *ieee80211_regdom = "00";
266 static char user_alpha2[2];
267 static const struct ieee80211_regdomain *cfg80211_user_regdom;
268 
269 module_param(ieee80211_regdom, charp, 0444);
270 MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
271 
reg_free_request(struct regulatory_request * request)272 static void reg_free_request(struct regulatory_request *request)
273 {
274 	if (request == &core_request_world)
275 		return;
276 
277 	if (request != get_last_request())
278 		kfree(request);
279 }
280 
reg_free_last_request(void)281 static void reg_free_last_request(void)
282 {
283 	struct regulatory_request *lr = get_last_request();
284 
285 	if (lr != &core_request_world && lr)
286 		kfree_rcu(lr, rcu_head);
287 }
288 
reg_update_last_request(struct regulatory_request * request)289 static void reg_update_last_request(struct regulatory_request *request)
290 {
291 	struct regulatory_request *lr;
292 
293 	lr = get_last_request();
294 	if (lr == request)
295 		return;
296 
297 	reg_free_last_request();
298 	rcu_assign_pointer(last_request, request);
299 }
300 
reset_regdomains(bool full_reset,const struct ieee80211_regdomain * new_regdom)301 static void reset_regdomains(bool full_reset,
302 			     const struct ieee80211_regdomain *new_regdom)
303 {
304 	const struct ieee80211_regdomain *r;
305 
306 	ASSERT_RTNL();
307 
308 	r = get_cfg80211_regdom();
309 
310 	/* avoid freeing static information or freeing something twice */
311 	if (r == cfg80211_world_regdom)
312 		r = NULL;
313 	if (cfg80211_world_regdom == &world_regdom)
314 		cfg80211_world_regdom = NULL;
315 	if (r == &world_regdom)
316 		r = NULL;
317 
318 	rcu_free_regdom(r);
319 	rcu_free_regdom(cfg80211_world_regdom);
320 
321 	cfg80211_world_regdom = &world_regdom;
322 	rcu_assign_pointer(cfg80211_regdomain, new_regdom);
323 
324 	if (!full_reset)
325 		return;
326 
327 	reg_update_last_request(&core_request_world);
328 }
329 
330 /*
331  * Dynamic world regulatory domain requested by the wireless
332  * core upon initialization
333  */
update_world_regdomain(const struct ieee80211_regdomain * rd)334 static void update_world_regdomain(const struct ieee80211_regdomain *rd)
335 {
336 	struct regulatory_request *lr;
337 
338 	lr = get_last_request();
339 
340 	WARN_ON(!lr);
341 
342 	reset_regdomains(false, rd);
343 
344 	cfg80211_world_regdom = rd;
345 }
346 
is_world_regdom(const char * alpha2)347 bool is_world_regdom(const char *alpha2)
348 {
349 	if (!alpha2)
350 		return false;
351 	return alpha2[0] == '0' && alpha2[1] == '0';
352 }
353 
is_alpha2_set(const char * alpha2)354 static bool is_alpha2_set(const char *alpha2)
355 {
356 	if (!alpha2)
357 		return false;
358 	return alpha2[0] && alpha2[1];
359 }
360 
is_unknown_alpha2(const char * alpha2)361 static bool is_unknown_alpha2(const char *alpha2)
362 {
363 	if (!alpha2)
364 		return false;
365 	/*
366 	 * Special case where regulatory domain was built by driver
367 	 * but a specific alpha2 cannot be determined
368 	 */
369 	return alpha2[0] == '9' && alpha2[1] == '9';
370 }
371 
is_intersected_alpha2(const char * alpha2)372 static bool is_intersected_alpha2(const char *alpha2)
373 {
374 	if (!alpha2)
375 		return false;
376 	/*
377 	 * Special case where regulatory domain is the
378 	 * result of an intersection between two regulatory domain
379 	 * structures
380 	 */
381 	return alpha2[0] == '9' && alpha2[1] == '8';
382 }
383 
is_an_alpha2(const char * alpha2)384 static bool is_an_alpha2(const char *alpha2)
385 {
386 	if (!alpha2)
387 		return false;
388 	return isalpha(alpha2[0]) && isalpha(alpha2[1]);
389 }
390 
alpha2_equal(const char * alpha2_x,const char * alpha2_y)391 static bool alpha2_equal(const char *alpha2_x, const char *alpha2_y)
392 {
393 	if (!alpha2_x || !alpha2_y)
394 		return false;
395 	return alpha2_x[0] == alpha2_y[0] && alpha2_x[1] == alpha2_y[1];
396 }
397 
regdom_changes(const char * alpha2)398 static bool regdom_changes(const char *alpha2)
399 {
400 	const struct ieee80211_regdomain *r = get_cfg80211_regdom();
401 
402 	if (!r)
403 		return true;
404 	return !alpha2_equal(r->alpha2, alpha2);
405 }
406 
407 /*
408  * The NL80211_REGDOM_SET_BY_USER regdom alpha2 is cached, this lets
409  * you know if a valid regulatory hint with NL80211_REGDOM_SET_BY_USER
410  * has ever been issued.
411  */
is_user_regdom_saved(void)412 static bool is_user_regdom_saved(void)
413 {
414 	if (user_alpha2[0] == '9' && user_alpha2[1] == '7')
415 		return false;
416 
417 	/* This would indicate a mistake on the design */
418 	if (WARN(!is_world_regdom(user_alpha2) && !is_an_alpha2(user_alpha2),
419 		 "Unexpected user alpha2: %c%c\n",
420 		 user_alpha2[0], user_alpha2[1]))
421 		return false;
422 
423 	return true;
424 }
425 
426 static const struct ieee80211_regdomain *
reg_copy_regd(const struct ieee80211_regdomain * src_regd)427 reg_copy_regd(const struct ieee80211_regdomain *src_regd)
428 {
429 	struct ieee80211_regdomain *regd;
430 	unsigned int i;
431 
432 	regd = kzalloc(struct_size(regd, reg_rules, src_regd->n_reg_rules),
433 		       GFP_KERNEL);
434 	if (!regd)
435 		return ERR_PTR(-ENOMEM);
436 
437 	memcpy(regd, src_regd, sizeof(struct ieee80211_regdomain));
438 
439 	for (i = 0; i < src_regd->n_reg_rules; i++)
440 		memcpy(&regd->reg_rules[i], &src_regd->reg_rules[i],
441 		       sizeof(struct ieee80211_reg_rule));
442 
443 	return regd;
444 }
445 
cfg80211_save_user_regdom(const struct ieee80211_regdomain * rd)446 static void cfg80211_save_user_regdom(const struct ieee80211_regdomain *rd)
447 {
448 	ASSERT_RTNL();
449 
450 	if (!IS_ERR(cfg80211_user_regdom))
451 		kfree(cfg80211_user_regdom);
452 	cfg80211_user_regdom = reg_copy_regd(rd);
453 }
454 
455 struct reg_regdb_apply_request {
456 	struct list_head list;
457 	const struct ieee80211_regdomain *regdom;
458 };
459 
460 static LIST_HEAD(reg_regdb_apply_list);
461 static DEFINE_MUTEX(reg_regdb_apply_mutex);
462 
reg_regdb_apply(struct work_struct * work)463 static void reg_regdb_apply(struct work_struct *work)
464 {
465 	struct reg_regdb_apply_request *request;
466 
467 	rtnl_lock();
468 
469 	mutex_lock(&reg_regdb_apply_mutex);
470 	while (!list_empty(&reg_regdb_apply_list)) {
471 		request = list_first_entry(&reg_regdb_apply_list,
472 					   struct reg_regdb_apply_request,
473 					   list);
474 		list_del(&request->list);
475 
476 		set_regdom(request->regdom, REGD_SOURCE_INTERNAL_DB);
477 		kfree(request);
478 	}
479 	mutex_unlock(&reg_regdb_apply_mutex);
480 
481 	rtnl_unlock();
482 }
483 
484 static DECLARE_WORK(reg_regdb_work, reg_regdb_apply);
485 
reg_schedule_apply(const struct ieee80211_regdomain * regdom)486 static int reg_schedule_apply(const struct ieee80211_regdomain *regdom)
487 {
488 	struct reg_regdb_apply_request *request;
489 
490 	request = kzalloc(sizeof(struct reg_regdb_apply_request), GFP_KERNEL);
491 	if (!request) {
492 		kfree(regdom);
493 		return -ENOMEM;
494 	}
495 
496 	request->regdom = regdom;
497 
498 	mutex_lock(&reg_regdb_apply_mutex);
499 	list_add_tail(&request->list, &reg_regdb_apply_list);
500 	mutex_unlock(&reg_regdb_apply_mutex);
501 
502 	schedule_work(&reg_regdb_work);
503 	return 0;
504 }
505 
506 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
507 /* Max number of consecutive attempts to communicate with CRDA  */
508 #define REG_MAX_CRDA_TIMEOUTS 10
509 
510 static u32 reg_crda_timeouts;
511 
512 static void crda_timeout_work(struct work_struct *work);
513 static DECLARE_DELAYED_WORK(crda_timeout, crda_timeout_work);
514 
crda_timeout_work(struct work_struct * work)515 static void crda_timeout_work(struct work_struct *work)
516 {
517 	pr_debug("Timeout while waiting for CRDA to reply, restoring regulatory settings\n");
518 	rtnl_lock();
519 	reg_crda_timeouts++;
520 	restore_regulatory_settings(true, false);
521 	rtnl_unlock();
522 }
523 
cancel_crda_timeout(void)524 static void cancel_crda_timeout(void)
525 {
526 	cancel_delayed_work(&crda_timeout);
527 }
528 
cancel_crda_timeout_sync(void)529 static void cancel_crda_timeout_sync(void)
530 {
531 	cancel_delayed_work_sync(&crda_timeout);
532 }
533 
reset_crda_timeouts(void)534 static void reset_crda_timeouts(void)
535 {
536 	reg_crda_timeouts = 0;
537 }
538 
539 /*
540  * This lets us keep regulatory code which is updated on a regulatory
541  * basis in userspace.
542  */
call_crda(const char * alpha2)543 static int call_crda(const char *alpha2)
544 {
545 	char country[12];
546 	char *env[] = { country, NULL };
547 	int ret;
548 
549 	snprintf(country, sizeof(country), "COUNTRY=%c%c",
550 		 alpha2[0], alpha2[1]);
551 
552 	if (reg_crda_timeouts > REG_MAX_CRDA_TIMEOUTS) {
553 		pr_debug("Exceeded CRDA call max attempts. Not calling CRDA\n");
554 		return -EINVAL;
555 	}
556 
557 	if (!is_world_regdom((char *) alpha2))
558 		pr_debug("Calling CRDA for country: %c%c\n",
559 			 alpha2[0], alpha2[1]);
560 	else
561 		pr_debug("Calling CRDA to update world regulatory domain\n");
562 
563 	ret = kobject_uevent_env(&reg_pdev->dev.kobj, KOBJ_CHANGE, env);
564 	if (ret)
565 		return ret;
566 
567 	queue_delayed_work(system_power_efficient_wq,
568 			   &crda_timeout, msecs_to_jiffies(3142));
569 	return 0;
570 }
571 #else
cancel_crda_timeout(void)572 static inline void cancel_crda_timeout(void) {}
cancel_crda_timeout_sync(void)573 static inline void cancel_crda_timeout_sync(void) {}
reset_crda_timeouts(void)574 static inline void reset_crda_timeouts(void) {}
call_crda(const char * alpha2)575 static inline int call_crda(const char *alpha2)
576 {
577 	return -ENODATA;
578 }
579 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
580 
581 /* code to directly load a firmware database through request_firmware */
582 static const struct fwdb_header *regdb;
583 
584 struct fwdb_country {
585 	u8 alpha2[2];
586 	__be16 coll_ptr;
587 	/* this struct cannot be extended */
588 } __packed __aligned(4);
589 
590 struct fwdb_collection {
591 	u8 len;
592 	u8 n_rules;
593 	u8 dfs_region;
594 	/* no optional data yet */
595 	/* aligned to 2, then followed by __be16 array of rule pointers */
596 } __packed __aligned(4);
597 
598 enum fwdb_flags {
599 	FWDB_FLAG_NO_OFDM	= BIT(0),
600 	FWDB_FLAG_NO_OUTDOOR	= BIT(1),
601 	FWDB_FLAG_DFS		= BIT(2),
602 	FWDB_FLAG_NO_IR		= BIT(3),
603 	FWDB_FLAG_AUTO_BW	= BIT(4),
604 };
605 
606 struct fwdb_wmm_ac {
607 	u8 ecw;
608 	u8 aifsn;
609 	__be16 cot;
610 } __packed;
611 
612 struct fwdb_wmm_rule {
613 	struct fwdb_wmm_ac client[IEEE80211_NUM_ACS];
614 	struct fwdb_wmm_ac ap[IEEE80211_NUM_ACS];
615 } __packed;
616 
617 struct fwdb_rule {
618 	u8 len;
619 	u8 flags;
620 	__be16 max_eirp;
621 	__be32 start, end, max_bw;
622 	/* start of optional data */
623 	__be16 cac_timeout;
624 	__be16 wmm_ptr;
625 } __packed __aligned(4);
626 
627 #define FWDB_MAGIC 0x52474442
628 #define FWDB_VERSION 20
629 
630 struct fwdb_header {
631 	__be32 magic;
632 	__be32 version;
633 	struct fwdb_country country[];
634 } __packed __aligned(4);
635 
ecw2cw(int ecw)636 static int ecw2cw(int ecw)
637 {
638 	return (1 << ecw) - 1;
639 }
640 
valid_wmm(struct fwdb_wmm_rule * rule)641 static bool valid_wmm(struct fwdb_wmm_rule *rule)
642 {
643 	struct fwdb_wmm_ac *ac = (struct fwdb_wmm_ac *)rule;
644 	int i;
645 
646 	for (i = 0; i < IEEE80211_NUM_ACS * 2; i++) {
647 		u16 cw_min = ecw2cw((ac[i].ecw & 0xf0) >> 4);
648 		u16 cw_max = ecw2cw(ac[i].ecw & 0x0f);
649 		u8 aifsn = ac[i].aifsn;
650 
651 		if (cw_min >= cw_max)
652 			return false;
653 
654 		if (aifsn < 1)
655 			return false;
656 	}
657 
658 	return true;
659 }
660 
valid_rule(const u8 * data,unsigned int size,u16 rule_ptr)661 static bool valid_rule(const u8 *data, unsigned int size, u16 rule_ptr)
662 {
663 	struct fwdb_rule *rule = (void *)(data + (rule_ptr << 2));
664 
665 	if ((u8 *)rule + sizeof(rule->len) > data + size)
666 		return false;
667 
668 	/* mandatory fields */
669 	if (rule->len < offsetofend(struct fwdb_rule, max_bw))
670 		return false;
671 	if (rule->len >= offsetofend(struct fwdb_rule, wmm_ptr)) {
672 		u32 wmm_ptr = be16_to_cpu(rule->wmm_ptr) << 2;
673 		struct fwdb_wmm_rule *wmm;
674 
675 		if (wmm_ptr + sizeof(struct fwdb_wmm_rule) > size)
676 			return false;
677 
678 		wmm = (void *)(data + wmm_ptr);
679 
680 		if (!valid_wmm(wmm))
681 			return false;
682 	}
683 	return true;
684 }
685 
valid_country(const u8 * data,unsigned int size,const struct fwdb_country * country)686 static bool valid_country(const u8 *data, unsigned int size,
687 			  const struct fwdb_country *country)
688 {
689 	unsigned int ptr = be16_to_cpu(country->coll_ptr) << 2;
690 	struct fwdb_collection *coll = (void *)(data + ptr);
691 	__be16 *rules_ptr;
692 	unsigned int i;
693 
694 	/* make sure we can read len/n_rules */
695 	if ((u8 *)coll + offsetofend(typeof(*coll), n_rules) > data + size)
696 		return false;
697 
698 	/* make sure base struct and all rules fit */
699 	if ((u8 *)coll + ALIGN(coll->len, 2) +
700 	    (coll->n_rules * 2) > data + size)
701 		return false;
702 
703 	/* mandatory fields must exist */
704 	if (coll->len < offsetofend(struct fwdb_collection, dfs_region))
705 		return false;
706 
707 	rules_ptr = (void *)((u8 *)coll + ALIGN(coll->len, 2));
708 
709 	for (i = 0; i < coll->n_rules; i++) {
710 		u16 rule_ptr = be16_to_cpu(rules_ptr[i]);
711 
712 		if (!valid_rule(data, size, rule_ptr))
713 			return false;
714 	}
715 
716 	return true;
717 }
718 
719 #ifdef CONFIG_CFG80211_REQUIRE_SIGNED_REGDB
720 static struct key *builtin_regdb_keys;
721 
load_keys_from_buffer(const u8 * p,unsigned int buflen)722 static void __init load_keys_from_buffer(const u8 *p, unsigned int buflen)
723 {
724 	const u8 *end = p + buflen;
725 	size_t plen;
726 	key_ref_t key;
727 
728 	while (p < end) {
729 		/* Each cert begins with an ASN.1 SEQUENCE tag and must be more
730 		 * than 256 bytes in size.
731 		 */
732 		if (end - p < 4)
733 			goto dodgy_cert;
734 		if (p[0] != 0x30 &&
735 		    p[1] != 0x82)
736 			goto dodgy_cert;
737 		plen = (p[2] << 8) | p[3];
738 		plen += 4;
739 		if (plen > end - p)
740 			goto dodgy_cert;
741 
742 		key = key_create_or_update(make_key_ref(builtin_regdb_keys, 1),
743 					   "asymmetric", NULL, p, plen,
744 					   ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
745 					    KEY_USR_VIEW | KEY_USR_READ),
746 					   KEY_ALLOC_NOT_IN_QUOTA |
747 					   KEY_ALLOC_BUILT_IN |
748 					   KEY_ALLOC_BYPASS_RESTRICTION);
749 		if (IS_ERR(key)) {
750 			pr_err("Problem loading in-kernel X.509 certificate (%ld)\n",
751 			       PTR_ERR(key));
752 		} else {
753 			pr_notice("Loaded X.509 cert '%s'\n",
754 				  key_ref_to_ptr(key)->description);
755 			key_ref_put(key);
756 		}
757 		p += plen;
758 	}
759 
760 	return;
761 
762 dodgy_cert:
763 	pr_err("Problem parsing in-kernel X.509 certificate list\n");
764 }
765 
load_builtin_regdb_keys(void)766 static int __init load_builtin_regdb_keys(void)
767 {
768 	builtin_regdb_keys =
769 		keyring_alloc(".builtin_regdb_keys",
770 			      KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
771 			      ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
772 			      KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH),
773 			      KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
774 	if (IS_ERR(builtin_regdb_keys))
775 		return PTR_ERR(builtin_regdb_keys);
776 
777 	pr_notice("Loading compiled-in X.509 certificates for regulatory database\n");
778 
779 #ifdef CONFIG_CFG80211_USE_KERNEL_REGDB_KEYS
780 	load_keys_from_buffer(shipped_regdb_certs, shipped_regdb_certs_len);
781 #endif
782 #ifdef CONFIG_CFG80211_EXTRA_REGDB_KEYDIR
783 	if (CONFIG_CFG80211_EXTRA_REGDB_KEYDIR[0] != '\0')
784 		load_keys_from_buffer(extra_regdb_certs, extra_regdb_certs_len);
785 #endif
786 
787 	return 0;
788 }
789 
regdb_has_valid_signature(const u8 * data,unsigned int size)790 static bool regdb_has_valid_signature(const u8 *data, unsigned int size)
791 {
792 	const struct firmware *sig;
793 	bool result;
794 
795 	if (request_firmware(&sig, "regulatory.db.p7s", &reg_pdev->dev))
796 		return false;
797 
798 	result = verify_pkcs7_signature(data, size, sig->data, sig->size,
799 					builtin_regdb_keys,
800 					VERIFYING_UNSPECIFIED_SIGNATURE,
801 					NULL, NULL) == 0;
802 
803 	release_firmware(sig);
804 
805 	return result;
806 }
807 
free_regdb_keyring(void)808 static void free_regdb_keyring(void)
809 {
810 	key_put(builtin_regdb_keys);
811 }
812 #else
load_builtin_regdb_keys(void)813 static int load_builtin_regdb_keys(void)
814 {
815 	return 0;
816 }
817 
regdb_has_valid_signature(const u8 * data,unsigned int size)818 static bool regdb_has_valid_signature(const u8 *data, unsigned int size)
819 {
820 	return true;
821 }
822 
free_regdb_keyring(void)823 static void free_regdb_keyring(void)
824 {
825 }
826 #endif /* CONFIG_CFG80211_REQUIRE_SIGNED_REGDB */
827 
valid_regdb(const u8 * data,unsigned int size)828 static bool valid_regdb(const u8 *data, unsigned int size)
829 {
830 	const struct fwdb_header *hdr = (void *)data;
831 	const struct fwdb_country *country;
832 
833 	if (size < sizeof(*hdr))
834 		return false;
835 
836 	if (hdr->magic != cpu_to_be32(FWDB_MAGIC))
837 		return false;
838 
839 	if (hdr->version != cpu_to_be32(FWDB_VERSION))
840 		return false;
841 
842 	if (!regdb_has_valid_signature(data, size))
843 		return false;
844 
845 	country = &hdr->country[0];
846 	while ((u8 *)(country + 1) <= data + size) {
847 		if (!country->coll_ptr)
848 			break;
849 		if (!valid_country(data, size, country))
850 			return false;
851 		country++;
852 	}
853 
854 	return true;
855 }
856 
set_wmm_rule(const struct fwdb_header * db,const struct fwdb_country * country,const struct fwdb_rule * rule,struct ieee80211_reg_rule * rrule)857 static void set_wmm_rule(const struct fwdb_header *db,
858 			 const struct fwdb_country *country,
859 			 const struct fwdb_rule *rule,
860 			 struct ieee80211_reg_rule *rrule)
861 {
862 	struct ieee80211_wmm_rule *wmm_rule = &rrule->wmm_rule;
863 	struct fwdb_wmm_rule *wmm;
864 	unsigned int i, wmm_ptr;
865 
866 	wmm_ptr = be16_to_cpu(rule->wmm_ptr) << 2;
867 	wmm = (void *)((u8 *)db + wmm_ptr);
868 
869 	if (!valid_wmm(wmm)) {
870 		pr_err("Invalid regulatory WMM rule %u-%u in domain %c%c\n",
871 		       be32_to_cpu(rule->start), be32_to_cpu(rule->end),
872 		       country->alpha2[0], country->alpha2[1]);
873 		return;
874 	}
875 
876 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
877 		wmm_rule->client[i].cw_min =
878 			ecw2cw((wmm->client[i].ecw & 0xf0) >> 4);
879 		wmm_rule->client[i].cw_max = ecw2cw(wmm->client[i].ecw & 0x0f);
880 		wmm_rule->client[i].aifsn =  wmm->client[i].aifsn;
881 		wmm_rule->client[i].cot =
882 			1000 * be16_to_cpu(wmm->client[i].cot);
883 		wmm_rule->ap[i].cw_min = ecw2cw((wmm->ap[i].ecw & 0xf0) >> 4);
884 		wmm_rule->ap[i].cw_max = ecw2cw(wmm->ap[i].ecw & 0x0f);
885 		wmm_rule->ap[i].aifsn = wmm->ap[i].aifsn;
886 		wmm_rule->ap[i].cot = 1000 * be16_to_cpu(wmm->ap[i].cot);
887 	}
888 
889 	rrule->has_wmm = true;
890 }
891 
__regdb_query_wmm(const struct fwdb_header * db,const struct fwdb_country * country,int freq,struct ieee80211_reg_rule * rrule)892 static int __regdb_query_wmm(const struct fwdb_header *db,
893 			     const struct fwdb_country *country, int freq,
894 			     struct ieee80211_reg_rule *rrule)
895 {
896 	unsigned int ptr = be16_to_cpu(country->coll_ptr) << 2;
897 	struct fwdb_collection *coll = (void *)((u8 *)db + ptr);
898 	int i;
899 
900 	for (i = 0; i < coll->n_rules; i++) {
901 		__be16 *rules_ptr = (void *)((u8 *)coll + ALIGN(coll->len, 2));
902 		unsigned int rule_ptr = be16_to_cpu(rules_ptr[i]) << 2;
903 		struct fwdb_rule *rule = (void *)((u8 *)db + rule_ptr);
904 
905 		if (rule->len < offsetofend(struct fwdb_rule, wmm_ptr))
906 			continue;
907 
908 		if (freq >= KHZ_TO_MHZ(be32_to_cpu(rule->start)) &&
909 		    freq <= KHZ_TO_MHZ(be32_to_cpu(rule->end))) {
910 			set_wmm_rule(db, country, rule, rrule);
911 			return 0;
912 		}
913 	}
914 
915 	return -ENODATA;
916 }
917 
reg_query_regdb_wmm(char * alpha2,int freq,struct ieee80211_reg_rule * rule)918 int reg_query_regdb_wmm(char *alpha2, int freq, struct ieee80211_reg_rule *rule)
919 {
920 	const struct fwdb_header *hdr = regdb;
921 	const struct fwdb_country *country;
922 
923 	if (!regdb)
924 		return -ENODATA;
925 
926 	if (IS_ERR(regdb))
927 		return PTR_ERR(regdb);
928 
929 	country = &hdr->country[0];
930 	while (country->coll_ptr) {
931 		if (alpha2_equal(alpha2, country->alpha2))
932 			return __regdb_query_wmm(regdb, country, freq, rule);
933 
934 		country++;
935 	}
936 
937 	return -ENODATA;
938 }
939 EXPORT_SYMBOL(reg_query_regdb_wmm);
940 
regdb_query_country(const struct fwdb_header * db,const struct fwdb_country * country)941 static int regdb_query_country(const struct fwdb_header *db,
942 			       const struct fwdb_country *country)
943 {
944 	unsigned int ptr = be16_to_cpu(country->coll_ptr) << 2;
945 	struct fwdb_collection *coll = (void *)((u8 *)db + ptr);
946 	struct ieee80211_regdomain *regdom;
947 	unsigned int i;
948 
949 	regdom = kzalloc(struct_size(regdom, reg_rules, coll->n_rules),
950 			 GFP_KERNEL);
951 	if (!regdom)
952 		return -ENOMEM;
953 
954 	regdom->n_reg_rules = coll->n_rules;
955 	regdom->alpha2[0] = country->alpha2[0];
956 	regdom->alpha2[1] = country->alpha2[1];
957 	regdom->dfs_region = coll->dfs_region;
958 
959 	for (i = 0; i < regdom->n_reg_rules; i++) {
960 		__be16 *rules_ptr = (void *)((u8 *)coll + ALIGN(coll->len, 2));
961 		unsigned int rule_ptr = be16_to_cpu(rules_ptr[i]) << 2;
962 		struct fwdb_rule *rule = (void *)((u8 *)db + rule_ptr);
963 		struct ieee80211_reg_rule *rrule = &regdom->reg_rules[i];
964 
965 		rrule->freq_range.start_freq_khz = be32_to_cpu(rule->start);
966 		rrule->freq_range.end_freq_khz = be32_to_cpu(rule->end);
967 		rrule->freq_range.max_bandwidth_khz = be32_to_cpu(rule->max_bw);
968 
969 		rrule->power_rule.max_antenna_gain = 0;
970 		rrule->power_rule.max_eirp = be16_to_cpu(rule->max_eirp);
971 
972 		rrule->flags = 0;
973 		if (rule->flags & FWDB_FLAG_NO_OFDM)
974 			rrule->flags |= NL80211_RRF_NO_OFDM;
975 		if (rule->flags & FWDB_FLAG_NO_OUTDOOR)
976 			rrule->flags |= NL80211_RRF_NO_OUTDOOR;
977 		if (rule->flags & FWDB_FLAG_DFS)
978 			rrule->flags |= NL80211_RRF_DFS;
979 		if (rule->flags & FWDB_FLAG_NO_IR)
980 			rrule->flags |= NL80211_RRF_NO_IR;
981 		if (rule->flags & FWDB_FLAG_AUTO_BW)
982 			rrule->flags |= NL80211_RRF_AUTO_BW;
983 
984 		rrule->dfs_cac_ms = 0;
985 
986 		/* handle optional data */
987 		if (rule->len >= offsetofend(struct fwdb_rule, cac_timeout))
988 			rrule->dfs_cac_ms =
989 				1000 * be16_to_cpu(rule->cac_timeout);
990 		if (rule->len >= offsetofend(struct fwdb_rule, wmm_ptr))
991 			set_wmm_rule(db, country, rule, rrule);
992 	}
993 
994 	return reg_schedule_apply(regdom);
995 }
996 
query_regdb(const char * alpha2)997 static int query_regdb(const char *alpha2)
998 {
999 	const struct fwdb_header *hdr = regdb;
1000 	const struct fwdb_country *country;
1001 
1002 	ASSERT_RTNL();
1003 
1004 	if (IS_ERR(regdb))
1005 		return PTR_ERR(regdb);
1006 
1007 	country = &hdr->country[0];
1008 	while (country->coll_ptr) {
1009 		if (alpha2_equal(alpha2, country->alpha2))
1010 			return regdb_query_country(regdb, country);
1011 		country++;
1012 	}
1013 
1014 	return -ENODATA;
1015 }
1016 
regdb_fw_cb(const struct firmware * fw,void * context)1017 static void regdb_fw_cb(const struct firmware *fw, void *context)
1018 {
1019 	int set_error = 0;
1020 	bool restore = true;
1021 	void *db;
1022 
1023 	if (!fw) {
1024 		pr_info("failed to load regulatory.db\n");
1025 		set_error = -ENODATA;
1026 	} else if (!valid_regdb(fw->data, fw->size)) {
1027 		pr_info("loaded regulatory.db is malformed or signature is missing/invalid\n");
1028 		set_error = -EINVAL;
1029 	}
1030 
1031 	rtnl_lock();
1032 	if (regdb && !IS_ERR(regdb)) {
1033 		/* negative case - a bug
1034 		 * positive case - can happen due to race in case of multiple cb's in
1035 		 * queue, due to usage of asynchronous callback
1036 		 *
1037 		 * Either case, just restore and free new db.
1038 		 */
1039 	} else if (set_error) {
1040 		regdb = ERR_PTR(set_error);
1041 	} else if (fw) {
1042 		db = kmemdup(fw->data, fw->size, GFP_KERNEL);
1043 		if (db) {
1044 			regdb = db;
1045 			restore = context && query_regdb(context);
1046 		} else {
1047 			restore = true;
1048 		}
1049 	}
1050 
1051 	if (restore)
1052 		restore_regulatory_settings(true, false);
1053 
1054 	rtnl_unlock();
1055 
1056 	kfree(context);
1057 
1058 	release_firmware(fw);
1059 }
1060 
query_regdb_file(const char * alpha2)1061 static int query_regdb_file(const char *alpha2)
1062 {
1063 	ASSERT_RTNL();
1064 
1065 	if (regdb)
1066 		return query_regdb(alpha2);
1067 
1068 	alpha2 = kmemdup(alpha2, 2, GFP_KERNEL);
1069 	if (!alpha2)
1070 		return -ENOMEM;
1071 
1072 	return request_firmware_nowait(THIS_MODULE, true, "regulatory.db",
1073 				       &reg_pdev->dev, GFP_KERNEL,
1074 				       (void *)alpha2, regdb_fw_cb);
1075 }
1076 
reg_reload_regdb(void)1077 int reg_reload_regdb(void)
1078 {
1079 	const struct firmware *fw;
1080 	void *db;
1081 	int err;
1082 
1083 	err = request_firmware(&fw, "regulatory.db", &reg_pdev->dev);
1084 	if (err)
1085 		return err;
1086 
1087 	if (!valid_regdb(fw->data, fw->size)) {
1088 		err = -ENODATA;
1089 		goto out;
1090 	}
1091 
1092 	db = kmemdup(fw->data, fw->size, GFP_KERNEL);
1093 	if (!db) {
1094 		err = -ENOMEM;
1095 		goto out;
1096 	}
1097 
1098 	rtnl_lock();
1099 	if (!IS_ERR_OR_NULL(regdb))
1100 		kfree(regdb);
1101 	regdb = db;
1102 	rtnl_unlock();
1103 
1104  out:
1105 	release_firmware(fw);
1106 	return err;
1107 }
1108 
reg_query_database(struct regulatory_request * request)1109 static bool reg_query_database(struct regulatory_request *request)
1110 {
1111 	if (query_regdb_file(request->alpha2) == 0)
1112 		return true;
1113 
1114 	if (call_crda(request->alpha2) == 0)
1115 		return true;
1116 
1117 	return false;
1118 }
1119 
reg_is_valid_request(const char * alpha2)1120 bool reg_is_valid_request(const char *alpha2)
1121 {
1122 	struct regulatory_request *lr = get_last_request();
1123 
1124 	if (!lr || lr->processed)
1125 		return false;
1126 
1127 	return alpha2_equal(lr->alpha2, alpha2);
1128 }
1129 
reg_get_regdomain(struct wiphy * wiphy)1130 static const struct ieee80211_regdomain *reg_get_regdomain(struct wiphy *wiphy)
1131 {
1132 	struct regulatory_request *lr = get_last_request();
1133 
1134 	/*
1135 	 * Follow the driver's regulatory domain, if present, unless a country
1136 	 * IE has been processed or a user wants to help complaince further
1137 	 */
1138 	if (lr->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
1139 	    lr->initiator != NL80211_REGDOM_SET_BY_USER &&
1140 	    wiphy->regd)
1141 		return get_wiphy_regdom(wiphy);
1142 
1143 	return get_cfg80211_regdom();
1144 }
1145 
1146 static unsigned int
reg_get_max_bandwidth_from_range(const struct ieee80211_regdomain * rd,const struct ieee80211_reg_rule * rule)1147 reg_get_max_bandwidth_from_range(const struct ieee80211_regdomain *rd,
1148 				 const struct ieee80211_reg_rule *rule)
1149 {
1150 	const struct ieee80211_freq_range *freq_range = &rule->freq_range;
1151 	const struct ieee80211_freq_range *freq_range_tmp;
1152 	const struct ieee80211_reg_rule *tmp;
1153 	u32 start_freq, end_freq, idx, no;
1154 
1155 	for (idx = 0; idx < rd->n_reg_rules; idx++)
1156 		if (rule == &rd->reg_rules[idx])
1157 			break;
1158 
1159 	if (idx == rd->n_reg_rules)
1160 		return 0;
1161 
1162 	/* get start_freq */
1163 	no = idx;
1164 
1165 	while (no) {
1166 		tmp = &rd->reg_rules[--no];
1167 		freq_range_tmp = &tmp->freq_range;
1168 
1169 		if (freq_range_tmp->end_freq_khz < freq_range->start_freq_khz)
1170 			break;
1171 
1172 		freq_range = freq_range_tmp;
1173 	}
1174 
1175 	start_freq = freq_range->start_freq_khz;
1176 
1177 	/* get end_freq */
1178 	freq_range = &rule->freq_range;
1179 	no = idx;
1180 
1181 	while (no < rd->n_reg_rules - 1) {
1182 		tmp = &rd->reg_rules[++no];
1183 		freq_range_tmp = &tmp->freq_range;
1184 
1185 		if (freq_range_tmp->start_freq_khz > freq_range->end_freq_khz)
1186 			break;
1187 
1188 		freq_range = freq_range_tmp;
1189 	}
1190 
1191 	end_freq = freq_range->end_freq_khz;
1192 
1193 	return end_freq - start_freq;
1194 }
1195 
reg_get_max_bandwidth(const struct ieee80211_regdomain * rd,const struct ieee80211_reg_rule * rule)1196 unsigned int reg_get_max_bandwidth(const struct ieee80211_regdomain *rd,
1197 				   const struct ieee80211_reg_rule *rule)
1198 {
1199 	unsigned int bw = reg_get_max_bandwidth_from_range(rd, rule);
1200 
1201 	if (rule->flags & NL80211_RRF_NO_160MHZ)
1202 		bw = min_t(unsigned int, bw, MHZ_TO_KHZ(80));
1203 	if (rule->flags & NL80211_RRF_NO_80MHZ)
1204 		bw = min_t(unsigned int, bw, MHZ_TO_KHZ(40));
1205 
1206 	/*
1207 	 * HT40+/HT40- limits are handled per-channel. Only limit BW if both
1208 	 * are not allowed.
1209 	 */
1210 	if (rule->flags & NL80211_RRF_NO_HT40MINUS &&
1211 	    rule->flags & NL80211_RRF_NO_HT40PLUS)
1212 		bw = min_t(unsigned int, bw, MHZ_TO_KHZ(20));
1213 
1214 	return bw;
1215 }
1216 
1217 /* Sanity check on a regulatory rule */
is_valid_reg_rule(const struct ieee80211_reg_rule * rule)1218 static bool is_valid_reg_rule(const struct ieee80211_reg_rule *rule)
1219 {
1220 	const struct ieee80211_freq_range *freq_range = &rule->freq_range;
1221 	u32 freq_diff;
1222 
1223 	if (freq_range->start_freq_khz <= 0 || freq_range->end_freq_khz <= 0)
1224 		return false;
1225 
1226 	if (freq_range->start_freq_khz > freq_range->end_freq_khz)
1227 		return false;
1228 
1229 	freq_diff = freq_range->end_freq_khz - freq_range->start_freq_khz;
1230 
1231 	if (freq_range->end_freq_khz <= freq_range->start_freq_khz ||
1232 	    freq_range->max_bandwidth_khz > freq_diff)
1233 		return false;
1234 
1235 	return true;
1236 }
1237 
is_valid_rd(const struct ieee80211_regdomain * rd)1238 static bool is_valid_rd(const struct ieee80211_regdomain *rd)
1239 {
1240 	const struct ieee80211_reg_rule *reg_rule = NULL;
1241 	unsigned int i;
1242 
1243 	if (!rd->n_reg_rules)
1244 		return false;
1245 
1246 	if (WARN_ON(rd->n_reg_rules > NL80211_MAX_SUPP_REG_RULES))
1247 		return false;
1248 
1249 	for (i = 0; i < rd->n_reg_rules; i++) {
1250 		reg_rule = &rd->reg_rules[i];
1251 		if (!is_valid_reg_rule(reg_rule))
1252 			return false;
1253 	}
1254 
1255 	return true;
1256 }
1257 
1258 /**
1259  * freq_in_rule_band - tells us if a frequency is in a frequency band
1260  * @freq_range: frequency rule we want to query
1261  * @freq_khz: frequency we are inquiring about
1262  *
1263  * This lets us know if a specific frequency rule is or is not relevant to
1264  * a specific frequency's band. Bands are device specific and artificial
1265  * definitions (the "2.4 GHz band", the "5 GHz band" and the "60GHz band"),
1266  * however it is safe for now to assume that a frequency rule should not be
1267  * part of a frequency's band if the start freq or end freq are off by more
1268  * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 20 GHz for the
1269  * 60 GHz band.
1270  * This resolution can be lowered and should be considered as we add
1271  * regulatory rule support for other "bands".
1272  **/
freq_in_rule_band(const struct ieee80211_freq_range * freq_range,u32 freq_khz)1273 static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,
1274 			      u32 freq_khz)
1275 {
1276 #define ONE_GHZ_IN_KHZ	1000000
1277 	/*
1278 	 * From 802.11ad: directional multi-gigabit (DMG):
1279 	 * Pertaining to operation in a frequency band containing a channel
1280 	 * with the Channel starting frequency above 45 GHz.
1281 	 */
1282 	u32 limit = freq_khz > 45 * ONE_GHZ_IN_KHZ ?
1283 			20 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ;
1284 	if (abs(freq_khz - freq_range->start_freq_khz) <= limit)
1285 		return true;
1286 	if (abs(freq_khz - freq_range->end_freq_khz) <= limit)
1287 		return true;
1288 	return false;
1289 #undef ONE_GHZ_IN_KHZ
1290 }
1291 
1292 /*
1293  * Later on we can perhaps use the more restrictive DFS
1294  * region but we don't have information for that yet so
1295  * for now simply disallow conflicts.
1296  */
1297 static enum nl80211_dfs_regions
reg_intersect_dfs_region(const enum nl80211_dfs_regions dfs_region1,const enum nl80211_dfs_regions dfs_region2)1298 reg_intersect_dfs_region(const enum nl80211_dfs_regions dfs_region1,
1299 			 const enum nl80211_dfs_regions dfs_region2)
1300 {
1301 	if (dfs_region1 != dfs_region2)
1302 		return NL80211_DFS_UNSET;
1303 	return dfs_region1;
1304 }
1305 
reg_wmm_rules_intersect(const struct ieee80211_wmm_ac * wmm_ac1,const struct ieee80211_wmm_ac * wmm_ac2,struct ieee80211_wmm_ac * intersect)1306 static void reg_wmm_rules_intersect(const struct ieee80211_wmm_ac *wmm_ac1,
1307 				    const struct ieee80211_wmm_ac *wmm_ac2,
1308 				    struct ieee80211_wmm_ac *intersect)
1309 {
1310 	intersect->cw_min = max_t(u16, wmm_ac1->cw_min, wmm_ac2->cw_min);
1311 	intersect->cw_max = max_t(u16, wmm_ac1->cw_max, wmm_ac2->cw_max);
1312 	intersect->cot = min_t(u16, wmm_ac1->cot, wmm_ac2->cot);
1313 	intersect->aifsn = max_t(u8, wmm_ac1->aifsn, wmm_ac2->aifsn);
1314 }
1315 
1316 /*
1317  * Helper for regdom_intersect(), this does the real
1318  * mathematical intersection fun
1319  */
reg_rules_intersect(const struct ieee80211_regdomain * rd1,const struct ieee80211_regdomain * rd2,const struct ieee80211_reg_rule * rule1,const struct ieee80211_reg_rule * rule2,struct ieee80211_reg_rule * intersected_rule)1320 static int reg_rules_intersect(const struct ieee80211_regdomain *rd1,
1321 			       const struct ieee80211_regdomain *rd2,
1322 			       const struct ieee80211_reg_rule *rule1,
1323 			       const struct ieee80211_reg_rule *rule2,
1324 			       struct ieee80211_reg_rule *intersected_rule)
1325 {
1326 	const struct ieee80211_freq_range *freq_range1, *freq_range2;
1327 	struct ieee80211_freq_range *freq_range;
1328 	const struct ieee80211_power_rule *power_rule1, *power_rule2;
1329 	struct ieee80211_power_rule *power_rule;
1330 	const struct ieee80211_wmm_rule *wmm_rule1, *wmm_rule2;
1331 	struct ieee80211_wmm_rule *wmm_rule;
1332 	u32 freq_diff, max_bandwidth1, max_bandwidth2;
1333 
1334 	freq_range1 = &rule1->freq_range;
1335 	freq_range2 = &rule2->freq_range;
1336 	freq_range = &intersected_rule->freq_range;
1337 
1338 	power_rule1 = &rule1->power_rule;
1339 	power_rule2 = &rule2->power_rule;
1340 	power_rule = &intersected_rule->power_rule;
1341 
1342 	wmm_rule1 = &rule1->wmm_rule;
1343 	wmm_rule2 = &rule2->wmm_rule;
1344 	wmm_rule = &intersected_rule->wmm_rule;
1345 
1346 	freq_range->start_freq_khz = max(freq_range1->start_freq_khz,
1347 					 freq_range2->start_freq_khz);
1348 	freq_range->end_freq_khz = min(freq_range1->end_freq_khz,
1349 				       freq_range2->end_freq_khz);
1350 
1351 	max_bandwidth1 = freq_range1->max_bandwidth_khz;
1352 	max_bandwidth2 = freq_range2->max_bandwidth_khz;
1353 
1354 	if (rule1->flags & NL80211_RRF_AUTO_BW)
1355 		max_bandwidth1 = reg_get_max_bandwidth(rd1, rule1);
1356 	if (rule2->flags & NL80211_RRF_AUTO_BW)
1357 		max_bandwidth2 = reg_get_max_bandwidth(rd2, rule2);
1358 
1359 	freq_range->max_bandwidth_khz = min(max_bandwidth1, max_bandwidth2);
1360 
1361 	intersected_rule->flags = rule1->flags | rule2->flags;
1362 
1363 	/*
1364 	 * In case NL80211_RRF_AUTO_BW requested for both rules
1365 	 * set AUTO_BW in intersected rule also. Next we will
1366 	 * calculate BW correctly in handle_channel function.
1367 	 * In other case remove AUTO_BW flag while we calculate
1368 	 * maximum bandwidth correctly and auto calculation is
1369 	 * not required.
1370 	 */
1371 	if ((rule1->flags & NL80211_RRF_AUTO_BW) &&
1372 	    (rule2->flags & NL80211_RRF_AUTO_BW))
1373 		intersected_rule->flags |= NL80211_RRF_AUTO_BW;
1374 	else
1375 		intersected_rule->flags &= ~NL80211_RRF_AUTO_BW;
1376 
1377 	freq_diff = freq_range->end_freq_khz - freq_range->start_freq_khz;
1378 	if (freq_range->max_bandwidth_khz > freq_diff)
1379 		freq_range->max_bandwidth_khz = freq_diff;
1380 
1381 	power_rule->max_eirp = min(power_rule1->max_eirp,
1382 		power_rule2->max_eirp);
1383 	power_rule->max_antenna_gain = min(power_rule1->max_antenna_gain,
1384 		power_rule2->max_antenna_gain);
1385 
1386 	intersected_rule->dfs_cac_ms = max(rule1->dfs_cac_ms,
1387 					   rule2->dfs_cac_ms);
1388 
1389 	if (rule1->has_wmm && rule2->has_wmm) {
1390 		u8 ac;
1391 
1392 		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1393 			reg_wmm_rules_intersect(&wmm_rule1->client[ac],
1394 						&wmm_rule2->client[ac],
1395 						&wmm_rule->client[ac]);
1396 			reg_wmm_rules_intersect(&wmm_rule1->ap[ac],
1397 						&wmm_rule2->ap[ac],
1398 						&wmm_rule->ap[ac]);
1399 		}
1400 
1401 		intersected_rule->has_wmm = true;
1402 	} else if (rule1->has_wmm) {
1403 		*wmm_rule = *wmm_rule1;
1404 		intersected_rule->has_wmm = true;
1405 	} else if (rule2->has_wmm) {
1406 		*wmm_rule = *wmm_rule2;
1407 		intersected_rule->has_wmm = true;
1408 	} else {
1409 		intersected_rule->has_wmm = false;
1410 	}
1411 
1412 	if (!is_valid_reg_rule(intersected_rule))
1413 		return -EINVAL;
1414 
1415 	return 0;
1416 }
1417 
1418 /* check whether old rule contains new rule */
rule_contains(struct ieee80211_reg_rule * r1,struct ieee80211_reg_rule * r2)1419 static bool rule_contains(struct ieee80211_reg_rule *r1,
1420 			  struct ieee80211_reg_rule *r2)
1421 {
1422 	/* for simplicity, currently consider only same flags */
1423 	if (r1->flags != r2->flags)
1424 		return false;
1425 
1426 	/* verify r1 is more restrictive */
1427 	if ((r1->power_rule.max_antenna_gain >
1428 	     r2->power_rule.max_antenna_gain) ||
1429 	    r1->power_rule.max_eirp > r2->power_rule.max_eirp)
1430 		return false;
1431 
1432 	/* make sure r2's range is contained within r1 */
1433 	if (r1->freq_range.start_freq_khz > r2->freq_range.start_freq_khz ||
1434 	    r1->freq_range.end_freq_khz < r2->freq_range.end_freq_khz)
1435 		return false;
1436 
1437 	/* and finally verify that r1.max_bw >= r2.max_bw */
1438 	if (r1->freq_range.max_bandwidth_khz <
1439 	    r2->freq_range.max_bandwidth_khz)
1440 		return false;
1441 
1442 	return true;
1443 }
1444 
1445 /* add or extend current rules. do nothing if rule is already contained */
add_rule(struct ieee80211_reg_rule * rule,struct ieee80211_reg_rule * reg_rules,u32 * n_rules)1446 static void add_rule(struct ieee80211_reg_rule *rule,
1447 		     struct ieee80211_reg_rule *reg_rules, u32 *n_rules)
1448 {
1449 	struct ieee80211_reg_rule *tmp_rule;
1450 	int i;
1451 
1452 	for (i = 0; i < *n_rules; i++) {
1453 		tmp_rule = &reg_rules[i];
1454 		/* rule is already contained - do nothing */
1455 		if (rule_contains(tmp_rule, rule))
1456 			return;
1457 
1458 		/* extend rule if possible */
1459 		if (rule_contains(rule, tmp_rule)) {
1460 			memcpy(tmp_rule, rule, sizeof(*rule));
1461 			return;
1462 		}
1463 	}
1464 
1465 	memcpy(&reg_rules[*n_rules], rule, sizeof(*rule));
1466 	(*n_rules)++;
1467 }
1468 
1469 /**
1470  * regdom_intersect - do the intersection between two regulatory domains
1471  * @rd1: first regulatory domain
1472  * @rd2: second regulatory domain
1473  *
1474  * Use this function to get the intersection between two regulatory domains.
1475  * Once completed we will mark the alpha2 for the rd as intersected, "98",
1476  * as no one single alpha2 can represent this regulatory domain.
1477  *
1478  * Returns a pointer to the regulatory domain structure which will hold the
1479  * resulting intersection of rules between rd1 and rd2. We will
1480  * kzalloc() this structure for you.
1481  */
1482 static struct ieee80211_regdomain *
regdom_intersect(const struct ieee80211_regdomain * rd1,const struct ieee80211_regdomain * rd2)1483 regdom_intersect(const struct ieee80211_regdomain *rd1,
1484 		 const struct ieee80211_regdomain *rd2)
1485 {
1486 	int r;
1487 	unsigned int x, y;
1488 	unsigned int num_rules = 0;
1489 	const struct ieee80211_reg_rule *rule1, *rule2;
1490 	struct ieee80211_reg_rule intersected_rule;
1491 	struct ieee80211_regdomain *rd;
1492 
1493 	if (!rd1 || !rd2)
1494 		return NULL;
1495 
1496 	/*
1497 	 * First we get a count of the rules we'll need, then we actually
1498 	 * build them. This is to so we can malloc() and free() a
1499 	 * regdomain once. The reason we use reg_rules_intersect() here
1500 	 * is it will return -EINVAL if the rule computed makes no sense.
1501 	 * All rules that do check out OK are valid.
1502 	 */
1503 
1504 	for (x = 0; x < rd1->n_reg_rules; x++) {
1505 		rule1 = &rd1->reg_rules[x];
1506 		for (y = 0; y < rd2->n_reg_rules; y++) {
1507 			rule2 = &rd2->reg_rules[y];
1508 			if (!reg_rules_intersect(rd1, rd2, rule1, rule2,
1509 						 &intersected_rule))
1510 				num_rules++;
1511 		}
1512 	}
1513 
1514 	if (!num_rules)
1515 		return NULL;
1516 
1517 	rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
1518 	if (!rd)
1519 		return NULL;
1520 
1521 	for (x = 0; x < rd1->n_reg_rules; x++) {
1522 		rule1 = &rd1->reg_rules[x];
1523 		for (y = 0; y < rd2->n_reg_rules; y++) {
1524 			rule2 = &rd2->reg_rules[y];
1525 			r = reg_rules_intersect(rd1, rd2, rule1, rule2,
1526 						&intersected_rule);
1527 			/*
1528 			 * No need to memset here the intersected rule here as
1529 			 * we're not using the stack anymore
1530 			 */
1531 			if (r)
1532 				continue;
1533 
1534 			add_rule(&intersected_rule, rd->reg_rules,
1535 				 &rd->n_reg_rules);
1536 		}
1537 	}
1538 
1539 	rd->alpha2[0] = '9';
1540 	rd->alpha2[1] = '8';
1541 	rd->dfs_region = reg_intersect_dfs_region(rd1->dfs_region,
1542 						  rd2->dfs_region);
1543 
1544 	return rd;
1545 }
1546 
1547 /*
1548  * XXX: add support for the rest of enum nl80211_reg_rule_flags, we may
1549  * want to just have the channel structure use these
1550  */
map_regdom_flags(u32 rd_flags)1551 static u32 map_regdom_flags(u32 rd_flags)
1552 {
1553 	u32 channel_flags = 0;
1554 	if (rd_flags & NL80211_RRF_NO_IR_ALL)
1555 		channel_flags |= IEEE80211_CHAN_NO_IR;
1556 	if (rd_flags & NL80211_RRF_DFS)
1557 		channel_flags |= IEEE80211_CHAN_RADAR;
1558 	if (rd_flags & NL80211_RRF_NO_OFDM)
1559 		channel_flags |= IEEE80211_CHAN_NO_OFDM;
1560 	if (rd_flags & NL80211_RRF_NO_OUTDOOR)
1561 		channel_flags |= IEEE80211_CHAN_INDOOR_ONLY;
1562 	if (rd_flags & NL80211_RRF_IR_CONCURRENT)
1563 		channel_flags |= IEEE80211_CHAN_IR_CONCURRENT;
1564 	if (rd_flags & NL80211_RRF_NO_HT40MINUS)
1565 		channel_flags |= IEEE80211_CHAN_NO_HT40MINUS;
1566 	if (rd_flags & NL80211_RRF_NO_HT40PLUS)
1567 		channel_flags |= IEEE80211_CHAN_NO_HT40PLUS;
1568 	if (rd_flags & NL80211_RRF_NO_80MHZ)
1569 		channel_flags |= IEEE80211_CHAN_NO_80MHZ;
1570 	if (rd_flags & NL80211_RRF_NO_160MHZ)
1571 		channel_flags |= IEEE80211_CHAN_NO_160MHZ;
1572 	return channel_flags;
1573 }
1574 
1575 static const struct ieee80211_reg_rule *
freq_reg_info_regd(u32 center_freq,const struct ieee80211_regdomain * regd,u32 bw)1576 freq_reg_info_regd(u32 center_freq,
1577 		   const struct ieee80211_regdomain *regd, u32 bw)
1578 {
1579 	int i;
1580 	bool band_rule_found = false;
1581 	bool bw_fits = false;
1582 
1583 	if (!regd)
1584 		return ERR_PTR(-EINVAL);
1585 
1586 	for (i = 0; i < regd->n_reg_rules; i++) {
1587 		const struct ieee80211_reg_rule *rr;
1588 		const struct ieee80211_freq_range *fr = NULL;
1589 
1590 		rr = &regd->reg_rules[i];
1591 		fr = &rr->freq_range;
1592 
1593 		/*
1594 		 * We only need to know if one frequency rule was
1595 		 * was in center_freq's band, that's enough, so lets
1596 		 * not overwrite it once found
1597 		 */
1598 		if (!band_rule_found)
1599 			band_rule_found = freq_in_rule_band(fr, center_freq);
1600 
1601 		bw_fits = cfg80211_does_bw_fit_range(fr, center_freq, bw);
1602 
1603 		if (band_rule_found && bw_fits)
1604 			return rr;
1605 	}
1606 
1607 	if (!band_rule_found)
1608 		return ERR_PTR(-ERANGE);
1609 
1610 	return ERR_PTR(-EINVAL);
1611 }
1612 
1613 static const struct ieee80211_reg_rule *
__freq_reg_info(struct wiphy * wiphy,u32 center_freq,u32 min_bw)1614 __freq_reg_info(struct wiphy *wiphy, u32 center_freq, u32 min_bw)
1615 {
1616 	const struct ieee80211_regdomain *regd = reg_get_regdomain(wiphy);
1617 	const struct ieee80211_reg_rule *reg_rule = NULL;
1618 	u32 bw;
1619 
1620 	for (bw = MHZ_TO_KHZ(20); bw >= min_bw; bw = bw / 2) {
1621 		reg_rule = freq_reg_info_regd(center_freq, regd, bw);
1622 		if (!IS_ERR(reg_rule))
1623 			return reg_rule;
1624 	}
1625 
1626 	return reg_rule;
1627 }
1628 
freq_reg_info(struct wiphy * wiphy,u32 center_freq)1629 const struct ieee80211_reg_rule *freq_reg_info(struct wiphy *wiphy,
1630 					       u32 center_freq)
1631 {
1632 	return __freq_reg_info(wiphy, center_freq, MHZ_TO_KHZ(20));
1633 }
1634 EXPORT_SYMBOL(freq_reg_info);
1635 
reg_initiator_name(enum nl80211_reg_initiator initiator)1636 const char *reg_initiator_name(enum nl80211_reg_initiator initiator)
1637 {
1638 	switch (initiator) {
1639 	case NL80211_REGDOM_SET_BY_CORE:
1640 		return "core";
1641 	case NL80211_REGDOM_SET_BY_USER:
1642 		return "user";
1643 	case NL80211_REGDOM_SET_BY_DRIVER:
1644 		return "driver";
1645 	case NL80211_REGDOM_SET_BY_COUNTRY_IE:
1646 		return "country element";
1647 	default:
1648 		WARN_ON(1);
1649 		return "bug";
1650 	}
1651 }
1652 EXPORT_SYMBOL(reg_initiator_name);
1653 
reg_rule_to_chan_bw_flags(const struct ieee80211_regdomain * regd,const struct ieee80211_reg_rule * reg_rule,const struct ieee80211_channel * chan)1654 static uint32_t reg_rule_to_chan_bw_flags(const struct ieee80211_regdomain *regd,
1655 					  const struct ieee80211_reg_rule *reg_rule,
1656 					  const struct ieee80211_channel *chan)
1657 {
1658 	const struct ieee80211_freq_range *freq_range = NULL;
1659 	u32 max_bandwidth_khz, bw_flags = 0;
1660 
1661 	freq_range = &reg_rule->freq_range;
1662 
1663 	max_bandwidth_khz = freq_range->max_bandwidth_khz;
1664 	/* Check if auto calculation requested */
1665 	if (reg_rule->flags & NL80211_RRF_AUTO_BW)
1666 		max_bandwidth_khz = reg_get_max_bandwidth(regd, reg_rule);
1667 
1668 	/* If we get a reg_rule we can assume that at least 5Mhz fit */
1669 	if (!cfg80211_does_bw_fit_range(freq_range,
1670 					MHZ_TO_KHZ(chan->center_freq),
1671 					MHZ_TO_KHZ(10)))
1672 		bw_flags |= IEEE80211_CHAN_NO_10MHZ;
1673 	if (!cfg80211_does_bw_fit_range(freq_range,
1674 					MHZ_TO_KHZ(chan->center_freq),
1675 					MHZ_TO_KHZ(20)))
1676 		bw_flags |= IEEE80211_CHAN_NO_20MHZ;
1677 
1678 	if (max_bandwidth_khz < MHZ_TO_KHZ(10))
1679 		bw_flags |= IEEE80211_CHAN_NO_10MHZ;
1680 	if (max_bandwidth_khz < MHZ_TO_KHZ(20))
1681 		bw_flags |= IEEE80211_CHAN_NO_20MHZ;
1682 	if (max_bandwidth_khz < MHZ_TO_KHZ(40))
1683 		bw_flags |= IEEE80211_CHAN_NO_HT40;
1684 	if (max_bandwidth_khz < MHZ_TO_KHZ(80))
1685 		bw_flags |= IEEE80211_CHAN_NO_80MHZ;
1686 	if (max_bandwidth_khz < MHZ_TO_KHZ(160))
1687 		bw_flags |= IEEE80211_CHAN_NO_160MHZ;
1688 	return bw_flags;
1689 }
1690 
1691 /*
1692  * Note that right now we assume the desired channel bandwidth
1693  * is always 20 MHz for each individual channel (HT40 uses 20 MHz
1694  * per channel, the primary and the extension channel).
1695  */
handle_channel(struct wiphy * wiphy,enum nl80211_reg_initiator initiator,struct ieee80211_channel * chan)1696 static void handle_channel(struct wiphy *wiphy,
1697 			   enum nl80211_reg_initiator initiator,
1698 			   struct ieee80211_channel *chan)
1699 {
1700 	u32 flags, bw_flags = 0;
1701 	const struct ieee80211_reg_rule *reg_rule = NULL;
1702 	const struct ieee80211_power_rule *power_rule = NULL;
1703 	struct wiphy *request_wiphy = NULL;
1704 	struct regulatory_request *lr = get_last_request();
1705 	const struct ieee80211_regdomain *regd;
1706 
1707 	request_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
1708 
1709 	flags = chan->orig_flags;
1710 
1711 	reg_rule = freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1712 	if (IS_ERR(reg_rule)) {
1713 		/*
1714 		 * We will disable all channels that do not match our
1715 		 * received regulatory rule unless the hint is coming
1716 		 * from a Country IE and the Country IE had no information
1717 		 * about a band. The IEEE 802.11 spec allows for an AP
1718 		 * to send only a subset of the regulatory rules allowed,
1719 		 * so an AP in the US that only supports 2.4 GHz may only send
1720 		 * a country IE with information for the 2.4 GHz band
1721 		 * while 5 GHz is still supported.
1722 		 */
1723 		if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
1724 		    PTR_ERR(reg_rule) == -ERANGE)
1725 			return;
1726 
1727 		if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
1728 		    request_wiphy && request_wiphy == wiphy &&
1729 		    request_wiphy->regulatory_flags & REGULATORY_STRICT_REG) {
1730 			pr_debug("Disabling freq %d MHz for good\n",
1731 				 chan->center_freq);
1732 			chan->orig_flags |= IEEE80211_CHAN_DISABLED;
1733 			chan->flags = chan->orig_flags;
1734 		} else {
1735 			pr_debug("Disabling freq %d MHz\n",
1736 				 chan->center_freq);
1737 			chan->flags |= IEEE80211_CHAN_DISABLED;
1738 		}
1739 		return;
1740 	}
1741 
1742 	regd = reg_get_regdomain(wiphy);
1743 
1744 	power_rule = &reg_rule->power_rule;
1745 	bw_flags = reg_rule_to_chan_bw_flags(regd, reg_rule, chan);
1746 
1747 	if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
1748 	    request_wiphy && request_wiphy == wiphy &&
1749 	    request_wiphy->regulatory_flags & REGULATORY_STRICT_REG) {
1750 		/*
1751 		 * This guarantees the driver's requested regulatory domain
1752 		 * will always be used as a base for further regulatory
1753 		 * settings
1754 		 */
1755 		chan->flags = chan->orig_flags =
1756 			map_regdom_flags(reg_rule->flags) | bw_flags;
1757 		chan->max_antenna_gain = chan->orig_mag =
1758 			(int) MBI_TO_DBI(power_rule->max_antenna_gain);
1759 		chan->max_reg_power = chan->max_power = chan->orig_mpwr =
1760 			(int) MBM_TO_DBM(power_rule->max_eirp);
1761 
1762 		if (chan->flags & IEEE80211_CHAN_RADAR) {
1763 			chan->dfs_cac_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
1764 			if (reg_rule->dfs_cac_ms)
1765 				chan->dfs_cac_ms = reg_rule->dfs_cac_ms;
1766 		}
1767 
1768 		return;
1769 	}
1770 
1771 	chan->dfs_state = NL80211_DFS_USABLE;
1772 	chan->dfs_state_entered = jiffies;
1773 
1774 	chan->beacon_found = false;
1775 	chan->flags = flags | bw_flags | map_regdom_flags(reg_rule->flags);
1776 	chan->max_antenna_gain =
1777 		min_t(int, chan->orig_mag,
1778 		      MBI_TO_DBI(power_rule->max_antenna_gain));
1779 	chan->max_reg_power = (int) MBM_TO_DBM(power_rule->max_eirp);
1780 
1781 	if (chan->flags & IEEE80211_CHAN_RADAR) {
1782 		if (reg_rule->dfs_cac_ms)
1783 			chan->dfs_cac_ms = reg_rule->dfs_cac_ms;
1784 		else
1785 			chan->dfs_cac_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
1786 	}
1787 
1788 	if (chan->orig_mpwr) {
1789 		/*
1790 		 * Devices that use REGULATORY_COUNTRY_IE_FOLLOW_POWER
1791 		 * will always follow the passed country IE power settings.
1792 		 */
1793 		if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
1794 		    wiphy->regulatory_flags & REGULATORY_COUNTRY_IE_FOLLOW_POWER)
1795 			chan->max_power = chan->max_reg_power;
1796 		else
1797 			chan->max_power = min(chan->orig_mpwr,
1798 					      chan->max_reg_power);
1799 	} else
1800 		chan->max_power = chan->max_reg_power;
1801 }
1802 
handle_band(struct wiphy * wiphy,enum nl80211_reg_initiator initiator,struct ieee80211_supported_band * sband)1803 static void handle_band(struct wiphy *wiphy,
1804 			enum nl80211_reg_initiator initiator,
1805 			struct ieee80211_supported_band *sband)
1806 {
1807 	unsigned int i;
1808 
1809 	if (!sband)
1810 		return;
1811 
1812 	for (i = 0; i < sband->n_channels; i++)
1813 		handle_channel(wiphy, initiator, &sband->channels[i]);
1814 }
1815 
reg_request_cell_base(struct regulatory_request * request)1816 static bool reg_request_cell_base(struct regulatory_request *request)
1817 {
1818 	if (request->initiator != NL80211_REGDOM_SET_BY_USER)
1819 		return false;
1820 	return request->user_reg_hint_type == NL80211_USER_REG_HINT_CELL_BASE;
1821 }
1822 
reg_last_request_cell_base(void)1823 bool reg_last_request_cell_base(void)
1824 {
1825 	return reg_request_cell_base(get_last_request());
1826 }
1827 
1828 #ifdef CONFIG_CFG80211_REG_CELLULAR_HINTS
1829 /* Core specific check */
1830 static enum reg_request_treatment
reg_ignore_cell_hint(struct regulatory_request * pending_request)1831 reg_ignore_cell_hint(struct regulatory_request *pending_request)
1832 {
1833 	struct regulatory_request *lr = get_last_request();
1834 
1835 	if (!reg_num_devs_support_basehint)
1836 		return REG_REQ_IGNORE;
1837 
1838 	if (reg_request_cell_base(lr) &&
1839 	    !regdom_changes(pending_request->alpha2))
1840 		return REG_REQ_ALREADY_SET;
1841 
1842 	return REG_REQ_OK;
1843 }
1844 
1845 /* Device specific check */
reg_dev_ignore_cell_hint(struct wiphy * wiphy)1846 static bool reg_dev_ignore_cell_hint(struct wiphy *wiphy)
1847 {
1848 	return !(wiphy->features & NL80211_FEATURE_CELL_BASE_REG_HINTS);
1849 }
1850 #else
1851 static enum reg_request_treatment
reg_ignore_cell_hint(struct regulatory_request * pending_request)1852 reg_ignore_cell_hint(struct regulatory_request *pending_request)
1853 {
1854 	return REG_REQ_IGNORE;
1855 }
1856 
reg_dev_ignore_cell_hint(struct wiphy * wiphy)1857 static bool reg_dev_ignore_cell_hint(struct wiphy *wiphy)
1858 {
1859 	return true;
1860 }
1861 #endif
1862 
wiphy_strict_alpha2_regd(struct wiphy * wiphy)1863 static bool wiphy_strict_alpha2_regd(struct wiphy *wiphy)
1864 {
1865 	if (wiphy->regulatory_flags & REGULATORY_STRICT_REG &&
1866 	    !(wiphy->regulatory_flags & REGULATORY_CUSTOM_REG))
1867 		return true;
1868 	return false;
1869 }
1870 
ignore_reg_update(struct wiphy * wiphy,enum nl80211_reg_initiator initiator)1871 static bool ignore_reg_update(struct wiphy *wiphy,
1872 			      enum nl80211_reg_initiator initiator)
1873 {
1874 	struct regulatory_request *lr = get_last_request();
1875 
1876 	if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED)
1877 		return true;
1878 
1879 	if (!lr) {
1880 		pr_debug("Ignoring regulatory request set by %s since last_request is not set\n",
1881 			 reg_initiator_name(initiator));
1882 		return true;
1883 	}
1884 
1885 	if (initiator == NL80211_REGDOM_SET_BY_CORE &&
1886 	    wiphy->regulatory_flags & REGULATORY_CUSTOM_REG) {
1887 		pr_debug("Ignoring regulatory request set by %s since the driver uses its own custom regulatory domain\n",
1888 			 reg_initiator_name(initiator));
1889 		return true;
1890 	}
1891 
1892 	/*
1893 	 * wiphy->regd will be set once the device has its own
1894 	 * desired regulatory domain set
1895 	 */
1896 	if (wiphy_strict_alpha2_regd(wiphy) && !wiphy->regd &&
1897 	    initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
1898 	    !is_world_regdom(lr->alpha2)) {
1899 		pr_debug("Ignoring regulatory request set by %s since the driver requires its own regulatory domain to be set first\n",
1900 			 reg_initiator_name(initiator));
1901 		return true;
1902 	}
1903 
1904 	if (reg_request_cell_base(lr))
1905 		return reg_dev_ignore_cell_hint(wiphy);
1906 
1907 	return false;
1908 }
1909 
reg_is_world_roaming(struct wiphy * wiphy)1910 static bool reg_is_world_roaming(struct wiphy *wiphy)
1911 {
1912 	const struct ieee80211_regdomain *cr = get_cfg80211_regdom();
1913 	const struct ieee80211_regdomain *wr = get_wiphy_regdom(wiphy);
1914 	struct regulatory_request *lr = get_last_request();
1915 
1916 	if (is_world_regdom(cr->alpha2) || (wr && is_world_regdom(wr->alpha2)))
1917 		return true;
1918 
1919 	if (lr && lr->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
1920 	    wiphy->regulatory_flags & REGULATORY_CUSTOM_REG)
1921 		return true;
1922 
1923 	return false;
1924 }
1925 
handle_reg_beacon(struct wiphy * wiphy,unsigned int chan_idx,struct reg_beacon * reg_beacon)1926 static void handle_reg_beacon(struct wiphy *wiphy, unsigned int chan_idx,
1927 			      struct reg_beacon *reg_beacon)
1928 {
1929 	struct ieee80211_supported_band *sband;
1930 	struct ieee80211_channel *chan;
1931 	bool channel_changed = false;
1932 	struct ieee80211_channel chan_before;
1933 
1934 	sband = wiphy->bands[reg_beacon->chan.band];
1935 	chan = &sband->channels[chan_idx];
1936 
1937 	if (likely(chan->center_freq != reg_beacon->chan.center_freq))
1938 		return;
1939 
1940 	if (chan->beacon_found)
1941 		return;
1942 
1943 	chan->beacon_found = true;
1944 
1945 	if (!reg_is_world_roaming(wiphy))
1946 		return;
1947 
1948 	if (wiphy->regulatory_flags & REGULATORY_DISABLE_BEACON_HINTS)
1949 		return;
1950 
1951 	chan_before = *chan;
1952 
1953 	if (chan->flags & IEEE80211_CHAN_NO_IR) {
1954 		chan->flags &= ~IEEE80211_CHAN_NO_IR;
1955 		channel_changed = true;
1956 	}
1957 
1958 	if (channel_changed)
1959 		nl80211_send_beacon_hint_event(wiphy, &chan_before, chan);
1960 }
1961 
1962 /*
1963  * Called when a scan on a wiphy finds a beacon on
1964  * new channel
1965  */
wiphy_update_new_beacon(struct wiphy * wiphy,struct reg_beacon * reg_beacon)1966 static void wiphy_update_new_beacon(struct wiphy *wiphy,
1967 				    struct reg_beacon *reg_beacon)
1968 {
1969 	unsigned int i;
1970 	struct ieee80211_supported_band *sband;
1971 
1972 	if (!wiphy->bands[reg_beacon->chan.band])
1973 		return;
1974 
1975 	sband = wiphy->bands[reg_beacon->chan.band];
1976 
1977 	for (i = 0; i < sband->n_channels; i++)
1978 		handle_reg_beacon(wiphy, i, reg_beacon);
1979 }
1980 
1981 /*
1982  * Called upon reg changes or a new wiphy is added
1983  */
wiphy_update_beacon_reg(struct wiphy * wiphy)1984 static void wiphy_update_beacon_reg(struct wiphy *wiphy)
1985 {
1986 	unsigned int i;
1987 	struct ieee80211_supported_band *sband;
1988 	struct reg_beacon *reg_beacon;
1989 
1990 	list_for_each_entry(reg_beacon, &reg_beacon_list, list) {
1991 		if (!wiphy->bands[reg_beacon->chan.band])
1992 			continue;
1993 		sband = wiphy->bands[reg_beacon->chan.band];
1994 		for (i = 0; i < sband->n_channels; i++)
1995 			handle_reg_beacon(wiphy, i, reg_beacon);
1996 	}
1997 }
1998 
1999 /* Reap the advantages of previously found beacons */
reg_process_beacons(struct wiphy * wiphy)2000 static void reg_process_beacons(struct wiphy *wiphy)
2001 {
2002 	/*
2003 	 * Means we are just firing up cfg80211, so no beacons would
2004 	 * have been processed yet.
2005 	 */
2006 	if (!last_request)
2007 		return;
2008 	wiphy_update_beacon_reg(wiphy);
2009 }
2010 
is_ht40_allowed(struct ieee80211_channel * chan)2011 static bool is_ht40_allowed(struct ieee80211_channel *chan)
2012 {
2013 	if (!chan)
2014 		return false;
2015 	if (chan->flags & IEEE80211_CHAN_DISABLED)
2016 		return false;
2017 	/* This would happen when regulatory rules disallow HT40 completely */
2018 	if ((chan->flags & IEEE80211_CHAN_NO_HT40) == IEEE80211_CHAN_NO_HT40)
2019 		return false;
2020 	return true;
2021 }
2022 
reg_process_ht_flags_channel(struct wiphy * wiphy,struct ieee80211_channel * channel)2023 static void reg_process_ht_flags_channel(struct wiphy *wiphy,
2024 					 struct ieee80211_channel *channel)
2025 {
2026 	struct ieee80211_supported_band *sband = wiphy->bands[channel->band];
2027 	struct ieee80211_channel *channel_before = NULL, *channel_after = NULL;
2028 	const struct ieee80211_regdomain *regd;
2029 	unsigned int i;
2030 	u32 flags;
2031 
2032 	if (!is_ht40_allowed(channel)) {
2033 		channel->flags |= IEEE80211_CHAN_NO_HT40;
2034 		return;
2035 	}
2036 
2037 	/*
2038 	 * We need to ensure the extension channels exist to
2039 	 * be able to use HT40- or HT40+, this finds them (or not)
2040 	 */
2041 	for (i = 0; i < sband->n_channels; i++) {
2042 		struct ieee80211_channel *c = &sband->channels[i];
2043 
2044 		if (c->center_freq == (channel->center_freq - 20))
2045 			channel_before = c;
2046 		if (c->center_freq == (channel->center_freq + 20))
2047 			channel_after = c;
2048 	}
2049 
2050 	flags = 0;
2051 	regd = get_wiphy_regdom(wiphy);
2052 	if (regd) {
2053 		const struct ieee80211_reg_rule *reg_rule =
2054 			freq_reg_info_regd(MHZ_TO_KHZ(channel->center_freq),
2055 					   regd, MHZ_TO_KHZ(20));
2056 
2057 		if (!IS_ERR(reg_rule))
2058 			flags = reg_rule->flags;
2059 	}
2060 
2061 	/*
2062 	 * Please note that this assumes target bandwidth is 20 MHz,
2063 	 * if that ever changes we also need to change the below logic
2064 	 * to include that as well.
2065 	 */
2066 	if (!is_ht40_allowed(channel_before) ||
2067 	    flags & NL80211_RRF_NO_HT40MINUS)
2068 		channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
2069 	else
2070 		channel->flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
2071 
2072 	if (!is_ht40_allowed(channel_after) ||
2073 	    flags & NL80211_RRF_NO_HT40PLUS)
2074 		channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
2075 	else
2076 		channel->flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
2077 }
2078 
reg_process_ht_flags_band(struct wiphy * wiphy,struct ieee80211_supported_band * sband)2079 static void reg_process_ht_flags_band(struct wiphy *wiphy,
2080 				      struct ieee80211_supported_band *sband)
2081 {
2082 	unsigned int i;
2083 
2084 	if (!sband)
2085 		return;
2086 
2087 	for (i = 0; i < sband->n_channels; i++)
2088 		reg_process_ht_flags_channel(wiphy, &sband->channels[i]);
2089 }
2090 
reg_process_ht_flags(struct wiphy * wiphy)2091 static void reg_process_ht_flags(struct wiphy *wiphy)
2092 {
2093 	enum nl80211_band band;
2094 
2095 	if (!wiphy)
2096 		return;
2097 
2098 	for (band = 0; band < NUM_NL80211_BANDS; band++)
2099 		reg_process_ht_flags_band(wiphy, wiphy->bands[band]);
2100 }
2101 
reg_call_notifier(struct wiphy * wiphy,struct regulatory_request * request)2102 static void reg_call_notifier(struct wiphy *wiphy,
2103 			      struct regulatory_request *request)
2104 {
2105 	if (wiphy->reg_notifier)
2106 		wiphy->reg_notifier(wiphy, request);
2107 }
2108 
reg_wdev_chan_valid(struct wiphy * wiphy,struct wireless_dev * wdev)2109 static bool reg_wdev_chan_valid(struct wiphy *wiphy, struct wireless_dev *wdev)
2110 {
2111 	struct cfg80211_chan_def chandef = {};
2112 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2113 	enum nl80211_iftype iftype;
2114 
2115 	wdev_lock(wdev);
2116 	iftype = wdev->iftype;
2117 
2118 	/* make sure the interface is active */
2119 	if (!wdev->netdev || !netif_running(wdev->netdev))
2120 		goto wdev_inactive_unlock;
2121 
2122 	switch (iftype) {
2123 	case NL80211_IFTYPE_AP:
2124 	case NL80211_IFTYPE_P2P_GO:
2125 		if (!wdev->beacon_interval)
2126 			goto wdev_inactive_unlock;
2127 		chandef = wdev->chandef;
2128 		break;
2129 	case NL80211_IFTYPE_ADHOC:
2130 		if (!wdev->ssid_len)
2131 			goto wdev_inactive_unlock;
2132 		chandef = wdev->chandef;
2133 		break;
2134 	case NL80211_IFTYPE_STATION:
2135 	case NL80211_IFTYPE_P2P_CLIENT:
2136 		if (!wdev->current_bss ||
2137 		    !wdev->current_bss->pub.channel)
2138 			goto wdev_inactive_unlock;
2139 
2140 		if (!rdev->ops->get_channel ||
2141 		    rdev_get_channel(rdev, wdev, &chandef))
2142 			cfg80211_chandef_create(&chandef,
2143 						wdev->current_bss->pub.channel,
2144 						NL80211_CHAN_NO_HT);
2145 		break;
2146 	case NL80211_IFTYPE_MONITOR:
2147 	case NL80211_IFTYPE_AP_VLAN:
2148 	case NL80211_IFTYPE_P2P_DEVICE:
2149 		/* no enforcement required */
2150 		break;
2151 	default:
2152 		/* others not implemented for now */
2153 		WARN_ON(1);
2154 		break;
2155 	}
2156 
2157 	wdev_unlock(wdev);
2158 
2159 	switch (iftype) {
2160 	case NL80211_IFTYPE_AP:
2161 	case NL80211_IFTYPE_P2P_GO:
2162 	case NL80211_IFTYPE_ADHOC:
2163 		return cfg80211_reg_can_beacon_relax(wiphy, &chandef, iftype);
2164 	case NL80211_IFTYPE_STATION:
2165 	case NL80211_IFTYPE_P2P_CLIENT:
2166 		return cfg80211_chandef_usable(wiphy, &chandef,
2167 					       IEEE80211_CHAN_DISABLED);
2168 	default:
2169 		break;
2170 	}
2171 
2172 	return true;
2173 
2174 wdev_inactive_unlock:
2175 	wdev_unlock(wdev);
2176 	return true;
2177 }
2178 
reg_leave_invalid_chans(struct wiphy * wiphy)2179 static void reg_leave_invalid_chans(struct wiphy *wiphy)
2180 {
2181 	struct wireless_dev *wdev;
2182 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
2183 
2184 	ASSERT_RTNL();
2185 
2186 	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list)
2187 		if (!reg_wdev_chan_valid(wiphy, wdev))
2188 			cfg80211_leave(rdev, wdev);
2189 }
2190 
reg_check_chans_work(struct work_struct * work)2191 static void reg_check_chans_work(struct work_struct *work)
2192 {
2193 	struct cfg80211_registered_device *rdev;
2194 
2195 	pr_debug("Verifying active interfaces after reg change\n");
2196 	rtnl_lock();
2197 
2198 	list_for_each_entry(rdev, &cfg80211_rdev_list, list)
2199 		if (!(rdev->wiphy.regulatory_flags &
2200 		      REGULATORY_IGNORE_STALE_KICKOFF))
2201 			reg_leave_invalid_chans(&rdev->wiphy);
2202 
2203 	rtnl_unlock();
2204 }
2205 
reg_check_channels(void)2206 static void reg_check_channels(void)
2207 {
2208 	/*
2209 	 * Give usermode a chance to do something nicer (move to another
2210 	 * channel, orderly disconnection), before forcing a disconnection.
2211 	 */
2212 	mod_delayed_work(system_power_efficient_wq,
2213 			 &reg_check_chans,
2214 			 msecs_to_jiffies(REG_ENFORCE_GRACE_MS));
2215 }
2216 
wiphy_update_regulatory(struct wiphy * wiphy,enum nl80211_reg_initiator initiator)2217 static void wiphy_update_regulatory(struct wiphy *wiphy,
2218 				    enum nl80211_reg_initiator initiator)
2219 {
2220 	enum nl80211_band band;
2221 	struct regulatory_request *lr = get_last_request();
2222 
2223 	if (ignore_reg_update(wiphy, initiator)) {
2224 		/*
2225 		 * Regulatory updates set by CORE are ignored for custom
2226 		 * regulatory cards. Let us notify the changes to the driver,
2227 		 * as some drivers used this to restore its orig_* reg domain.
2228 		 */
2229 		if (initiator == NL80211_REGDOM_SET_BY_CORE &&
2230 		    wiphy->regulatory_flags & REGULATORY_CUSTOM_REG &&
2231 		    !(wiphy->regulatory_flags &
2232 		      REGULATORY_WIPHY_SELF_MANAGED))
2233 			reg_call_notifier(wiphy, lr);
2234 		return;
2235 	}
2236 
2237 	lr->dfs_region = get_cfg80211_regdom()->dfs_region;
2238 
2239 	for (band = 0; band < NUM_NL80211_BANDS; band++)
2240 		handle_band(wiphy, initiator, wiphy->bands[band]);
2241 
2242 	reg_process_beacons(wiphy);
2243 	reg_process_ht_flags(wiphy);
2244 	reg_call_notifier(wiphy, lr);
2245 }
2246 
update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)2247 static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)
2248 {
2249 	struct cfg80211_registered_device *rdev;
2250 	struct wiphy *wiphy;
2251 
2252 	ASSERT_RTNL();
2253 
2254 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2255 		wiphy = &rdev->wiphy;
2256 		wiphy_update_regulatory(wiphy, initiator);
2257 	}
2258 
2259 	reg_check_channels();
2260 }
2261 
handle_channel_custom(struct wiphy * wiphy,struct ieee80211_channel * chan,const struct ieee80211_regdomain * regd)2262 static void handle_channel_custom(struct wiphy *wiphy,
2263 				  struct ieee80211_channel *chan,
2264 				  const struct ieee80211_regdomain *regd)
2265 {
2266 	u32 bw_flags = 0;
2267 	const struct ieee80211_reg_rule *reg_rule = NULL;
2268 	const struct ieee80211_power_rule *power_rule = NULL;
2269 	u32 bw;
2270 
2271 	for (bw = MHZ_TO_KHZ(20); bw >= MHZ_TO_KHZ(5); bw = bw / 2) {
2272 		reg_rule = freq_reg_info_regd(MHZ_TO_KHZ(chan->center_freq),
2273 					      regd, bw);
2274 		if (!IS_ERR(reg_rule))
2275 			break;
2276 	}
2277 
2278 	if (IS_ERR(reg_rule)) {
2279 		pr_debug("Disabling freq %d MHz as custom regd has no rule that fits it\n",
2280 			 chan->center_freq);
2281 		if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED) {
2282 			chan->flags |= IEEE80211_CHAN_DISABLED;
2283 		} else {
2284 			chan->orig_flags |= IEEE80211_CHAN_DISABLED;
2285 			chan->flags = chan->orig_flags;
2286 		}
2287 		return;
2288 	}
2289 
2290 	power_rule = &reg_rule->power_rule;
2291 	bw_flags = reg_rule_to_chan_bw_flags(regd, reg_rule, chan);
2292 
2293 	chan->dfs_state_entered = jiffies;
2294 	chan->dfs_state = NL80211_DFS_USABLE;
2295 
2296 	chan->beacon_found = false;
2297 
2298 	if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED)
2299 		chan->flags = chan->orig_flags | bw_flags |
2300 			      map_regdom_flags(reg_rule->flags);
2301 	else
2302 		chan->flags |= map_regdom_flags(reg_rule->flags) | bw_flags;
2303 
2304 	chan->max_antenna_gain = (int) MBI_TO_DBI(power_rule->max_antenna_gain);
2305 	chan->max_reg_power = chan->max_power =
2306 		(int) MBM_TO_DBM(power_rule->max_eirp);
2307 
2308 	if (chan->flags & IEEE80211_CHAN_RADAR) {
2309 		if (reg_rule->dfs_cac_ms)
2310 			chan->dfs_cac_ms = reg_rule->dfs_cac_ms;
2311 		else
2312 			chan->dfs_cac_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
2313 	}
2314 
2315 	chan->max_power = chan->max_reg_power;
2316 }
2317 
handle_band_custom(struct wiphy * wiphy,struct ieee80211_supported_band * sband,const struct ieee80211_regdomain * regd)2318 static void handle_band_custom(struct wiphy *wiphy,
2319 			       struct ieee80211_supported_band *sband,
2320 			       const struct ieee80211_regdomain *regd)
2321 {
2322 	unsigned int i;
2323 
2324 	if (!sband)
2325 		return;
2326 
2327 	for (i = 0; i < sband->n_channels; i++)
2328 		handle_channel_custom(wiphy, &sband->channels[i], regd);
2329 }
2330 
2331 /* Used by drivers prior to wiphy registration */
wiphy_apply_custom_regulatory(struct wiphy * wiphy,const struct ieee80211_regdomain * regd)2332 void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
2333 				   const struct ieee80211_regdomain *regd)
2334 {
2335 	enum nl80211_band band;
2336 	unsigned int bands_set = 0;
2337 
2338 	WARN(!(wiphy->regulatory_flags & REGULATORY_CUSTOM_REG),
2339 	     "wiphy should have REGULATORY_CUSTOM_REG\n");
2340 	wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
2341 
2342 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
2343 		if (!wiphy->bands[band])
2344 			continue;
2345 		handle_band_custom(wiphy, wiphy->bands[band], regd);
2346 		bands_set++;
2347 	}
2348 
2349 	/*
2350 	 * no point in calling this if it won't have any effect
2351 	 * on your device's supported bands.
2352 	 */
2353 	WARN_ON(!bands_set);
2354 }
2355 EXPORT_SYMBOL(wiphy_apply_custom_regulatory);
2356 
reg_set_request_processed(void)2357 static void reg_set_request_processed(void)
2358 {
2359 	bool need_more_processing = false;
2360 	struct regulatory_request *lr = get_last_request();
2361 
2362 	lr->processed = true;
2363 
2364 	spin_lock(&reg_requests_lock);
2365 	if (!list_empty(&reg_requests_list))
2366 		need_more_processing = true;
2367 	spin_unlock(&reg_requests_lock);
2368 
2369 	cancel_crda_timeout();
2370 
2371 	if (need_more_processing)
2372 		schedule_work(&reg_work);
2373 }
2374 
2375 /**
2376  * reg_process_hint_core - process core regulatory requests
2377  * @pending_request: a pending core regulatory request
2378  *
2379  * The wireless subsystem can use this function to process
2380  * a regulatory request issued by the regulatory core.
2381  */
2382 static enum reg_request_treatment
reg_process_hint_core(struct regulatory_request * core_request)2383 reg_process_hint_core(struct regulatory_request *core_request)
2384 {
2385 	if (reg_query_database(core_request)) {
2386 		core_request->intersect = false;
2387 		core_request->processed = false;
2388 		reg_update_last_request(core_request);
2389 		return REG_REQ_OK;
2390 	}
2391 
2392 	return REG_REQ_IGNORE;
2393 }
2394 
2395 static enum reg_request_treatment
__reg_process_hint_user(struct regulatory_request * user_request)2396 __reg_process_hint_user(struct regulatory_request *user_request)
2397 {
2398 	struct regulatory_request *lr = get_last_request();
2399 
2400 	if (reg_request_cell_base(user_request))
2401 		return reg_ignore_cell_hint(user_request);
2402 
2403 	if (reg_request_cell_base(lr))
2404 		return REG_REQ_IGNORE;
2405 
2406 	if (lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE)
2407 		return REG_REQ_INTERSECT;
2408 	/*
2409 	 * If the user knows better the user should set the regdom
2410 	 * to their country before the IE is picked up
2411 	 */
2412 	if (lr->initiator == NL80211_REGDOM_SET_BY_USER &&
2413 	    lr->intersect)
2414 		return REG_REQ_IGNORE;
2415 	/*
2416 	 * Process user requests only after previous user/driver/core
2417 	 * requests have been processed
2418 	 */
2419 	if ((lr->initiator == NL80211_REGDOM_SET_BY_CORE ||
2420 	     lr->initiator == NL80211_REGDOM_SET_BY_DRIVER ||
2421 	     lr->initiator == NL80211_REGDOM_SET_BY_USER) &&
2422 	    regdom_changes(lr->alpha2))
2423 		return REG_REQ_IGNORE;
2424 
2425 	if (!regdom_changes(user_request->alpha2))
2426 		return REG_REQ_ALREADY_SET;
2427 
2428 	return REG_REQ_OK;
2429 }
2430 
2431 /**
2432  * reg_process_hint_user - process user regulatory requests
2433  * @user_request: a pending user regulatory request
2434  *
2435  * The wireless subsystem can use this function to process
2436  * a regulatory request initiated by userspace.
2437  */
2438 static enum reg_request_treatment
reg_process_hint_user(struct regulatory_request * user_request)2439 reg_process_hint_user(struct regulatory_request *user_request)
2440 {
2441 	enum reg_request_treatment treatment;
2442 
2443 	treatment = __reg_process_hint_user(user_request);
2444 	if (treatment == REG_REQ_IGNORE ||
2445 	    treatment == REG_REQ_ALREADY_SET)
2446 		return REG_REQ_IGNORE;
2447 
2448 	user_request->intersect = treatment == REG_REQ_INTERSECT;
2449 	user_request->processed = false;
2450 
2451 	if (reg_query_database(user_request)) {
2452 		reg_update_last_request(user_request);
2453 		user_alpha2[0] = user_request->alpha2[0];
2454 		user_alpha2[1] = user_request->alpha2[1];
2455 		return REG_REQ_OK;
2456 	}
2457 
2458 	return REG_REQ_IGNORE;
2459 }
2460 
2461 static enum reg_request_treatment
__reg_process_hint_driver(struct regulatory_request * driver_request)2462 __reg_process_hint_driver(struct regulatory_request *driver_request)
2463 {
2464 	struct regulatory_request *lr = get_last_request();
2465 
2466 	if (lr->initiator == NL80211_REGDOM_SET_BY_CORE) {
2467 		if (regdom_changes(driver_request->alpha2))
2468 			return REG_REQ_OK;
2469 		return REG_REQ_ALREADY_SET;
2470 	}
2471 
2472 	/*
2473 	 * This would happen if you unplug and plug your card
2474 	 * back in or if you add a new device for which the previously
2475 	 * loaded card also agrees on the regulatory domain.
2476 	 */
2477 	if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
2478 	    !regdom_changes(driver_request->alpha2))
2479 		return REG_REQ_ALREADY_SET;
2480 
2481 	return REG_REQ_INTERSECT;
2482 }
2483 
2484 /**
2485  * reg_process_hint_driver - process driver regulatory requests
2486  * @driver_request: a pending driver regulatory request
2487  *
2488  * The wireless subsystem can use this function to process
2489  * a regulatory request issued by an 802.11 driver.
2490  *
2491  * Returns one of the different reg request treatment values.
2492  */
2493 static enum reg_request_treatment
reg_process_hint_driver(struct wiphy * wiphy,struct regulatory_request * driver_request)2494 reg_process_hint_driver(struct wiphy *wiphy,
2495 			struct regulatory_request *driver_request)
2496 {
2497 	const struct ieee80211_regdomain *regd, *tmp;
2498 	enum reg_request_treatment treatment;
2499 
2500 	treatment = __reg_process_hint_driver(driver_request);
2501 
2502 	switch (treatment) {
2503 	case REG_REQ_OK:
2504 		break;
2505 	case REG_REQ_IGNORE:
2506 		return REG_REQ_IGNORE;
2507 	case REG_REQ_INTERSECT:
2508 	case REG_REQ_ALREADY_SET:
2509 		regd = reg_copy_regd(get_cfg80211_regdom());
2510 		if (IS_ERR(regd))
2511 			return REG_REQ_IGNORE;
2512 
2513 		tmp = get_wiphy_regdom(wiphy);
2514 		rcu_assign_pointer(wiphy->regd, regd);
2515 		rcu_free_regdom(tmp);
2516 	}
2517 
2518 
2519 	driver_request->intersect = treatment == REG_REQ_INTERSECT;
2520 	driver_request->processed = false;
2521 
2522 	/*
2523 	 * Since CRDA will not be called in this case as we already
2524 	 * have applied the requested regulatory domain before we just
2525 	 * inform userspace we have processed the request
2526 	 */
2527 	if (treatment == REG_REQ_ALREADY_SET) {
2528 		nl80211_send_reg_change_event(driver_request);
2529 		reg_update_last_request(driver_request);
2530 		reg_set_request_processed();
2531 		return REG_REQ_ALREADY_SET;
2532 	}
2533 
2534 	if (reg_query_database(driver_request)) {
2535 		reg_update_last_request(driver_request);
2536 		return REG_REQ_OK;
2537 	}
2538 
2539 	return REG_REQ_IGNORE;
2540 }
2541 
2542 static enum reg_request_treatment
__reg_process_hint_country_ie(struct wiphy * wiphy,struct regulatory_request * country_ie_request)2543 __reg_process_hint_country_ie(struct wiphy *wiphy,
2544 			      struct regulatory_request *country_ie_request)
2545 {
2546 	struct wiphy *last_wiphy = NULL;
2547 	struct regulatory_request *lr = get_last_request();
2548 
2549 	if (reg_request_cell_base(lr)) {
2550 		/* Trust a Cell base station over the AP's country IE */
2551 		if (regdom_changes(country_ie_request->alpha2))
2552 			return REG_REQ_IGNORE;
2553 		return REG_REQ_ALREADY_SET;
2554 	} else {
2555 		if (wiphy->regulatory_flags & REGULATORY_COUNTRY_IE_IGNORE)
2556 			return REG_REQ_IGNORE;
2557 	}
2558 
2559 	if (unlikely(!is_an_alpha2(country_ie_request->alpha2)))
2560 		return -EINVAL;
2561 
2562 	if (lr->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE)
2563 		return REG_REQ_OK;
2564 
2565 	last_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
2566 
2567 	if (last_wiphy != wiphy) {
2568 		/*
2569 		 * Two cards with two APs claiming different
2570 		 * Country IE alpha2s. We could
2571 		 * intersect them, but that seems unlikely
2572 		 * to be correct. Reject second one for now.
2573 		 */
2574 		if (regdom_changes(country_ie_request->alpha2))
2575 			return REG_REQ_IGNORE;
2576 		return REG_REQ_ALREADY_SET;
2577 	}
2578 
2579 	if (regdom_changes(country_ie_request->alpha2))
2580 		return REG_REQ_OK;
2581 	return REG_REQ_ALREADY_SET;
2582 }
2583 
2584 /**
2585  * reg_process_hint_country_ie - process regulatory requests from country IEs
2586  * @country_ie_request: a regulatory request from a country IE
2587  *
2588  * The wireless subsystem can use this function to process
2589  * a regulatory request issued by a country Information Element.
2590  *
2591  * Returns one of the different reg request treatment values.
2592  */
2593 static enum reg_request_treatment
reg_process_hint_country_ie(struct wiphy * wiphy,struct regulatory_request * country_ie_request)2594 reg_process_hint_country_ie(struct wiphy *wiphy,
2595 			    struct regulatory_request *country_ie_request)
2596 {
2597 	enum reg_request_treatment treatment;
2598 
2599 	treatment = __reg_process_hint_country_ie(wiphy, country_ie_request);
2600 
2601 	switch (treatment) {
2602 	case REG_REQ_OK:
2603 		break;
2604 	case REG_REQ_IGNORE:
2605 		return REG_REQ_IGNORE;
2606 	case REG_REQ_ALREADY_SET:
2607 		reg_free_request(country_ie_request);
2608 		return REG_REQ_ALREADY_SET;
2609 	case REG_REQ_INTERSECT:
2610 		/*
2611 		 * This doesn't happen yet, not sure we
2612 		 * ever want to support it for this case.
2613 		 */
2614 		WARN_ONCE(1, "Unexpected intersection for country elements");
2615 		return REG_REQ_IGNORE;
2616 	}
2617 
2618 	country_ie_request->intersect = false;
2619 	country_ie_request->processed = false;
2620 
2621 	if (reg_query_database(country_ie_request)) {
2622 		reg_update_last_request(country_ie_request);
2623 		return REG_REQ_OK;
2624 	}
2625 
2626 	return REG_REQ_IGNORE;
2627 }
2628 
reg_dfs_domain_same(struct wiphy * wiphy1,struct wiphy * wiphy2)2629 bool reg_dfs_domain_same(struct wiphy *wiphy1, struct wiphy *wiphy2)
2630 {
2631 	const struct ieee80211_regdomain *wiphy1_regd = NULL;
2632 	const struct ieee80211_regdomain *wiphy2_regd = NULL;
2633 	const struct ieee80211_regdomain *cfg80211_regd = NULL;
2634 	bool dfs_domain_same;
2635 
2636 	rcu_read_lock();
2637 
2638 	cfg80211_regd = rcu_dereference(cfg80211_regdomain);
2639 	wiphy1_regd = rcu_dereference(wiphy1->regd);
2640 	if (!wiphy1_regd)
2641 		wiphy1_regd = cfg80211_regd;
2642 
2643 	wiphy2_regd = rcu_dereference(wiphy2->regd);
2644 	if (!wiphy2_regd)
2645 		wiphy2_regd = cfg80211_regd;
2646 
2647 	dfs_domain_same = wiphy1_regd->dfs_region == wiphy2_regd->dfs_region;
2648 
2649 	rcu_read_unlock();
2650 
2651 	return dfs_domain_same;
2652 }
2653 
reg_copy_dfs_chan_state(struct ieee80211_channel * dst_chan,struct ieee80211_channel * src_chan)2654 static void reg_copy_dfs_chan_state(struct ieee80211_channel *dst_chan,
2655 				    struct ieee80211_channel *src_chan)
2656 {
2657 	if (!(dst_chan->flags & IEEE80211_CHAN_RADAR) ||
2658 	    !(src_chan->flags & IEEE80211_CHAN_RADAR))
2659 		return;
2660 
2661 	if (dst_chan->flags & IEEE80211_CHAN_DISABLED ||
2662 	    src_chan->flags & IEEE80211_CHAN_DISABLED)
2663 		return;
2664 
2665 	if (src_chan->center_freq == dst_chan->center_freq &&
2666 	    dst_chan->dfs_state == NL80211_DFS_USABLE) {
2667 		dst_chan->dfs_state = src_chan->dfs_state;
2668 		dst_chan->dfs_state_entered = src_chan->dfs_state_entered;
2669 	}
2670 }
2671 
wiphy_share_dfs_chan_state(struct wiphy * dst_wiphy,struct wiphy * src_wiphy)2672 static void wiphy_share_dfs_chan_state(struct wiphy *dst_wiphy,
2673 				       struct wiphy *src_wiphy)
2674 {
2675 	struct ieee80211_supported_band *src_sband, *dst_sband;
2676 	struct ieee80211_channel *src_chan, *dst_chan;
2677 	int i, j, band;
2678 
2679 	if (!reg_dfs_domain_same(dst_wiphy, src_wiphy))
2680 		return;
2681 
2682 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
2683 		dst_sband = dst_wiphy->bands[band];
2684 		src_sband = src_wiphy->bands[band];
2685 		if (!dst_sband || !src_sband)
2686 			continue;
2687 
2688 		for (i = 0; i < dst_sband->n_channels; i++) {
2689 			dst_chan = &dst_sband->channels[i];
2690 			for (j = 0; j < src_sband->n_channels; j++) {
2691 				src_chan = &src_sband->channels[j];
2692 				reg_copy_dfs_chan_state(dst_chan, src_chan);
2693 			}
2694 		}
2695 	}
2696 }
2697 
wiphy_all_share_dfs_chan_state(struct wiphy * wiphy)2698 static void wiphy_all_share_dfs_chan_state(struct wiphy *wiphy)
2699 {
2700 	struct cfg80211_registered_device *rdev;
2701 
2702 	ASSERT_RTNL();
2703 
2704 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2705 		if (wiphy == &rdev->wiphy)
2706 			continue;
2707 		wiphy_share_dfs_chan_state(wiphy, &rdev->wiphy);
2708 	}
2709 }
2710 
2711 /* This processes *all* regulatory hints */
reg_process_hint(struct regulatory_request * reg_request)2712 static void reg_process_hint(struct regulatory_request *reg_request)
2713 {
2714 	struct wiphy *wiphy = NULL;
2715 	enum reg_request_treatment treatment;
2716 	enum nl80211_reg_initiator initiator = reg_request->initiator;
2717 
2718 	if (reg_request->wiphy_idx != WIPHY_IDX_INVALID)
2719 		wiphy = wiphy_idx_to_wiphy(reg_request->wiphy_idx);
2720 
2721 	switch (initiator) {
2722 	case NL80211_REGDOM_SET_BY_CORE:
2723 		treatment = reg_process_hint_core(reg_request);
2724 		break;
2725 	case NL80211_REGDOM_SET_BY_USER:
2726 		treatment = reg_process_hint_user(reg_request);
2727 		break;
2728 	case NL80211_REGDOM_SET_BY_DRIVER:
2729 		if (!wiphy)
2730 			goto out_free;
2731 		treatment = reg_process_hint_driver(wiphy, reg_request);
2732 		break;
2733 	case NL80211_REGDOM_SET_BY_COUNTRY_IE:
2734 		if (!wiphy)
2735 			goto out_free;
2736 		treatment = reg_process_hint_country_ie(wiphy, reg_request);
2737 		break;
2738 	default:
2739 		WARN(1, "invalid initiator %d\n", initiator);
2740 		goto out_free;
2741 	}
2742 
2743 	if (treatment == REG_REQ_IGNORE)
2744 		goto out_free;
2745 
2746 	WARN(treatment != REG_REQ_OK && treatment != REG_REQ_ALREADY_SET,
2747 	     "unexpected treatment value %d\n", treatment);
2748 
2749 	/* This is required so that the orig_* parameters are saved.
2750 	 * NOTE: treatment must be set for any case that reaches here!
2751 	 */
2752 	if (treatment == REG_REQ_ALREADY_SET && wiphy &&
2753 	    wiphy->regulatory_flags & REGULATORY_STRICT_REG) {
2754 		wiphy_update_regulatory(wiphy, initiator);
2755 		wiphy_all_share_dfs_chan_state(wiphy);
2756 		reg_check_channels();
2757 	}
2758 
2759 	return;
2760 
2761 out_free:
2762 	reg_free_request(reg_request);
2763 }
2764 
notify_self_managed_wiphys(struct regulatory_request * request)2765 static void notify_self_managed_wiphys(struct regulatory_request *request)
2766 {
2767 	struct cfg80211_registered_device *rdev;
2768 	struct wiphy *wiphy;
2769 
2770 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2771 		wiphy = &rdev->wiphy;
2772 		if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2773 		    request->initiator == NL80211_REGDOM_SET_BY_USER)
2774 			reg_call_notifier(wiphy, request);
2775 	}
2776 }
2777 
2778 /*
2779  * Processes regulatory hints, this is all the NL80211_REGDOM_SET_BY_*
2780  * Regulatory hints come on a first come first serve basis and we
2781  * must process each one atomically.
2782  */
reg_process_pending_hints(void)2783 static void reg_process_pending_hints(void)
2784 {
2785 	struct regulatory_request *reg_request, *lr;
2786 
2787 	lr = get_last_request();
2788 
2789 	/* When last_request->processed becomes true this will be rescheduled */
2790 	if (lr && !lr->processed) {
2791 		pr_debug("Pending regulatory request, waiting for it to be processed...\n");
2792 		return;
2793 	}
2794 
2795 	spin_lock(&reg_requests_lock);
2796 
2797 	if (list_empty(&reg_requests_list)) {
2798 		spin_unlock(&reg_requests_lock);
2799 		return;
2800 	}
2801 
2802 	reg_request = list_first_entry(&reg_requests_list,
2803 				       struct regulatory_request,
2804 				       list);
2805 	list_del_init(&reg_request->list);
2806 
2807 	spin_unlock(&reg_requests_lock);
2808 
2809 	notify_self_managed_wiphys(reg_request);
2810 
2811 	reg_process_hint(reg_request);
2812 
2813 	lr = get_last_request();
2814 
2815 	spin_lock(&reg_requests_lock);
2816 	if (!list_empty(&reg_requests_list) && lr && lr->processed)
2817 		schedule_work(&reg_work);
2818 	spin_unlock(&reg_requests_lock);
2819 }
2820 
2821 /* Processes beacon hints -- this has nothing to do with country IEs */
reg_process_pending_beacon_hints(void)2822 static void reg_process_pending_beacon_hints(void)
2823 {
2824 	struct cfg80211_registered_device *rdev;
2825 	struct reg_beacon *pending_beacon, *tmp;
2826 
2827 	/* This goes through the _pending_ beacon list */
2828 	spin_lock_bh(&reg_pending_beacons_lock);
2829 
2830 	list_for_each_entry_safe(pending_beacon, tmp,
2831 				 &reg_pending_beacons, list) {
2832 		list_del_init(&pending_beacon->list);
2833 
2834 		/* Applies the beacon hint to current wiphys */
2835 		list_for_each_entry(rdev, &cfg80211_rdev_list, list)
2836 			wiphy_update_new_beacon(&rdev->wiphy, pending_beacon);
2837 
2838 		/* Remembers the beacon hint for new wiphys or reg changes */
2839 		list_add_tail(&pending_beacon->list, &reg_beacon_list);
2840 	}
2841 
2842 	spin_unlock_bh(&reg_pending_beacons_lock);
2843 }
2844 
reg_process_self_managed_hints(void)2845 static void reg_process_self_managed_hints(void)
2846 {
2847 	struct cfg80211_registered_device *rdev;
2848 	struct wiphy *wiphy;
2849 	const struct ieee80211_regdomain *tmp;
2850 	const struct ieee80211_regdomain *regd;
2851 	enum nl80211_band band;
2852 	struct regulatory_request request = {};
2853 
2854 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2855 		wiphy = &rdev->wiphy;
2856 
2857 		spin_lock(&reg_requests_lock);
2858 		regd = rdev->requested_regd;
2859 		rdev->requested_regd = NULL;
2860 		spin_unlock(&reg_requests_lock);
2861 
2862 		if (regd == NULL)
2863 			continue;
2864 
2865 		tmp = get_wiphy_regdom(wiphy);
2866 		rcu_assign_pointer(wiphy->regd, regd);
2867 		rcu_free_regdom(tmp);
2868 
2869 		for (band = 0; band < NUM_NL80211_BANDS; band++)
2870 			handle_band_custom(wiphy, wiphy->bands[band], regd);
2871 
2872 		reg_process_ht_flags(wiphy);
2873 
2874 		request.wiphy_idx = get_wiphy_idx(wiphy);
2875 		request.alpha2[0] = regd->alpha2[0];
2876 		request.alpha2[1] = regd->alpha2[1];
2877 		request.initiator = NL80211_REGDOM_SET_BY_DRIVER;
2878 
2879 		nl80211_send_wiphy_reg_change_event(&request);
2880 	}
2881 
2882 	reg_check_channels();
2883 }
2884 
reg_todo(struct work_struct * work)2885 static void reg_todo(struct work_struct *work)
2886 {
2887 	rtnl_lock();
2888 	reg_process_pending_hints();
2889 	reg_process_pending_beacon_hints();
2890 	reg_process_self_managed_hints();
2891 	rtnl_unlock();
2892 }
2893 
queue_regulatory_request(struct regulatory_request * request)2894 static void queue_regulatory_request(struct regulatory_request *request)
2895 {
2896 	request->alpha2[0] = toupper(request->alpha2[0]);
2897 	request->alpha2[1] = toupper(request->alpha2[1]);
2898 
2899 	spin_lock(&reg_requests_lock);
2900 	list_add_tail(&request->list, &reg_requests_list);
2901 	spin_unlock(&reg_requests_lock);
2902 
2903 	schedule_work(&reg_work);
2904 }
2905 
2906 /*
2907  * Core regulatory hint -- happens during cfg80211_init()
2908  * and when we restore regulatory settings.
2909  */
regulatory_hint_core(const char * alpha2)2910 static int regulatory_hint_core(const char *alpha2)
2911 {
2912 	struct regulatory_request *request;
2913 
2914 	request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
2915 	if (!request)
2916 		return -ENOMEM;
2917 
2918 	request->alpha2[0] = alpha2[0];
2919 	request->alpha2[1] = alpha2[1];
2920 	request->initiator = NL80211_REGDOM_SET_BY_CORE;
2921 	request->wiphy_idx = WIPHY_IDX_INVALID;
2922 
2923 	queue_regulatory_request(request);
2924 
2925 	return 0;
2926 }
2927 
2928 /* User hints */
regulatory_hint_user(const char * alpha2,enum nl80211_user_reg_hint_type user_reg_hint_type)2929 int regulatory_hint_user(const char *alpha2,
2930 			 enum nl80211_user_reg_hint_type user_reg_hint_type)
2931 {
2932 	struct regulatory_request *request;
2933 
2934 	if (WARN_ON(!alpha2))
2935 		return -EINVAL;
2936 
2937 	request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
2938 	if (!request)
2939 		return -ENOMEM;
2940 
2941 	request->wiphy_idx = WIPHY_IDX_INVALID;
2942 	request->alpha2[0] = alpha2[0];
2943 	request->alpha2[1] = alpha2[1];
2944 	request->initiator = NL80211_REGDOM_SET_BY_USER;
2945 	request->user_reg_hint_type = user_reg_hint_type;
2946 
2947 	/* Allow calling CRDA again */
2948 	reset_crda_timeouts();
2949 
2950 	queue_regulatory_request(request);
2951 
2952 	return 0;
2953 }
2954 
regulatory_hint_indoor(bool is_indoor,u32 portid)2955 int regulatory_hint_indoor(bool is_indoor, u32 portid)
2956 {
2957 	spin_lock(&reg_indoor_lock);
2958 
2959 	/* It is possible that more than one user space process is trying to
2960 	 * configure the indoor setting. To handle such cases, clear the indoor
2961 	 * setting in case that some process does not think that the device
2962 	 * is operating in an indoor environment. In addition, if a user space
2963 	 * process indicates that it is controlling the indoor setting, save its
2964 	 * portid, i.e., make it the owner.
2965 	 */
2966 	reg_is_indoor = is_indoor;
2967 	if (reg_is_indoor) {
2968 		if (!reg_is_indoor_portid)
2969 			reg_is_indoor_portid = portid;
2970 	} else {
2971 		reg_is_indoor_portid = 0;
2972 	}
2973 
2974 	spin_unlock(&reg_indoor_lock);
2975 
2976 	if (!is_indoor)
2977 		reg_check_channels();
2978 
2979 	return 0;
2980 }
2981 
regulatory_netlink_notify(u32 portid)2982 void regulatory_netlink_notify(u32 portid)
2983 {
2984 	spin_lock(&reg_indoor_lock);
2985 
2986 	if (reg_is_indoor_portid != portid) {
2987 		spin_unlock(&reg_indoor_lock);
2988 		return;
2989 	}
2990 
2991 	reg_is_indoor = false;
2992 	reg_is_indoor_portid = 0;
2993 
2994 	spin_unlock(&reg_indoor_lock);
2995 
2996 	reg_check_channels();
2997 }
2998 
2999 /* Driver hints */
regulatory_hint(struct wiphy * wiphy,const char * alpha2)3000 int regulatory_hint(struct wiphy *wiphy, const char *alpha2)
3001 {
3002 	struct regulatory_request *request;
3003 
3004 	if (WARN_ON(!alpha2 || !wiphy))
3005 		return -EINVAL;
3006 
3007 	wiphy->regulatory_flags &= ~REGULATORY_CUSTOM_REG;
3008 
3009 	request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
3010 	if (!request)
3011 		return -ENOMEM;
3012 
3013 	request->wiphy_idx = get_wiphy_idx(wiphy);
3014 
3015 	request->alpha2[0] = alpha2[0];
3016 	request->alpha2[1] = alpha2[1];
3017 	request->initiator = NL80211_REGDOM_SET_BY_DRIVER;
3018 
3019 	/* Allow calling CRDA again */
3020 	reset_crda_timeouts();
3021 
3022 	queue_regulatory_request(request);
3023 
3024 	return 0;
3025 }
3026 EXPORT_SYMBOL(regulatory_hint);
3027 
regulatory_hint_country_ie(struct wiphy * wiphy,enum nl80211_band band,const u8 * country_ie,u8 country_ie_len)3028 void regulatory_hint_country_ie(struct wiphy *wiphy, enum nl80211_band band,
3029 				const u8 *country_ie, u8 country_ie_len)
3030 {
3031 	char alpha2[2];
3032 	enum environment_cap env = ENVIRON_ANY;
3033 	struct regulatory_request *request = NULL, *lr;
3034 
3035 	/* IE len must be evenly divisible by 2 */
3036 	if (country_ie_len & 0x01)
3037 		return;
3038 
3039 	if (country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
3040 		return;
3041 
3042 	request = kzalloc(sizeof(*request), GFP_KERNEL);
3043 	if (!request)
3044 		return;
3045 
3046 	alpha2[0] = country_ie[0];
3047 	alpha2[1] = country_ie[1];
3048 
3049 	if (country_ie[2] == 'I')
3050 		env = ENVIRON_INDOOR;
3051 	else if (country_ie[2] == 'O')
3052 		env = ENVIRON_OUTDOOR;
3053 
3054 	rcu_read_lock();
3055 	lr = get_last_request();
3056 
3057 	if (unlikely(!lr))
3058 		goto out;
3059 
3060 	/*
3061 	 * We will run this only upon a successful connection on cfg80211.
3062 	 * We leave conflict resolution to the workqueue, where can hold
3063 	 * the RTNL.
3064 	 */
3065 	if (lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
3066 	    lr->wiphy_idx != WIPHY_IDX_INVALID)
3067 		goto out;
3068 
3069 	request->wiphy_idx = get_wiphy_idx(wiphy);
3070 	request->alpha2[0] = alpha2[0];
3071 	request->alpha2[1] = alpha2[1];
3072 	request->initiator = NL80211_REGDOM_SET_BY_COUNTRY_IE;
3073 	request->country_ie_env = env;
3074 
3075 	/* Allow calling CRDA again */
3076 	reset_crda_timeouts();
3077 
3078 	queue_regulatory_request(request);
3079 	request = NULL;
3080 out:
3081 	kfree(request);
3082 	rcu_read_unlock();
3083 }
3084 
restore_alpha2(char * alpha2,bool reset_user)3085 static void restore_alpha2(char *alpha2, bool reset_user)
3086 {
3087 	/* indicates there is no alpha2 to consider for restoration */
3088 	alpha2[0] = '9';
3089 	alpha2[1] = '7';
3090 
3091 	/* The user setting has precedence over the module parameter */
3092 	if (is_user_regdom_saved()) {
3093 		/* Unless we're asked to ignore it and reset it */
3094 		if (reset_user) {
3095 			pr_debug("Restoring regulatory settings including user preference\n");
3096 			user_alpha2[0] = '9';
3097 			user_alpha2[1] = '7';
3098 
3099 			/*
3100 			 * If we're ignoring user settings, we still need to
3101 			 * check the module parameter to ensure we put things
3102 			 * back as they were for a full restore.
3103 			 */
3104 			if (!is_world_regdom(ieee80211_regdom)) {
3105 				pr_debug("Keeping preference on module parameter ieee80211_regdom: %c%c\n",
3106 					 ieee80211_regdom[0], ieee80211_regdom[1]);
3107 				alpha2[0] = ieee80211_regdom[0];
3108 				alpha2[1] = ieee80211_regdom[1];
3109 			}
3110 		} else {
3111 			pr_debug("Restoring regulatory settings while preserving user preference for: %c%c\n",
3112 				 user_alpha2[0], user_alpha2[1]);
3113 			alpha2[0] = user_alpha2[0];
3114 			alpha2[1] = user_alpha2[1];
3115 		}
3116 	} else if (!is_world_regdom(ieee80211_regdom)) {
3117 		pr_debug("Keeping preference on module parameter ieee80211_regdom: %c%c\n",
3118 			 ieee80211_regdom[0], ieee80211_regdom[1]);
3119 		alpha2[0] = ieee80211_regdom[0];
3120 		alpha2[1] = ieee80211_regdom[1];
3121 	} else
3122 		pr_debug("Restoring regulatory settings\n");
3123 }
3124 
restore_custom_reg_settings(struct wiphy * wiphy)3125 static void restore_custom_reg_settings(struct wiphy *wiphy)
3126 {
3127 	struct ieee80211_supported_band *sband;
3128 	enum nl80211_band band;
3129 	struct ieee80211_channel *chan;
3130 	int i;
3131 
3132 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
3133 		sband = wiphy->bands[band];
3134 		if (!sband)
3135 			continue;
3136 		for (i = 0; i < sband->n_channels; i++) {
3137 			chan = &sband->channels[i];
3138 			chan->flags = chan->orig_flags;
3139 			chan->max_antenna_gain = chan->orig_mag;
3140 			chan->max_power = chan->orig_mpwr;
3141 			chan->beacon_found = false;
3142 		}
3143 	}
3144 }
3145 
3146 /*
3147  * Restoring regulatory settings involves ingoring any
3148  * possibly stale country IE information and user regulatory
3149  * settings if so desired, this includes any beacon hints
3150  * learned as we could have traveled outside to another country
3151  * after disconnection. To restore regulatory settings we do
3152  * exactly what we did at bootup:
3153  *
3154  *   - send a core regulatory hint
3155  *   - send a user regulatory hint if applicable
3156  *
3157  * Device drivers that send a regulatory hint for a specific country
3158  * keep their own regulatory domain on wiphy->regd so that does does
3159  * not need to be remembered.
3160  */
restore_regulatory_settings(bool reset_user,bool cached)3161 static void restore_regulatory_settings(bool reset_user, bool cached)
3162 {
3163 	char alpha2[2];
3164 	char world_alpha2[2];
3165 	struct reg_beacon *reg_beacon, *btmp;
3166 	LIST_HEAD(tmp_reg_req_list);
3167 	struct cfg80211_registered_device *rdev;
3168 
3169 	ASSERT_RTNL();
3170 
3171 	/*
3172 	 * Clear the indoor setting in case that it is not controlled by user
3173 	 * space, as otherwise there is no guarantee that the device is still
3174 	 * operating in an indoor environment.
3175 	 */
3176 	spin_lock(&reg_indoor_lock);
3177 	if (reg_is_indoor && !reg_is_indoor_portid) {
3178 		reg_is_indoor = false;
3179 		reg_check_channels();
3180 	}
3181 	spin_unlock(&reg_indoor_lock);
3182 
3183 	reset_regdomains(true, &world_regdom);
3184 	restore_alpha2(alpha2, reset_user);
3185 
3186 	/*
3187 	 * If there's any pending requests we simply
3188 	 * stash them to a temporary pending queue and
3189 	 * add then after we've restored regulatory
3190 	 * settings.
3191 	 */
3192 	spin_lock(&reg_requests_lock);
3193 	list_splice_tail_init(&reg_requests_list, &tmp_reg_req_list);
3194 	spin_unlock(&reg_requests_lock);
3195 
3196 	/* Clear beacon hints */
3197 	spin_lock_bh(&reg_pending_beacons_lock);
3198 	list_for_each_entry_safe(reg_beacon, btmp, &reg_pending_beacons, list) {
3199 		list_del(&reg_beacon->list);
3200 		kfree(reg_beacon);
3201 	}
3202 	spin_unlock_bh(&reg_pending_beacons_lock);
3203 
3204 	list_for_each_entry_safe(reg_beacon, btmp, &reg_beacon_list, list) {
3205 		list_del(&reg_beacon->list);
3206 		kfree(reg_beacon);
3207 	}
3208 
3209 	/* First restore to the basic regulatory settings */
3210 	world_alpha2[0] = cfg80211_world_regdom->alpha2[0];
3211 	world_alpha2[1] = cfg80211_world_regdom->alpha2[1];
3212 
3213 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3214 		if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED)
3215 			continue;
3216 		if (rdev->wiphy.regulatory_flags & REGULATORY_CUSTOM_REG)
3217 			restore_custom_reg_settings(&rdev->wiphy);
3218 	}
3219 
3220 	if (cached && (!is_an_alpha2(alpha2) ||
3221 		       !IS_ERR_OR_NULL(cfg80211_user_regdom))) {
3222 		reset_regdomains(false, cfg80211_world_regdom);
3223 		update_all_wiphy_regulatory(NL80211_REGDOM_SET_BY_CORE);
3224 		print_regdomain(get_cfg80211_regdom());
3225 		nl80211_send_reg_change_event(&core_request_world);
3226 		reg_set_request_processed();
3227 
3228 		if (is_an_alpha2(alpha2) &&
3229 		    !regulatory_hint_user(alpha2, NL80211_USER_REG_HINT_USER)) {
3230 			struct regulatory_request *ureq;
3231 
3232 			spin_lock(&reg_requests_lock);
3233 			ureq = list_last_entry(&reg_requests_list,
3234 					       struct regulatory_request,
3235 					       list);
3236 			list_del(&ureq->list);
3237 			spin_unlock(&reg_requests_lock);
3238 
3239 			notify_self_managed_wiphys(ureq);
3240 			reg_update_last_request(ureq);
3241 			set_regdom(reg_copy_regd(cfg80211_user_regdom),
3242 				   REGD_SOURCE_CACHED);
3243 		}
3244 	} else {
3245 		regulatory_hint_core(world_alpha2);
3246 
3247 		/*
3248 		 * This restores the ieee80211_regdom module parameter
3249 		 * preference or the last user requested regulatory
3250 		 * settings, user regulatory settings takes precedence.
3251 		 */
3252 		if (is_an_alpha2(alpha2))
3253 			regulatory_hint_user(alpha2, NL80211_USER_REG_HINT_USER);
3254 	}
3255 
3256 	spin_lock(&reg_requests_lock);
3257 	list_splice_tail_init(&tmp_reg_req_list, &reg_requests_list);
3258 	spin_unlock(&reg_requests_lock);
3259 
3260 	pr_debug("Kicking the queue\n");
3261 
3262 	schedule_work(&reg_work);
3263 }
3264 
is_wiphy_all_set_reg_flag(enum ieee80211_regulatory_flags flag)3265 static bool is_wiphy_all_set_reg_flag(enum ieee80211_regulatory_flags flag)
3266 {
3267 	struct cfg80211_registered_device *rdev;
3268 	struct wireless_dev *wdev;
3269 
3270 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3271 		list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3272 			wdev_lock(wdev);
3273 			if (!(wdev->wiphy->regulatory_flags & flag)) {
3274 				wdev_unlock(wdev);
3275 				return false;
3276 			}
3277 			wdev_unlock(wdev);
3278 		}
3279 	}
3280 
3281 	return true;
3282 }
3283 
regulatory_hint_disconnect(void)3284 void regulatory_hint_disconnect(void)
3285 {
3286 	/* Restore of regulatory settings is not required when wiphy(s)
3287 	 * ignore IE from connected access point but clearance of beacon hints
3288 	 * is required when wiphy(s) supports beacon hints.
3289 	 */
3290 	if (is_wiphy_all_set_reg_flag(REGULATORY_COUNTRY_IE_IGNORE)) {
3291 		struct reg_beacon *reg_beacon, *btmp;
3292 
3293 		if (is_wiphy_all_set_reg_flag(REGULATORY_DISABLE_BEACON_HINTS))
3294 			return;
3295 
3296 		spin_lock_bh(&reg_pending_beacons_lock);
3297 		list_for_each_entry_safe(reg_beacon, btmp,
3298 					 &reg_pending_beacons, list) {
3299 			list_del(&reg_beacon->list);
3300 			kfree(reg_beacon);
3301 		}
3302 		spin_unlock_bh(&reg_pending_beacons_lock);
3303 
3304 		list_for_each_entry_safe(reg_beacon, btmp,
3305 					 &reg_beacon_list, list) {
3306 			list_del(&reg_beacon->list);
3307 			kfree(reg_beacon);
3308 		}
3309 
3310 		return;
3311 	}
3312 
3313 	pr_debug("All devices are disconnected, going to restore regulatory settings\n");
3314 	restore_regulatory_settings(false, true);
3315 }
3316 
freq_is_chan_12_13_14(u32 freq)3317 static bool freq_is_chan_12_13_14(u32 freq)
3318 {
3319 	if (freq == ieee80211_channel_to_frequency(12, NL80211_BAND_2GHZ) ||
3320 	    freq == ieee80211_channel_to_frequency(13, NL80211_BAND_2GHZ) ||
3321 	    freq == ieee80211_channel_to_frequency(14, NL80211_BAND_2GHZ))
3322 		return true;
3323 	return false;
3324 }
3325 
pending_reg_beacon(struct ieee80211_channel * beacon_chan)3326 static bool pending_reg_beacon(struct ieee80211_channel *beacon_chan)
3327 {
3328 	struct reg_beacon *pending_beacon;
3329 
3330 	list_for_each_entry(pending_beacon, &reg_pending_beacons, list)
3331 		if (beacon_chan->center_freq ==
3332 		    pending_beacon->chan.center_freq)
3333 			return true;
3334 	return false;
3335 }
3336 
regulatory_hint_found_beacon(struct wiphy * wiphy,struct ieee80211_channel * beacon_chan,gfp_t gfp)3337 int regulatory_hint_found_beacon(struct wiphy *wiphy,
3338 				 struct ieee80211_channel *beacon_chan,
3339 				 gfp_t gfp)
3340 {
3341 	struct reg_beacon *reg_beacon;
3342 	bool processing;
3343 
3344 	if (beacon_chan->beacon_found ||
3345 	    beacon_chan->flags & IEEE80211_CHAN_RADAR ||
3346 	    (beacon_chan->band == NL80211_BAND_2GHZ &&
3347 	     !freq_is_chan_12_13_14(beacon_chan->center_freq)))
3348 		return 0;
3349 
3350 	spin_lock_bh(&reg_pending_beacons_lock);
3351 	processing = pending_reg_beacon(beacon_chan);
3352 	spin_unlock_bh(&reg_pending_beacons_lock);
3353 
3354 	if (processing)
3355 		return 0;
3356 
3357 	reg_beacon = kzalloc(sizeof(struct reg_beacon), gfp);
3358 	if (!reg_beacon)
3359 		return -ENOMEM;
3360 
3361 	pr_debug("Found new beacon on frequency: %d MHz (Ch %d) on %s\n",
3362 		 beacon_chan->center_freq,
3363 		 ieee80211_frequency_to_channel(beacon_chan->center_freq),
3364 		 wiphy_name(wiphy));
3365 
3366 	memcpy(&reg_beacon->chan, beacon_chan,
3367 	       sizeof(struct ieee80211_channel));
3368 
3369 	/*
3370 	 * Since we can be called from BH or and non-BH context
3371 	 * we must use spin_lock_bh()
3372 	 */
3373 	spin_lock_bh(&reg_pending_beacons_lock);
3374 	list_add_tail(&reg_beacon->list, &reg_pending_beacons);
3375 	spin_unlock_bh(&reg_pending_beacons_lock);
3376 
3377 	schedule_work(&reg_work);
3378 
3379 	return 0;
3380 }
3381 
print_rd_rules(const struct ieee80211_regdomain * rd)3382 static void print_rd_rules(const struct ieee80211_regdomain *rd)
3383 {
3384 	unsigned int i;
3385 	const struct ieee80211_reg_rule *reg_rule = NULL;
3386 	const struct ieee80211_freq_range *freq_range = NULL;
3387 	const struct ieee80211_power_rule *power_rule = NULL;
3388 	char bw[32], cac_time[32];
3389 
3390 	pr_debug("  (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)\n");
3391 
3392 	for (i = 0; i < rd->n_reg_rules; i++) {
3393 		reg_rule = &rd->reg_rules[i];
3394 		freq_range = &reg_rule->freq_range;
3395 		power_rule = &reg_rule->power_rule;
3396 
3397 		if (reg_rule->flags & NL80211_RRF_AUTO_BW)
3398 			snprintf(bw, sizeof(bw), "%d KHz, %d KHz AUTO",
3399 				 freq_range->max_bandwidth_khz,
3400 				 reg_get_max_bandwidth(rd, reg_rule));
3401 		else
3402 			snprintf(bw, sizeof(bw), "%d KHz",
3403 				 freq_range->max_bandwidth_khz);
3404 
3405 		if (reg_rule->flags & NL80211_RRF_DFS)
3406 			scnprintf(cac_time, sizeof(cac_time), "%u s",
3407 				  reg_rule->dfs_cac_ms/1000);
3408 		else
3409 			scnprintf(cac_time, sizeof(cac_time), "N/A");
3410 
3411 
3412 		/*
3413 		 * There may not be documentation for max antenna gain
3414 		 * in certain regions
3415 		 */
3416 		if (power_rule->max_antenna_gain)
3417 			pr_debug("  (%d KHz - %d KHz @ %s), (%d mBi, %d mBm), (%s)\n",
3418 				freq_range->start_freq_khz,
3419 				freq_range->end_freq_khz,
3420 				bw,
3421 				power_rule->max_antenna_gain,
3422 				power_rule->max_eirp,
3423 				cac_time);
3424 		else
3425 			pr_debug("  (%d KHz - %d KHz @ %s), (N/A, %d mBm), (%s)\n",
3426 				freq_range->start_freq_khz,
3427 				freq_range->end_freq_khz,
3428 				bw,
3429 				power_rule->max_eirp,
3430 				cac_time);
3431 	}
3432 }
3433 
reg_supported_dfs_region(enum nl80211_dfs_regions dfs_region)3434 bool reg_supported_dfs_region(enum nl80211_dfs_regions dfs_region)
3435 {
3436 	switch (dfs_region) {
3437 	case NL80211_DFS_UNSET:
3438 	case NL80211_DFS_FCC:
3439 	case NL80211_DFS_ETSI:
3440 	case NL80211_DFS_JP:
3441 		return true;
3442 	default:
3443 		pr_debug("Ignoring unknown DFS master region: %d\n", dfs_region);
3444 		return false;
3445 	}
3446 }
3447 
print_regdomain(const struct ieee80211_regdomain * rd)3448 static void print_regdomain(const struct ieee80211_regdomain *rd)
3449 {
3450 	struct regulatory_request *lr = get_last_request();
3451 
3452 	if (is_intersected_alpha2(rd->alpha2)) {
3453 		if (lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE) {
3454 			struct cfg80211_registered_device *rdev;
3455 			rdev = cfg80211_rdev_by_wiphy_idx(lr->wiphy_idx);
3456 			if (rdev) {
3457 				pr_debug("Current regulatory domain updated by AP to: %c%c\n",
3458 					rdev->country_ie_alpha2[0],
3459 					rdev->country_ie_alpha2[1]);
3460 			} else
3461 				pr_debug("Current regulatory domain intersected:\n");
3462 		} else
3463 			pr_debug("Current regulatory domain intersected:\n");
3464 	} else if (is_world_regdom(rd->alpha2)) {
3465 		pr_debug("World regulatory domain updated:\n");
3466 	} else {
3467 		if (is_unknown_alpha2(rd->alpha2))
3468 			pr_debug("Regulatory domain changed to driver built-in settings (unknown country)\n");
3469 		else {
3470 			if (reg_request_cell_base(lr))
3471 				pr_debug("Regulatory domain changed to country: %c%c by Cell Station\n",
3472 					rd->alpha2[0], rd->alpha2[1]);
3473 			else
3474 				pr_debug("Regulatory domain changed to country: %c%c\n",
3475 					rd->alpha2[0], rd->alpha2[1]);
3476 		}
3477 	}
3478 
3479 	pr_debug(" DFS Master region: %s", reg_dfs_region_str(rd->dfs_region));
3480 	print_rd_rules(rd);
3481 }
3482 
print_regdomain_info(const struct ieee80211_regdomain * rd)3483 static void print_regdomain_info(const struct ieee80211_regdomain *rd)
3484 {
3485 	pr_debug("Regulatory domain: %c%c\n", rd->alpha2[0], rd->alpha2[1]);
3486 	print_rd_rules(rd);
3487 }
3488 
reg_set_rd_core(const struct ieee80211_regdomain * rd)3489 static int reg_set_rd_core(const struct ieee80211_regdomain *rd)
3490 {
3491 	if (!is_world_regdom(rd->alpha2))
3492 		return -EINVAL;
3493 	update_world_regdomain(rd);
3494 	return 0;
3495 }
3496 
reg_set_rd_user(const struct ieee80211_regdomain * rd,struct regulatory_request * user_request)3497 static int reg_set_rd_user(const struct ieee80211_regdomain *rd,
3498 			   struct regulatory_request *user_request)
3499 {
3500 	const struct ieee80211_regdomain *intersected_rd = NULL;
3501 
3502 	if (!regdom_changes(rd->alpha2))
3503 		return -EALREADY;
3504 
3505 	if (!is_valid_rd(rd)) {
3506 		pr_err("Invalid regulatory domain detected: %c%c\n",
3507 		       rd->alpha2[0], rd->alpha2[1]);
3508 		print_regdomain_info(rd);
3509 		return -EINVAL;
3510 	}
3511 
3512 	if (!user_request->intersect) {
3513 		reset_regdomains(false, rd);
3514 		return 0;
3515 	}
3516 
3517 	intersected_rd = regdom_intersect(rd, get_cfg80211_regdom());
3518 	if (!intersected_rd)
3519 		return -EINVAL;
3520 
3521 	kfree(rd);
3522 	rd = NULL;
3523 	reset_regdomains(false, intersected_rd);
3524 
3525 	return 0;
3526 }
3527 
reg_set_rd_driver(const struct ieee80211_regdomain * rd,struct regulatory_request * driver_request)3528 static int reg_set_rd_driver(const struct ieee80211_regdomain *rd,
3529 			     struct regulatory_request *driver_request)
3530 {
3531 	const struct ieee80211_regdomain *regd;
3532 	const struct ieee80211_regdomain *intersected_rd = NULL;
3533 	const struct ieee80211_regdomain *tmp;
3534 	struct wiphy *request_wiphy;
3535 
3536 	if (is_world_regdom(rd->alpha2))
3537 		return -EINVAL;
3538 
3539 	if (!regdom_changes(rd->alpha2))
3540 		return -EALREADY;
3541 
3542 	if (!is_valid_rd(rd)) {
3543 		pr_err("Invalid regulatory domain detected: %c%c\n",
3544 		       rd->alpha2[0], rd->alpha2[1]);
3545 		print_regdomain_info(rd);
3546 		return -EINVAL;
3547 	}
3548 
3549 	request_wiphy = wiphy_idx_to_wiphy(driver_request->wiphy_idx);
3550 	if (!request_wiphy)
3551 		return -ENODEV;
3552 
3553 	if (!driver_request->intersect) {
3554 		if (request_wiphy->regd)
3555 			return -EALREADY;
3556 
3557 		regd = reg_copy_regd(rd);
3558 		if (IS_ERR(regd))
3559 			return PTR_ERR(regd);
3560 
3561 		rcu_assign_pointer(request_wiphy->regd, regd);
3562 		reset_regdomains(false, rd);
3563 		return 0;
3564 	}
3565 
3566 	intersected_rd = regdom_intersect(rd, get_cfg80211_regdom());
3567 	if (!intersected_rd)
3568 		return -EINVAL;
3569 
3570 	/*
3571 	 * We can trash what CRDA provided now.
3572 	 * However if a driver requested this specific regulatory
3573 	 * domain we keep it for its private use
3574 	 */
3575 	tmp = get_wiphy_regdom(request_wiphy);
3576 	rcu_assign_pointer(request_wiphy->regd, rd);
3577 	rcu_free_regdom(tmp);
3578 
3579 	rd = NULL;
3580 
3581 	reset_regdomains(false, intersected_rd);
3582 
3583 	return 0;
3584 }
3585 
reg_set_rd_country_ie(const struct ieee80211_regdomain * rd,struct regulatory_request * country_ie_request)3586 static int reg_set_rd_country_ie(const struct ieee80211_regdomain *rd,
3587 				 struct regulatory_request *country_ie_request)
3588 {
3589 	struct wiphy *request_wiphy;
3590 
3591 	if (!is_alpha2_set(rd->alpha2) && !is_an_alpha2(rd->alpha2) &&
3592 	    !is_unknown_alpha2(rd->alpha2))
3593 		return -EINVAL;
3594 
3595 	/*
3596 	 * Lets only bother proceeding on the same alpha2 if the current
3597 	 * rd is non static (it means CRDA was present and was used last)
3598 	 * and the pending request came in from a country IE
3599 	 */
3600 
3601 	if (!is_valid_rd(rd)) {
3602 		pr_err("Invalid regulatory domain detected: %c%c\n",
3603 		       rd->alpha2[0], rd->alpha2[1]);
3604 		print_regdomain_info(rd);
3605 		return -EINVAL;
3606 	}
3607 
3608 	request_wiphy = wiphy_idx_to_wiphy(country_ie_request->wiphy_idx);
3609 	if (!request_wiphy)
3610 		return -ENODEV;
3611 
3612 	if (country_ie_request->intersect)
3613 		return -EINVAL;
3614 
3615 	reset_regdomains(false, rd);
3616 	return 0;
3617 }
3618 
3619 /*
3620  * Use this call to set the current regulatory domain. Conflicts with
3621  * multiple drivers can be ironed out later. Caller must've already
3622  * kmalloc'd the rd structure.
3623  */
set_regdom(const struct ieee80211_regdomain * rd,enum ieee80211_regd_source regd_src)3624 int set_regdom(const struct ieee80211_regdomain *rd,
3625 	       enum ieee80211_regd_source regd_src)
3626 {
3627 	struct regulatory_request *lr;
3628 	bool user_reset = false;
3629 	int r;
3630 
3631 	if (IS_ERR_OR_NULL(rd))
3632 		return -ENODATA;
3633 
3634 	if (!reg_is_valid_request(rd->alpha2)) {
3635 		kfree(rd);
3636 		return -EINVAL;
3637 	}
3638 
3639 	if (regd_src == REGD_SOURCE_CRDA)
3640 		reset_crda_timeouts();
3641 
3642 	lr = get_last_request();
3643 
3644 	/* Note that this doesn't update the wiphys, this is done below */
3645 	switch (lr->initiator) {
3646 	case NL80211_REGDOM_SET_BY_CORE:
3647 		r = reg_set_rd_core(rd);
3648 		break;
3649 	case NL80211_REGDOM_SET_BY_USER:
3650 		cfg80211_save_user_regdom(rd);
3651 		r = reg_set_rd_user(rd, lr);
3652 		user_reset = true;
3653 		break;
3654 	case NL80211_REGDOM_SET_BY_DRIVER:
3655 		r = reg_set_rd_driver(rd, lr);
3656 		break;
3657 	case NL80211_REGDOM_SET_BY_COUNTRY_IE:
3658 		r = reg_set_rd_country_ie(rd, lr);
3659 		break;
3660 	default:
3661 		WARN(1, "invalid initiator %d\n", lr->initiator);
3662 		kfree(rd);
3663 		return -EINVAL;
3664 	}
3665 
3666 	if (r) {
3667 		switch (r) {
3668 		case -EALREADY:
3669 			reg_set_request_processed();
3670 			break;
3671 		default:
3672 			/* Back to world regulatory in case of errors */
3673 			restore_regulatory_settings(user_reset, false);
3674 		}
3675 
3676 		kfree(rd);
3677 		return r;
3678 	}
3679 
3680 	/* This would make this whole thing pointless */
3681 	if (WARN_ON(!lr->intersect && rd != get_cfg80211_regdom()))
3682 		return -EINVAL;
3683 
3684 	/* update all wiphys now with the new established regulatory domain */
3685 	update_all_wiphy_regulatory(lr->initiator);
3686 
3687 	print_regdomain(get_cfg80211_regdom());
3688 
3689 	nl80211_send_reg_change_event(lr);
3690 
3691 	reg_set_request_processed();
3692 
3693 	return 0;
3694 }
3695 
__regulatory_set_wiphy_regd(struct wiphy * wiphy,struct ieee80211_regdomain * rd)3696 static int __regulatory_set_wiphy_regd(struct wiphy *wiphy,
3697 				       struct ieee80211_regdomain *rd)
3698 {
3699 	const struct ieee80211_regdomain *regd;
3700 	const struct ieee80211_regdomain *prev_regd;
3701 	struct cfg80211_registered_device *rdev;
3702 
3703 	if (WARN_ON(!wiphy || !rd))
3704 		return -EINVAL;
3705 
3706 	if (WARN(!(wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED),
3707 		 "wiphy should have REGULATORY_WIPHY_SELF_MANAGED\n"))
3708 		return -EPERM;
3709 
3710 	if (WARN(!is_valid_rd(rd), "Invalid regulatory domain detected\n")) {
3711 		print_regdomain_info(rd);
3712 		return -EINVAL;
3713 	}
3714 
3715 	regd = reg_copy_regd(rd);
3716 	if (IS_ERR(regd))
3717 		return PTR_ERR(regd);
3718 
3719 	rdev = wiphy_to_rdev(wiphy);
3720 
3721 	spin_lock(&reg_requests_lock);
3722 	prev_regd = rdev->requested_regd;
3723 	rdev->requested_regd = regd;
3724 	spin_unlock(&reg_requests_lock);
3725 
3726 	kfree(prev_regd);
3727 	return 0;
3728 }
3729 
regulatory_set_wiphy_regd(struct wiphy * wiphy,struct ieee80211_regdomain * rd)3730 int regulatory_set_wiphy_regd(struct wiphy *wiphy,
3731 			      struct ieee80211_regdomain *rd)
3732 {
3733 	int ret = __regulatory_set_wiphy_regd(wiphy, rd);
3734 
3735 	if (ret)
3736 		return ret;
3737 
3738 	schedule_work(&reg_work);
3739 	return 0;
3740 }
3741 EXPORT_SYMBOL(regulatory_set_wiphy_regd);
3742 
regulatory_set_wiphy_regd_sync_rtnl(struct wiphy * wiphy,struct ieee80211_regdomain * rd)3743 int regulatory_set_wiphy_regd_sync_rtnl(struct wiphy *wiphy,
3744 					struct ieee80211_regdomain *rd)
3745 {
3746 	int ret;
3747 
3748 	ASSERT_RTNL();
3749 
3750 	ret = __regulatory_set_wiphy_regd(wiphy, rd);
3751 	if (ret)
3752 		return ret;
3753 
3754 	/* process the request immediately */
3755 	reg_process_self_managed_hints();
3756 	return 0;
3757 }
3758 EXPORT_SYMBOL(regulatory_set_wiphy_regd_sync_rtnl);
3759 
wiphy_regulatory_register(struct wiphy * wiphy)3760 void wiphy_regulatory_register(struct wiphy *wiphy)
3761 {
3762 	struct regulatory_request *lr = get_last_request();
3763 
3764 	/* self-managed devices ignore beacon hints and country IE */
3765 	if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED) {
3766 		wiphy->regulatory_flags |= REGULATORY_DISABLE_BEACON_HINTS |
3767 					   REGULATORY_COUNTRY_IE_IGNORE;
3768 
3769 		/*
3770 		 * The last request may have been received before this
3771 		 * registration call. Call the driver notifier if
3772 		 * initiator is USER.
3773 		 */
3774 		if (lr->initiator == NL80211_REGDOM_SET_BY_USER)
3775 			reg_call_notifier(wiphy, lr);
3776 	}
3777 
3778 	if (!reg_dev_ignore_cell_hint(wiphy))
3779 		reg_num_devs_support_basehint++;
3780 
3781 	wiphy_update_regulatory(wiphy, lr->initiator);
3782 	wiphy_all_share_dfs_chan_state(wiphy);
3783 }
3784 
wiphy_regulatory_deregister(struct wiphy * wiphy)3785 void wiphy_regulatory_deregister(struct wiphy *wiphy)
3786 {
3787 	struct wiphy *request_wiphy = NULL;
3788 	struct regulatory_request *lr;
3789 
3790 	lr = get_last_request();
3791 
3792 	if (!reg_dev_ignore_cell_hint(wiphy))
3793 		reg_num_devs_support_basehint--;
3794 
3795 	rcu_free_regdom(get_wiphy_regdom(wiphy));
3796 	RCU_INIT_POINTER(wiphy->regd, NULL);
3797 
3798 	if (lr)
3799 		request_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
3800 
3801 	if (!request_wiphy || request_wiphy != wiphy)
3802 		return;
3803 
3804 	lr->wiphy_idx = WIPHY_IDX_INVALID;
3805 	lr->country_ie_env = ENVIRON_ANY;
3806 }
3807 
3808 /*
3809  * See FCC notices for UNII band definitions
3810  *  5GHz: https://www.fcc.gov/document/5-ghz-unlicensed-spectrum-unii
3811  *  6GHz: https://www.fcc.gov/document/fcc-proposes-more-spectrum-unlicensed-use-0
3812  */
cfg80211_get_unii(int freq)3813 int cfg80211_get_unii(int freq)
3814 {
3815 	/* UNII-1 */
3816 	if (freq >= 5150 && freq <= 5250)
3817 		return 0;
3818 
3819 	/* UNII-2A */
3820 	if (freq > 5250 && freq <= 5350)
3821 		return 1;
3822 
3823 	/* UNII-2B */
3824 	if (freq > 5350 && freq <= 5470)
3825 		return 2;
3826 
3827 	/* UNII-2C */
3828 	if (freq > 5470 && freq <= 5725)
3829 		return 3;
3830 
3831 	/* UNII-3 */
3832 	if (freq > 5725 && freq <= 5825)
3833 		return 4;
3834 
3835 	/* UNII-5 */
3836 	if (freq > 5925 && freq <= 6425)
3837 		return 5;
3838 
3839 	/* UNII-6 */
3840 	if (freq > 6425 && freq <= 6525)
3841 		return 6;
3842 
3843 	/* UNII-7 */
3844 	if (freq > 6525 && freq <= 6875)
3845 		return 7;
3846 
3847 	/* UNII-8 */
3848 	if (freq > 6875 && freq <= 7125)
3849 		return 8;
3850 
3851 	return -EINVAL;
3852 }
3853 
regulatory_indoor_allowed(void)3854 bool regulatory_indoor_allowed(void)
3855 {
3856 	return reg_is_indoor;
3857 }
3858 
regulatory_pre_cac_allowed(struct wiphy * wiphy)3859 bool regulatory_pre_cac_allowed(struct wiphy *wiphy)
3860 {
3861 	const struct ieee80211_regdomain *regd = NULL;
3862 	const struct ieee80211_regdomain *wiphy_regd = NULL;
3863 	bool pre_cac_allowed = false;
3864 
3865 	rcu_read_lock();
3866 
3867 	regd = rcu_dereference(cfg80211_regdomain);
3868 	wiphy_regd = rcu_dereference(wiphy->regd);
3869 	if (!wiphy_regd) {
3870 		if (regd->dfs_region == NL80211_DFS_ETSI)
3871 			pre_cac_allowed = true;
3872 
3873 		rcu_read_unlock();
3874 
3875 		return pre_cac_allowed;
3876 	}
3877 
3878 	if (regd->dfs_region == wiphy_regd->dfs_region &&
3879 	    wiphy_regd->dfs_region == NL80211_DFS_ETSI)
3880 		pre_cac_allowed = true;
3881 
3882 	rcu_read_unlock();
3883 
3884 	return pre_cac_allowed;
3885 }
3886 EXPORT_SYMBOL(regulatory_pre_cac_allowed);
3887 
regulatory_propagate_dfs_state(struct wiphy * wiphy,struct cfg80211_chan_def * chandef,enum nl80211_dfs_state dfs_state,enum nl80211_radar_event event)3888 void regulatory_propagate_dfs_state(struct wiphy *wiphy,
3889 				    struct cfg80211_chan_def *chandef,
3890 				    enum nl80211_dfs_state dfs_state,
3891 				    enum nl80211_radar_event event)
3892 {
3893 	struct cfg80211_registered_device *rdev;
3894 
3895 	ASSERT_RTNL();
3896 
3897 	if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3898 		return;
3899 
3900 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3901 		if (wiphy == &rdev->wiphy)
3902 			continue;
3903 
3904 		if (!reg_dfs_domain_same(wiphy, &rdev->wiphy))
3905 			continue;
3906 
3907 		if (!ieee80211_get_channel(&rdev->wiphy,
3908 					   chandef->chan->center_freq))
3909 			continue;
3910 
3911 		cfg80211_set_dfs_state(&rdev->wiphy, chandef, dfs_state);
3912 
3913 		if (event == NL80211_RADAR_DETECTED ||
3914 		    event == NL80211_RADAR_CAC_FINISHED)
3915 			cfg80211_sched_dfs_chan_update(rdev);
3916 
3917 		nl80211_radar_notify(rdev, chandef, event, NULL, GFP_KERNEL);
3918 	}
3919 }
3920 
regulatory_init_db(void)3921 static int __init regulatory_init_db(void)
3922 {
3923 	int err;
3924 
3925 	/*
3926 	 * It's possible that - due to other bugs/issues - cfg80211
3927 	 * never called regulatory_init() below, or that it failed;
3928 	 * in that case, don't try to do any further work here as
3929 	 * it's doomed to lead to crashes.
3930 	 */
3931 	if (IS_ERR_OR_NULL(reg_pdev))
3932 		return -EINVAL;
3933 
3934 	err = load_builtin_regdb_keys();
3935 	if (err)
3936 		return err;
3937 
3938 	/* We always try to get an update for the static regdomain */
3939 	err = regulatory_hint_core(cfg80211_world_regdom->alpha2);
3940 	if (err) {
3941 		if (err == -ENOMEM) {
3942 			platform_device_unregister(reg_pdev);
3943 			return err;
3944 		}
3945 		/*
3946 		 * N.B. kobject_uevent_env() can fail mainly for when we're out
3947 		 * memory which is handled and propagated appropriately above
3948 		 * but it can also fail during a netlink_broadcast() or during
3949 		 * early boot for call_usermodehelper(). For now treat these
3950 		 * errors as non-fatal.
3951 		 */
3952 		pr_err("kobject_uevent_env() was unable to call CRDA during init\n");
3953 	}
3954 
3955 	/*
3956 	 * Finally, if the user set the module parameter treat it
3957 	 * as a user hint.
3958 	 */
3959 	if (!is_world_regdom(ieee80211_regdom))
3960 		regulatory_hint_user(ieee80211_regdom,
3961 				     NL80211_USER_REG_HINT_USER);
3962 
3963 	return 0;
3964 }
3965 #ifndef MODULE
3966 late_initcall(regulatory_init_db);
3967 #endif
3968 
regulatory_init(void)3969 int __init regulatory_init(void)
3970 {
3971 	reg_pdev = platform_device_register_simple("regulatory", 0, NULL, 0);
3972 	if (IS_ERR(reg_pdev))
3973 		return PTR_ERR(reg_pdev);
3974 
3975 	spin_lock_init(&reg_requests_lock);
3976 	spin_lock_init(&reg_pending_beacons_lock);
3977 	spin_lock_init(&reg_indoor_lock);
3978 
3979 	rcu_assign_pointer(cfg80211_regdomain, cfg80211_world_regdom);
3980 
3981 	user_alpha2[0] = '9';
3982 	user_alpha2[1] = '7';
3983 
3984 #ifdef MODULE
3985 	return regulatory_init_db();
3986 #else
3987 	return 0;
3988 #endif
3989 }
3990 
regulatory_exit(void)3991 void regulatory_exit(void)
3992 {
3993 	struct regulatory_request *reg_request, *tmp;
3994 	struct reg_beacon *reg_beacon, *btmp;
3995 
3996 	cancel_work_sync(&reg_work);
3997 	cancel_crda_timeout_sync();
3998 	cancel_delayed_work_sync(&reg_check_chans);
3999 
4000 	/* Lock to suppress warnings */
4001 	rtnl_lock();
4002 	reset_regdomains(true, NULL);
4003 	rtnl_unlock();
4004 
4005 	dev_set_uevent_suppress(&reg_pdev->dev, true);
4006 
4007 	platform_device_unregister(reg_pdev);
4008 
4009 	list_for_each_entry_safe(reg_beacon, btmp, &reg_pending_beacons, list) {
4010 		list_del(&reg_beacon->list);
4011 		kfree(reg_beacon);
4012 	}
4013 
4014 	list_for_each_entry_safe(reg_beacon, btmp, &reg_beacon_list, list) {
4015 		list_del(&reg_beacon->list);
4016 		kfree(reg_beacon);
4017 	}
4018 
4019 	list_for_each_entry_safe(reg_request, tmp, &reg_requests_list, list) {
4020 		list_del(&reg_request->list);
4021 		kfree(reg_request);
4022 	}
4023 
4024 	if (!IS_ERR_OR_NULL(regdb))
4025 		kfree(regdb);
4026 	if (!IS_ERR_OR_NULL(cfg80211_user_regdom))
4027 		kfree(cfg80211_user_regdom);
4028 
4029 	free_regdb_keyring();
4030 }
4031