net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015-2017  Intel Deutschland GmbH
   7  */
   8
   9 #include <linux/if.h>
  10 #include <linux/module.h>
  11 #include <linux/err.h>
  12 #include <linux/slab.h>
  13 #include <linux/list.h>
  14 #include <linux/if_ether.h>
  15 #include <linux/ieee80211.h>
  16 #include <linux/nl80211.h>
  17 #include <linux/rtnetlink.h>
  18 #include <linux/netlink.h>
  19 #include <linux/etherdevice.h>
  20 #include <net/net_namespace.h>
  21 #include <net/genetlink.h>
  22 #include <net/cfg80211.h>
  23 #include <net/sock.h>
  24 #include <net/inet_connection_sock.h>
  25 #include "core.h"
  26 #include "nl80211.h"
  27 #include "reg.h"
  28 #include "rdev-ops.h"
  29
  30 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  31                                    struct genl_info *info,
  32                                    struct cfg80211_crypto_settings *settings,
  33                                    int cipher_limit);
  34
  35 /* the netlink family */
  36 static struct genl_family nl80211_fam;
  37
  38 /* multicast groups */
  39 enum nl80211_multicast_groups {
  40         NL80211_MCGRP_CONFIG,
  41         NL80211_MCGRP_SCAN,
  42         NL80211_MCGRP_REGULATORY,
  43         NL80211_MCGRP_MLME,
  44         NL80211_MCGRP_VENDOR,
  45         NL80211_MCGRP_NAN,
  46         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  47 };
  48
  49 static const struct genl_multicast_group nl80211_mcgrps[] = {
  50         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  51         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  52         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  53         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  54         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  55         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  56 #ifdef CONFIG_NL80211_TESTMODE
  57         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  58 #endif
  59 };
  60
  61 /* returns ERR_PTR values */
  62 static struct wireless_dev *
  63 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  64 {
  65         struct cfg80211_registered_device *rdev;
  66         struct wireless_dev *result = NULL;
  67         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  68         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  69         u64 wdev_id;
  70         int wiphy_idx = -1;
  71         int ifidx = -1;
  72
  73         ASSERT_RTNL();
  74
  75         if (!have_ifidx && !have_wdev_id)
  76                 return ERR_PTR(-EINVAL);
  77
  78         if (have_ifidx)
  79                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  80         if (have_wdev_id) {
  81                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  82                 wiphy_idx = wdev_id >> 32;
  83         }
  84
  85         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  86                 struct wireless_dev *wdev;
  87
  88                 if (wiphy_net(&rdev->wiphy) != netns)
  89                         continue;
  90
  91                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  92                         continue;
  93
  94                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  95                         if (have_ifidx && wdev->netdev &&
  96                             wdev->netdev->ifindex == ifidx) {
  97                                 result = wdev;
  98                                 break;
  99                         }
 100                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 101                                 result = wdev;
 102                                 break;
 103                         }
 104                 }
 105
 106                 if (result)
 107                         break;
 108         }
 109
 110         if (result)
 111                 return result;
 112         return ERR_PTR(-ENODEV);
 113 }
 114
 115 static struct cfg80211_registered_device *
 116 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 117 {
 118         struct cfg80211_registered_device *rdev = NULL, *tmp;
 119         struct net_device *netdev;
 120
 121         ASSERT_RTNL();
 122
 123         if (!attrs[NL80211_ATTR_WIPHY] &&
 124             !attrs[NL80211_ATTR_IFINDEX] &&
 125             !attrs[NL80211_ATTR_WDEV])
 126                 return ERR_PTR(-EINVAL);
 127
 128         if (attrs[NL80211_ATTR_WIPHY])
 129                 rdev = cfg80211_rdev_by_wiphy_idx(
 130                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 131
 132         if (attrs[NL80211_ATTR_WDEV]) {
 133                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 134                 struct wireless_dev *wdev;
 135                 bool found = false;
 136
 137                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 138                 if (tmp) {
 139                         /* make sure wdev exists */
 140                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 141                                 if (wdev->identifier != (u32)wdev_id)
 142                                         continue;
 143                                 found = true;
 144                                 break;
 145                         }
 146
 147                         if (!found)
 148                                 tmp = NULL;
 149
 150                         if (rdev && tmp != rdev)
 151                                 return ERR_PTR(-EINVAL);
 152                         rdev = tmp;
 153                 }
 154         }
 155
 156         if (attrs[NL80211_ATTR_IFINDEX]) {
 157                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 158
 159                 netdev = __dev_get_by_index(netns, ifindex);
 160                 if (netdev) {
 161                         if (netdev->ieee80211_ptr)
 162                                 tmp = wiphy_to_rdev(
 163                                         netdev->ieee80211_ptr->wiphy);
 164                         else
 165                                 tmp = NULL;
 166
 167                         /* not wireless device -- return error */
 168                         if (!tmp)
 169                                 return ERR_PTR(-EINVAL);
 170
 171                         /* mismatch -- return error */
 172                         if (rdev && tmp != rdev)
 173                                 return ERR_PTR(-EINVAL);
 174
 175                         rdev = tmp;
 176                 }
 177         }
 178
 179         if (!rdev)
 180                 return ERR_PTR(-ENODEV);
 181
 182         if (netns != wiphy_net(&rdev->wiphy))
 183                 return ERR_PTR(-ENODEV);
 184
 185         return rdev;
 186 }
 187
 188 /*
 189  * This function returns a pointer to the driver
 190  * that the genl_info item that is passed refers to.
 191  *
 192  * The result of this can be a PTR_ERR and hence must
 193  * be checked with IS_ERR() for errors.
 194  */
 195 static struct cfg80211_registered_device *
 196 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 197 {
 198         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 199 }
 200
 201 /* policy for the attributes */
 202 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 203         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 204         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 205                                       .len = 20-1 },
 206         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 207
 208         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 209         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 210         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 211         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 212         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 213
 214         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 215         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 216         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 217         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 218         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 219         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 220
 221         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 222         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 223         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 224
 225         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 226         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 227
 228         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 229         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 230                                     .len = WLAN_MAX_KEY_LEN },
 231         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 232         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 233         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 234         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 235         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 236
 237         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 238         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 239         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 240                                        .len = IEEE80211_MAX_DATA_LEN },
 241         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 242                                        .len = IEEE80211_MAX_DATA_LEN },
 243         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 244         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 245         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 246         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 247                                                .len = NL80211_MAX_SUPP_RATES },
 248         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 249         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 250         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 251         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 252                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 253         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 254
 255         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 256         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 257
 258         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 259         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 260         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 261         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 262                                            .len = NL80211_MAX_SUPP_RATES },
 263         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 264
 265         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 266         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 267
 268         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 269
 270         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 271         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 272                               .len = IEEE80211_MAX_DATA_LEN },
 273         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 274         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 275
 276         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 277                                 .len = IEEE80211_MAX_SSID_LEN },
 278         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 279         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 280         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 281         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 282         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 283         [NL80211_ATTR_STA_FLAGS2] = {
 284                 .len = sizeof(struct nl80211_sta_flag_update),
 285         },
 286         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 287         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 288         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 289         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 290         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 291         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 292         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 293         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 294         [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
 295         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 296         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 297         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 298         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 299                                  .len = IEEE80211_MAX_DATA_LEN },
 300         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 301         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 302         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 303         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 304         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 305         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 306         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 307         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 308         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 309         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 310         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 311         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 312         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 313         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 314         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 315         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 316         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 317         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 318         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 319         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 320                                          .len = IEEE80211_MAX_DATA_LEN },
 321         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 322                                          .len = IEEE80211_MAX_DATA_LEN },
 323         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 324         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 325         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 326         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 327         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 328         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 329         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 330         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 331         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 332         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 333         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 334                                       .len = IEEE80211_MAX_DATA_LEN },
 335         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 336         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 337         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 338                 .len = NL80211_HT_CAPABILITY_LEN
 339         },
 340         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 341         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 342         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 343         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 344         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 345         [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
 346         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 347         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 348         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 349         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 350         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 },
 351         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 352         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 353         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 354         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 355         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 356         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 357         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 358                 .len = NL80211_VHT_CAPABILITY_LEN,
 359         },
 360         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 361         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 362                                   .len = IEEE80211_MAX_DATA_LEN },
 363         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 364         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 365         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 366         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 367         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 368         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 369         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 370         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 371         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 372         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 373         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 374         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 375         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 376         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 377                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 378         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 379         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 380         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 381         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 382         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 383         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 384         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 385         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 386         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 387         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 388         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 389         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 390         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 391         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 392         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 393         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 394         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 395         [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
 396         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 397                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 398         },
 399         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
 400         [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
 401         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 402         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 403         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 404                                     .len = FILS_MAX_KEK_LEN },
 405         [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN },
 406         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 407         [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
 408         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 409         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 410                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 411         },
 412         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 413         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 414                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 415         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 416                                           .len = FILS_ERP_MAX_REALM_LEN },
 417         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 418         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 419                                         .len = FILS_ERP_MAX_RRK_LEN },
 420         [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
 421         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 422         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 423 };
 424
 425 /* policy for the key attributes */
 426 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 427         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 428         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 429         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 430         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 431         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 432         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 433         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 434         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 435 };
 436
 437 /* policy for the key default flags */
 438 static const struct nla_policy
 439 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 440         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 441         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 442 };
 443
 444 #ifdef CONFIG_PM
 445 /* policy for WoWLAN attributes */
 446 static const struct nla_policy
 447 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 448         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 449         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 450         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 451         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 452         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 453         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 454         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 455         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 456         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 457         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 458 };
 459
 460 static const struct nla_policy
 461 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 462         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 463         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 464         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 465         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 466         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 467         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 468         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 469                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 470         },
 471         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 472                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 473         },
 474         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 475         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 476         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 477 };
 478 #endif /* CONFIG_PM */
 479
 480 /* policy for coalesce rule attributes */
 481 static const struct nla_policy
 482 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 483         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 484         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 485         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 486 };
 487
 488 /* policy for GTK rekey offload attributes */
 489 static const struct nla_policy
 490 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 491         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 492         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 493         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 494 };
 495
 496 static const struct nla_policy
 497 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 498         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 499                                                  .len = IEEE80211_MAX_SSID_LEN },
 500         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN },
 501         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 502 };
 503
 504 static const struct nla_policy
 505 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 506         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 507         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 508 };
 509
 510 static const struct nla_policy
 511 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 512         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 513         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 514         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 515                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 516         },
 517 };
 518
 519 /* policy for NAN function attributes */
 520 static const struct nla_policy
 521 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 522         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 523         [NL80211_NAN_FUNC_SERVICE_ID] = {
 524                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 525         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 526         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 527         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 528         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 529         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 530         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
 531         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 532         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 533         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 534                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 535         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 536         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 537         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 538         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 539         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 540 };
 541
 542 /* policy for Service Response Filter attributes */
 543 static const struct nla_policy
 544 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 545         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 546         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 547                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 548         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 549         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 550 };
 551
 552 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 553                                      struct netlink_callback *cb,
 554                                      struct cfg80211_registered_device **rdev,
 555                                      struct wireless_dev **wdev)
 556 {
 557         int err;
 558
 559         if (!cb->args[0]) {
 560                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 561                                   genl_family_attrbuf(&nl80211_fam),
 562                                   nl80211_fam.maxattr, nl80211_policy, NULL);
 563                 if (err)
 564                         return err;
 565
 566                 *wdev = __cfg80211_wdev_from_attrs(
 567                                         sock_net(skb->sk),
 568                                         genl_family_attrbuf(&nl80211_fam));
 569                 if (IS_ERR(*wdev))
 570                         return PTR_ERR(*wdev);
 571                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 572                 /* 0 is the first index - add 1 to parse only once */
 573                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 574                 cb->args[1] = (*wdev)->identifier;
 575         } else {
 576                 /* subtract the 1 again here */
 577                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 578                 struct wireless_dev *tmp;
 579
 580                 if (!wiphy)
 581                         return -ENODEV;
 582                 *rdev = wiphy_to_rdev(wiphy);
 583                 *wdev = NULL;
 584
 585                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 586                         if (tmp->identifier == cb->args[1]) {
 587                                 *wdev = tmp;
 588                                 break;
 589                         }
 590                 }
 591
 592                 if (!*wdev)
 593                         return -ENODEV;
 594         }
 595
 596         return 0;
 597 }
 598
 599 /* IE validation */
 600 static bool is_valid_ie_attr(const struct nlattr *attr)
 601 {
 602         const u8 *pos;
 603         int len;
 604
 605         if (!attr)
 606                 return true;
 607
 608         pos = nla_data(attr);
 609         len = nla_len(attr);
 610
 611         while (len) {
 612                 u8 elemlen;
 613
 614                 if (len < 2)
 615                         return false;
 616                 len -= 2;
 617
 618                 elemlen = pos[1];
 619                 if (elemlen > len)
 620                         return false;
 621
 622                 len -= elemlen;
 623                 pos += 2 + elemlen;
 624         }
 625
 626         return true;
 627 }
 628
 629 /* message building helper */
 630 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 631                                    int flags, u8 cmd)
 632 {
 633         /* since there is no private header just add the generic one */
 634         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 635 }
 636
 637 static int nl80211_msg_put_channel(struct sk_buff *msg,
 638                                    struct ieee80211_channel *chan,
 639                                    bool large)
 640 {
 641         /* Some channels must be completely excluded from the
 642          * list to protect old user-space tools from breaking
 643          */
 644         if (!large && chan->flags &
 645             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 646                 return 0;
 647
 648         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 649                         chan->center_freq))
 650                 goto nla_put_failure;
 651
 652         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 653             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 654                 goto nla_put_failure;
 655         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 656                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 657                         goto nla_put_failure;
 658                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 659                         goto nla_put_failure;
 660         }
 661         if (chan->flags & IEEE80211_CHAN_RADAR) {
 662                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 663                         goto nla_put_failure;
 664                 if (large) {
 665                         u32 time;
 666
 667                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 668
 669                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 670                                         chan->dfs_state))
 671                                 goto nla_put_failure;
 672                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 673                                         time))
 674                                 goto nla_put_failure;
 675                         if (nla_put_u32(msg,
 676                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 677                                         chan->dfs_cac_ms))
 678                                 goto nla_put_failure;
 679                 }
 680         }
 681
 682         if (large) {
 683                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 684                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 685                         goto nla_put_failure;
 686                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 687                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 688                         goto nla_put_failure;
 689                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 690                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 691                         goto nla_put_failure;
 692                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 693                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 694                         goto nla_put_failure;
 695                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 696                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 697                         goto nla_put_failure;
 698                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 699                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 700                         goto nla_put_failure;
 701                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 702                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 703                         goto nla_put_failure;
 704                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 705                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 706                         goto nla_put_failure;
 707         }
 708
 709         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 710                         DBM_TO_MBM(chan->max_power)))
 711                 goto nla_put_failure;
 712
 713         return 0;
 714
 715  nla_put_failure:
 716         return -ENOBUFS;
 717 }
 718
 719 /* netlink command implementations */
 720
 721 struct key_parse {
 722         struct key_params p;
 723         int idx;
 724         int type;
 725         bool def, defmgmt;
 726         bool def_uni, def_multi;
 727 };
 728
 729 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 730 {
 731         struct nlattr *tb[NL80211_KEY_MAX + 1];
 732         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 733                                    nl80211_key_policy, NULL);
 734         if (err)
 735                 return err;
 736
 737         k->def = !!tb[NL80211_KEY_DEFAULT];
 738         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 739
 740         if (k->def) {
 741                 k->def_uni = true;
 742                 k->def_multi = true;
 743         }
 744         if (k->defmgmt)
 745                 k->def_multi = true;
 746
 747         if (tb[NL80211_KEY_IDX])
 748                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 749
 750         if (tb[NL80211_KEY_DATA]) {
 751                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 752                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 753         }
 754
 755         if (tb[NL80211_KEY_SEQ]) {
 756                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 757                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 758         }
 759
 760         if (tb[NL80211_KEY_CIPHER])
 761                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 762
 763         if (tb[NL80211_KEY_TYPE]) {
 764                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 765                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 766                         return -EINVAL;
 767         }
 768
 769         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 770                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 771
 772                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 773                                        tb[NL80211_KEY_DEFAULT_TYPES],
 774                                        nl80211_key_default_policy, NULL);
 775                 if (err)
 776                         return err;
 777
 778                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 779                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 780         }
 781
 782         return 0;
 783 }
 784
 785 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 786 {
 787         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 788                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 789                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 790         }
 791
 792         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 793                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 794                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 795         }
 796
 797         if (info->attrs[NL80211_ATTR_KEY_IDX])
 798                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 799
 800         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 801                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 802
 803         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 804         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 805
 806         if (k->def) {
 807                 k->def_uni = true;
 808                 k->def_multi = true;
 809         }
 810         if (k->defmgmt)
 811                 k->def_multi = true;
 812
 813         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 814                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 815                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 816                         return -EINVAL;
 817         }
 818
 819         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 820                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 821                 int err = nla_parse_nested(kdt,
 822                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 823                                            info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 824                                            nl80211_key_default_policy,
 825                                            info->extack);
 826                 if (err)
 827                         return err;
 828
 829                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 830                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 831         }
 832
 833         return 0;
 834 }
 835
 836 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 837 {
 838         int err;
 839
 840         memset(k, 0, sizeof(*k));
 841         k->idx = -1;
 842         k->type = -1;
 843
 844         if (info->attrs[NL80211_ATTR_KEY])
 845                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 846         else
 847                 err = nl80211_parse_key_old(info, k);
 848
 849         if (err)
 850                 return err;
 851
 852         if (k->def && k->defmgmt)
 853                 return -EINVAL;
 854
 855         if (k->defmgmt) {
 856                 if (k->def_uni || !k->def_multi)
 857                         return -EINVAL;
 858         }
 859
 860         if (k->idx != -1) {
 861                 if (k->defmgmt) {
 862                         if (k->idx < 4 || k->idx > 5)
 863                                 return -EINVAL;
 864                 } else if (k->def) {
 865                         if (k->idx < 0 || k->idx > 3)
 866                                 return -EINVAL;
 867                 } else {
 868                         if (k->idx < 0 || k->idx > 5)
 869                                 return -EINVAL;
 870                 }
 871         }
 872
 873         return 0;
 874 }
 875
 876 static struct cfg80211_cached_keys *
 877 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 878                        struct nlattr *keys, bool *no_ht)
 879 {
 880         struct key_parse parse;
 881         struct nlattr *key;
 882         struct cfg80211_cached_keys *result;
 883         int rem, err, def = 0;
 884         bool have_key = false;
 885
 886         nla_for_each_nested(key, keys, rem) {
 887                 have_key = true;
 888                 break;
 889         }
 890
 891         if (!have_key)
 892                 return NULL;
 893
 894         result = kzalloc(sizeof(*result), GFP_KERNEL);
 895         if (!result)
 896                 return ERR_PTR(-ENOMEM);
 897
 898         result->def = -1;
 899
 900         nla_for_each_nested(key, keys, rem) {
 901                 memset(&parse, 0, sizeof(parse));
 902                 parse.idx = -1;
 903
 904                 err = nl80211_parse_key_new(key, &parse);
 905                 if (err)
 906                         goto error;
 907                 err = -EINVAL;
 908                 if (!parse.p.key)
 909                         goto error;
 910                 if (parse.idx < 0 || parse.idx > 3)
 911                         goto error;
 912                 if (parse.def) {
 913                         if (def)
 914                                 goto error;
 915                         def = 1;
 916                         result->def = parse.idx;
 917                         if (!parse.def_uni || !parse.def_multi)
 918                                 goto error;
 919                 } else if (parse.defmgmt)
 920                         goto error;
 921                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 922                                                      parse.idx, false, NULL);
 923                 if (err)
 924                         goto error;
 925                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
 926                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
 927                         err = -EINVAL;
 928                         goto error;
 929                 }
 930                 result->params[parse.idx].cipher = parse.p.cipher;
 931                 result->params[parse.idx].key_len = parse.p.key_len;
 932                 result->params[parse.idx].key = result->data[parse.idx];
 933                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 934
 935                 /* must be WEP key if we got here */
 936                 if (no_ht)
 937                         *no_ht = true;
 938         }
 939
 940         if (result->def < 0) {
 941                 err = -EINVAL;
 942                 goto error;
 943         }
 944
 945         return result;
 946  error:
 947         kfree(result);
 948         return ERR_PTR(err);
 949 }
 950
 951 static int nl80211_key_allowed(struct wireless_dev *wdev)
 952 {
 953         ASSERT_WDEV_LOCK(wdev);
 954
 955         switch (wdev->iftype) {
 956         case NL80211_IFTYPE_AP:
 957         case NL80211_IFTYPE_AP_VLAN:
 958         case NL80211_IFTYPE_P2P_GO:
 959         case NL80211_IFTYPE_MESH_POINT:
 960                 break;
 961         case NL80211_IFTYPE_ADHOC:
 962         case NL80211_IFTYPE_STATION:
 963         case NL80211_IFTYPE_P2P_CLIENT:
 964                 if (!wdev->current_bss)
 965                         return -ENOLINK;
 966                 break;
 967         case NL80211_IFTYPE_UNSPECIFIED:
 968         case NL80211_IFTYPE_OCB:
 969         case NL80211_IFTYPE_MONITOR:
 970         case NL80211_IFTYPE_NAN:
 971         case NL80211_IFTYPE_P2P_DEVICE:
 972         case NL80211_IFTYPE_WDS:
 973         case NUM_NL80211_IFTYPES:
 974                 return -EINVAL;
 975         }
 976
 977         return 0;
 978 }
 979
 980 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 981                                                         struct nlattr *tb)
 982 {
 983         struct ieee80211_channel *chan;
 984
 985         if (tb == NULL)
 986                 return NULL;
 987         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 988         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 989                 return NULL;
 990         return chan;
 991 }
 992
 993 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 994 {
 995         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 996         int i;
 997
 998         if (!nl_modes)
 999                 goto nla_put_failure;
1000
1001         i = 0;
1002         while (ifmodes) {
1003                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1004                         goto nla_put_failure;
1005                 ifmodes >>= 1;
1006                 i++;
1007         }
1008
1009         nla_nest_end(msg, nl_modes);
1010         return 0;
1011
1012 nla_put_failure:
1013         return -ENOBUFS;
1014 }
1015
1016 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1017                                           struct sk_buff *msg,
1018                                           bool large)
1019 {
1020         struct nlattr *nl_combis;
1021         int i, j;
1022
1023         nl_combis = nla_nest_start(msg,
1024                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
1025         if (!nl_combis)
1026                 goto nla_put_failure;
1027
1028         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1029                 const struct ieee80211_iface_combination *c;
1030                 struct nlattr *nl_combi, *nl_limits;
1031
1032                 c = &wiphy->iface_combinations[i];
1033
1034                 nl_combi = nla_nest_start(msg, i + 1);
1035                 if (!nl_combi)
1036                         goto nla_put_failure;
1037
1038                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1039                 if (!nl_limits)
1040                         goto nla_put_failure;
1041
1042                 for (j = 0; j < c->n_limits; j++) {
1043                         struct nlattr *nl_limit;
1044
1045                         nl_limit = nla_nest_start(msg, j + 1);
1046                         if (!nl_limit)
1047                                 goto nla_put_failure;
1048                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1049                                         c->limits[j].max))
1050                                 goto nla_put_failure;
1051                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1052                                                 c->limits[j].types))
1053                                 goto nla_put_failure;
1054                         nla_nest_end(msg, nl_limit);
1055                 }
1056
1057                 nla_nest_end(msg, nl_limits);
1058
1059                 if (c->beacon_int_infra_match &&
1060                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1061                         goto nla_put_failure;
1062                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1063                                 c->num_different_channels) ||
1064                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1065                                 c->max_interfaces))
1066                         goto nla_put_failure;
1067                 if (large &&
1068                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1069                                 c->radar_detect_widths) ||
1070                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1071                                 c->radar_detect_regions)))
1072                         goto nla_put_failure;
1073                 if (c->beacon_int_min_gcd &&
1074                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1075                                 c->beacon_int_min_gcd))
1076                         goto nla_put_failure;
1077
1078                 nla_nest_end(msg, nl_combi);
1079         }
1080
1081         nla_nest_end(msg, nl_combis);
1082
1083         return 0;
1084 nla_put_failure:
1085         return -ENOBUFS;
1086 }
1087
1088 #ifdef CONFIG_PM
1089 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1090                                         struct sk_buff *msg)
1091 {
1092         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1093         struct nlattr *nl_tcp;
1094
1095         if (!tcp)
1096                 return 0;
1097
1098         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1099         if (!nl_tcp)
1100                 return -ENOBUFS;
1101
1102         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1103                         tcp->data_payload_max))
1104                 return -ENOBUFS;
1105
1106         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1107                         tcp->data_payload_max))
1108                 return -ENOBUFS;
1109
1110         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1111                 return -ENOBUFS;
1112
1113         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1114                                 sizeof(*tcp->tok), tcp->tok))
1115                 return -ENOBUFS;
1116
1117         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1118                         tcp->data_interval_max))
1119                 return -ENOBUFS;
1120
1121         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1122                         tcp->wake_payload_max))
1123                 return -ENOBUFS;
1124
1125         nla_nest_end(msg, nl_tcp);
1126         return 0;
1127 }
1128
1129 static int nl80211_send_wowlan(struct sk_buff *msg,
1130                                struct cfg80211_registered_device *rdev,
1131                                bool large)
1132 {
1133         struct nlattr *nl_wowlan;
1134
1135         if (!rdev->wiphy.wowlan)
1136                 return 0;
1137
1138         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1139         if (!nl_wowlan)
1140                 return -ENOBUFS;
1141
1142         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1143              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1144             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1145              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1146             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1147              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1148             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1149              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1150             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1151              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1152             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1153              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1154             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1155              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1156             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1157              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1158                 return -ENOBUFS;
1159
1160         if (rdev->wiphy.wowlan->n_patterns) {
1161                 struct nl80211_pattern_support pat = {
1162                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1163                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1164                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1165                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1166                 };
1167
1168                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1169                             sizeof(pat), &pat))
1170                         return -ENOBUFS;
1171         }
1172
1173         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1174             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1175                         rdev->wiphy.wowlan->max_nd_match_sets))
1176                 return -ENOBUFS;
1177
1178         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1179                 return -ENOBUFS;
1180
1181         nla_nest_end(msg, nl_wowlan);
1182
1183         return 0;
1184 }
1185 #endif
1186
1187 static int nl80211_send_coalesce(struct sk_buff *msg,
1188                                  struct cfg80211_registered_device *rdev)
1189 {
1190         struct nl80211_coalesce_rule_support rule;
1191
1192         if (!rdev->wiphy.coalesce)
1193                 return 0;
1194
1195         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1196         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1197         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1198         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1199         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1200         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1201
1202         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1203                 return -ENOBUFS;
1204
1205         return 0;
1206 }
1207
1208 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1209                                       struct ieee80211_supported_band *sband)
1210 {
1211         struct nlattr *nl_rates, *nl_rate;
1212         struct ieee80211_rate *rate;
1213         int i;
1214
1215         /* add HT info */
1216         if (sband->ht_cap.ht_supported &&
1217             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1218                      sizeof(sband->ht_cap.mcs),
1219                      &sband->ht_cap.mcs) ||
1220              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1221                          sband->ht_cap.cap) ||
1222              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1223                         sband->ht_cap.ampdu_factor) ||
1224              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1225                         sband->ht_cap.ampdu_density)))
1226                 return -ENOBUFS;
1227
1228         /* add VHT info */
1229         if (sband->vht_cap.vht_supported &&
1230             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1231                      sizeof(sband->vht_cap.vht_mcs),
1232                      &sband->vht_cap.vht_mcs) ||
1233              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1234                          sband->vht_cap.cap)))
1235                 return -ENOBUFS;
1236
1237         /* add bitrates */
1238         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1239         if (!nl_rates)
1240                 return -ENOBUFS;
1241
1242         for (i = 0; i < sband->n_bitrates; i++) {
1243                 nl_rate = nla_nest_start(msg, i);
1244                 if (!nl_rate)
1245                         return -ENOBUFS;
1246
1247                 rate = &sband->bitrates[i];
1248                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1249                                 rate->bitrate))
1250                         return -ENOBUFS;
1251                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1252                     nla_put_flag(msg,
1253                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1254                         return -ENOBUFS;
1255
1256                 nla_nest_end(msg, nl_rate);
1257         }
1258
1259         nla_nest_end(msg, nl_rates);
1260
1261         return 0;
1262 }
1263
1264 static int
1265 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1266                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1267 {
1268         u16 stypes;
1269         struct nlattr *nl_ftypes, *nl_ifs;
1270         enum nl80211_iftype ift;
1271         int i;
1272
1273         if (!mgmt_stypes)
1274                 return 0;
1275
1276         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1277         if (!nl_ifs)
1278                 return -ENOBUFS;
1279
1280         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1281                 nl_ftypes = nla_nest_start(msg, ift);
1282                 if (!nl_ftypes)
1283                         return -ENOBUFS;
1284                 i = 0;
1285                 stypes = mgmt_stypes[ift].tx;
1286                 while (stypes) {
1287                         if ((stypes & 1) &&
1288                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1289                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1290                                 return -ENOBUFS;
1291                         stypes >>= 1;
1292                         i++;
1293                 }
1294                 nla_nest_end(msg, nl_ftypes);
1295         }
1296
1297         nla_nest_end(msg, nl_ifs);
1298
1299         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1300         if (!nl_ifs)
1301                 return -ENOBUFS;
1302
1303         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1304                 nl_ftypes = nla_nest_start(msg, ift);
1305                 if (!nl_ftypes)
1306                         return -ENOBUFS;
1307                 i = 0;
1308                 stypes = mgmt_stypes[ift].rx;
1309                 while (stypes) {
1310                         if ((stypes & 1) &&
1311                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1312                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1313                                 return -ENOBUFS;
1314                         stypes >>= 1;
1315                         i++;
1316                 }
1317                 nla_nest_end(msg, nl_ftypes);
1318         }
1319         nla_nest_end(msg, nl_ifs);
1320
1321         return 0;
1322 }
1323
1324 #define CMD(op, n)                                                      \
1325          do {                                                           \
1326                 if (rdev->ops->op) {                                    \
1327                         i++;                                            \
1328                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1329                                 goto nla_put_failure;                   \
1330                 }                                                       \
1331         } while (0)
1332
1333 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1334                                         struct sk_buff *msg)
1335 {
1336         int i = 0;
1337
1338         /*
1339          * do *NOT* add anything into this function, new things need to be
1340          * advertised only to new versions of userspace that can deal with
1341          * the split (and they can't possibly care about new features...
1342          */
1343         CMD(add_virtual_intf, NEW_INTERFACE);
1344         CMD(change_virtual_intf, SET_INTERFACE);
1345         CMD(add_key, NEW_KEY);
1346         CMD(start_ap, START_AP);
1347         CMD(add_station, NEW_STATION);
1348         CMD(add_mpath, NEW_MPATH);
1349         CMD(update_mesh_config, SET_MESH_CONFIG);
1350         CMD(change_bss, SET_BSS);
1351         CMD(auth, AUTHENTICATE);
1352         CMD(assoc, ASSOCIATE);
1353         CMD(deauth, DEAUTHENTICATE);
1354         CMD(disassoc, DISASSOCIATE);
1355         CMD(join_ibss, JOIN_IBSS);
1356         CMD(join_mesh, JOIN_MESH);
1357         CMD(set_pmksa, SET_PMKSA);
1358         CMD(del_pmksa, DEL_PMKSA);
1359         CMD(flush_pmksa, FLUSH_PMKSA);
1360         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1361                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1362         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1363         CMD(mgmt_tx, FRAME);
1364         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1365         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1366                 i++;
1367                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1368                         goto nla_put_failure;
1369         }
1370         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1371             rdev->ops->join_mesh) {
1372                 i++;
1373                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1374                         goto nla_put_failure;
1375         }
1376         CMD(set_wds_peer, SET_WDS_PEER);
1377         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1378                 CMD(tdls_mgmt, TDLS_MGMT);
1379                 CMD(tdls_oper, TDLS_OPER);
1380         }
1381         if (rdev->wiphy.max_sched_scan_reqs)
1382                 CMD(sched_scan_start, START_SCHED_SCAN);
1383         CMD(probe_client, PROBE_CLIENT);
1384         CMD(set_noack_map, SET_NOACK_MAP);
1385         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1386                 i++;
1387                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1388                         goto nla_put_failure;
1389         }
1390         CMD(start_p2p_device, START_P2P_DEVICE);
1391         CMD(set_mcast_rate, SET_MCAST_RATE);
1392 #ifdef CONFIG_NL80211_TESTMODE
1393         CMD(testmode_cmd, TESTMODE);
1394 #endif
1395
1396         if (rdev->ops->connect || rdev->ops->auth) {
1397                 i++;
1398                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1399                         goto nla_put_failure;
1400         }
1401
1402         if (rdev->ops->disconnect || rdev->ops->deauth) {
1403                 i++;
1404                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1405                         goto nla_put_failure;
1406         }
1407
1408         return i;
1409  nla_put_failure:
1410         return -ENOBUFS;
1411 }
1412
1413 struct nl80211_dump_wiphy_state {
1414         s64 filter_wiphy;
1415         long start;
1416         long split_start, band_start, chan_start, capa_start;
1417         bool split;
1418 };
1419
1420 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1421                               enum nl80211_commands cmd,
1422                               struct sk_buff *msg, u32 portid, u32 seq,
1423                               int flags, struct nl80211_dump_wiphy_state *state)
1424 {
1425         void *hdr;
1426         struct nlattr *nl_bands, *nl_band;
1427         struct nlattr *nl_freqs, *nl_freq;
1428         struct nlattr *nl_cmds;
1429         enum nl80211_band band;
1430         struct ieee80211_channel *chan;
1431         int i;
1432         const struct ieee80211_txrx_stypes *mgmt_stypes =
1433                                 rdev->wiphy.mgmt_stypes;
1434         u32 features;
1435
1436         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1437         if (!hdr)
1438                 return -ENOBUFS;
1439
1440         if (WARN_ON(!state))
1441                 return -EINVAL;
1442
1443         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1444             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1445                            wiphy_name(&rdev->wiphy)) ||
1446             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1447                         cfg80211_rdev_list_generation))
1448                 goto nla_put_failure;
1449
1450         if (cmd != NL80211_CMD_NEW_WIPHY)
1451                 goto finish;
1452
1453         switch (state->split_start) {
1454         case 0:
1455                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1456                                rdev->wiphy.retry_short) ||
1457                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1458                                rdev->wiphy.retry_long) ||
1459                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1460                                 rdev->wiphy.frag_threshold) ||
1461                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1462                                 rdev->wiphy.rts_threshold) ||
1463                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1464                                rdev->wiphy.coverage_class) ||
1465                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1466                                rdev->wiphy.max_scan_ssids) ||
1467                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1468                                rdev->wiphy.max_sched_scan_ssids) ||
1469                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1470                                 rdev->wiphy.max_scan_ie_len) ||
1471                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1472                                 rdev->wiphy.max_sched_scan_ie_len) ||
1473                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1474                                rdev->wiphy.max_match_sets) ||
1475                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1476                                 rdev->wiphy.max_sched_scan_plans) ||
1477                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1478                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1479                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1480                                 rdev->wiphy.max_sched_scan_plan_iterations))
1481                         goto nla_put_failure;
1482
1483                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1484                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1485                         goto nla_put_failure;
1486                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1487                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1488                         goto nla_put_failure;
1489                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1490                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1491                         goto nla_put_failure;
1492                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1493                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1494                         goto nla_put_failure;
1495                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1496                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1497                         goto nla_put_failure;
1498                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1499                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1500                         goto nla_put_failure;
1501                 state->split_start++;
1502                 if (state->split)
1503                         break;
1504         case 1:
1505                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1506                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1507                             rdev->wiphy.cipher_suites))
1508                         goto nla_put_failure;
1509
1510                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1511                                rdev->wiphy.max_num_pmkids))
1512                         goto nla_put_failure;
1513
1514                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1515                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1516                         goto nla_put_failure;
1517
1518                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1519                                 rdev->wiphy.available_antennas_tx) ||
1520                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1521                                 rdev->wiphy.available_antennas_rx))
1522                         goto nla_put_failure;
1523
1524                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1525                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1526                                 rdev->wiphy.probe_resp_offload))
1527                         goto nla_put_failure;
1528
1529                 if ((rdev->wiphy.available_antennas_tx ||
1530                      rdev->wiphy.available_antennas_rx) &&
1531                     rdev->ops->get_antenna) {
1532                         u32 tx_ant = 0, rx_ant = 0;
1533                         int res;
1534
1535                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1536                         if (!res) {
1537                                 if (nla_put_u32(msg,
1538                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1539                                                 tx_ant) ||
1540                                     nla_put_u32(msg,
1541                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1542                                                 rx_ant))
1543                                         goto nla_put_failure;
1544                         }
1545                 }
1546
1547                 state->split_start++;
1548                 if (state->split)
1549                         break;
1550         case 2:
1551                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1552                                         rdev->wiphy.interface_modes))
1553                                 goto nla_put_failure;
1554                 state->split_start++;
1555                 if (state->split)
1556                         break;
1557         case 3:
1558                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1559                 if (!nl_bands)
1560                         goto nla_put_failure;
1561
1562                 for (band = state->band_start;
1563                      band < NUM_NL80211_BANDS; band++) {
1564                         struct ieee80211_supported_band *sband;
1565
1566                         sband = rdev->wiphy.bands[band];
1567
1568                         if (!sband)
1569                                 continue;
1570
1571                         nl_band = nla_nest_start(msg, band);
1572                         if (!nl_band)
1573                                 goto nla_put_failure;
1574
1575                         switch (state->chan_start) {
1576                         case 0:
1577                                 if (nl80211_send_band_rateinfo(msg, sband))
1578                                         goto nla_put_failure;
1579                                 state->chan_start++;
1580                                 if (state->split)
1581                                         break;
1582                         default:
1583                                 /* add frequencies */
1584                                 nl_freqs = nla_nest_start(
1585                                         msg, NL80211_BAND_ATTR_FREQS);
1586                                 if (!nl_freqs)
1587                                         goto nla_put_failure;
1588
1589                                 for (i = state->chan_start - 1;
1590                                      i < sband->n_channels;
1591                                      i++) {
1592                                         nl_freq = nla_nest_start(msg, i);
1593                                         if (!nl_freq)
1594                                                 goto nla_put_failure;
1595
1596                                         chan = &sband->channels[i];
1597
1598                                         if (nl80211_msg_put_channel(
1599                                                         msg, chan,
1600                                                         state->split))
1601                                                 goto nla_put_failure;
1602
1603                                         nla_nest_end(msg, nl_freq);
1604                                         if (state->split)
1605                                                 break;
1606                                 }
1607                                 if (i < sband->n_channels)
1608                                         state->chan_start = i + 2;
1609                                 else
1610                                         state->chan_start = 0;
1611                                 nla_nest_end(msg, nl_freqs);
1612                         }
1613
1614                         nla_nest_end(msg, nl_band);
1615
1616                         if (state->split) {
1617                                 /* start again here */
1618                                 if (state->chan_start)
1619                                         band--;
1620                                 break;
1621                         }
1622                 }
1623                 nla_nest_end(msg, nl_bands);
1624
1625                 if (band < NUM_NL80211_BANDS)
1626                         state->band_start = band + 1;
1627                 else
1628                         state->band_start = 0;
1629
1630                 /* if bands & channels are done, continue outside */
1631                 if (state->band_start == 0 && state->chan_start == 0)
1632                         state->split_start++;
1633                 if (state->split)
1634                         break;
1635         case 4:
1636                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1637                 if (!nl_cmds)
1638                         goto nla_put_failure;
1639
1640                 i = nl80211_add_commands_unsplit(rdev, msg);
1641                 if (i < 0)
1642                         goto nla_put_failure;
1643                 if (state->split) {
1644                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1645                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1646                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1647                                 CMD(channel_switch, CHANNEL_SWITCH);
1648                         CMD(set_qos_map, SET_QOS_MAP);
1649                         if (rdev->wiphy.features &
1650                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1651                                 CMD(add_tx_ts, ADD_TX_TS);
1652                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
1653                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
1654                 }
1655 #undef CMD
1656
1657                 nla_nest_end(msg, nl_cmds);
1658                 state->split_start++;
1659                 if (state->split)
1660                         break;
1661         case 5:
1662                 if (rdev->ops->remain_on_channel &&
1663                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1664                     nla_put_u32(msg,
1665                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1666                                 rdev->wiphy.max_remain_on_channel_duration))
1667                         goto nla_put_failure;
1668
1669                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1670                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1671                         goto nla_put_failure;
1672
1673                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1674                         goto nla_put_failure;
1675                 state->split_start++;
1676                 if (state->split)
1677                         break;
1678         case 6:
1679 #ifdef CONFIG_PM
1680                 if (nl80211_send_wowlan(msg, rdev, state->split))
1681                         goto nla_put_failure;
1682                 state->split_start++;
1683                 if (state->split)
1684                         break;
1685 #else
1686                 state->split_start++;
1687 #endif
1688         case 7:
1689                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1690                                         rdev->wiphy.software_iftypes))
1691                         goto nla_put_failure;
1692
1693                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1694                                                    state->split))
1695                         goto nla_put_failure;
1696
1697                 state->split_start++;
1698                 if (state->split)
1699                         break;
1700         case 8:
1701                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1702                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1703                                 rdev->wiphy.ap_sme_capa))
1704                         goto nla_put_failure;
1705
1706                 features = rdev->wiphy.features;
1707                 /*
1708                  * We can only add the per-channel limit information if the
1709                  * dump is split, otherwise it makes it too big. Therefore
1710                  * only advertise it in that case.
1711                  */
1712                 if (state->split)
1713                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1714                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1715                         goto nla_put_failure;
1716
1717                 if (rdev->wiphy.ht_capa_mod_mask &&
1718                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1719                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1720                             rdev->wiphy.ht_capa_mod_mask))
1721                         goto nla_put_failure;
1722
1723                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1724                     rdev->wiphy.max_acl_mac_addrs &&
1725                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1726                                 rdev->wiphy.max_acl_mac_addrs))
1727                         goto nla_put_failure;
1728
1729                 /*
1730                  * Any information below this point is only available to
1731                  * applications that can deal with it being split. This
1732                  * helps ensure that newly added capabilities don't break
1733                  * older tools by overrunning their buffers.
1734                  *
1735                  * We still increment split_start so that in the split
1736                  * case we'll continue with more data in the next round,
1737                  * but break unconditionally so unsplit data stops here.
1738                  */
1739                 state->split_start++;
1740                 break;
1741         case 9:
1742                 if (rdev->wiphy.extended_capabilities &&
1743                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1744                              rdev->wiphy.extended_capabilities_len,
1745                              rdev->wiphy.extended_capabilities) ||
1746                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1747                              rdev->wiphy.extended_capabilities_len,
1748                              rdev->wiphy.extended_capabilities_mask)))
1749                         goto nla_put_failure;
1750
1751                 if (rdev->wiphy.vht_capa_mod_mask &&
1752                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1753                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1754                             rdev->wiphy.vht_capa_mod_mask))
1755                         goto nla_put_failure;
1756
1757                 state->split_start++;
1758                 break;
1759         case 10:
1760                 if (nl80211_send_coalesce(msg, rdev))
1761                         goto nla_put_failure;
1762
1763                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1764                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1765                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1766                         goto nla_put_failure;
1767
1768                 if (rdev->wiphy.max_ap_assoc_sta &&
1769                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1770                                 rdev->wiphy.max_ap_assoc_sta))
1771                         goto nla_put_failure;
1772
1773                 state->split_start++;
1774                 break;
1775         case 11:
1776                 if (rdev->wiphy.n_vendor_commands) {
1777                         const struct nl80211_vendor_cmd_info *info;
1778                         struct nlattr *nested;
1779
1780                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1781                         if (!nested)
1782                                 goto nla_put_failure;
1783
1784                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1785                                 info = &rdev->wiphy.vendor_commands[i].info;
1786                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1787                                         goto nla_put_failure;
1788                         }
1789                         nla_nest_end(msg, nested);
1790                 }
1791
1792                 if (rdev->wiphy.n_vendor_events) {
1793                         const struct nl80211_vendor_cmd_info *info;
1794                         struct nlattr *nested;
1795
1796                         nested = nla_nest_start(msg,
1797                                                 NL80211_ATTR_VENDOR_EVENTS);
1798                         if (!nested)
1799                                 goto nla_put_failure;
1800
1801                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1802                                 info = &rdev->wiphy.vendor_events[i];
1803                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1804                                         goto nla_put_failure;
1805                         }
1806                         nla_nest_end(msg, nested);
1807                 }
1808                 state->split_start++;
1809                 break;
1810         case 12:
1811                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1812                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1813                                rdev->wiphy.max_num_csa_counters))
1814                         goto nla_put_failure;
1815
1816                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1817                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1818                         goto nla_put_failure;
1819
1820                 if (rdev->wiphy.max_sched_scan_reqs &&
1821                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
1822                                 rdev->wiphy.max_sched_scan_reqs))
1823                         goto nla_put_failure;
1824
1825                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1826                             sizeof(rdev->wiphy.ext_features),
1827                             rdev->wiphy.ext_features))
1828                         goto nla_put_failure;
1829
1830                 if (rdev->wiphy.bss_select_support) {
1831                         struct nlattr *nested;
1832                         u32 bss_select_support = rdev->wiphy.bss_select_support;
1833
1834                         nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
1835                         if (!nested)
1836                                 goto nla_put_failure;
1837
1838                         i = 0;
1839                         while (bss_select_support) {
1840                                 if ((bss_select_support & 1) &&
1841                                     nla_put_flag(msg, i))
1842                                         goto nla_put_failure;
1843                                 i++;
1844                                 bss_select_support >>= 1;
1845                         }
1846                         nla_nest_end(msg, nested);
1847                 }
1848
1849                 state->split_start++;
1850                 break;
1851         case 13:
1852                 if (rdev->wiphy.num_iftype_ext_capab &&
1853                     rdev->wiphy.iftype_ext_capab) {
1854                         struct nlattr *nested_ext_capab, *nested;
1855
1856                         nested = nla_nest_start(msg,
1857                                                 NL80211_ATTR_IFTYPE_EXT_CAPA);
1858                         if (!nested)
1859                                 goto nla_put_failure;
1860
1861                         for (i = state->capa_start;
1862                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
1863                                 const struct wiphy_iftype_ext_capab *capab;
1864
1865                                 capab = &rdev->wiphy.iftype_ext_capab[i];
1866
1867                                 nested_ext_capab = nla_nest_start(msg, i);
1868                                 if (!nested_ext_capab ||
1869                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
1870                                                 capab->iftype) ||
1871                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
1872                                             capab->extended_capabilities_len,
1873                                             capab->extended_capabilities) ||
1874                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1875                                             capab->extended_capabilities_len,
1876                                             capab->extended_capabilities_mask))
1877                                         goto nla_put_failure;
1878
1879                                 nla_nest_end(msg, nested_ext_capab);
1880                                 if (state->split)
1881                                         break;
1882                         }
1883                         nla_nest_end(msg, nested);
1884                         if (i < rdev->wiphy.num_iftype_ext_capab) {
1885                                 state->capa_start = i + 1;
1886                                 break;
1887                         }
1888                 }
1889
1890                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
1891                                 rdev->wiphy.nan_supported_bands))
1892                         goto nla_put_failure;
1893
1894                 /* done */
1895                 state->split_start = 0;
1896                 break;
1897         }
1898  finish:
1899         genlmsg_end(msg, hdr);
1900         return 0;
1901
1902  nla_put_failure:
1903         genlmsg_cancel(msg, hdr);
1904         return -EMSGSIZE;
1905 }
1906
1907 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1908                                     struct netlink_callback *cb,
1909                                     struct nl80211_dump_wiphy_state *state)
1910 {
1911         struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
1912         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb,
1913                               nl80211_fam.maxattr, nl80211_policy, NULL);
1914         /* ignore parse errors for backward compatibility */
1915         if (ret)
1916                 return 0;
1917
1918         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1919         if (tb[NL80211_ATTR_WIPHY])
1920                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1921         if (tb[NL80211_ATTR_WDEV])
1922                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1923         if (tb[NL80211_ATTR_IFINDEX]) {
1924                 struct net_device *netdev;
1925                 struct cfg80211_registered_device *rdev;
1926                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1927
1928                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1929                 if (!netdev)
1930                         return -ENODEV;
1931                 if (netdev->ieee80211_ptr) {
1932                         rdev = wiphy_to_rdev(
1933                                 netdev->ieee80211_ptr->wiphy);
1934                         state->filter_wiphy = rdev->wiphy_idx;
1935                 }
1936         }
1937
1938         return 0;
1939 }
1940
1941 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1942 {
1943         int idx = 0, ret;
1944         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1945         struct cfg80211_registered_device *rdev;
1946
1947         rtnl_lock();
1948         if (!state) {
1949                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1950                 if (!state) {
1951                         rtnl_unlock();
1952                         return -ENOMEM;
1953                 }
1954                 state->filter_wiphy = -1;
1955                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1956                 if (ret) {
1957                         kfree(state);
1958                         rtnl_unlock();
1959                         return ret;
1960                 }
1961                 cb->args[0] = (long)state;
1962         }
1963
1964         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1965                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1966                         continue;
1967                 if (++idx <= state->start)
1968                         continue;
1969                 if (state->filter_wiphy != -1 &&
1970                     state->filter_wiphy != rdev->wiphy_idx)
1971                         continue;
1972                 /* attempt to fit multiple wiphy data chunks into the skb */
1973                 do {
1974                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1975                                                  skb,
1976                                                  NETLINK_CB(cb->skb).portid,
1977                                                  cb->nlh->nlmsg_seq,
1978                                                  NLM_F_MULTI, state);
1979                         if (ret < 0) {
1980                                 /*
1981                                  * If sending the wiphy data didn't fit (ENOBUFS
1982                                  * or EMSGSIZE returned), this SKB is still
1983                                  * empty (so it's not too big because another
1984                                  * wiphy dataset is already in the skb) and
1985                                  * we've not tried to adjust the dump allocation
1986                                  * yet ... then adjust the alloc size to be
1987                                  * bigger, and return 1 but with the empty skb.
1988                                  * This results in an empty message being RX'ed
1989                                  * in userspace, but that is ignored.
1990                                  *
1991                                  * We can then retry with the larger buffer.
1992                                  */
1993                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1994                                     !skb->len && !state->split &&
1995                                     cb->min_dump_alloc < 4096) {
1996                                         cb->min_dump_alloc = 4096;
1997                                         state->split_start = 0;
1998                                         rtnl_unlock();
1999                                         return 1;
2000                                 }
2001                                 idx--;
2002                                 break;
2003                         }
2004                 } while (state->split_start > 0);
2005                 break;
2006         }
2007         rtnl_unlock();
2008
2009         state->start = idx;
2010
2011         return skb->len;
2012 }
2013
2014 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2015 {
2016         kfree((void *)cb->args[0]);
2017         return 0;
2018 }
2019
2020 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2021 {
2022         struct sk_buff *msg;
2023         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2024         struct nl80211_dump_wiphy_state state = {};
2025
2026         msg = nlmsg_new(4096, GFP_KERNEL);
2027         if (!msg)
2028                 return -ENOMEM;
2029
2030         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2031                                info->snd_portid, info->snd_seq, 0,
2032                                &state) < 0) {
2033                 nlmsg_free(msg);
2034                 return -ENOBUFS;
2035         }
2036
2037         return genlmsg_reply(msg, info);
2038 }
2039
2040 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2041         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2042         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2043         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2044         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2045         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2046 };
2047
2048 static int parse_txq_params(struct nlattr *tb[],
2049                             struct ieee80211_txq_params *txq_params)
2050 {
2051         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2052             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2053             !tb[NL80211_TXQ_ATTR_AIFS])
2054                 return -EINVAL;
2055
2056         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2057         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2058         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2059         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2060         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2061
2062         if (txq_params->ac >= NL80211_NUM_ACS)
2063                 return -EINVAL;
2064
2065         return 0;
2066 }
2067
2068 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2069 {
2070         /*
2071          * You can only set the channel explicitly for WDS interfaces,
2072          * all others have their channel managed via their respective
2073          * "establish a connection" command (connect, join, ...)
2074          *
2075          * For AP/GO and mesh mode, the channel can be set with the
2076          * channel userspace API, but is only stored and passed to the
2077          * low-level driver when the AP starts or the mesh is joined.
2078          * This is for backward compatibility, userspace can also give
2079          * the channel in the start-ap or join-mesh commands instead.
2080          *
2081          * Monitors are special as they are normally slaved to
2082          * whatever else is going on, so they have their own special
2083          * operation to set the monitor channel if possible.
2084          */
2085         return !wdev ||
2086                 wdev->iftype == NL80211_IFTYPE_AP ||
2087                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2088                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2089                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2090 }
2091
2092 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2093                                  struct genl_info *info,
2094                                  struct cfg80211_chan_def *chandef)
2095 {
2096         u32 control_freq;
2097
2098         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
2099                 return -EINVAL;
2100
2101         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
2102
2103         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2104         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2105         chandef->center_freq1 = control_freq;
2106         chandef->center_freq2 = 0;
2107
2108         /* Primary channel not allowed */
2109         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
2110                 return -EINVAL;
2111
2112         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2113                 enum nl80211_channel_type chantype;
2114
2115                 chantype = nla_get_u32(
2116                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2117
2118                 switch (chantype) {
2119                 case NL80211_CHAN_NO_HT:
2120                 case NL80211_CHAN_HT20:
2121                 case NL80211_CHAN_HT40PLUS:
2122                 case NL80211_CHAN_HT40MINUS:
2123                         cfg80211_chandef_create(chandef, chandef->chan,
2124                                                 chantype);
2125                         /* user input for center_freq is incorrect */
2126                         if (info->attrs[NL80211_ATTR_CENTER_FREQ1] &&
2127                             chandef->center_freq1 != nla_get_u32(
2128                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]))
2129                                 return -EINVAL;
2130                         /* center_freq2 must be zero */
2131                         if (info->attrs[NL80211_ATTR_CENTER_FREQ2] &&
2132                             nla_get_u32(info->attrs[NL80211_ATTR_CENTER_FREQ2]))
2133                                 return -EINVAL;
2134                         break;
2135                 default:
2136                         return -EINVAL;
2137                 }
2138         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2139                 chandef->width =
2140                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2141                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2142                         chandef->center_freq1 =
2143                                 nla_get_u32(
2144                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2145                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2146                         chandef->center_freq2 =
2147                                 nla_get_u32(
2148                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2149         }
2150
2151         if (!cfg80211_chandef_valid(chandef))
2152                 return -EINVAL;
2153
2154         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2155                                      IEEE80211_CHAN_DISABLED))
2156                 return -EINVAL;
2157
2158         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2159              chandef->width == NL80211_CHAN_WIDTH_10) &&
2160             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2161                 return -EINVAL;
2162
2163         return 0;
2164 }
2165
2166 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2167                                  struct net_device *dev,
2168                                  struct genl_info *info)
2169 {
2170         struct cfg80211_chan_def chandef;
2171         int result;
2172         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2173         struct wireless_dev *wdev = NULL;
2174
2175         if (dev)
2176                 wdev = dev->ieee80211_ptr;
2177         if (!nl80211_can_set_dev_channel(wdev))
2178                 return -EOPNOTSUPP;
2179         if (wdev)
2180                 iftype = wdev->iftype;
2181
2182         result = nl80211_parse_chandef(rdev, info, &chandef);
2183         if (result)
2184                 return result;
2185
2186         switch (iftype) {
2187         case NL80211_IFTYPE_AP:
2188         case NL80211_IFTYPE_P2P_GO:
2189                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2190                                                    iftype)) {
2191                         result = -EINVAL;
2192                         break;
2193                 }
2194                 if (wdev->beacon_interval) {
2195                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2196                             !(rdev->wiphy.features &
2197                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2198                                 result = -EBUSY;
2199                                 break;
2200                         }
2201
2202                         /* Only allow dynamic channel width changes */
2203                         if (chandef.chan != wdev->preset_chandef.chan) {
2204                                 result = -EBUSY;
2205                                 break;
2206                         }
2207                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2208                         if (result)
2209                                 break;
2210                 }
2211                 wdev->preset_chandef = chandef;
2212                 result = 0;
2213                 break;
2214         case NL80211_IFTYPE_MESH_POINT:
2215                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2216                 break;
2217         case NL80211_IFTYPE_MONITOR:
2218                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2219                 break;
2220         default:
2221                 result = -EINVAL;
2222         }
2223
2224         return result;
2225 }
2226
2227 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2228 {
2229         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2230         struct net_device *netdev = info->user_ptr[1];
2231
2232         return __nl80211_set_channel(rdev, netdev, info);
2233 }
2234
2235 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2236 {
2237         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2238         struct net_device *dev = info->user_ptr[1];
2239         struct wireless_dev *wdev = dev->ieee80211_ptr;
2240         const u8 *bssid;
2241
2242         if (!info->attrs[NL80211_ATTR_MAC])
2243                 return -EINVAL;
2244
2245         if (netif_running(dev))
2246                 return -EBUSY;
2247
2248         if (!rdev->ops->set_wds_peer)
2249                 return -EOPNOTSUPP;
2250
2251         if (wdev->iftype != NL80211_IFTYPE_WDS)
2252                 return -EOPNOTSUPP;
2253
2254         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2255         return rdev_set_wds_peer(rdev, dev, bssid);
2256 }
2257
2258 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2259 {
2260         struct cfg80211_registered_device *rdev;
2261         struct net_device *netdev = NULL;
2262         struct wireless_dev *wdev;
2263         int result = 0, rem_txq_params = 0;
2264         struct nlattr *nl_txq_params;
2265         u32 changed;
2266         u8 retry_short = 0, retry_long = 0;
2267         u32 frag_threshold = 0, rts_threshold = 0;
2268         u8 coverage_class = 0;
2269
2270         ASSERT_RTNL();
2271
2272         /*
2273          * Try to find the wiphy and netdev. Normally this
2274          * function shouldn't need the netdev, but this is
2275          * done for backward compatibility -- previously
2276          * setting the channel was done per wiphy, but now
2277          * it is per netdev. Previous userland like hostapd
2278          * also passed a netdev to set_wiphy, so that it is
2279          * possible to let that go to the right netdev!
2280          */
2281
2282         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2283                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2284
2285                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2286                 if (netdev && netdev->ieee80211_ptr)
2287                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2288                 else
2289                         netdev = NULL;
2290         }
2291
2292         if (!netdev) {
2293                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2294                                                   info->attrs);
2295                 if (IS_ERR(rdev))
2296                         return PTR_ERR(rdev);
2297                 wdev = NULL;
2298                 netdev = NULL;
2299                 result = 0;
2300         } else
2301                 wdev = netdev->ieee80211_ptr;
2302
2303         /*
2304          * end workaround code, by now the rdev is available
2305          * and locked, and wdev may or may not be NULL.
2306          */
2307
2308         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2309                 result = cfg80211_dev_rename(
2310                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2311
2312         if (result)
2313                 return result;
2314
2315         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2316                 struct ieee80211_txq_params txq_params;
2317                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2318
2319                 if (!rdev->ops->set_txq_params)
2320                         return -EOPNOTSUPP;
2321
2322                 if (!netdev)
2323                         return -EINVAL;
2324
2325                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2326                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2327                         return -EINVAL;
2328
2329                 if (!netif_running(netdev))
2330                         return -ENETDOWN;
2331
2332                 nla_for_each_nested(nl_txq_params,
2333                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2334                                     rem_txq_params) {
2335                         result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX,
2336                                                   nl_txq_params,
2337                                                   txq_params_policy,
2338                                                   info->extack);
2339                         if (result)
2340                                 return result;
2341                         result = parse_txq_params(tb, &txq_params);
2342                         if (result)
2343                                 return result;
2344
2345                         result = rdev_set_txq_params(rdev, netdev,
2346                                                      &txq_params);
2347                         if (result)
2348                                 return result;
2349                 }
2350         }
2351
2352         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2353                 result = __nl80211_set_channel(
2354                         rdev,
2355                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2356                         info);
2357                 if (result)
2358                         return result;
2359         }
2360
2361         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2362                 struct wireless_dev *txp_wdev = wdev;
2363                 enum nl80211_tx_power_setting type;
2364                 int idx, mbm = 0;
2365
2366                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2367                         txp_wdev = NULL;
2368
2369                 if (!rdev->ops->set_tx_power)
2370                         return -EOPNOTSUPP;
2371
2372                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2373                 type = nla_get_u32(info->attrs[idx]);
2374
2375                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2376                     (type != NL80211_TX_POWER_AUTOMATIC))
2377                         return -EINVAL;
2378
2379                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2380                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2381                         mbm = nla_get_u32(info->attrs[idx]);
2382                 }
2383
2384                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2385                 if (result)
2386                         return result;
2387         }
2388
2389         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2390             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2391                 u32 tx_ant, rx_ant;
2392
2393                 if ((!rdev->wiphy.available_antennas_tx &&
2394                      !rdev->wiphy.available_antennas_rx) ||
2395                     !rdev->ops->set_antenna)
2396                         return -EOPNOTSUPP;
2397
2398                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2399                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2400
2401                 /* reject antenna configurations which don't match the
2402                  * available antenna masks, except for the "all" mask */
2403                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2404                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2405                         return -EINVAL;
2406
2407                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2408                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2409
2410                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2411                 if (result)
2412                         return result;
2413         }
2414
2415         changed = 0;
2416
2417         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2418                 retry_short = nla_get_u8(
2419                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2420                 if (retry_short == 0)
2421                         return -EINVAL;
2422
2423                 changed |= WIPHY_PARAM_RETRY_SHORT;
2424         }
2425
2426         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2427                 retry_long = nla_get_u8(
2428                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2429                 if (retry_long == 0)
2430                         return -EINVAL;
2431
2432                 changed |= WIPHY_PARAM_RETRY_LONG;
2433         }
2434
2435         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2436                 frag_threshold = nla_get_u32(
2437                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2438                 if (frag_threshold < 256)
2439                         return -EINVAL;
2440
2441                 if (frag_threshold != (u32) -1) {
2442                         /*
2443                          * Fragments (apart from the last one) are required to
2444                          * have even length. Make the fragmentation code
2445                          * simpler by stripping LSB should someone try to use
2446                          * odd threshold value.
2447                          */
2448                         frag_threshold &= ~0x1;
2449                 }
2450                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2451         }
2452
2453         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2454                 rts_threshold = nla_get_u32(
2455                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2456                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2457         }
2458
2459         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2460                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2461                         return -EINVAL;
2462
2463                 coverage_class = nla_get_u8(
2464                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2465                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2466         }
2467
2468         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2469                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2470                         return -EOPNOTSUPP;
2471
2472                 changed |= WIPHY_PARAM_DYN_ACK;
2473         }
2474
2475         if (changed) {
2476                 u8 old_retry_short, old_retry_long;
2477                 u32 old_frag_threshold, old_rts_threshold;
2478                 u8 old_coverage_class;
2479
2480                 if (!rdev->ops->set_wiphy_params)
2481                         return -EOPNOTSUPP;
2482
2483                 old_retry_short = rdev->wiphy.retry_short;
2484                 old_retry_long = rdev->wiphy.retry_long;
2485                 old_frag_threshold = rdev->wiphy.frag_threshold;
2486                 old_rts_threshold = rdev->wiphy.rts_threshold;
2487                 old_coverage_class = rdev->wiphy.coverage_class;
2488
2489                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2490                         rdev->wiphy.retry_short = retry_short;
2491                 if (changed & WIPHY_PARAM_RETRY_LONG)
2492                         rdev->wiphy.retry_long = retry_long;
2493                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2494                         rdev->wiphy.frag_threshold = frag_threshold;
2495                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2496                         rdev->wiphy.rts_threshold = rts_threshold;
2497                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2498                         rdev->wiphy.coverage_class = coverage_class;
2499
2500                 result = rdev_set_wiphy_params(rdev, changed);
2501                 if (result) {
2502                         rdev->wiphy.retry_short = old_retry_short;
2503                         rdev->wiphy.retry_long = old_retry_long;
2504                         rdev->wiphy.frag_threshold = old_frag_threshold;
2505                         rdev->wiphy.rts_threshold = old_rts_threshold;
2506                         rdev->wiphy.coverage_class = old_coverage_class;
2507                         return result;
2508                 }
2509         }
2510         return 0;
2511 }
2512
2513 static inline u64 wdev_id(struct wireless_dev *wdev)
2514 {
2515         return (u64)wdev->identifier |
2516                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2517 }
2518
2519 static int nl80211_send_chandef(struct sk_buff *msg,
2520                                 const struct cfg80211_chan_def *chandef)
2521 {
2522         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2523                 return -EINVAL;
2524
2525         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2526                         chandef->chan->center_freq))
2527                 return -ENOBUFS;
2528         switch (chandef->width) {
2529         case NL80211_CHAN_WIDTH_20_NOHT:
2530         case NL80211_CHAN_WIDTH_20:
2531         case NL80211_CHAN_WIDTH_40:
2532                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2533                                 cfg80211_get_chandef_type(chandef)))
2534                         return -ENOBUFS;
2535                 break;
2536         default:
2537                 break;
2538         }
2539         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2540                 return -ENOBUFS;
2541         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2542                 return -ENOBUFS;
2543         if (chandef->center_freq2 &&
2544             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2545                 return -ENOBUFS;
2546         return 0;
2547 }
2548
2549 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2550                               struct cfg80211_registered_device *rdev,
2551                               struct wireless_dev *wdev, bool removal)
2552 {
2553         struct net_device *dev = wdev->netdev;
2554         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2555         void *hdr;
2556
2557         if (removal)
2558                 cmd = NL80211_CMD_DEL_INTERFACE;
2559
2560         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2561         if (!hdr)
2562                 return -1;
2563
2564         if (dev &&
2565             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2566              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2567                 goto nla_put_failure;
2568
2569         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2570             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2571             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2572                               NL80211_ATTR_PAD) ||
2573             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2574             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2575                         rdev->devlist_generation ^
2576                         (cfg80211_rdev_list_generation << 2)))
2577                 goto nla_put_failure;
2578
2579         if (rdev->ops->get_channel) {
2580                 int ret;
2581                 struct cfg80211_chan_def chandef;
2582
2583                 ret = rdev_get_channel(rdev, wdev, &chandef);
2584                 if (ret == 0) {
2585                         if (nl80211_send_chandef(msg, &chandef))
2586                                 goto nla_put_failure;
2587                 }
2588         }
2589
2590         if (rdev->ops->get_tx_power) {
2591                 int dbm, ret;
2592
2593                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2594                 if (ret == 0 &&
2595                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2596                                 DBM_TO_MBM(dbm)))
2597                         goto nla_put_failure;
2598         }
2599
2600         if (wdev->ssid_len) {
2601                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2602                         goto nla_put_failure;
2603         }
2604
2605         genlmsg_end(msg, hdr);
2606         return 0;
2607
2608  nla_put_failure:
2609         genlmsg_cancel(msg, hdr);
2610         return -EMSGSIZE;
2611 }
2612
2613 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2614 {
2615         int wp_idx = 0;
2616         int if_idx = 0;
2617         int wp_start = cb->args[0];
2618         int if_start = cb->args[1];
2619         int filter_wiphy = -1;
2620         struct cfg80211_registered_device *rdev;
2621         struct wireless_dev *wdev;
2622         int ret;
2623
2624         rtnl_lock();
2625         if (!cb->args[2]) {
2626                 struct nl80211_dump_wiphy_state state = {
2627                         .filter_wiphy = -1,
2628                 };
2629
2630                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
2631                 if (ret)
2632                         goto out_unlock;
2633
2634                 filter_wiphy = state.filter_wiphy;
2635
2636                 /*
2637                  * if filtering, set cb->args[2] to +1 since 0 is the default
2638                  * value needed to determine that parsing is necessary.
2639                  */
2640                 if (filter_wiphy >= 0)
2641                         cb->args[2] = filter_wiphy + 1;
2642                 else
2643                         cb->args[2] = -1;
2644         } else if (cb->args[2] > 0) {
2645                 filter_wiphy = cb->args[2] - 1;
2646         }
2647
2648         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2649                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2650                         continue;
2651                 if (wp_idx < wp_start) {
2652                         wp_idx++;
2653                         continue;
2654                 }
2655
2656                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
2657                         continue;
2658
2659                 if_idx = 0;
2660
2661                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2662                         if (if_idx < if_start) {
2663                                 if_idx++;
2664                                 continue;
2665                         }
2666                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2667                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2668                                                rdev, wdev, false) < 0) {
2669                                 goto out;
2670                         }
2671                         if_idx++;
2672                 }
2673
2674                 wp_idx++;
2675         }
2676  out:
2677         cb->args[0] = wp_idx;
2678         cb->args[1] = if_idx;
2679
2680         ret = skb->len;
2681  out_unlock:
2682         rtnl_unlock();
2683
2684         return ret;
2685 }
2686
2687 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2688 {
2689         struct sk_buff *msg;
2690         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2691         struct wireless_dev *wdev = info->user_ptr[1];
2692
2693         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2694         if (!msg)
2695                 return -ENOMEM;
2696
2697         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2698                                rdev, wdev, false) < 0) {
2699                 nlmsg_free(msg);
2700                 return -ENOBUFS;
2701         }
2702
2703         return genlmsg_reply(msg, info);
2704 }
2705
2706 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2707         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2708         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2709         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2710         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2711         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2712         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2713 };
2714
2715 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2716 {
2717         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2718         int flag;
2719
2720         *mntrflags = 0;
2721
2722         if (!nla)
2723                 return -EINVAL;
2724
2725         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla,
2726                              mntr_flags_policy, NULL))
2727                 return -EINVAL;
2728
2729         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2730                 if (flags[flag])
2731                         *mntrflags |= (1<<flag);
2732
2733         *mntrflags |= MONITOR_FLAG_CHANGED;
2734
2735         return 0;
2736 }
2737
2738 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
2739                                      enum nl80211_iftype type,
2740                                      struct genl_info *info,
2741                                      struct vif_params *params)
2742 {
2743         bool change = false;
2744         int err;
2745
2746         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2747                 if (type != NL80211_IFTYPE_MONITOR)
2748                         return -EINVAL;
2749
2750                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2751                                           &params->flags);
2752                 if (err)
2753                         return err;
2754
2755                 change = true;
2756         }
2757
2758         if (params->flags & MONITOR_FLAG_ACTIVE &&
2759             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2760                 return -EOPNOTSUPP;
2761
2762         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
2763                 const u8 *mumimo_groups;
2764                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2765
2766                 if (type != NL80211_IFTYPE_MONITOR)
2767                         return -EINVAL;
2768
2769                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2770                         return -EOPNOTSUPP;
2771
2772                 mumimo_groups =
2773                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
2774
2775                 /* bits 0 and 63 are reserved and must be zero */
2776                 if ((mumimo_groups[0] & BIT(0)) ||
2777                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
2778                         return -EINVAL;
2779
2780                 params->vht_mumimo_groups = mumimo_groups;
2781                 change = true;
2782         }
2783
2784         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
2785                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2786
2787                 if (type != NL80211_IFTYPE_MONITOR)
2788                         return -EINVAL;
2789
2790                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2791                         return -EOPNOTSUPP;
2792
2793                 params->vht_mumimo_follow_addr =
2794                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
2795                 change = true;
2796         }
2797
2798         return change ? 1 : 0;
2799 }
2800
2801 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2802                                struct net_device *netdev, u8 use_4addr,
2803                                enum nl80211_iftype iftype)
2804 {
2805         if (!use_4addr) {
2806                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2807                         return -EBUSY;
2808                 return 0;
2809         }
2810
2811         switch (iftype) {
2812         case NL80211_IFTYPE_AP_VLAN:
2813                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2814                         return 0;
2815                 break;
2816         case NL80211_IFTYPE_STATION:
2817                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2818                         return 0;
2819                 break;
2820         default:
2821                 break;
2822         }
2823
2824         return -EOPNOTSUPP;
2825 }
2826
2827 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2828 {
2829         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2830         struct vif_params params;
2831         int err;
2832         enum nl80211_iftype otype, ntype;
2833         struct net_device *dev = info->user_ptr[1];
2834         bool change = false;
2835
2836         memset(&params, 0, sizeof(params));
2837
2838         otype = ntype = dev->ieee80211_ptr->iftype;
2839
2840         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2841                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2842                 if (otype != ntype)
2843                         change = true;
2844                 if (ntype > NL80211_IFTYPE_MAX)
2845                         return -EINVAL;
2846         }
2847
2848         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2849                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2850
2851                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2852                         return -EINVAL;
2853                 if (netif_running(dev))
2854                         return -EBUSY;
2855
2856                 wdev_lock(wdev);
2857                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2858                              IEEE80211_MAX_MESH_ID_LEN);
2859                 wdev->mesh_id_up_len =
2860                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2861                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2862                        wdev->mesh_id_up_len);
2863                 wdev_unlock(wdev);
2864         }
2865
2866         if (info->attrs[NL80211_ATTR_4ADDR]) {
2867                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2868                 change = true;
2869                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2870                 if (err)
2871                         return err;
2872         } else {
2873                 params.use_4addr = -1;
2874         }
2875
2876         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
2877         if (err < 0)
2878                 return err;
2879         if (err > 0)
2880                 change = true;
2881
2882         if (change)
2883                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
2884         else
2885                 err = 0;
2886
2887         if (!err && params.use_4addr != -1)
2888                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2889
2890         return err;
2891 }
2892
2893 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2894 {
2895         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2896         struct vif_params params;
2897         struct wireless_dev *wdev;
2898         struct sk_buff *msg;
2899         int err;
2900         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2901
2902         /* to avoid failing a new interface creation due to pending removal */
2903         cfg80211_destroy_ifaces(rdev);
2904
2905         memset(&params, 0, sizeof(params));
2906
2907         if (!info->attrs[NL80211_ATTR_IFNAME])
2908                 return -EINVAL;
2909
2910         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2911                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2912                 if (type > NL80211_IFTYPE_MAX)
2913                         return -EINVAL;
2914         }
2915
2916         if (!rdev->ops->add_virtual_intf ||
2917             !(rdev->wiphy.interface_modes & (1 << type)))
2918                 return -EOPNOTSUPP;
2919
2920         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
2921              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2922             info->attrs[NL80211_ATTR_MAC]) {
2923                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2924                            ETH_ALEN);
2925                 if (!is_valid_ether_addr(params.macaddr))
2926                         return -EADDRNOTAVAIL;
2927         }
2928
2929         if (info->attrs[NL80211_ATTR_4ADDR]) {
2930                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2931                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2932                 if (err)
2933                         return err;
2934         }
2935
2936         err = nl80211_parse_mon_options(rdev, type, info, &params);
2937         if (err < 0)
2938                 return err;
2939
2940         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2941         if (!msg)
2942                 return -ENOMEM;
2943
2944         wdev = rdev_add_virtual_intf(rdev,
2945                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2946                                 NET_NAME_USER, type, &params);
2947         if (WARN_ON(!wdev)) {
2948                 nlmsg_free(msg);
2949                 return -EPROTO;
2950         } else if (IS_ERR(wdev)) {
2951                 nlmsg_free(msg);
2952                 return PTR_ERR(wdev);
2953         }
2954
2955         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2956                 wdev->owner_nlportid = info->snd_portid;
2957
2958         switch (type) {
2959         case NL80211_IFTYPE_MESH_POINT:
2960                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2961                         break;
2962                 wdev_lock(wdev);
2963                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2964                              IEEE80211_MAX_MESH_ID_LEN);
2965                 wdev->mesh_id_up_len =
2966                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2967                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2968                        wdev->mesh_id_up_len);
2969                 wdev_unlock(wdev);
2970                 break;
2971         case NL80211_IFTYPE_NAN:
2972         case NL80211_IFTYPE_P2P_DEVICE:
2973                 /*
2974                  * P2P Device and NAN do not have a netdev, so don't go
2975                  * through the netdev notifier and must be added here
2976                  */
2977                 mutex_init(&wdev->mtx);
2978                 INIT_LIST_HEAD(&wdev->event_list);
2979                 spin_lock_init(&wdev->event_lock);
2980                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2981                 spin_lock_init(&wdev->mgmt_registrations_lock);
2982
2983                 wdev->identifier = ++rdev->wdev_id;
2984                 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
2985                 rdev->devlist_generation++;
2986                 break;
2987         default:
2988                 break;
2989         }
2990
2991         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2992                                rdev, wdev, false) < 0) {
2993                 nlmsg_free(msg);
2994                 return -ENOBUFS;
2995         }
2996
2997         /*
2998          * For wdevs which have no associated netdev object (e.g. of type
2999          * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here.
3000          * For all other types, the event will be generated from the
3001          * netdev notifier
3002          */
3003         if (!wdev->netdev)
3004                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);
3005
3006         return genlmsg_reply(msg, info);
3007 }
3008
3009 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3010 {
3011         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3012         struct wireless_dev *wdev = info->user_ptr[1];
3013
3014         if (!rdev->ops->del_virtual_intf)
3015                 return -EOPNOTSUPP;
3016
3017         /*
3018          * If we remove a wireless device without a netdev then clear
3019          * user_ptr[1] so that nl80211_post_doit won't dereference it
3020          * to check if it needs to do dev_put(). Otherwise it crashes
3021          * since the wdev has been freed, unlike with a netdev where
3022          * we need the dev_put() for the netdev to really be freed.
3023          */
3024         if (!wdev->netdev)
3025                 info->user_ptr[1] = NULL;
3026
3027         return rdev_del_virtual_intf(rdev, wdev);
3028 }
3029
3030 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3031 {
3032         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3033         struct net_device *dev = info->user_ptr[1];
3034         u16 noack_map;
3035
3036         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3037                 return -EINVAL;
3038
3039         if (!rdev->ops->set_noack_map)
3040                 return -EOPNOTSUPP;
3041
3042         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3043
3044         return rdev_set_noack_map(rdev, dev, noack_map);
3045 }
3046
3047 struct get_key_cookie {
3048         struct sk_buff *msg;
3049         int error;
3050         int idx;
3051 };
3052
3053 static void get_key_callback(void *c, struct key_params *params)
3054 {
3055         struct nlattr *key;
3056         struct get_key_cookie *cookie = c;
3057
3058         if ((params->key &&
3059              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3060                      params->key_len, params->key)) ||
3061             (params->seq &&
3062              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3063                      params->seq_len, params->seq)) ||
3064             (params->cipher &&
3065              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3066                          params->cipher)))
3067                 goto nla_put_failure;
3068
3069         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3070         if (!key)
3071                 goto nla_put_failure;
3072
3073         if ((params->key &&
3074              nla_put(cookie->msg, NL80211_KEY_DATA,
3075                      params->key_len, params->key)) ||
3076             (params->seq &&
3077              nla_put(cookie->msg, NL80211_KEY_SEQ,
3078                      params->seq_len, params->seq)) ||
3079             (params->cipher &&
3080              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3081                          params->cipher)))
3082                 goto nla_put_failure;
3083
3084         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
3085                 goto nla_put_failure;
3086
3087         nla_nest_end(cookie->msg, key);
3088
3089         return;
3090  nla_put_failure:
3091         cookie->error = 1;
3092 }
3093
3094 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3095 {
3096         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3097         int err;
3098         struct net_device *dev = info->user_ptr[1];
3099         u8 key_idx = 0;
3100         const u8 *mac_addr = NULL;
3101         bool pairwise;
3102         struct get_key_cookie cookie = {
3103                 .error = 0,
3104         };
3105         void *hdr;
3106         struct sk_buff *msg;
3107
3108         if (info->attrs[NL80211_ATTR_KEY_IDX])
3109                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3110
3111         if (key_idx > 5)
3112                 return -EINVAL;
3113
3114         if (info->attrs[NL80211_ATTR_MAC])
3115                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3116
3117         pairwise = !!mac_addr;
3118         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3119                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3120
3121                 if (kt >= NUM_NL80211_KEYTYPES)
3122                         return -EINVAL;
3123                 if (kt != NL80211_KEYTYPE_GROUP &&
3124                     kt != NL80211_KEYTYPE_PAIRWISE)
3125                         return -EINVAL;
3126                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3127         }
3128
3129         if (!rdev->ops->get_key)
3130                 return -EOPNOTSUPP;
3131
3132         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3133                 return -ENOENT;
3134
3135         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3136         if (!msg)
3137                 return -ENOMEM;
3138
3139         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3140                              NL80211_CMD_NEW_KEY);
3141         if (!hdr)
3142                 goto nla_put_failure;
3143
3144         cookie.msg = msg;
3145         cookie.idx = key_idx;
3146
3147         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3148             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3149                 goto nla_put_failure;
3150         if (mac_addr &&
3151             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3152                 goto nla_put_failure;
3153
3154         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3155                            get_key_callback);
3156
3157         if (err)
3158                 goto free_msg;
3159
3160         if (cookie.error)
3161                 goto nla_put_failure;
3162
3163         genlmsg_end(msg, hdr);
3164         return genlmsg_reply(msg, info);
3165
3166  nla_put_failure:
3167         err = -ENOBUFS;
3168  free_msg:
3169         nlmsg_free(msg);
3170         return err;
3171 }
3172
3173 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3174 {
3175         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3176         struct key_parse key;
3177         int err;
3178         struct net_device *dev = info->user_ptr[1];
3179
3180         err = nl80211_parse_key(info, &key);
3181         if (err)
3182                 return err;
3183
3184         if (key.idx < 0)
3185                 return -EINVAL;
3186
3187         /* only support setting default key */
3188         if (!key.def && !key.defmgmt)
3189                 return -EINVAL;
3190
3191         wdev_lock(dev->ieee80211_ptr);
3192
3193         if (key.def) {
3194                 if (!rdev->ops->set_default_key) {
3195                         err = -EOPNOTSUPP;
3196                         goto out;
3197                 }
3198
3199                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3200                 if (err)
3201                         goto out;
3202
3203                 err = rdev_set_default_key(rdev, dev, key.idx,
3204                                                  key.def_uni, key.def_multi);
3205
3206                 if (err)
3207                         goto out;
3208
3209 #ifdef CONFIG_CFG80211_WEXT
3210                 dev->ieee80211_ptr->wext.default_key = key.idx;
3211 #endif
3212         } else {
3213                 if (key.def_uni || !key.def_multi) {
3214                         err = -EINVAL;
3215                         goto out;
3216                 }
3217
3218                 if (!rdev->ops->set_default_mgmt_key) {
3219                         err = -EOPNOTSUPP;
3220                         goto out;
3221                 }
3222
3223                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3224                 if (err)
3225                         goto out;
3226
3227                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3228                 if (err)
3229                         goto out;
3230
3231 #ifdef CONFIG_CFG80211_WEXT
3232                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3233 #endif
3234         }
3235
3236  out:
3237         wdev_unlock(dev->ieee80211_ptr);
3238
3239         return err;
3240 }
3241
3242 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3243 {
3244         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3245         int err;
3246         struct net_device *dev = info->user_ptr[1];
3247         struct key_parse key;
3248         const u8 *mac_addr = NULL;
3249
3250         err = nl80211_parse_key(info, &key);
3251         if (err)
3252                 return err;
3253
3254         if (!key.p.key)
3255                 return -EINVAL;
3256
3257         if (info->attrs[NL80211_ATTR_MAC])
3258                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3259
3260         if (key.type == -1) {
3261                 if (mac_addr)
3262                         key.type = NL80211_KEYTYPE_PAIRWISE;
3263                 else
3264                         key.type = NL80211_KEYTYPE_GROUP;
3265         }
3266
3267         /* for now */
3268         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3269             key.type != NL80211_KEYTYPE_GROUP)
3270                 return -EINVAL;
3271
3272         if (!rdev->ops->add_key)
3273                 return -EOPNOTSUPP;
3274
3275         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3276                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3277                                            mac_addr))
3278                 return -EINVAL;
3279
3280         wdev_lock(dev->ieee80211_ptr);
3281         err = nl80211_key_allowed(dev->ieee80211_ptr);
3282         if (!err)
3283                 err = rdev_add_key(rdev, dev, key.idx,
3284                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3285                                     mac_addr, &key.p);
3286         wdev_unlock(dev->ieee80211_ptr);
3287
3288         return err;
3289 }
3290
3291 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3292 {
3293         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3294         int err;
3295         struct net_device *dev = info->user_ptr[1];
3296         u8 *mac_addr = NULL;
3297         struct key_parse key;
3298
3299         err = nl80211_parse_key(info, &key);
3300         if (err)
3301                 return err;
3302
3303         if (info->attrs[NL80211_ATTR_MAC])
3304                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3305
3306         if (key.type == -1) {
3307                 if (mac_addr)
3308                         key.type = NL80211_KEYTYPE_PAIRWISE;
3309                 else
3310                         key.type = NL80211_KEYTYPE_GROUP;
3311         }
3312
3313         /* for now */
3314         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3315             key.type != NL80211_KEYTYPE_GROUP)
3316                 return -EINVAL;
3317
3318         if (!rdev->ops->del_key)
3319                 return -EOPNOTSUPP;
3320
3321         wdev_lock(dev->ieee80211_ptr);
3322         err = nl80211_key_allowed(dev->ieee80211_ptr);
3323
3324         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3325             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3326                 err = -ENOENT;
3327
3328         if (!err)
3329                 err = rdev_del_key(rdev, dev, key.idx,
3330                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3331                                    mac_addr);
3332
3333 #ifdef CONFIG_CFG80211_WEXT
3334         if (!err) {
3335                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3336                         dev->ieee80211_ptr->wext.default_key = -1;
3337                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3338                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3339         }
3340 #endif
3341         wdev_unlock(dev->ieee80211_ptr);
3342
3343         return err;
3344 }
3345
3346 /* This function returns an error or the number of nested attributes */
3347 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3348 {
3349         struct nlattr *attr;
3350         int n_entries = 0, tmp;
3351
3352         nla_for_each_nested(attr, nl_attr, tmp) {
3353                 if (nla_len(attr) != ETH_ALEN)
3354                         return -EINVAL;
3355
3356                 n_entries++;
3357         }
3358
3359         return n_entries;
3360 }
3361
3362 /*
3363  * This function parses ACL information and allocates memory for ACL data.
3364  * On successful return, the calling function is responsible to free the
3365  * ACL buffer returned by this function.
3366  */
3367 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3368                                                 struct genl_info *info)
3369 {
3370         enum nl80211_acl_policy acl_policy;
3371         struct nlattr *attr;
3372         struct cfg80211_acl_data *acl;
3373         int i = 0, n_entries, tmp;
3374
3375         if (!wiphy->max_acl_mac_addrs)
3376                 return ERR_PTR(-EOPNOTSUPP);
3377
3378         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3379                 return ERR_PTR(-EINVAL);
3380
3381         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3382         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3383             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3384                 return ERR_PTR(-EINVAL);
3385
3386         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3387                 return ERR_PTR(-EINVAL);
3388
3389         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3390         if (n_entries < 0)
3391                 return ERR_PTR(n_entries);
3392
3393         if (n_entries > wiphy->max_acl_mac_addrs)
3394                 return ERR_PTR(-ENOTSUPP);
3395
3396         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3397                       GFP_KERNEL);
3398         if (!acl)
3399                 return ERR_PTR(-ENOMEM);
3400
3401         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3402                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3403                 i++;
3404         }
3405
3406         acl->n_acl_entries = n_entries;
3407         acl->acl_policy = acl_policy;
3408
3409         return acl;
3410 }
3411
3412 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3413 {
3414         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3415         struct net_device *dev = info->user_ptr[1];
3416         struct cfg80211_acl_data *acl;
3417         int err;
3418
3419         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3420             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3421                 return -EOPNOTSUPP;
3422
3423         if (!dev->ieee80211_ptr->beacon_interval)
3424                 return -EINVAL;
3425
3426         acl = parse_acl_data(&rdev->wiphy, info);
3427         if (IS_ERR(acl))
3428                 return PTR_ERR(acl);
3429
3430         err = rdev_set_mac_acl(rdev, dev, acl);
3431
3432         kfree(acl);
3433
3434         return err;
3435 }
3436
3437 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3438                            u8 *rates, u8 rates_len)
3439 {
3440         u8 i;
3441         u32 mask = 0;
3442
3443         for (i = 0; i < rates_len; i++) {
3444                 int rate = (rates[i] & 0x7f) * 5;
3445                 int ridx;
3446
3447                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3448                         struct ieee80211_rate *srate =
3449                                 &sband->bitrates[ridx];
3450                         if (rate == srate->bitrate) {
3451                                 mask |= 1 << ridx;
3452                                 break;
3453                         }
3454                 }
3455                 if (ridx == sband->n_bitrates)
3456                         return 0; /* rate not found */
3457         }
3458
3459         return mask;
3460 }
3461
3462 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3463                                u8 *rates, u8 rates_len,
3464                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3465 {
3466         u8 i;
3467
3468         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3469
3470         for (i = 0; i < rates_len; i++) {
3471                 int ridx, rbit;
3472
3473                 ridx = rates[i] / 8;
3474                 rbit = BIT(rates[i] % 8);
3475
3476                 /* check validity */
3477                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3478                         return false;
3479
3480                 /* check availability */
3481                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3482                         mcs[ridx] |= rbit;
3483                 else
3484                         return false;
3485         }
3486
3487         return true;
3488 }
3489
3490 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3491 {
3492         u16 mcs_mask = 0;
3493
3494         switch (vht_mcs_map) {
3495         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3496                 break;
3497         case IEEE80211_VHT_MCS_SUPPORT_0_7:
3498                 mcs_mask = 0x00FF;
3499                 break;
3500         case IEEE80211_VHT_MCS_SUPPORT_0_8:
3501                 mcs_mask = 0x01FF;
3502                 break;
3503         case IEEE80211_VHT_MCS_SUPPORT_0_9:
3504                 mcs_mask = 0x03FF;
3505                 break;
3506         default:
3507                 break;
3508         }
3509
3510         return mcs_mask;
3511 }
3512
3513 static void vht_build_mcs_mask(u16 vht_mcs_map,
3514                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3515 {
3516         u8 nss;
3517
3518         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3519                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3520                 vht_mcs_map >>= 2;
3521         }
3522 }
3523
3524 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3525                              struct nl80211_txrate_vht *txrate,
3526                              u16 mcs[NL80211_VHT_NSS_MAX])
3527 {
3528         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3529         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3530         u8 i;
3531
3532         if (!sband->vht_cap.vht_supported)
3533                 return false;
3534
3535         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3536
3537         /* Build vht_mcs_mask from VHT capabilities */
3538         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3539
3540         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3541                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3542                         mcs[i] = txrate->mcs[i];
3543                 else
3544                         return false;
3545         }
3546
3547         return true;
3548 }
3549
3550 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
3551         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
3552                                     .len = NL80211_MAX_SUPP_RATES },
3553         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
3554                                 .len = NL80211_MAX_SUPP_HT_RATES },
3555         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
3556         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
3557 };
3558
3559 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
3560                                          struct cfg80211_bitrate_mask *mask)
3561 {
3562         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
3563         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3564         int rem, i;
3565         struct nlattr *tx_rates;
3566         struct ieee80211_supported_band *sband;
3567         u16 vht_tx_mcs_map;
3568
3569         memset(mask, 0, sizeof(*mask));
3570         /* Default to all rates enabled */
3571         for (i = 0; i < NUM_NL80211_BANDS; i++) {
3572                 sband = rdev->wiphy.bands[i];
3573
3574                 if (!sband)
3575                         continue;
3576
3577                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
3578                 memcpy(mask->control[i].ht_mcs,
3579                        sband->ht_cap.mcs.rx_mask,
3580                        sizeof(mask->control[i].ht_mcs));
3581
3582                 if (!sband->vht_cap.vht_supported)
3583                         continue;
3584
3585                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3586                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
3587         }
3588
3589         /* if no rates are given set it back to the defaults */
3590         if (!info->attrs[NL80211_ATTR_TX_RATES])
3591                 goto out;
3592
3593         /* The nested attribute uses enum nl80211_band as the index. This maps
3594          * directly to the enum nl80211_band values used in cfg80211.
3595          */
3596         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
3597         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
3598                 enum nl80211_band band = nla_type(tx_rates);
3599                 int err;
3600
3601                 if (band < 0 || band >= NUM_NL80211_BANDS)
3602                         return -EINVAL;
3603                 sband = rdev->wiphy.bands[band];
3604                 if (sband == NULL)
3605                         return -EINVAL;
3606                 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates,
3607                                        nl80211_txattr_policy, info->extack);
3608                 if (err)
3609                         return err;
3610                 if (tb[NL80211_TXRATE_LEGACY]) {
3611                         mask->control[band].legacy = rateset_to_mask(
3612                                 sband,
3613                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
3614                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
3615                         if ((mask->control[band].legacy == 0) &&
3616                             nla_len(tb[NL80211_TXRATE_LEGACY]))
3617                                 return -EINVAL;
3618                 }
3619                 if (tb[NL80211_TXRATE_HT]) {
3620                         if (!ht_rateset_to_mask(
3621                                         sband,
3622                                         nla_data(tb[NL80211_TXRATE_HT]),
3623                                         nla_len(tb[NL80211_TXRATE_HT]),
3624                                         mask->control[band].ht_mcs))
3625                                 return -EINVAL;
3626                 }
3627                 if (tb[NL80211_TXRATE_VHT]) {
3628                         if (!vht_set_mcs_mask(
3629                                         sband,
3630                                         nla_data(tb[NL80211_TXRATE_VHT]),
3631                                         mask->control[band].vht_mcs))
3632                                 return -EINVAL;
3633                 }
3634                 if (tb[NL80211_TXRATE_GI]) {
3635                         mask->control[band].gi =
3636                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
3637                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
3638                                 return -EINVAL;
3639                 }
3640
3641                 if (mask->control[band].legacy == 0) {
3642                         /* don't allow empty legacy rates if HT or VHT
3643                          * are not even supported.
3644                          */
3645                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
3646                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
3647                                 return -EINVAL;
3648
3649                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
3650                                 if (mask->control[band].ht_mcs[i])
3651                                         goto out;
3652
3653                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
3654                                 if (mask->control[band].vht_mcs[i])
3655                                         goto out;
3656
3657                         /* legacy and mcs rates may not be both empty */
3658                         return -EINVAL;
3659                 }
3660         }
3661
3662 out:
3663         return 0;
3664 }
3665
3666 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
3667                                    enum nl80211_band band,
3668                                    struct cfg80211_bitrate_mask *beacon_rate)
3669 {
3670         u32 count_ht, count_vht, i;
3671         u32 rate = beacon_rate->control[band].legacy;
3672
3673         /* Allow only one rate */
3674         if (hweight32(rate) > 1)
3675                 return -EINVAL;
3676
3677         count_ht = 0;
3678         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3679                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
3680                         return -EINVAL;
3681                 } else if (beacon_rate->control[band].ht_mcs[i]) {
3682                         count_ht++;
3683                         if (count_ht > 1)
3684                                 return -EINVAL;
3685                 }
3686                 if (count_ht && rate)
3687                         return -EINVAL;
3688         }
3689
3690         count_vht = 0;
3691         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3692                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
3693                         return -EINVAL;
3694                 } else if (beacon_rate->control[band].vht_mcs[i]) {
3695                         count_vht++;
3696                         if (count_vht > 1)
3697                                 return -EINVAL;
3698                 }
3699                 if (count_vht && rate)
3700                         return -EINVAL;
3701         }
3702
3703         if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
3704                 return -EINVAL;
3705
3706         if (rate &&
3707             !wiphy_ext_feature_isset(&rdev->wiphy,
3708                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
3709                 return -EINVAL;
3710         if (count_ht &&
3711             !wiphy_ext_feature_isset(&rdev->wiphy,
3712                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
3713                 return -EINVAL;
3714         if (count_vht &&
3715             !wiphy_ext_feature_isset(&rdev->wiphy,
3716                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
3717                 return -EINVAL;
3718
3719         return 0;
3720 }
3721
3722 static int nl80211_parse_beacon(struct nlattr *attrs[],
3723                                 struct cfg80211_beacon_data *bcn)
3724 {
3725         bool haveinfo = false;
3726
3727         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3728             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3729             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3730             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3731                 return -EINVAL;
3732
3733         memset(bcn, 0, sizeof(*bcn));
3734
3735         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3736                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3737                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3738                 if (!bcn->head_len)
3739                         return -EINVAL;
3740                 haveinfo = true;
3741         }
3742
3743         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3744                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3745                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3746                 haveinfo = true;
3747         }
3748
3749         if (!haveinfo)
3750                 return -EINVAL;
3751
3752         if (attrs[NL80211_ATTR_IE]) {
3753                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3754                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3755         }
3756
3757         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3758                 bcn->proberesp_ies =
3759                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3760                 bcn->proberesp_ies_len =
3761                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3762         }
3763
3764         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3765                 bcn->assocresp_ies =
3766                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3767                 bcn->assocresp_ies_len =
3768                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3769         }
3770
3771         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3772                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3773                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3774         }
3775
3776         return 0;
3777 }
3778
3779 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
3780                                             const u8 *rates)
3781 {
3782         int i;
3783
3784         if (!rates)
3785                 return;
3786
3787         for (i = 0; i < rates[1]; i++) {
3788                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
3789                         params->ht_required = true;
3790                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
3791                         params->vht_required = true;
3792         }
3793 }
3794
3795 /*
3796  * Since the nl80211 API didn't include, from the beginning, attributes about
3797  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
3798  * benefit of drivers that rebuild IEs in the firmware.
3799  */
3800 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
3801 {
3802         const struct cfg80211_beacon_data *bcn = &params->beacon;
3803         size_t ies_len = bcn->tail_len;
3804         const u8 *ies = bcn->tail;
3805         const u8 *rates;
3806         const u8 *cap;
3807
3808         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
3809         nl80211_check_ap_rate_selectors(params, rates);
3810
3811         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
3812         nl80211_check_ap_rate_selectors(params, rates);
3813
3814         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
3815         if (cap && cap[1] >= sizeof(*params->ht_cap))
3816                 params->ht_cap = (void *)(cap + 2);
3817         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
3818         if (cap && cap[1] >= sizeof(*params->vht_cap))
3819                 params->vht_cap = (void *)(cap + 2);
3820 }
3821
3822 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3823                                    struct cfg80211_ap_settings *params)
3824 {
3825         struct wireless_dev *wdev;
3826         bool ret = false;
3827
3828         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3829                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3830                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3831                         continue;
3832
3833                 if (!wdev->preset_chandef.chan)
3834                         continue;
3835
3836                 params->chandef = wdev->preset_chandef;
3837                 ret = true;
3838                 break;
3839         }
3840
3841         return ret;
3842 }
3843
3844 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3845                                     enum nl80211_auth_type auth_type,
3846                                     enum nl80211_commands cmd)
3847 {
3848         if (auth_type > NL80211_AUTHTYPE_MAX)
3849                 return false;
3850
3851         switch (cmd) {
3852         case NL80211_CMD_AUTHENTICATE:
3853                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3854                     auth_type == NL80211_AUTHTYPE_SAE)
3855                         return false;
3856                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3857                                              NL80211_EXT_FEATURE_FILS_STA) &&
3858                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
3859                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3860                      auth_type == NL80211_AUTHTYPE_FILS_PK))
3861                         return false;
3862                 return true;
3863         case NL80211_CMD_CONNECT:
3864                 /* SAE not supported yet */
3865                 if (auth_type == NL80211_AUTHTYPE_SAE)
3866                         return false;
3867                 /* FILS with SK PFS or PK not supported yet */
3868                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3869                     auth_type == NL80211_AUTHTYPE_FILS_PK)
3870                         return false;
3871                 if (!wiphy_ext_feature_isset(
3872                             &rdev->wiphy,
3873                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
3874                     auth_type == NL80211_AUTHTYPE_FILS_SK)
3875                         return false;
3876                 return true;
3877         case NL80211_CMD_START_AP:
3878                 /* SAE not supported yet */
3879                 if (auth_type == NL80211_AUTHTYPE_SAE)
3880                         return false;
3881                 /* FILS not supported yet */
3882                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
3883                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3884                     auth_type == NL80211_AUTHTYPE_FILS_PK)
3885                         return false;
3886                 return true;
3887         default:
3888                 return false;
3889         }
3890 }
3891
3892 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3893 {
3894         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3895         struct net_device *dev = info->user_ptr[1];
3896         struct wireless_dev *wdev = dev->ieee80211_ptr;
3897         struct cfg80211_ap_settings params;
3898         int err;
3899
3900         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3901             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3902                 return -EOPNOTSUPP;
3903
3904         if (!rdev->ops->start_ap)
3905                 return -EOPNOTSUPP;
3906
3907         if (wdev->beacon_interval)
3908                 return -EALREADY;
3909
3910         memset(&params, 0, sizeof(params));
3911
3912         /* these are required for START_AP */
3913         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3914             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3915             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3916                 return -EINVAL;
3917
3918         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3919         if (err)
3920                 return err;
3921
3922         params.beacon_interval =
3923                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3924         params.dtim_period =
3925                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3926
3927         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
3928                                            params.beacon_interval);
3929         if (err)
3930                 return err;
3931
3932         /*
3933          * In theory, some of these attributes should be required here
3934          * but since they were not used when the command was originally
3935          * added, keep them optional for old user space programs to let
3936          * them continue to work with drivers that do not need the
3937          * additional information -- drivers must check!
3938          */
3939         if (info->attrs[NL80211_ATTR_SSID]) {
3940                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3941                 params.ssid_len =
3942                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3943                 if (params.ssid_len == 0 ||
3944                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3945                         return -EINVAL;
3946         }
3947
3948         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3949                 params.hidden_ssid = nla_get_u32(
3950                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3951                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3952                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3953                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3954                         return -EINVAL;
3955         }
3956
3957         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3958
3959         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3960                 params.auth_type = nla_get_u32(
3961                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3962                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3963                                              NL80211_CMD_START_AP))
3964                         return -EINVAL;
3965         } else
3966                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3967
3968         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3969                                       NL80211_MAX_NR_CIPHER_SUITES);
3970         if (err)
3971                 return err;
3972
3973         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3974                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3975                         return -EOPNOTSUPP;
3976                 params.inactivity_timeout = nla_get_u16(
3977                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3978         }
3979
3980         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3981                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3982                         return -EINVAL;
3983                 params.p2p_ctwindow =
3984                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3985                 if (params.p2p_ctwindow > 127)
3986                         return -EINVAL;
3987                 if (params.p2p_ctwindow != 0 &&
3988                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3989                         return -EINVAL;
3990         }
3991
3992         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3993                 u8 tmp;
3994
3995                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3996                         return -EINVAL;
3997                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3998                 if (tmp > 1)
3999                         return -EINVAL;
4000                 params.p2p_opp_ps = tmp;
4001                 if (params.p2p_opp_ps != 0 &&
4002                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4003                         return -EINVAL;
4004         }
4005
4006         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4007                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
4008                 if (err)
4009                         return err;
4010         } else if (wdev->preset_chandef.chan) {
4011                 params.chandef = wdev->preset_chandef;
4012         } else if (!nl80211_get_ap_channel(rdev, &params))
4013                 return -EINVAL;
4014
4015         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4016                                            wdev->iftype))
4017                 return -EINVAL;
4018
4019         if (info->attrs[NL80211_ATTR_TX_RATES]) {
4020                 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4021                 if (err)
4022                         return err;
4023
4024                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4025                                               &params.beacon_rate);
4026                 if (err)
4027                         return err;
4028         }
4029
4030         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4031                 params.smps_mode =
4032                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4033                 switch (params.smps_mode) {
4034                 case NL80211_SMPS_OFF:
4035                         break;
4036                 case NL80211_SMPS_STATIC:
4037                         if (!(rdev->wiphy.features &
4038                               NL80211_FEATURE_STATIC_SMPS))
4039                                 return -EINVAL;
4040                         break;
4041                 case NL80211_SMPS_DYNAMIC:
4042                         if (!(rdev->wiphy.features &
4043                               NL80211_FEATURE_DYNAMIC_SMPS))
4044                                 return -EINVAL;
4045                         break;
4046                 default:
4047                         return -EINVAL;
4048                 }
4049         } else {
4050                 params.smps_mode = NL80211_SMPS_OFF;
4051         }
4052
4053         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4054         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4055                 return -EOPNOTSUPP;
4056
4057         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4058                 params.acl = parse_acl_data(&rdev->wiphy, info);
4059                 if (IS_ERR(params.acl))
4060                         return PTR_ERR(params.acl);
4061         }
4062
4063         nl80211_calculate_ap_params(&params);
4064
4065         wdev_lock(wdev);
4066         err = rdev_start_ap(rdev, dev, &params);
4067         if (!err) {
4068                 wdev->preset_chandef = params.chandef;
4069                 wdev->beacon_interval = params.beacon_interval;
4070                 wdev->chandef = params.chandef;
4071                 wdev->ssid_len = params.ssid_len;
4072                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4073         }
4074         wdev_unlock(wdev);
4075
4076         kfree(params.acl);
4077
4078         return err;
4079 }
4080
4081 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4082 {
4083         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4084         struct net_device *dev = info->user_ptr[1];
4085         struct wireless_dev *wdev = dev->ieee80211_ptr;
4086         struct cfg80211_beacon_data params;
4087         int err;
4088
4089         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4090             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4091                 return -EOPNOTSUPP;
4092
4093         if (!rdev->ops->change_beacon)
4094                 return -EOPNOTSUPP;
4095
4096         if (!wdev->beacon_interval)
4097                 return -EINVAL;
4098
4099         err = nl80211_parse_beacon(info->attrs, &params);
4100         if (err)
4101                 return err;
4102
4103         wdev_lock(wdev);
4104         err = rdev_change_beacon(rdev, dev, &params);
4105         wdev_unlock(wdev);
4106
4107         return err;
4108 }
4109
4110 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4111 {
4112         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4113         struct net_device *dev = info->user_ptr[1];
4114
4115         return cfg80211_stop_ap(rdev, dev, false);
4116 }
4117
4118 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4119         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4120         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4121         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4122         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4123         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4124         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4125 };
4126
4127 static int parse_station_flags(struct genl_info *info,
4128                                enum nl80211_iftype iftype,
4129                                struct station_parameters *params)
4130 {
4131         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4132         struct nlattr *nla;
4133         int flag;
4134
4135         /*
4136          * Try parsing the new attribute first so userspace
4137          * can specify both for older kernels.
4138          */
4139         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4140         if (nla) {
4141                 struct nl80211_sta_flag_update *sta_flags;
4142
4143                 sta_flags = nla_data(nla);
4144                 params->sta_flags_mask = sta_flags->mask;
4145                 params->sta_flags_set = sta_flags->set;
4146                 params->sta_flags_set &= params->sta_flags_mask;
4147                 if ((params->sta_flags_mask |
4148                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4149                         return -EINVAL;
4150                 return 0;
4151         }
4152
4153         /* if present, parse the old attribute */
4154
4155         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4156         if (!nla)
4157                 return 0;
4158
4159         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla,
4160                              sta_flags_policy, info->extack))
4161                 return -EINVAL;
4162
4163         /*
4164          * Only allow certain flags for interface types so that
4165          * other attributes are silently ignored. Remember that
4166          * this is backward compatibility code with old userspace
4167          * and shouldn't be hit in other cases anyway.
4168          */
4169         switch (iftype) {
4170         case NL80211_IFTYPE_AP:
4171         case NL80211_IFTYPE_AP_VLAN:
4172         case NL80211_IFTYPE_P2P_GO:
4173                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4174                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4175                                          BIT(NL80211_STA_FLAG_WME) |
4176                                          BIT(NL80211_STA_FLAG_MFP);
4177                 break;
4178         case NL80211_IFTYPE_P2P_CLIENT:
4179         case NL80211_IFTYPE_STATION:
4180                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4181                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
4182                 break;
4183         case NL80211_IFTYPE_MESH_POINT:
4184                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4185                                          BIT(NL80211_STA_FLAG_MFP) |
4186                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
4187         default:
4188                 return -EINVAL;
4189         }
4190
4191         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4192                 if (flags[flag]) {
4193                         params->sta_flags_set |= (1<<flag);
4194
4195                         /* no longer support new API additions in old API */
4196                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4197                                 return -EINVAL;
4198                 }
4199         }
4200
4201         return 0;
4202 }
4203
4204 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
4205                                  int attr)
4206 {
4207         struct nlattr *rate;
4208         u32 bitrate;
4209         u16 bitrate_compat;
4210         enum nl80211_rate_info rate_flg;
4211
4212         rate = nla_nest_start(msg, attr);
4213         if (!rate)
4214                 return false;
4215
4216         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4217         bitrate = cfg80211_calculate_bitrate(info);
4218         /* report 16-bit bitrate only if we can */
4219         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4220         if (bitrate > 0 &&
4221             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4222                 return false;
4223         if (bitrate_compat > 0 &&
4224             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4225                 return false;
4226
4227         switch (info->bw) {
4228         case RATE_INFO_BW_5:
4229                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4230                 break;
4231         case RATE_INFO_BW_10:
4232                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4233                 break;
4234         default:
4235                 WARN_ON(1);
4236                 /* fall through */
4237         case RATE_INFO_BW_20:
4238                 rate_flg = 0;
4239                 break;
4240         case RATE_INFO_BW_40:
4241                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4242                 break;
4243         case RATE_INFO_BW_80:
4244                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4245                 break;
4246         case RATE_INFO_BW_160:
4247                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4248                 break;
4249         }
4250
4251         if (rate_flg && nla_put_flag(msg, rate_flg))
4252                 return false;
4253
4254         if (info->flags & RATE_INFO_FLAGS_MCS) {
4255                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4256                         return false;
4257                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4258                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4259                         return false;
4260         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4261                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4262                         return false;
4263                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4264                         return false;
4265                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4266                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4267                         return false;
4268         }
4269
4270         nla_nest_end(msg, rate);
4271         return true;
4272 }
4273
4274 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4275                                int id)
4276 {
4277         void *attr;
4278         int i = 0;
4279
4280         if (!mask)
4281                 return true;
4282
4283         attr = nla_nest_start(msg, id);
4284         if (!attr)
4285                 return false;
4286
4287         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4288                 if (!(mask & BIT(i)))
4289                         continue;
4290
4291                 if (nla_put_u8(msg, i, signal[i]))
4292                         return false;
4293         }
4294
4295         nla_nest_end(msg, attr);
4296
4297         return true;
4298 }
4299
4300 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4301                                 u32 seq, int flags,
4302                                 struct cfg80211_registered_device *rdev,
4303                                 struct net_device *dev,
4304                                 const u8 *mac_addr, struct station_info *sinfo)
4305 {
4306         void *hdr;
4307         struct nlattr *sinfoattr, *bss_param;
4308
4309         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4310         if (!hdr)
4311                 return -1;
4312
4313         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4314             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4315             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4316                 goto nla_put_failure;
4317
4318         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4319         if (!sinfoattr)
4320                 goto nla_put_failure;
4321
4322 #define PUT_SINFO(attr, memb, type) do {                                \
4323         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
4324         if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) &&      \
4325             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
4326                              sinfo->memb))                              \
4327                 goto nla_put_failure;                                   \
4328         } while (0)
4329 #define PUT_SINFO_U64(attr, memb) do {                                  \
4330         if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) &&      \
4331             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
4332                               sinfo->memb, NL80211_STA_INFO_PAD))       \
4333                 goto nla_put_failure;                                   \
4334         } while (0)
4335
4336         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4337         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4338
4339         if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
4340                              BIT(NL80211_STA_INFO_RX_BYTES64)) &&
4341             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4342                         (u32)sinfo->rx_bytes))
4343                 goto nla_put_failure;
4344
4345         if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
4346                              BIT(NL80211_STA_INFO_TX_BYTES64)) &&
4347             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4348                         (u32)sinfo->tx_bytes))
4349                 goto nla_put_failure;
4350
4351         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4352         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4353         PUT_SINFO(LLID, llid, u16);
4354         PUT_SINFO(PLID, plid, u16);
4355         PUT_SINFO(PLINK_STATE, plink_state, u8);
4356         PUT_SINFO_U64(RX_DURATION, rx_duration);
4357
4358         switch (rdev->wiphy.signal_type) {
4359         case CFG80211_SIGNAL_TYPE_MBM:
4360                 PUT_SINFO(SIGNAL, signal, u8);
4361                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4362                 break;
4363         default:
4364                 break;
4365         }
4366         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4367                 if (!nl80211_put_signal(msg, sinfo->chains,
4368                                         sinfo->chain_signal,
4369                                         NL80211_STA_INFO_CHAIN_SIGNAL))
4370                         goto nla_put_failure;
4371         }
4372         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4373                 if (!nl80211_put_signal(msg, sinfo->chains,
4374                                         sinfo->chain_signal_avg,
4375                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4376                         goto nla_put_failure;
4377         }
4378         if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
4379                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4380                                           NL80211_STA_INFO_TX_BITRATE))
4381                         goto nla_put_failure;
4382         }
4383         if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
4384                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4385                                           NL80211_STA_INFO_RX_BITRATE))
4386                         goto nla_put_failure;
4387         }
4388
4389         PUT_SINFO(RX_PACKETS, rx_packets, u32);
4390         PUT_SINFO(TX_PACKETS, tx_packets, u32);
4391         PUT_SINFO(TX_RETRIES, tx_retries, u32);
4392         PUT_SINFO(TX_FAILED, tx_failed, u32);
4393         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4394         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4395         PUT_SINFO(LOCAL_PM, local_pm, u32);
4396         PUT_SINFO(PEER_PM, peer_pm, u32);
4397         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4398
4399         if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
4400                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4401                 if (!bss_param)
4402                         goto nla_put_failure;
4403
4404                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4405                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4406                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4407                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4408                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4409                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4410                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4411                                sinfo->bss_param.dtim_period) ||
4412                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4413                                 sinfo->bss_param.beacon_interval))
4414                         goto nla_put_failure;
4415
4416                 nla_nest_end(msg, bss_param);
4417         }
4418         if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
4419             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4420                     sizeof(struct nl80211_sta_flag_update),
4421                     &sinfo->sta_flags))
4422                 goto nla_put_failure;
4423
4424         PUT_SINFO_U64(T_OFFSET, t_offset);
4425         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4426         PUT_SINFO_U64(BEACON_RX, rx_beacon);
4427         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4428
4429 #undef PUT_SINFO
4430 #undef PUT_SINFO_U64
4431
4432         if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
4433                 struct nlattr *tidsattr;
4434                 int tid;
4435
4436                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4437                 if (!tidsattr)
4438                         goto nla_put_failure;
4439
4440                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4441                         struct cfg80211_tid_stats *tidstats;
4442                         struct nlattr *tidattr;
4443
4444                         tidstats = &sinfo->pertid[tid];
4445
4446                         if (!tidstats->filled)
4447                                 continue;
4448
4449                         tidattr = nla_nest_start(msg, tid + 1);
4450                         if (!tidattr)
4451                                 goto nla_put_failure;
4452
4453 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
4454         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
4455             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
4456                               tidstats->memb, NL80211_TID_STATS_PAD))   \
4457                 goto nla_put_failure;                                   \
4458         } while (0)
4459
4460                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
4461                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
4462                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
4463                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
4464
4465 #undef PUT_TIDVAL_U64
4466                         nla_nest_end(msg, tidattr);
4467                 }
4468
4469                 nla_nest_end(msg, tidsattr);
4470         }
4471
4472         nla_nest_end(msg, sinfoattr);
4473
4474         if (sinfo->assoc_req_ies_len &&
4475             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4476                     sinfo->assoc_req_ies))
4477                 goto nla_put_failure;
4478
4479         genlmsg_end(msg, hdr);
4480         return 0;
4481
4482  nla_put_failure:
4483         genlmsg_cancel(msg, hdr);
4484         return -EMSGSIZE;
4485 }
4486
4487 static int nl80211_dump_station(struct sk_buff *skb,
4488                                 struct netlink_callback *cb)
4489 {
4490         struct station_info sinfo;
4491         struct cfg80211_registered_device *rdev;
4492         struct wireless_dev *wdev;
4493         u8 mac_addr[ETH_ALEN];
4494         int sta_idx = cb->args[2];
4495         int err;
4496
4497         rtnl_lock();
4498         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4499         if (err)
4500                 goto out_err;
4501
4502         if (!wdev->netdev) {
4503                 err = -EINVAL;
4504                 goto out_err;
4505         }
4506
4507         if (!rdev->ops->dump_station) {
4508                 err = -EOPNOTSUPP;
4509                 goto out_err;
4510         }
4511
4512         while (1) {
4513                 memset(&sinfo, 0, sizeof(sinfo));
4514                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
4515                                         mac_addr, &sinfo);
4516                 if (err == -ENOENT)
4517                         break;
4518                 if (err)
4519                         goto out_err;
4520
4521                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
4522                                 NETLINK_CB(cb->skb).portid,
4523                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4524                                 rdev, wdev->netdev, mac_addr,
4525                                 &sinfo) < 0)
4526                         goto out;
4527
4528                 sta_idx++;
4529         }
4530
4531  out:
4532         cb->args[2] = sta_idx;
4533         err = skb->len;
4534  out_err:
4535         rtnl_unlock();
4536
4537         return err;
4538 }
4539
4540 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4541 {
4542         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4543         struct net_device *dev = info->user_ptr[1];
4544         struct station_info sinfo;
4545         struct sk_buff *msg;
4546         u8 *mac_addr = NULL;
4547         int err;
4548
4549         memset(&sinfo, 0, sizeof(sinfo));
4550
4551         if (!info->attrs[NL80211_ATTR_MAC])
4552                 return -EINVAL;
4553
4554         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4555
4556         if (!rdev->ops->get_station)
4557                 return -EOPNOTSUPP;
4558
4559         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4560         if (err)
4561                 return err;
4562
4563         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4564         if (!msg)
4565                 return -ENOMEM;
4566
4567         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4568                                  info->snd_portid, info->snd_seq, 0,
4569                                  rdev, dev, mac_addr, &sinfo) < 0) {
4570                 nlmsg_free(msg);
4571                 return -ENOBUFS;
4572         }
4573
4574         return genlmsg_reply(msg, info);
4575 }
4576
4577 int cfg80211_check_station_change(struct wiphy *wiphy,
4578                                   struct station_parameters *params,
4579                                   enum cfg80211_station_type statype)
4580 {
4581         if (params->listen_interval != -1 &&
4582             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4583                 return -EINVAL;
4584
4585         if (params->support_p2p_ps != -1 &&
4586             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4587                 return -EINVAL;
4588
4589         if (params->aid &&
4590             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4591             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4592                 return -EINVAL;
4593
4594         /* When you run into this, adjust the code below for the new flag */
4595         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4596
4597         switch (statype) {
4598         case CFG80211_STA_MESH_PEER_KERNEL:
4599         case CFG80211_STA_MESH_PEER_USER:
4600                 /*
4601                  * No ignoring the TDLS flag here -- the userspace mesh
4602                  * code doesn't have the bug of including TDLS in the
4603                  * mask everywhere.
4604                  */
4605                 if (params->sta_flags_mask &
4606                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4607                                   BIT(NL80211_STA_FLAG_MFP) |
4608                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
4609                         return -EINVAL;
4610                 break;
4611         case CFG80211_STA_TDLS_PEER_SETUP:
4612         case CFG80211_STA_TDLS_PEER_ACTIVE:
4613                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4614                         return -EINVAL;
4615                 /* ignore since it can't change */
4616                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4617                 break;
4618         default:
4619                 /* disallow mesh-specific things */
4620                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4621                         return -EINVAL;
4622                 if (params->local_pm)
4623                         return -EINVAL;
4624                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4625                         return -EINVAL;
4626         }
4627
4628         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4629             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4630                 /* TDLS can't be set, ... */
4631                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4632                         return -EINVAL;
4633                 /*
4634                  * ... but don't bother the driver with it. This works around
4635                  * a hostapd/wpa_supplicant issue -- it always includes the
4636                  * TLDS_PEER flag in the mask even for AP mode.
4637                  */
4638                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4639         }
4640
4641         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4642             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4643                 /* reject other things that can't change */
4644                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4645                         return -EINVAL;
4646                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4647                         return -EINVAL;
4648                 if (params->supported_rates)
4649                         return -EINVAL;
4650                 if (params->ext_capab || params->ht_capa || params->vht_capa)
4651                         return -EINVAL;
4652         }
4653
4654         if (statype != CFG80211_STA_AP_CLIENT &&
4655             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4656                 if (params->vlan)
4657                         return -EINVAL;
4658         }
4659
4660         switch (statype) {
4661         case CFG80211_STA_AP_MLME_CLIENT:
4662                 /* Use this only for authorizing/unauthorizing a station */
4663                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4664                         return -EOPNOTSUPP;
4665                 break;
4666         case CFG80211_STA_AP_CLIENT:
4667         case CFG80211_STA_AP_CLIENT_UNASSOC:
4668                 /* accept only the listed bits */
4669                 if (params->sta_flags_mask &
4670                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4671                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4672                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
4673                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4674                                   BIT(NL80211_STA_FLAG_WME) |
4675                                   BIT(NL80211_STA_FLAG_MFP)))
4676                         return -EINVAL;
4677
4678                 /* but authenticated/associated only if driver handles it */
4679                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4680                     params->sta_flags_mask &
4681                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4682                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4683                         return -EINVAL;
4684                 break;
4685         case CFG80211_STA_IBSS:
4686         case CFG80211_STA_AP_STA:
4687                 /* reject any changes other than AUTHORIZED */
4688                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4689                         return -EINVAL;
4690                 break;
4691         case CFG80211_STA_TDLS_PEER_SETUP:
4692                 /* reject any changes other than AUTHORIZED or WME */
4693                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4694                                                BIT(NL80211_STA_FLAG_WME)))
4695                         return -EINVAL;
4696                 /* force (at least) rates when authorizing */
4697                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4698                     !params->supported_rates)
4699                         return -EINVAL;
4700                 break;
4701         case CFG80211_STA_TDLS_PEER_ACTIVE:
4702                 /* reject any changes */
4703                 return -EINVAL;
4704         case CFG80211_STA_MESH_PEER_KERNEL:
4705                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4706                         return -EINVAL;
4707                 break;
4708         case CFG80211_STA_MESH_PEER_USER:
4709                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
4710                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
4711                         return -EINVAL;
4712                 break;
4713         }
4714
4715         /*
4716          * Older kernel versions ignored this attribute entirely, so don't
4717          * reject attempts to update it but mark it as unused instead so the
4718          * driver won't look at the data.
4719          */
4720         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
4721             statype != CFG80211_STA_TDLS_PEER_SETUP)
4722                 params->opmode_notif_used = false;
4723
4724         return 0;
4725 }
4726 EXPORT_SYMBOL(cfg80211_check_station_change);
4727
4728 /*
4729  * Get vlan interface making sure it is running and on the right wiphy.
4730  */
4731 static struct net_device *get_vlan(struct genl_info *info,
4732                                    struct cfg80211_registered_device *rdev)
4733 {
4734         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4735         struct net_device *v;
4736         int ret;
4737
4738         if (!vlanattr)
4739                 return NULL;
4740
4741         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4742         if (!v)
4743                 return ERR_PTR(-ENODEV);
4744
4745         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4746                 ret = -EINVAL;
4747                 goto error;
4748         }
4749
4750         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4751             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4752             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4753                 ret = -EINVAL;
4754                 goto error;
4755         }
4756
4757         if (!netif_running(v)) {
4758                 ret = -ENETDOWN;
4759                 goto error;
4760         }
4761
4762         return v;
4763  error:
4764         dev_put(v);
4765         return ERR_PTR(ret);
4766 }
4767
4768 static const struct nla_policy
4769 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4770         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4771         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4772 };
4773
4774 static int nl80211_parse_sta_wme(struct genl_info *info,
4775                                  struct station_parameters *params)
4776 {
4777         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4778         struct nlattr *nla;
4779         int err;
4780
4781         /* parse WME attributes if present */
4782         if (!info->attrs[NL80211_ATTR_STA_WME])
4783                 return 0;
4784
4785         nla = info->attrs[NL80211_ATTR_STA_WME];
4786         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4787                                nl80211_sta_wme_policy, info->extack);
4788         if (err)
4789                 return err;
4790
4791         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4792                 params->uapsd_queues = nla_get_u8(
4793                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4794         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4795                 return -EINVAL;
4796
4797         if (tb[NL80211_STA_WME_MAX_SP])
4798                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4799
4800         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4801                 return -EINVAL;
4802
4803         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4804
4805         return 0;
4806 }
4807
4808 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4809                                       struct station_parameters *params)
4810 {
4811         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4812                 params->supported_channels =
4813                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4814                 params->supported_channels_len =
4815                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4816                 /*
4817                  * Need to include at least one (first channel, number of
4818                  * channels) tuple for each subband, and must have proper
4819                  * tuples for the rest of the data as well.
4820                  */
4821                 if (params->supported_channels_len < 2)
4822                         return -EINVAL;
4823                 if (params->supported_channels_len % 2)
4824                         return -EINVAL;
4825         }
4826
4827         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4828                 params->supported_oper_classes =
4829                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4830                 params->supported_oper_classes_len =
4831                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4832                 /*
4833                  * The value of the Length field of the Supported Operating
4834                  * Classes element is between 2 and 253.
4835                  */
4836                 if (params->supported_oper_classes_len < 2 ||
4837                     params->supported_oper_classes_len > 253)
4838                         return -EINVAL;
4839         }
4840         return 0;
4841 }
4842
4843 static int nl80211_set_station_tdls(struct genl_info *info,
4844                                     struct station_parameters *params)
4845 {
4846         int err;
4847         /* Dummy STA entry gets updated once the peer capabilities are known */
4848         if (info->attrs[NL80211_ATTR_PEER_AID])
4849                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4850         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4851                 params->ht_capa =
4852                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4853         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4854                 params->vht_capa =
4855                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4856
4857         err = nl80211_parse_sta_channel_info(info, params);
4858         if (err)
4859                 return err;
4860
4861         return nl80211_parse_sta_wme(info, params);
4862 }
4863
4864 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4865 {
4866         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4867         struct net_device *dev = info->user_ptr[1];
4868         struct station_parameters params;
4869         u8 *mac_addr;
4870         int err;
4871
4872         memset(&params, 0, sizeof(params));
4873
4874         if (!rdev->ops->change_station)
4875                 return -EOPNOTSUPP;
4876
4877         /*
4878          * AID and listen_interval properties can be set only for unassociated
4879          * station. Include these parameters here and will check them in
4880          * cfg80211_check_station_change().
4881          */
4882         if (info->attrs[NL80211_ATTR_STA_AID])
4883                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4884
4885         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4886                 params.listen_interval =
4887                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4888         else
4889                 params.listen_interval = -1;
4890
4891         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4892                 u8 tmp;
4893
4894                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4895                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4896                         return -EINVAL;
4897
4898                 params.support_p2p_ps = tmp;
4899         } else {
4900                 params.support_p2p_ps = -1;
4901         }
4902
4903         if (!info->attrs[NL80211_ATTR_MAC])
4904                 return -EINVAL;
4905
4906         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4907
4908         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4909                 params.supported_rates =
4910                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4911                 params.supported_rates_len =
4912                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4913         }
4914
4915         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4916                 params.capability =
4917                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4918                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4919         }
4920
4921         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4922                 params.ext_capab =
4923                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4924                 params.ext_capab_len =
4925                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4926         }
4927
4928         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4929                 return -EINVAL;
4930
4931         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4932                 params.plink_action =
4933                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4934                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4935                         return -EINVAL;
4936         }
4937
4938         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4939                 params.plink_state =
4940                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4941                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4942                         return -EINVAL;
4943                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) {
4944                         params.peer_aid = nla_get_u16(
4945                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
4946                         if (params.peer_aid > IEEE80211_MAX_AID)
4947                                 return -EINVAL;
4948                 }
4949                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4950         }
4951
4952         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4953                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4954                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4955
4956                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4957                     pm > NL80211_MESH_POWER_MAX)
4958                         return -EINVAL;
4959
4960                 params.local_pm = pm;
4961         }
4962
4963         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4964                 params.opmode_notif_used = true;
4965                 params.opmode_notif =
4966                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4967         }
4968
4969         /* Include parameters for TDLS peer (will check later) */
4970         err = nl80211_set_station_tdls(info, &params);
4971         if (err)
4972                 return err;
4973
4974         params.vlan = get_vlan(info, rdev);
4975         if (IS_ERR(params.vlan))
4976                 return PTR_ERR(params.vlan);
4977
4978         switch (dev->ieee80211_ptr->iftype) {
4979         case NL80211_IFTYPE_AP:
4980         case NL80211_IFTYPE_AP_VLAN:
4981         case NL80211_IFTYPE_P2P_GO:
4982         case NL80211_IFTYPE_P2P_CLIENT:
4983         case NL80211_IFTYPE_STATION:
4984         case NL80211_IFTYPE_ADHOC:
4985         case NL80211_IFTYPE_MESH_POINT:
4986                 break;
4987         default:
4988                 err = -EOPNOTSUPP;
4989                 goto out_put_vlan;
4990         }
4991
4992         /* driver will call cfg80211_check_station_change() */
4993         err = rdev_change_station(rdev, dev, mac_addr, &params);
4994
4995  out_put_vlan:
4996         if (params.vlan)
4997                 dev_put(params.vlan);
4998
4999         return err;
5000 }
5001
5002 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
5003 {
5004         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5005         int err;
5006         struct net_device *dev = info->user_ptr[1];
5007         struct station_parameters params;
5008         u8 *mac_addr = NULL;
5009         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5010                          BIT(NL80211_STA_FLAG_ASSOCIATED);
5011
5012         memset(&params, 0, sizeof(params));
5013
5014         if (!rdev->ops->add_station)
5015                 return -EOPNOTSUPP;
5016
5017         if (!info->attrs[NL80211_ATTR_MAC])
5018                 return -EINVAL;
5019
5020         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5021                 return -EINVAL;
5022
5023         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
5024                 return -EINVAL;
5025
5026         if (!info->attrs[NL80211_ATTR_STA_AID] &&
5027             !info->attrs[NL80211_ATTR_PEER_AID])
5028                 return -EINVAL;
5029
5030         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5031         params.supported_rates =
5032                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5033         params.supported_rates_len =
5034                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5035         params.listen_interval =
5036                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5037
5038         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5039                 u8 tmp;
5040
5041                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5042                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
5043                         return -EINVAL;
5044
5045                 params.support_p2p_ps = tmp;
5046         } else {
5047                 /*
5048                  * if not specified, assume it's supported for P2P GO interface,
5049                  * and is NOT supported for AP interface
5050                  */
5051                 params.support_p2p_ps =
5052                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5053         }
5054
5055         if (info->attrs[NL80211_ATTR_PEER_AID])
5056                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5057         else
5058                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5059         if (!params.aid || params.aid > IEEE80211_MAX_AID)
5060                 return -EINVAL;
5061
5062         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5063                 params.capability =
5064                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5065                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5066         }
5067
5068         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5069                 params.ext_capab =
5070                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5071                 params.ext_capab_len =
5072                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5073         }
5074
5075         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5076                 params.ht_capa =
5077                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5078
5079         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5080                 params.vht_capa =
5081                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5082
5083         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5084                 params.opmode_notif_used = true;
5085                 params.opmode_notif =
5086                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5087         }
5088
5089         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
5090                 params.plink_action =
5091                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5092                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
5093                         return -EINVAL;
5094         }
5095
5096         err = nl80211_parse_sta_channel_info(info, &params);
5097         if (err)
5098                 return err;
5099
5100         err = nl80211_parse_sta_wme(info, &params);
5101         if (err)
5102                 return err;
5103
5104         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5105                 return -EINVAL;
5106
5107         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5108          * as userspace might just pass through the capabilities from the IEs
5109          * directly, rather than enforcing this restriction and returning an
5110          * error in this case.
5111          */
5112         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5113                 params.ht_capa = NULL;
5114                 params.vht_capa = NULL;
5115         }
5116
5117         /* When you run into this, adjust the code below for the new flag */
5118         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5119
5120         switch (dev->ieee80211_ptr->iftype) {
5121         case NL80211_IFTYPE_AP:
5122         case NL80211_IFTYPE_AP_VLAN:
5123         case NL80211_IFTYPE_P2P_GO:
5124                 /* ignore WME attributes if iface/sta is not capable */
5125                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5126                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5127                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5128
5129                 /* TDLS peers cannot be added */
5130                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5131                     info->attrs[NL80211_ATTR_PEER_AID])
5132                         return -EINVAL;
5133                 /* but don't bother the driver with it */
5134                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5135
5136                 /* allow authenticated/associated only if driver handles it */
5137                 if (!(rdev->wiphy.features &
5138                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5139                     params.sta_flags_mask & auth_assoc)
5140                         return -EINVAL;
5141
5142                 /* Older userspace, or userspace wanting to be compatible with
5143                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5144                  * and assoc flags in the mask, but assumes the station will be
5145                  * added as associated anyway since this was the required driver
5146                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5147                  * introduced.
5148                  * In order to not bother drivers with this quirk in the API
5149                  * set the flags in both the mask and set for new stations in
5150                  * this case.
5151                  */
5152                 if (!(params.sta_flags_mask & auth_assoc)) {
5153                         params.sta_flags_mask |= auth_assoc;
5154                         params.sta_flags_set |= auth_assoc;
5155                 }
5156
5157                 /* must be last in here for error handling */
5158                 params.vlan = get_vlan(info, rdev);
5159                 if (IS_ERR(params.vlan))
5160                         return PTR_ERR(params.vlan);
5161                 break;
5162         case NL80211_IFTYPE_MESH_POINT:
5163                 /* ignore uAPSD data */
5164                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5165
5166                 /* associated is disallowed */
5167                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5168                         return -EINVAL;
5169                 /* TDLS peers cannot be added */
5170                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5171                     info->attrs[NL80211_ATTR_PEER_AID])
5172                         return -EINVAL;
5173                 break;
5174         case NL80211_IFTYPE_STATION:
5175         case NL80211_IFTYPE_P2P_CLIENT:
5176                 /* ignore uAPSD data */
5177                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5178
5179                 /* these are disallowed */
5180                 if (params.sta_flags_mask &
5181                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5182                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5183                         return -EINVAL;
5184                 /* Only TDLS peers can be added */
5185                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5186                         return -EINVAL;
5187                 /* Can only add if TDLS ... */
5188                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5189                         return -EOPNOTSUPP;
5190                 /* ... with external setup is supported */
5191                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5192                         return -EOPNOTSUPP;
5193                 /*
5194                  * Older wpa_supplicant versions always mark the TDLS peer
5195                  * as authorized, but it shouldn't yet be.
5196                  */
5197                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5198                 break;
5199         default:
5200                 return -EOPNOTSUPP;
5201         }
5202
5203         /* be aware of params.vlan when changing code here */
5204
5205         err = rdev_add_station(rdev, dev, mac_addr, &params);
5206
5207         if (params.vlan)
5208                 dev_put(params.vlan);
5209         return err;
5210 }
5211
5212 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5213 {
5214         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5215         struct net_device *dev = info->user_ptr[1];
5216         struct station_del_parameters params;
5217
5218         memset(&params, 0, sizeof(params));
5219
5220         if (info->attrs[NL80211_ATTR_MAC])
5221                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5222
5223         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5224             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5225             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5226             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5227                 return -EINVAL;
5228
5229         if (!rdev->ops->del_station)
5230                 return -EOPNOTSUPP;
5231
5232         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5233                 params.subtype =
5234                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5235                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5236                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5237                         return -EINVAL;
5238         } else {
5239                 /* Default to Deauthentication frame */
5240                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5241         }
5242
5243         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5244                 params.reason_code =
5245                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5246                 if (params.reason_code == 0)
5247                         return -EINVAL; /* 0 is reserved */
5248         } else {
5249                 /* Default to reason code 2 */
5250                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5251         }
5252
5253         return rdev_del_station(rdev, dev, &params);
5254 }
5255
5256 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5257                                 int flags, struct net_device *dev,
5258                                 u8 *dst, u8 *next_hop,
5259                                 struct mpath_info *pinfo)
5260 {
5261         void *hdr;
5262         struct nlattr *pinfoattr;
5263
5264         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5265         if (!hdr)
5266                 return -1;
5267
5268         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5269             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5270             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5271             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5272                 goto nla_put_failure;
5273
5274         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5275         if (!pinfoattr)
5276                 goto nla_put_failure;
5277         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5278             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5279                         pinfo->frame_qlen))
5280                 goto nla_put_failure;
5281         if (((pinfo->filled & MPATH_INFO_SN) &&
5282              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5283             ((pinfo->filled & MPATH_INFO_METRIC) &&
5284              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5285                          pinfo->metric)) ||
5286             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5287              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5288                          pinfo->exptime)) ||
5289             ((pinfo->filled & MPATH_INFO_FLAGS) &&
5290              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5291                         pinfo->flags)) ||
5292             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5293              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5294                          pinfo->discovery_timeout)) ||
5295             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5296              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5297                         pinfo->discovery_retries)))
5298                 goto nla_put_failure;
5299
5300         nla_nest_end(msg, pinfoattr);
5301
5302         genlmsg_end(msg, hdr);
5303         return 0;
5304
5305  nla_put_failure:
5306         genlmsg_cancel(msg, hdr);
5307         return -EMSGSIZE;
5308 }
5309
5310 static int nl80211_dump_mpath(struct sk_buff *skb,
5311                               struct netlink_callback *cb)
5312 {
5313         struct mpath_info pinfo;
5314         struct cfg80211_registered_device *rdev;
5315         struct wireless_dev *wdev;
5316         u8 dst[ETH_ALEN];
5317         u8 next_hop[ETH_ALEN];
5318         int path_idx = cb->args[2];
5319         int err;
5320
5321         rtnl_lock();
5322         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5323         if (err)
5324                 goto out_err;
5325
5326         if (!rdev->ops->dump_mpath) {
5327                 err = -EOPNOTSUPP;
5328                 goto out_err;
5329         }
5330
5331         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5332                 err = -EOPNOTSUPP;
5333                 goto out_err;
5334         }
5335
5336         while (1) {
5337                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5338                                       next_hop, &pinfo);
5339                 if (err == -ENOENT)
5340                         break;
5341                 if (err)
5342                         goto out_err;
5343
5344                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5345                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5346                                        wdev->netdev, dst, next_hop,
5347                                        &pinfo) < 0)
5348                         goto out;
5349
5350                 path_idx++;
5351         }
5352
5353  out:
5354         cb->args[2] = path_idx;
5355         err = skb->len;
5356  out_err:
5357         rtnl_unlock();
5358         return err;
5359 }
5360
5361 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5362 {
5363         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5364         int err;
5365         struct net_device *dev = info->user_ptr[1];
5366         struct mpath_info pinfo;
5367         struct sk_buff *msg;
5368         u8 *dst = NULL;
5369         u8 next_hop[ETH_ALEN];
5370
5371         memset(&pinfo, 0, sizeof(pinfo));
5372
5373         if (!info->attrs[NL80211_ATTR_MAC])
5374                 return -EINVAL;
5375
5376         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5377
5378         if (!rdev->ops->get_mpath)
5379                 return -EOPNOTSUPP;
5380
5381         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5382                 return -EOPNOTSUPP;
5383
5384         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5385         if (err)
5386                 return err;
5387
5388         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5389         if (!msg)
5390                 return -ENOMEM;
5391
5392         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5393                                  dev, dst, next_hop, &pinfo) < 0) {
5394                 nlmsg_free(msg);
5395                 return -ENOBUFS;
5396         }
5397
5398         return genlmsg_reply(msg, info);
5399 }
5400
5401 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5402 {
5403         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5404         struct net_device *dev = info->user_ptr[1];
5405         u8 *dst = NULL;
5406         u8 *next_hop = NULL;
5407
5408         if (!info->attrs[NL80211_ATTR_MAC])
5409                 return -EINVAL;
5410
5411         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5412                 return -EINVAL;
5413
5414         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5415         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5416
5417         if (!rdev->ops->change_mpath)
5418                 return -EOPNOTSUPP;
5419
5420         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5421                 return -EOPNOTSUPP;
5422
5423         return rdev_change_mpath(rdev, dev, dst, next_hop);
5424 }
5425
5426 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5427 {
5428         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5429         struct net_device *dev = info->user_ptr[1];
5430         u8 *dst = NULL;
5431         u8 *next_hop = NULL;
5432
5433         if (!info->attrs[NL80211_ATTR_MAC])
5434                 return -EINVAL;
5435
5436         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5437                 return -EINVAL;
5438
5439         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5440         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5441
5442         if (!rdev->ops->add_mpath)
5443                 return -EOPNOTSUPP;
5444
5445         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5446                 return -EOPNOTSUPP;
5447
5448         return rdev_add_mpath(rdev, dev, dst, next_hop);
5449 }
5450
5451 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
5452 {
5453         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5454         struct net_device *dev = info->user_ptr[1];
5455         u8 *dst = NULL;
5456
5457         if (info->attrs[NL80211_ATTR_MAC])
5458                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5459
5460         if (!rdev->ops->del_mpath)
5461                 return -EOPNOTSUPP;
5462
5463         return rdev_del_mpath(rdev, dev, dst);
5464 }
5465
5466 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
5467 {
5468         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5469         int err;
5470         struct net_device *dev = info->user_ptr[1];
5471         struct mpath_info pinfo;
5472         struct sk_buff *msg;
5473         u8 *dst = NULL;
5474         u8 mpp[ETH_ALEN];
5475
5476         memset(&pinfo, 0, sizeof(pinfo));
5477
5478         if (!info->attrs[NL80211_ATTR_MAC])
5479                 return -EINVAL;
5480
5481         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5482
5483         if (!rdev->ops->get_mpp)
5484                 return -EOPNOTSUPP;
5485
5486         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5487                 return -EOPNOTSUPP;
5488
5489         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
5490         if (err)
5491                 return err;
5492
5493         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5494         if (!msg)
5495                 return -ENOMEM;
5496
5497         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5498                                dev, dst, mpp, &pinfo) < 0) {
5499                 nlmsg_free(msg);
5500                 return -ENOBUFS;
5501         }
5502
5503         return genlmsg_reply(msg, info);
5504 }
5505
5506 static int nl80211_dump_mpp(struct sk_buff *skb,
5507                             struct netlink_callback *cb)
5508 {
5509         struct mpath_info pinfo;
5510         struct cfg80211_registered_device *rdev;
5511         struct wireless_dev *wdev;
5512         u8 dst[ETH_ALEN];
5513         u8 mpp[ETH_ALEN];
5514         int path_idx = cb->args[2];
5515         int err;
5516
5517         rtnl_lock();
5518         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5519         if (err)
5520                 goto out_err;
5521
5522         if (!rdev->ops->dump_mpp) {
5523                 err = -EOPNOTSUPP;
5524                 goto out_err;
5525         }
5526
5527         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5528                 err = -EOPNOTSUPP;
5529                 goto out_err;
5530         }
5531
5532         while (1) {
5533                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
5534                                     mpp, &pinfo);
5535                 if (err == -ENOENT)
5536                         break;
5537                 if (err)
5538                         goto out_err;
5539
5540                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5541                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5542                                        wdev->netdev, dst, mpp,
5543                                        &pinfo) < 0)
5544                         goto out;
5545
5546                 path_idx++;
5547         }
5548
5549  out:
5550         cb->args[2] = path_idx;
5551         err = skb->len;
5552  out_err:
5553         rtnl_unlock();
5554         return err;
5555 }
5556
5557 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5558 {
5559         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5560         struct net_device *dev = info->user_ptr[1];
5561         struct wireless_dev *wdev = dev->ieee80211_ptr;
5562         struct bss_parameters params;
5563         int err;
5564
5565         memset(&params, 0, sizeof(params));
5566         /* default to not changing parameters */
5567         params.use_cts_prot = -1;
5568         params.use_short_preamble = -1;
5569         params.use_short_slot_time = -1;
5570         params.ap_isolate = -1;
5571         params.ht_opmode = -1;
5572         params.p2p_ctwindow = -1;
5573         params.p2p_opp_ps = -1;
5574
5575         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5576                 params.use_cts_prot =
5577                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5578         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5579                 params.use_short_preamble =
5580                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5581         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5582                 params.use_short_slot_time =
5583                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5584         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5585                 params.basic_rates =
5586                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5587                 params.basic_rates_len =
5588                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5589         }
5590         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5591                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5592         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5593                 params.ht_opmode =
5594                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5595
5596         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5597                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5598                         return -EINVAL;
5599                 params.p2p_ctwindow =
5600                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5601                 if (params.p2p_ctwindow < 0)
5602                         return -EINVAL;
5603                 if (params.p2p_ctwindow != 0 &&
5604                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5605                         return -EINVAL;
5606         }
5607
5608         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5609                 u8 tmp;
5610
5611                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5612                         return -EINVAL;
5613                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5614                 if (tmp > 1)
5615                         return -EINVAL;
5616                 params.p2p_opp_ps = tmp;
5617                 if (params.p2p_opp_ps &&
5618                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5619                         return -EINVAL;
5620         }
5621
5622         if (!rdev->ops->change_bss)
5623                 return -EOPNOTSUPP;
5624
5625         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5626             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5627                 return -EOPNOTSUPP;
5628
5629         wdev_lock(wdev);
5630         err = rdev_change_bss(rdev, dev, &params);
5631         wdev_unlock(wdev);
5632
5633         return err;
5634 }
5635
5636 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5637 {
5638         char *data = NULL;
5639         bool is_indoor;
5640         enum nl80211_user_reg_hint_type user_reg_hint_type;
5641         u32 owner_nlportid;
5642
5643         /*
5644          * You should only get this when cfg80211 hasn't yet initialized
5645          * completely when built-in to the kernel right between the time
5646          * window between nl80211_init() and regulatory_init(), if that is
5647          * even possible.
5648          */
5649         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5650                 return -EINPROGRESS;
5651
5652         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5653                 user_reg_hint_type =
5654                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5655         else
5656                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
5657
5658         switch (user_reg_hint_type) {
5659         case NL80211_USER_REG_HINT_USER:
5660         case NL80211_USER_REG_HINT_CELL_BASE:
5661                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5662                         return -EINVAL;
5663
5664                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5665                 return regulatory_hint_user(data, user_reg_hint_type);
5666         case NL80211_USER_REG_HINT_INDOOR:
5667                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
5668                         owner_nlportid = info->snd_portid;
5669                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
5670                 } else {
5671                         owner_nlportid = 0;
5672                         is_indoor = true;
5673                 }
5674
5675                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
5676         default:
5677                 return -EINVAL;
5678         }
5679 }
5680
5681 static int nl80211_get_mesh_config(struct sk_buff *skb,
5682                                    struct genl_info *info)
5683 {
5684         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5685         struct net_device *dev = info->user_ptr[1];
5686         struct wireless_dev *wdev = dev->ieee80211_ptr;
5687         struct mesh_config cur_params;
5688         int err = 0;
5689         void *hdr;
5690         struct nlattr *pinfoattr;
5691         struct sk_buff *msg;
5692
5693         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5694                 return -EOPNOTSUPP;
5695
5696         if (!rdev->ops->get_mesh_config)
5697                 return -EOPNOTSUPP;
5698
5699         wdev_lock(wdev);
5700         /* If not connected, get default parameters */
5701         if (!wdev->mesh_id_len)
5702                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5703         else
5704                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
5705         wdev_unlock(wdev);
5706
5707         if (err)
5708                 return err;
5709
5710         /* Draw up a netlink message to send back */
5711         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5712         if (!msg)
5713                 return -ENOMEM;
5714         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5715                              NL80211_CMD_GET_MESH_CONFIG);
5716         if (!hdr)
5717                 goto out;
5718         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5719         if (!pinfoattr)
5720                 goto nla_put_failure;
5721         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5722             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5723                         cur_params.dot11MeshRetryTimeout) ||
5724             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5725                         cur_params.dot11MeshConfirmTimeout) ||
5726             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5727                         cur_params.dot11MeshHoldingTimeout) ||
5728             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5729                         cur_params.dot11MeshMaxPeerLinks) ||
5730             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5731                        cur_params.dot11MeshMaxRetries) ||
5732             nla_put_u8(msg, NL80211_MESHCONF_TTL,
5733                        cur_params.dot11MeshTTL) ||
5734             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5735                        cur_params.element_ttl) ||
5736             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5737                        cur_params.auto_open_plinks) ||
5738             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5739                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5740             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5741                        cur_params.dot11MeshHWMPmaxPREQretries) ||
5742             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5743                         cur_params.path_refresh_time) ||
5744             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5745                         cur_params.min_discovery_timeout) ||
5746             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5747                         cur_params.dot11MeshHWMPactivePathTimeout) ||
5748             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5749                         cur_params.dot11MeshHWMPpreqMinInterval) ||
5750             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5751                         cur_params.dot11MeshHWMPperrMinInterval) ||
5752             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5753                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5754             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5755                        cur_params.dot11MeshHWMPRootMode) ||
5756             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5757                         cur_params.dot11MeshHWMPRannInterval) ||
5758             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5759                        cur_params.dot11MeshGateAnnouncementProtocol) ||
5760             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5761                        cur_params.dot11MeshForwarding) ||
5762             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5763                         cur_params.rssi_threshold) ||
5764             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5765                         cur_params.ht_opmode) ||
5766             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5767                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5768             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5769                         cur_params.dot11MeshHWMProotInterval) ||
5770             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5771                         cur_params.dot11MeshHWMPconfirmationInterval) ||
5772             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5773                         cur_params.power_mode) ||
5774             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5775                         cur_params.dot11MeshAwakeWindowDuration) ||
5776             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5777                         cur_params.plink_timeout))
5778                 goto nla_put_failure;
5779         nla_nest_end(msg, pinfoattr);
5780         genlmsg_end(msg, hdr);
5781         return genlmsg_reply(msg, info);
5782
5783  nla_put_failure:
5784         genlmsg_cancel(msg, hdr);
5785  out:
5786         nlmsg_free(msg);
5787         return -ENOBUFS;
5788 }
5789
5790 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5791         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5792         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5793         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5794         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5795         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5796         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5797         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5798         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5799         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5800         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5801         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5802         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5803         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5804         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5805         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5806         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5807         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5808         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5809         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5810         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5811         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5812         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5813         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5814         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5815         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5816         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5817         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5818         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5819 };
5820
5821 static const struct nla_policy
5822         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5823         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5824         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5825         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5826         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5827         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5828         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5829         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5830                                     .len = IEEE80211_MAX_DATA_LEN },
5831         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5832 };
5833
5834 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out)
5835 {
5836         u8 val = nla_get_u8(nla);
5837         if (val < min || val > max)
5838                 return -EINVAL;
5839         *out = val;
5840         return 0;
5841 }
5842
5843 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out)
5844 {
5845         u8 val = nla_get_u8(nla);
5846         if (val < min || val > max)
5847                 return -EINVAL;
5848         *out = val;
5849         return 0;
5850 }
5851
5852 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out)
5853 {
5854         u16 val = nla_get_u16(nla);
5855         if (val < min || val > max)
5856                 return -EINVAL;
5857         *out = val;
5858         return 0;
5859 }
5860
5861 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out)
5862 {
5863         u32 val = nla_get_u32(nla);
5864         if (val < min || val > max)
5865                 return -EINVAL;
5866         *out = val;
5867         return 0;
5868 }
5869
5870 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out)
5871 {
5872         s32 val = nla_get_s32(nla);
5873         if (val < min || val > max)
5874                 return -EINVAL;
5875         *out = val;
5876         return 0;
5877 }
5878
5879 static int nl80211_check_power_mode(const struct nlattr *nla,
5880                                     enum nl80211_mesh_power_mode min,
5881                                     enum nl80211_mesh_power_mode max,
5882                                     enum nl80211_mesh_power_mode *out)
5883 {
5884         u32 val = nla_get_u32(nla);
5885         if (val < min || val > max)
5886                 return -EINVAL;
5887         *out = val;
5888         return 0;
5889 }
5890
5891 static int nl80211_parse_mesh_config(struct genl_info *info,
5892                                      struct mesh_config *cfg,
5893                                      u32 *mask_out)
5894 {
5895         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5896         u32 mask = 0;
5897         u16 ht_opmode;
5898
5899 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5900 do {                                                                        \
5901         if (tb[attr]) {                                                     \
5902                 if (fn(tb[attr], min, max, &cfg->param))                    \
5903                         return -EINVAL;                                     \
5904                 mask |= (1 << (attr - 1));                                  \
5905         }                                                                   \
5906 } while (0)
5907
5908         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5909                 return -EINVAL;
5910         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5911                              info->attrs[NL80211_ATTR_MESH_CONFIG],
5912                              nl80211_meshconf_params_policy, info->extack))
5913                 return -EINVAL;
5914
5915         /* This makes sure that there aren't more than 32 mesh config
5916          * parameters (otherwise our bitfield scheme would not work.) */
5917         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5918
5919         /* Fill in the params struct */
5920         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5921                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5922                                   nl80211_check_u16);
5923         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5924                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5925                                   nl80211_check_u16);
5926         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5927                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5928                                   nl80211_check_u16);
5929         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5930                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5931                                   nl80211_check_u16);
5932         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5933                                   mask, NL80211_MESHCONF_MAX_RETRIES,
5934                                   nl80211_check_u8);
5935         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5936                                   mask, NL80211_MESHCONF_TTL, nl80211_check_u8);
5937         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5938                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
5939                                   nl80211_check_u8);
5940         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5941                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5942                                   nl80211_check_bool);
5943         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5944                                   1, 255, mask,
5945                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5946                                   nl80211_check_u32);
5947         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5948                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5949                                   nl80211_check_u8);
5950         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5951                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5952                                   nl80211_check_u32);
5953         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5954                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5955                                   nl80211_check_u16);
5956         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5957                                   1, 65535, mask,
5958                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5959                                   nl80211_check_u32);
5960         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5961                                   1, 65535, mask,
5962                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5963                                   nl80211_check_u16);
5964         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5965                                   1, 65535, mask,
5966                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5967                                   nl80211_check_u16);
5968         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5969                                   dot11MeshHWMPnetDiameterTraversalTime,
5970                                   1, 65535, mask,
5971                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5972                                   nl80211_check_u16);
5973         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5974                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5975                                   nl80211_check_u8);
5976         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5977                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5978                                   nl80211_check_u16);
5979         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5980                                   dot11MeshGateAnnouncementProtocol, 0, 1,
5981                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5982                                   nl80211_check_bool);
5983         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5984                                   mask, NL80211_MESHCONF_FORWARDING,
5985                                   nl80211_check_bool);
5986         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5987                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5988                                   nl80211_check_s32);
5989         /*
5990          * Check HT operation mode based on
5991          * IEEE 802.11 2012 8.4.2.59 HT Operation element.
5992          */
5993         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
5994                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
5995
5996                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
5997                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
5998                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
5999                         return -EINVAL;
6000
6001                 if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) &&
6002                     (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6003                         return -EINVAL;
6004
6005                 switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) {
6006                 case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
6007                 case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
6008                         if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)
6009                                 return -EINVAL;
6010                         break;
6011                 case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
6012                 case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
6013                         if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6014                                 return -EINVAL;
6015                         break;
6016                 }
6017                 cfg->ht_opmode = ht_opmode;
6018                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
6019         }
6020         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
6021                                   1, 65535, mask,
6022                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6023                                   nl80211_check_u32);
6024         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
6025                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6026                                   nl80211_check_u16);
6027         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6028                                   dot11MeshHWMPconfirmationInterval,
6029                                   1, 65535, mask,
6030                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6031                                   nl80211_check_u16);
6032         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
6033                                   NL80211_MESH_POWER_ACTIVE,
6034                                   NL80211_MESH_POWER_MAX,
6035                                   mask, NL80211_MESHCONF_POWER_MODE,
6036                                   nl80211_check_power_mode);
6037         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
6038                                   0, 65535, mask,
6039                                   NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16);
6040         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
6041                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
6042                                   nl80211_check_u32);
6043         if (mask_out)
6044                 *mask_out = mask;
6045
6046         return 0;
6047
6048 #undef FILL_IN_MESH_PARAM_IF_SET
6049 }
6050
6051 static int nl80211_parse_mesh_setup(struct genl_info *info,
6052                                      struct mesh_setup *setup)
6053 {
6054         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6055         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6056
6057         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6058                 return -EINVAL;
6059         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
6060                              info->attrs[NL80211_ATTR_MESH_SETUP],
6061                              nl80211_mesh_setup_params_policy, info->extack))
6062                 return -EINVAL;
6063
6064         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6065                 setup->sync_method =
6066                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6067                  IEEE80211_SYNC_METHOD_VENDOR :
6068                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6069
6070         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6071                 setup->path_sel_proto =
6072                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6073                  IEEE80211_PATH_PROTOCOL_VENDOR :
6074                  IEEE80211_PATH_PROTOCOL_HWMP;
6075
6076         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6077                 setup->path_metric =
6078                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6079                  IEEE80211_PATH_METRIC_VENDOR :
6080                  IEEE80211_PATH_METRIC_AIRTIME;
6081
6082         if (tb[NL80211_MESH_SETUP_IE]) {
6083                 struct nlattr *ieattr =
6084                         tb[NL80211_MESH_SETUP_IE];
6085                 if (!is_valid_ie_attr(ieattr))
6086                         return -EINVAL;
6087                 setup->ie = nla_data(ieattr);
6088                 setup->ie_len = nla_len(ieattr);
6089         }
6090         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6091             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6092                 return -EINVAL;
6093         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6094         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6095         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6096         if (setup->is_secure)
6097                 setup->user_mpm = true;
6098
6099         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6100                 if (!setup->user_mpm)
6101                         return -EINVAL;
6102                 setup->auth_id =
6103                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6104         }
6105
6106         return 0;
6107 }
6108
6109 static int nl80211_update_mesh_config(struct sk_buff *skb,
6110                                       struct genl_info *info)
6111 {
6112         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6113         struct net_device *dev = info->user_ptr[1];
6114         struct wireless_dev *wdev = dev->ieee80211_ptr;
6115         struct mesh_config cfg;
6116         u32 mask;
6117         int err;
6118
6119         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6120                 return -EOPNOTSUPP;
6121
6122         if (!rdev->ops->update_mesh_config)
6123                 return -EOPNOTSUPP;
6124
6125         err = nl80211_parse_mesh_config(info, &cfg, &mask);
6126         if (err)
6127                 return err;
6128
6129         wdev_lock(wdev);
6130         if (!wdev->mesh_id_len)
6131                 err = -ENOLINK;
6132
6133         if (!err)
6134                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6135
6136         wdev_unlock(wdev);
6137
6138         return err;
6139 }
6140
6141 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6142                               struct sk_buff *msg)
6143 {
6144         struct nlattr *nl_reg_rules;
6145         unsigned int i;
6146
6147         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6148             (regdom->dfs_region &&
6149              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6150                 goto nla_put_failure;
6151
6152         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6153         if (!nl_reg_rules)
6154                 goto nla_put_failure;
6155
6156         for (i = 0; i < regdom->n_reg_rules; i++) {
6157                 struct nlattr *nl_reg_rule;
6158                 const struct ieee80211_reg_rule *reg_rule;
6159                 const struct ieee80211_freq_range *freq_range;
6160                 const struct ieee80211_power_rule *power_rule;
6161                 unsigned int max_bandwidth_khz;
6162
6163                 reg_rule = &regdom->reg_rules[i];
6164                 freq_range = &reg_rule->freq_range;
6165                 power_rule = &reg_rule->power_rule;
6166
6167                 nl_reg_rule = nla_nest_start(msg, i);
6168                 if (!nl_reg_rule)
6169                         goto nla_put_failure;
6170
6171                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6172                 if (!max_bandwidth_khz)
6173                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6174                                                                   reg_rule);
6175
6176                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6177                                 reg_rule->flags) ||
6178                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6179                                 freq_range->start_freq_khz) ||
6180                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6181                                 freq_range->end_freq_khz) ||
6182                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6183                                 max_bandwidth_khz) ||
6184                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6185                                 power_rule->max_antenna_gain) ||
6186                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6187                                 power_rule->max_eirp) ||
6188                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6189                                 reg_rule->dfs_cac_ms))
6190                         goto nla_put_failure;
6191
6192                 nla_nest_end(msg, nl_reg_rule);
6193         }
6194
6195         nla_nest_end(msg, nl_reg_rules);
6196         return 0;
6197
6198 nla_put_failure:
6199         return -EMSGSIZE;
6200 }
6201
6202 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6203 {
6204         const struct ieee80211_regdomain *regdom = NULL;
6205         struct cfg80211_registered_device *rdev;
6206         struct wiphy *wiphy = NULL;
6207         struct sk_buff *msg;
6208         void *hdr;
6209
6210         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6211         if (!msg)
6212                 return -ENOBUFS;
6213
6214         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6215                              NL80211_CMD_GET_REG);
6216         if (!hdr)
6217                 goto put_failure;
6218
6219         if (info->attrs[NL80211_ATTR_WIPHY]) {
6220                 bool self_managed;
6221
6222                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6223                 if (IS_ERR(rdev)) {
6224                         nlmsg_free(msg);
6225                         return PTR_ERR(rdev);
6226                 }
6227
6228                 wiphy = &rdev->wiphy;
6229                 self_managed = wiphy->regulatory_flags &
6230                                REGULATORY_WIPHY_SELF_MANAGED;
6231                 regdom = get_wiphy_regdom(wiphy);
6232
6233                 /* a self-managed-reg device must have a private regdom */
6234                 if (WARN_ON(!regdom && self_managed)) {
6235                         nlmsg_free(msg);
6236                         return -EINVAL;
6237                 }
6238
6239                 if (regdom &&
6240                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6241                         goto nla_put_failure;
6242         }
6243
6244         if (!wiphy && reg_last_request_cell_base() &&
6245             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6246                         NL80211_USER_REG_HINT_CELL_BASE))
6247                 goto nla_put_failure;
6248
6249         rcu_read_lock();
6250
6251         if (!regdom)
6252                 regdom = rcu_dereference(cfg80211_regdomain);
6253
6254         if (nl80211_put_regdom(regdom, msg))
6255                 goto nla_put_failure_rcu;
6256
6257         rcu_read_unlock();
6258
6259         genlmsg_end(msg, hdr);
6260         return genlmsg_reply(msg, info);
6261
6262 nla_put_failure_rcu:
6263         rcu_read_unlock();
6264 nla_put_failure:
6265         genlmsg_cancel(msg, hdr);
6266 put_failure:
6267         nlmsg_free(msg);
6268         return -EMSGSIZE;
6269 }
6270
6271 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6272                                u32 seq, int flags, struct wiphy *wiphy,
6273                                const struct ieee80211_regdomain *regdom)
6274 {
6275         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6276                                    NL80211_CMD_GET_REG);
6277
6278         if (!hdr)
6279                 return -1;
6280
6281         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6282
6283         if (nl80211_put_regdom(regdom, msg))
6284                 goto nla_put_failure;
6285
6286         if (!wiphy && reg_last_request_cell_base() &&
6287             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6288                         NL80211_USER_REG_HINT_CELL_BASE))
6289                 goto nla_put_failure;
6290
6291         if (wiphy &&
6292             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6293                 goto nla_put_failure;
6294
6295         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6296             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6297                 goto nla_put_failure;
6298
6299         genlmsg_end(msg, hdr);
6300         return 0;
6301
6302 nla_put_failure:
6303         genlmsg_cancel(msg, hdr);
6304         return -EMSGSIZE;
6305 }
6306
6307 static int nl80211_get_reg_dump(struct sk_buff *skb,
6308                                 struct netlink_callback *cb)
6309 {
6310         const struct ieee80211_regdomain *regdom = NULL;
6311         struct cfg80211_registered_device *rdev;
6312         int err, reg_idx, start = cb->args[2];
6313
6314         rtnl_lock();
6315
6316         if (cfg80211_regdomain && start == 0) {
6317                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6318                                           NLM_F_MULTI, NULL,
6319                                           rtnl_dereference(cfg80211_regdomain));
6320                 if (err < 0)
6321                         goto out_err;
6322         }
6323
6324         /* the global regdom is idx 0 */
6325         reg_idx = 1;
6326         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6327                 regdom = get_wiphy_regdom(&rdev->wiphy);
6328                 if (!regdom)
6329                         continue;
6330
6331                 if (++reg_idx <= start)
6332                         continue;
6333
6334                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6335                                           NLM_F_MULTI, &rdev->wiphy, regdom);
6336                 if (err < 0) {
6337                         reg_idx--;
6338                         break;
6339                 }
6340         }
6341
6342         cb->args[2] = reg_idx;
6343         err = skb->len;
6344 out_err:
6345         rtnl_unlock();
6346         return err;
6347 }
6348
6349 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6350 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6351         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
6352         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
6353         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
6354         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
6355         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
6356         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
6357         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
6358 };
6359
6360 static int parse_reg_rule(struct nlattr *tb[],
6361         struct ieee80211_reg_rule *reg_rule)
6362 {
6363         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6364         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6365
6366         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6367                 return -EINVAL;
6368         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6369                 return -EINVAL;
6370         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6371                 return -EINVAL;
6372         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6373                 return -EINVAL;
6374         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6375                 return -EINVAL;
6376
6377         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6378
6379         freq_range->start_freq_khz =
6380                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6381         freq_range->end_freq_khz =
6382                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6383         freq_range->max_bandwidth_khz =
6384                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6385
6386         power_rule->max_eirp =
6387                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6388
6389         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6390                 power_rule->max_antenna_gain =
6391                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6392
6393         if (tb[NL80211_ATTR_DFS_CAC_TIME])
6394                 reg_rule->dfs_cac_ms =
6395                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6396
6397         return 0;
6398 }
6399
6400 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6401 {
6402         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6403         struct nlattr *nl_reg_rule;
6404         char *alpha2;
6405         int rem_reg_rules, r;
6406         u32 num_rules = 0, rule_idx = 0, size_of_regd;
6407         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6408         struct ieee80211_regdomain *rd;
6409
6410         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6411                 return -EINVAL;
6412
6413         if (!info->attrs[NL80211_ATTR_REG_RULES])
6414                 return -EINVAL;
6415
6416         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6417
6418         if (info->attrs[NL80211_ATTR_DFS_REGION])
6419                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6420
6421         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6422                             rem_reg_rules) {
6423                 num_rules++;
6424                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6425                         return -EINVAL;
6426         }
6427
6428         if (!reg_is_valid_request(alpha2))
6429                 return -EINVAL;
6430
6431         size_of_regd = sizeof(struct ieee80211_regdomain) +
6432                        num_rules * sizeof(struct ieee80211_reg_rule);
6433
6434         rd = kzalloc(size_of_regd, GFP_KERNEL);
6435         if (!rd)
6436                 return -ENOMEM;
6437
6438         rd->n_reg_rules = num_rules;
6439         rd->alpha2[0] = alpha2[0];
6440         rd->alpha2[1] = alpha2[1];
6441
6442         /*
6443          * Disable DFS master mode if the DFS region was
6444          * not supported or known on this kernel.
6445          */
6446         if (reg_supported_dfs_region(dfs_region))
6447                 rd->dfs_region = dfs_region;
6448
6449         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6450                             rem_reg_rules) {
6451                 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX,
6452                                      nl_reg_rule, reg_rule_policy,
6453                                      info->extack);
6454                 if (r)
6455                         goto bad_reg;
6456                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6457                 if (r)
6458                         goto bad_reg;
6459
6460                 rule_idx++;
6461
6462                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6463                         r = -EINVAL;
6464                         goto bad_reg;
6465                 }
6466         }
6467
6468         /* set_regdom takes ownership of rd */
6469         return set_regdom(rd, REGD_SOURCE_CRDA);
6470  bad_reg:
6471         kfree(rd);
6472         return r;
6473 }
6474 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6475
6476 static int validate_scan_freqs(struct nlattr *freqs)
6477 {
6478         struct nlattr *attr1, *attr2;
6479         int n_channels = 0, tmp1, tmp2;
6480
6481         nla_for_each_nested(attr1, freqs, tmp1)
6482                 if (nla_len(attr1) != sizeof(u32))
6483                         return 0;
6484
6485         nla_for_each_nested(attr1, freqs, tmp1) {
6486                 n_channels++;
6487                 /*
6488                  * Some hardware has a limited channel list for
6489                  * scanning, and it is pretty much nonsensical
6490                  * to scan for a channel twice, so disallow that
6491                  * and don't require drivers to check that the
6492                  * channel list they get isn't longer than what
6493                  * they can scan, as long as they can scan all
6494                  * the channels they registered at once.
6495                  */
6496                 nla_for_each_nested(attr2, freqs, tmp2)
6497                         if (attr1 != attr2 &&
6498                             nla_get_u32(attr1) == nla_get_u32(attr2))
6499                                 return 0;
6500         }
6501
6502         return n_channels;
6503 }
6504
6505 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6506 {
6507         return b < NUM_NL80211_BANDS && wiphy->bands[b];
6508 }
6509
6510 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6511                             struct cfg80211_bss_selection *bss_select)
6512 {
6513         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6514         struct nlattr *nest;
6515         int err;
6516         bool found = false;
6517         int i;
6518
6519         /* only process one nested attribute */
6520         nest = nla_data(nla);
6521         if (!nla_ok(nest, nla_len(nest)))
6522                 return -EINVAL;
6523
6524         err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest,
6525                                nl80211_bss_select_policy, NULL);
6526         if (err)
6527                 return err;
6528
6529         /* only one attribute may be given */
6530         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
6531                 if (attr[i]) {
6532                         if (found)
6533                                 return -EINVAL;
6534                         found = true;
6535                 }
6536         }
6537
6538         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
6539
6540         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
6541                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
6542
6543         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
6544                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
6545                 bss_select->param.band_pref =
6546                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
6547                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
6548                         return -EINVAL;
6549         }
6550
6551         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
6552                 struct nl80211_bss_select_rssi_adjust *adj_param;
6553
6554                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
6555                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
6556                 bss_select->param.adjust.band = adj_param->band;
6557                 bss_select->param.adjust.delta = adj_param->delta;
6558                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
6559                         return -EINVAL;
6560         }
6561
6562         /* user-space did not provide behaviour attribute */
6563         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
6564                 return -EINVAL;
6565
6566         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
6567                 return -EINVAL;
6568
6569         return 0;
6570 }
6571
6572 static int nl80211_parse_random_mac(struct nlattr **attrs,
6573                                     u8 *mac_addr, u8 *mac_addr_mask)
6574 {
6575         int i;
6576
6577         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
6578                 eth_zero_addr(mac_addr);
6579                 eth_zero_addr(mac_addr_mask);
6580                 mac_addr[0] = 0x2;
6581                 mac_addr_mask[0] = 0x3;
6582
6583                 return 0;
6584         }
6585
6586         /* need both or none */
6587         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
6588                 return -EINVAL;
6589
6590         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
6591         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
6592
6593         /* don't allow or configure an mcast address */
6594         if (!is_multicast_ether_addr(mac_addr_mask) ||
6595             is_multicast_ether_addr(mac_addr))
6596                 return -EINVAL;
6597
6598         /*
6599          * allow users to pass a MAC address that has bits set outside
6600          * of the mask, but don't bother drivers with having to deal
6601          * with such bits
6602          */
6603         for (i = 0; i < ETH_ALEN; i++)
6604                 mac_addr[i] &= mac_addr_mask[i];
6605
6606         return 0;
6607 }
6608
6609 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
6610 {
6611         ASSERT_WDEV_LOCK(wdev);
6612
6613         if (!cfg80211_beaconing_iface_active(wdev))
6614                 return true;
6615
6616         if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
6617                 return true;
6618
6619         return regulatory_pre_cac_allowed(wdev->wiphy);
6620 }
6621
6622 static int
6623 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
6624                          void *request, struct nlattr **attrs,
6625                          bool is_sched_scan)
6626 {
6627         u8 *mac_addr, *mac_addr_mask;
6628         u32 *flags;
6629         enum nl80211_feature_flags randomness_flag;
6630
6631         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
6632                 return 0;
6633
6634         if (is_sched_scan) {
6635                 struct cfg80211_sched_scan_request *req = request;
6636
6637                 randomness_flag = wdev ?
6638                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
6639                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6640                 flags = &req->flags;
6641                 mac_addr = req->mac_addr;
6642                 mac_addr_mask = req->mac_addr_mask;
6643         } else {
6644                 struct cfg80211_scan_request *req = request;
6645
6646                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
6647                 flags = &req->flags;
6648                 mac_addr = req->mac_addr;
6649                 mac_addr_mask = req->mac_addr_mask;
6650         }
6651
6652         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
6653
6654         if ((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6655             !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN))
6656                 return -EOPNOTSUPP;
6657
6658         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6659                 int err;
6660
6661                 if (!(wiphy->features & randomness_flag) ||
6662                     (wdev && wdev->current_bss))
6663                         return -EOPNOTSUPP;
6664
6665                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
6666                 if (err)
6667                         return err;
6668         }
6669
6670         if ((*flags & NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME) &&
6671             !wiphy_ext_feature_isset(wiphy,
6672                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME))
6673                 return -EOPNOTSUPP;
6674
6675         if ((*flags & NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP) &&
6676            !wiphy_ext_feature_isset(wiphy,
6677                                     NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP))
6678                 return -EOPNOTSUPP;
6679
6680         if ((*flags & NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) &&
6681             !wiphy_ext_feature_isset(wiphy,
6682                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION))
6683                 return -EOPNOTSUPP;
6684
6685         if ((*flags & NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE) &&
6686             !wiphy_ext_feature_isset(wiphy,
6687                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE))
6688                 return -EOPNOTSUPP;
6689
6690         return 0;
6691 }
6692
6693 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
6694 {
6695         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6696         struct wireless_dev *wdev = info->user_ptr[1];
6697         struct cfg80211_scan_request *request;
6698         struct nlattr *attr;
6699         struct wiphy *wiphy;
6700         int err, tmp, n_ssids = 0, n_channels, i;
6701         size_t ie_len;
6702
6703         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6704                 return -EINVAL;
6705
6706         wiphy = &rdev->wiphy;
6707
6708         if (wdev->iftype == NL80211_IFTYPE_NAN)
6709                 return -EOPNOTSUPP;
6710
6711         if (!rdev->ops->scan)
6712                 return -EOPNOTSUPP;
6713
6714         if (rdev->scan_req || rdev->scan_msg) {
6715                 err = -EBUSY;
6716                 goto unlock;
6717         }
6718
6719         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6720                 n_channels = validate_scan_freqs(
6721                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6722                 if (!n_channels) {
6723                         err = -EINVAL;
6724                         goto unlock;
6725                 }
6726         } else {
6727                 n_channels = ieee80211_get_num_supported_channels(wiphy);
6728         }
6729
6730         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
6731                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
6732                         n_ssids++;
6733
6734         if (n_ssids > wiphy->max_scan_ssids) {
6735                 err = -EINVAL;
6736                 goto unlock;
6737         }
6738
6739         if (info->attrs[NL80211_ATTR_IE])
6740                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6741         else
6742                 ie_len = 0;
6743
6744         if (ie_len > wiphy->max_scan_ie_len) {
6745                 err = -EINVAL;
6746                 goto unlock;
6747         }
6748
6749         request = kzalloc(sizeof(*request)
6750                         + sizeof(*request->ssids) * n_ssids
6751                         + sizeof(*request->channels) * n_channels
6752                         + ie_len, GFP_KERNEL);
6753         if (!request) {
6754                 err = -ENOMEM;
6755                 goto unlock;
6756         }
6757
6758         if (n_ssids)
6759                 request->ssids = (void *)&request->channels[n_channels];
6760         request->n_ssids = n_ssids;
6761         if (ie_len) {
6762                 if (n_ssids)
6763                         request->ie = (void *)(request->ssids + n_ssids);
6764                 else
6765                         request->ie = (void *)(request->channels + n_channels);
6766         }
6767
6768         i = 0;
6769         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6770                 /* user specified, bail out if channel not found */
6771                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
6772                         struct ieee80211_channel *chan;
6773
6774                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6775
6776                         if (!chan) {
6777                                 err = -EINVAL;
6778                                 goto out_free;
6779                         }
6780
6781                         /* ignore disabled channels */
6782                         if (chan->flags & IEEE80211_CHAN_DISABLED)
6783                                 continue;
6784
6785                         request->channels[i] = chan;
6786                         i++;
6787                 }
6788         } else {
6789                 enum nl80211_band band;
6790
6791                 /* all channels */
6792                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
6793                         int j;
6794
6795                         if (!wiphy->bands[band])
6796                                 continue;
6797                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6798                                 struct ieee80211_channel *chan;
6799
6800                                 chan = &wiphy->bands[band]->channels[j];
6801
6802                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
6803                                         continue;
6804
6805                                 request->channels[i] = chan;
6806                                 i++;
6807                         }
6808                 }
6809         }
6810
6811         if (!i) {
6812                 err = -EINVAL;
6813                 goto out_free;
6814         }
6815
6816         request->n_channels = i;
6817
6818         wdev_lock(wdev);
6819         if (!cfg80211_off_channel_oper_allowed(wdev)) {
6820                 struct ieee80211_channel *chan;
6821
6822                 if (request->n_channels != 1) {
6823                         wdev_unlock(wdev);
6824                         err = -EBUSY;
6825                         goto out_free;
6826                 }
6827
6828                 chan = request->channels[0];
6829                 if (chan->center_freq != wdev->chandef.chan->center_freq) {
6830                         wdev_unlock(wdev);
6831                         err = -EBUSY;
6832                         goto out_free;
6833                 }
6834         }
6835         wdev_unlock(wdev);
6836
6837         i = 0;
6838         if (n_ssids) {
6839                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
6840                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6841                                 err = -EINVAL;
6842                                 goto out_free;
6843                         }
6844                         request->ssids[i].ssid_len = nla_len(attr);
6845                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
6846                         i++;
6847                 }
6848         }
6849
6850         if (info->attrs[NL80211_ATTR_IE]) {
6851                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6852                 memcpy((void *)request->ie,
6853                        nla_data(info->attrs[NL80211_ATTR_IE]),
6854                        request->ie_len);
6855         }
6856
6857         for (i = 0; i < NUM_NL80211_BANDS; i++)
6858                 if (wiphy->bands[i])
6859                         request->rates[i] =
6860                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
6861
6862         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
6863                 nla_for_each_nested(attr,
6864                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
6865                                     tmp) {
6866                         enum nl80211_band band = nla_type(attr);
6867
6868                         if (band < 0 || band >= NUM_NL80211_BANDS) {
6869                                 err = -EINVAL;
6870                                 goto out_free;
6871                         }
6872
6873                         if (!wiphy->bands[band])
6874                                 continue;
6875
6876                         err = ieee80211_get_ratemask(wiphy->bands[band],
6877                                                      nla_data(attr),
6878                                                      nla_len(attr),
6879                                                      &request->rates[band]);
6880                         if (err)
6881                                 goto out_free;
6882                 }
6883         }
6884
6885         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
6886                 if (!wiphy_ext_feature_isset(wiphy,
6887                                         NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
6888                         err = -EOPNOTSUPP;
6889                         goto out_free;
6890                 }
6891
6892                 request->duration =
6893                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
6894                 request->duration_mandatory =
6895                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
6896         }
6897
6898         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
6899                                        false);
6900         if (err)
6901                 goto out_free;
6902
6903         request->no_cck =
6904                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6905
6906         /* Initial implementation used NL80211_ATTR_MAC to set the specific
6907          * BSSID to scan for. This was problematic because that same attribute
6908          * was already used for another purpose (local random MAC address). The
6909          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
6910          * compatibility with older userspace components, also use the
6911          * NL80211_ATTR_MAC value here if it can be determined to be used for
6912          * the specific BSSID use case instead of the random MAC address
6913          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
6914          */
6915         if (info->attrs[NL80211_ATTR_BSSID])
6916                 memcpy(request->bssid,
6917                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
6918         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
6919                  info->attrs[NL80211_ATTR_MAC])
6920                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
6921                        ETH_ALEN);
6922         else
6923                 eth_broadcast_addr(request->bssid);
6924
6925         request->wdev = wdev;
6926         request->wiphy = &rdev->wiphy;
6927         request->scan_start = jiffies;
6928
6929         rdev->scan_req = request;
6930         err = rdev_scan(rdev, request);
6931
6932         if (!err) {
6933                 nl80211_send_scan_start(rdev, wdev);
6934                 if (wdev->netdev)
6935                         dev_hold(wdev->netdev);
6936         } else {
6937  out_free:
6938                 rdev->scan_req = NULL;
6939                 kfree(request);
6940         }
6941
6942  unlock:
6943         return err;
6944 }
6945
6946 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
6947 {
6948         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6949         struct wireless_dev *wdev = info->user_ptr[1];
6950
6951         if (!rdev->ops->abort_scan)
6952                 return -EOPNOTSUPP;
6953
6954         if (rdev->scan_msg)
6955                 return 0;
6956
6957         if (!rdev->scan_req)
6958                 return -ENOENT;
6959
6960         rdev_abort_scan(rdev, wdev);
6961         return 0;
6962 }
6963
6964 static int
6965 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
6966                                struct cfg80211_sched_scan_request *request,
6967                                struct nlattr **attrs)
6968 {
6969         int tmp, err, i = 0;
6970         struct nlattr *attr;
6971
6972         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6973                 u32 interval;
6974
6975                 /*
6976                  * If scan plans are not specified,
6977                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
6978                  * case one scan plan will be set with the specified scan
6979                  * interval and infinite number of iterations.
6980                  */
6981                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
6982                 if (!interval)
6983                         return -EINVAL;
6984
6985                 request->scan_plans[0].interval =
6986                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
6987                 if (!request->scan_plans[0].interval)
6988                         return -EINVAL;
6989
6990                 if (request->scan_plans[0].interval >
6991                     wiphy->max_sched_scan_plan_interval)
6992                         request->scan_plans[0].interval =
6993                                 wiphy->max_sched_scan_plan_interval;
6994
6995                 return 0;
6996         }
6997
6998         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
6999                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
7000
7001                 if (WARN_ON(i >= n_plans))
7002                         return -EINVAL;
7003
7004                 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX,
7005                                        attr, nl80211_plan_policy, NULL);
7006                 if (err)
7007                         return err;
7008
7009                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
7010                         return -EINVAL;
7011
7012                 request->scan_plans[i].interval =
7013                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
7014                 if (!request->scan_plans[i].interval ||
7015                     request->scan_plans[i].interval >
7016                     wiphy->max_sched_scan_plan_interval)
7017                         return -EINVAL;
7018
7019                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
7020                         request->scan_plans[i].iterations =
7021                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
7022                         if (!request->scan_plans[i].iterations ||
7023                             (request->scan_plans[i].iterations >
7024                              wiphy->max_sched_scan_plan_iterations))
7025                                 return -EINVAL;
7026                 } else if (i < n_plans - 1) {
7027                         /*
7028                          * All scan plans but the last one must specify
7029                          * a finite number of iterations
7030                          */
7031                         return -EINVAL;
7032                 }
7033
7034                 i++;
7035         }
7036
7037         /*
7038          * The last scan plan must not specify the number of
7039          * iterations, it is supposed to run infinitely
7040          */
7041         if (request->scan_plans[n_plans - 1].iterations)
7042                 return  -EINVAL;
7043
7044         return 0;
7045 }
7046
7047 static struct cfg80211_sched_scan_request *
7048 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
7049                          struct nlattr **attrs, int max_match_sets)
7050 {
7051         struct cfg80211_sched_scan_request *request;
7052         struct nlattr *attr;
7053         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
7054         enum nl80211_band band;
7055         size_t ie_len;
7056         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
7057         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
7058
7059         if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
7060                 return ERR_PTR(-EINVAL);
7061
7062         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7063                 n_channels = validate_scan_freqs(
7064                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7065                 if (!n_channels)
7066                         return ERR_PTR(-EINVAL);
7067         } else {
7068                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7069         }
7070
7071         if (attrs[NL80211_ATTR_SCAN_SSIDS])
7072                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7073                                     tmp)
7074                         n_ssids++;
7075
7076         if (n_ssids > wiphy->max_sched_scan_ssids)
7077                 return ERR_PTR(-EINVAL);
7078
7079         /*
7080          * First, count the number of 'real' matchsets. Due to an issue with
7081          * the old implementation, matchsets containing only the RSSI attribute
7082          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
7083          * RSSI for all matchsets, rather than their own matchset for reporting
7084          * all APs with a strong RSSI. This is needed to be compatible with
7085          * older userspace that treated a matchset with only the RSSI as the
7086          * global RSSI for all other matchsets - if there are other matchsets.
7087          */
7088         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7089                 nla_for_each_nested(attr,
7090                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7091                                     tmp) {
7092                         struct nlattr *rssi;
7093
7094                         err = nla_parse_nested(tb,
7095                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7096                                                attr, nl80211_match_policy,
7097                                                NULL);
7098                         if (err)
7099                                 return ERR_PTR(err);
7100
7101                         /* SSID and BSSID are mutually exclusive */
7102                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
7103                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
7104                                 return ERR_PTR(-EINVAL);
7105
7106                         /* add other standalone attributes here */
7107                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
7108                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
7109                                 n_match_sets++;
7110                                 continue;
7111                         }
7112                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7113                         if (rssi)
7114                                 default_match_rssi = nla_get_s32(rssi);
7115                 }
7116         }
7117
7118         /* However, if there's no other matchset, add the RSSI one */
7119         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
7120                 n_match_sets = 1;
7121
7122         if (n_match_sets > max_match_sets)
7123                 return ERR_PTR(-EINVAL);
7124
7125         if (attrs[NL80211_ATTR_IE])
7126                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
7127         else
7128                 ie_len = 0;
7129
7130         if (ie_len > wiphy->max_sched_scan_ie_len)
7131                 return ERR_PTR(-EINVAL);
7132
7133         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7134                 /*
7135                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
7136                  * each scan plan already specifies its own interval
7137                  */
7138                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7139                         return ERR_PTR(-EINVAL);
7140
7141                 nla_for_each_nested(attr,
7142                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7143                         n_plans++;
7144         } else {
7145                 /*
7146                  * The scan interval attribute is kept for backward
7147                  * compatibility. If no scan plans are specified and sched scan
7148                  * interval is specified, one scan plan will be set with this
7149                  * scan interval and infinite number of iterations.
7150                  */
7151                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7152                         return ERR_PTR(-EINVAL);
7153
7154                 n_plans = 1;
7155         }
7156
7157         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
7158                 return ERR_PTR(-EINVAL);
7159
7160         if (!wiphy_ext_feature_isset(
7161                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
7162             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
7163              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
7164                 return ERR_PTR(-EINVAL);
7165
7166         request = kzalloc(sizeof(*request)
7167                         + sizeof(*request->ssids) * n_ssids
7168                         + sizeof(*request->match_sets) * n_match_sets
7169                         + sizeof(*request->scan_plans) * n_plans
7170                         + sizeof(*request->channels) * n_channels
7171                         + ie_len, GFP_KERNEL);
7172         if (!request)
7173                 return ERR_PTR(-ENOMEM);
7174
7175         if (n_ssids)
7176                 request->ssids = (void *)&request->channels[n_channels];
7177         request->n_ssids = n_ssids;
7178         if (ie_len) {
7179                 if (n_ssids)
7180                         request->ie = (void *)(request->ssids + n_ssids);
7181                 else
7182                         request->ie = (void *)(request->channels + n_channels);
7183         }
7184
7185         if (n_match_sets) {
7186                 if (request->ie)
7187                         request->match_sets = (void *)(request->ie + ie_len);
7188                 else if (n_ssids)
7189                         request->match_sets =
7190                                 (void *)(request->ssids + n_ssids);
7191                 else
7192                         request->match_sets =
7193                                 (void *)(request->channels + n_channels);
7194         }
7195         request->n_match_sets = n_match_sets;
7196
7197         if (n_match_sets)
7198                 request->scan_plans = (void *)(request->match_sets +
7199                                                n_match_sets);
7200         else if (request->ie)
7201                 request->scan_plans = (void *)(request->ie + ie_len);
7202         else if (n_ssids)
7203                 request->scan_plans = (void *)(request->ssids + n_ssids);
7204         else
7205                 request->scan_plans = (void *)(request->channels + n_channels);
7206
7207         request->n_scan_plans = n_plans;
7208
7209         i = 0;
7210         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7211                 /* user specified, bail out if channel not found */
7212                 nla_for_each_nested(attr,
7213                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7214                                     tmp) {
7215                         struct ieee80211_channel *chan;
7216
7217                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7218
7219                         if (!chan) {
7220                                 err = -EINVAL;
7221                                 goto out_free;
7222                         }
7223
7224                         /* ignore disabled channels */
7225                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7226                                 continue;
7227
7228                         request->channels[i] = chan;
7229                         i++;
7230                 }
7231         } else {
7232                 /* all channels */
7233                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7234                         int j;
7235
7236                         if (!wiphy->bands[band])
7237                                 continue;
7238                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7239                                 struct ieee80211_channel *chan;
7240
7241                                 chan = &wiphy->bands[band]->channels[j];
7242
7243                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7244                                         continue;
7245
7246                                 request->channels[i] = chan;
7247                                 i++;
7248                         }
7249                 }
7250         }
7251
7252         if (!i) {
7253                 err = -EINVAL;
7254                 goto out_free;
7255         }
7256
7257         request->n_channels = i;
7258
7259         i = 0;
7260         if (n_ssids) {
7261                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7262                                     tmp) {
7263                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7264                                 err = -EINVAL;
7265                                 goto out_free;
7266                         }
7267                         request->ssids[i].ssid_len = nla_len(attr);
7268                         memcpy(request->ssids[i].ssid, nla_data(attr),
7269                                nla_len(attr));
7270                         i++;
7271                 }
7272         }
7273
7274         i = 0;
7275         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7276                 nla_for_each_nested(attr,
7277                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7278                                     tmp) {
7279                         struct nlattr *ssid, *bssid, *rssi;
7280
7281                         err = nla_parse_nested(tb,
7282                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7283                                                attr, nl80211_match_policy,
7284                                                NULL);
7285                         if (err)
7286                                 goto out_free;
7287                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7288                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
7289                         if (ssid || bssid) {
7290                                 if (WARN_ON(i >= n_match_sets)) {
7291                                         /* this indicates a programming error,
7292                                          * the loop above should have verified
7293                                          * things properly
7294                                          */
7295                                         err = -EINVAL;
7296                                         goto out_free;
7297                                 }
7298
7299                                 if (ssid) {
7300                                         if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7301                                                 err = -EINVAL;
7302                                                 goto out_free;
7303                                         }
7304                                         memcpy(request->match_sets[i].ssid.ssid,
7305                                                nla_data(ssid), nla_len(ssid));
7306                                         request->match_sets[i].ssid.ssid_len =
7307                                                 nla_len(ssid);
7308                                 }
7309                                 if (bssid) {
7310                                         if (nla_len(bssid) != ETH_ALEN) {
7311                                                 err = -EINVAL;
7312                                                 goto out_free;
7313                                         }
7314                                         memcpy(request->match_sets[i].bssid,
7315                                                nla_data(bssid), ETH_ALEN);
7316                                 }
7317
7318                                 /* special attribute - old implementation w/a */
7319                                 request->match_sets[i].rssi_thold =
7320                                         default_match_rssi;
7321                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7322                                 if (rssi)
7323                                         request->match_sets[i].rssi_thold =
7324                                                 nla_get_s32(rssi);
7325                         }
7326                         i++;
7327                 }
7328
7329                 /* there was no other matchset, so the RSSI one is alone */
7330                 if (i == 0 && n_match_sets)
7331                         request->match_sets[0].rssi_thold = default_match_rssi;
7332
7333                 request->min_rssi_thold = INT_MAX;
7334                 for (i = 0; i < n_match_sets; i++)
7335                         request->min_rssi_thold =
7336                                 min(request->match_sets[i].rssi_thold,
7337                                     request->min_rssi_thold);
7338         } else {
7339                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7340         }
7341
7342         if (ie_len) {
7343                 request->ie_len = ie_len;
7344                 memcpy((void *)request->ie,
7345                        nla_data(attrs[NL80211_ATTR_IE]),
7346                        request->ie_len);
7347         }
7348
7349         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
7350         if (err)
7351                 goto out_free;
7352
7353         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7354                 request->delay =
7355                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7356
7357         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
7358                 request->relative_rssi = nla_get_s8(
7359                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
7360                 request->relative_rssi_set = true;
7361         }
7362
7363         if (request->relative_rssi_set &&
7364             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
7365                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
7366
7367                 rssi_adjust = nla_data(
7368                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
7369                 request->rssi_adjust.band = rssi_adjust->band;
7370                 request->rssi_adjust.delta = rssi_adjust->delta;
7371                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
7372                         err = -EINVAL;
7373                         goto out_free;
7374                 }
7375         }
7376
7377         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7378         if (err)
7379                 goto out_free;
7380
7381         request->scan_start = jiffies;
7382
7383         return request;
7384
7385 out_free:
7386         kfree(request);
7387         return ERR_PTR(err);
7388 }
7389
7390 static int nl80211_start_sched_scan(struct sk_buff *skb,
7391                                     struct genl_info *info)
7392 {
7393         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7394         struct net_device *dev = info->user_ptr[1];
7395         struct wireless_dev *wdev = dev->ieee80211_ptr;
7396         struct cfg80211_sched_scan_request *sched_scan_req;
7397         bool want_multi;
7398         int err;
7399
7400         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
7401                 return -EOPNOTSUPP;
7402
7403         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
7404         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
7405         if (err)
7406                 return err;
7407
7408         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
7409                                                   info->attrs,
7410                                                   rdev->wiphy.max_match_sets);
7411
7412         err = PTR_ERR_OR_ZERO(sched_scan_req);
7413         if (err)
7414                 goto out_err;
7415
7416         /* leave request id zero for legacy request
7417          * or if driver does not support multi-scheduled scan
7418          */
7419         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) {
7420                 while (!sched_scan_req->reqid)
7421                         sched_scan_req->reqid = rdev->wiphy.cookie_counter++;
7422         }
7423
7424         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
7425         if (err)
7426                 goto out_free;
7427
7428         sched_scan_req->dev = dev;
7429         sched_scan_req->wiphy = &rdev->wiphy;
7430
7431         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
7432                 sched_scan_req->owner_nlportid = info->snd_portid;
7433
7434         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
7435
7436         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
7437         return 0;
7438
7439 out_free:
7440         kfree(sched_scan_req);
7441 out_err:
7442         return err;
7443 }
7444
7445 static int nl80211_stop_sched_scan(struct sk_buff *skb,
7446                                    struct genl_info *info)
7447 {
7448         struct cfg80211_sched_scan_request *req;
7449         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7450         u64 cookie;
7451
7452         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
7453                 return -EOPNOTSUPP;
7454
7455         if (info->attrs[NL80211_ATTR_COOKIE]) {
7456                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7457                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
7458         }
7459
7460         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
7461                                      struct cfg80211_sched_scan_request,
7462                                      list);
7463         if (!req || req->reqid ||
7464             (req->owner_nlportid &&
7465              req->owner_nlportid != info->snd_portid))
7466                 return -ENOENT;
7467
7468         return cfg80211_stop_sched_scan_req(rdev, req, false);
7469 }
7470
7471 static int nl80211_start_radar_detection(struct sk_buff *skb,
7472                                          struct genl_info *info)
7473 {
7474         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7475         struct net_device *dev = info->user_ptr[1];
7476         struct wireless_dev *wdev = dev->ieee80211_ptr;
7477         struct cfg80211_chan_def chandef;
7478         enum nl80211_dfs_regions dfs_region;
7479         unsigned int cac_time_ms;
7480         int err;
7481
7482         dfs_region = reg_get_dfs_region(wdev->wiphy);
7483         if (dfs_region == NL80211_DFS_UNSET)
7484                 return -EINVAL;
7485
7486         err = nl80211_parse_chandef(rdev, info, &chandef);
7487         if (err)
7488                 return err;
7489
7490         if (netif_carrier_ok(dev))
7491                 return -EBUSY;
7492
7493         if (wdev->cac_started)
7494                 return -EBUSY;
7495
7496         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
7497                                             wdev->iftype);
7498         if (err < 0)
7499                 return err;
7500
7501         if (err == 0)
7502                 return -EINVAL;
7503
7504         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
7505                 return -EINVAL;
7506
7507         if (!rdev->ops->start_radar_detection)
7508                 return -EOPNOTSUPP;
7509
7510         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
7511         if (WARN_ON(!cac_time_ms))
7512                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
7513
7514         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
7515         if (!err) {
7516                 wdev->chandef = chandef;
7517                 wdev->cac_started = true;
7518                 wdev->cac_start_time = jiffies;
7519                 wdev->cac_time_ms = cac_time_ms;
7520         }
7521         return err;
7522 }
7523
7524 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
7525 {
7526         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7527         struct net_device *dev = info->user_ptr[1];
7528         struct wireless_dev *wdev = dev->ieee80211_ptr;
7529         struct cfg80211_csa_settings params;
7530         /* csa_attrs is defined static to avoid waste of stack size - this
7531          * function is called under RTNL lock, so this should not be a problem.
7532          */
7533         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
7534         int err;
7535         bool need_new_beacon = false;
7536         bool need_handle_dfs_flag = true;
7537         int len, i;
7538         u32 cs_count;
7539
7540         if (!rdev->ops->channel_switch ||
7541             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
7542                 return -EOPNOTSUPP;
7543
7544         switch (dev->ieee80211_ptr->iftype) {
7545         case NL80211_IFTYPE_AP:
7546         case NL80211_IFTYPE_P2P_GO:
7547                 need_new_beacon = true;
7548                 /* For all modes except AP the handle_dfs flag needs to be
7549                  * supplied to tell the kernel that userspace will handle radar
7550                  * events when they happen. Otherwise a switch to a channel
7551                  * requiring DFS will be rejected.
7552                  */
7553                 need_handle_dfs_flag = false;
7554
7555                 /* useless if AP is not running */
7556                 if (!wdev->beacon_interval)
7557                         return -ENOTCONN;
7558                 break;
7559         case NL80211_IFTYPE_ADHOC:
7560                 if (!wdev->ssid_len)
7561                         return -ENOTCONN;
7562                 break;
7563         case NL80211_IFTYPE_MESH_POINT:
7564                 if (!wdev->mesh_id_len)
7565                         return -ENOTCONN;
7566                 break;
7567         default:
7568                 return -EOPNOTSUPP;
7569         }
7570
7571         memset(&params, 0, sizeof(params));
7572
7573         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7574             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
7575                 return -EINVAL;
7576
7577         /* only important for AP, IBSS and mesh create IEs internally */
7578         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
7579                 return -EINVAL;
7580
7581         /* Even though the attribute is u32, the specification says
7582          * u8, so let's make sure we don't overflow.
7583          */
7584         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
7585         if (cs_count > 255)
7586                 return -EINVAL;
7587
7588         params.count = cs_count;
7589
7590         if (!need_new_beacon)
7591                 goto skip_beacons;
7592
7593         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
7594         if (err)
7595                 return err;
7596
7597         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
7598                                info->attrs[NL80211_ATTR_CSA_IES],
7599                                nl80211_policy, info->extack);
7600         if (err)
7601                 return err;
7602
7603         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
7604         if (err)
7605                 return err;
7606
7607         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
7608                 return -EINVAL;
7609
7610         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7611         if (!len || (len % sizeof(u16)))
7612                 return -EINVAL;
7613
7614         params.n_counter_offsets_beacon = len / sizeof(u16);
7615         if (rdev->wiphy.max_num_csa_counters &&
7616             (params.n_counter_offsets_beacon >
7617              rdev->wiphy.max_num_csa_counters))
7618                 return -EINVAL;
7619
7620         params.counter_offsets_beacon =
7621                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7622
7623         /* sanity checks - counters should fit and be the same */
7624         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
7625                 u16 offset = params.counter_offsets_beacon[i];
7626
7627                 if (offset >= params.beacon_csa.tail_len)
7628                         return -EINVAL;
7629
7630                 if (params.beacon_csa.tail[offset] != params.count)
7631                         return -EINVAL;
7632         }
7633
7634         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
7635                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7636                 if (!len || (len % sizeof(u16)))
7637                         return -EINVAL;
7638
7639                 params.n_counter_offsets_presp = len / sizeof(u16);
7640                 if (rdev->wiphy.max_num_csa_counters &&
7641                     (params.n_counter_offsets_presp >
7642                      rdev->wiphy.max_num_csa_counters))
7643                         return -EINVAL;
7644
7645                 params.counter_offsets_presp =
7646                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7647
7648                 /* sanity checks - counters should fit and be the same */
7649                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
7650                         u16 offset = params.counter_offsets_presp[i];
7651
7652                         if (offset >= params.beacon_csa.probe_resp_len)
7653                                 return -EINVAL;
7654
7655                         if (params.beacon_csa.probe_resp[offset] !=
7656                             params.count)
7657                                 return -EINVAL;
7658                 }
7659         }
7660
7661 skip_beacons:
7662         err = nl80211_parse_chandef(rdev, info, &params.chandef);
7663         if (err)
7664                 return err;
7665
7666         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
7667                                            wdev->iftype))
7668                 return -EINVAL;
7669
7670         err = cfg80211_chandef_dfs_required(wdev->wiphy,
7671                                             &params.chandef,
7672                                             wdev->iftype);
7673         if (err < 0)
7674                 return err;
7675
7676         if (err > 0) {
7677                 params.radar_required = true;
7678                 if (need_handle_dfs_flag &&
7679                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
7680                         return -EINVAL;
7681                 }
7682         }
7683
7684         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
7685                 params.block_tx = true;
7686
7687         wdev_lock(wdev);
7688         err = rdev_channel_switch(rdev, dev, &params);
7689         wdev_unlock(wdev);
7690
7691         return err;
7692 }
7693
7694 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
7695                             u32 seq, int flags,
7696                             struct cfg80211_registered_device *rdev,
7697                             struct wireless_dev *wdev,
7698                             struct cfg80211_internal_bss *intbss)
7699 {
7700         struct cfg80211_bss *res = &intbss->pub;
7701         const struct cfg80211_bss_ies *ies;
7702         void *hdr;
7703         struct nlattr *bss;
7704
7705         ASSERT_WDEV_LOCK(wdev);
7706
7707         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7708                              NL80211_CMD_NEW_SCAN_RESULTS);
7709         if (!hdr)
7710                 return -1;
7711
7712         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
7713
7714         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
7715                 goto nla_put_failure;
7716         if (wdev->netdev &&
7717             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
7718                 goto nla_put_failure;
7719         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
7720                               NL80211_ATTR_PAD))
7721                 goto nla_put_failure;
7722
7723         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
7724         if (!bss)
7725                 goto nla_put_failure;
7726         if ((!is_zero_ether_addr(res->bssid) &&
7727              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
7728                 goto nla_put_failure;
7729
7730         rcu_read_lock();
7731         /* indicate whether we have probe response data or not */
7732         if (rcu_access_pointer(res->proberesp_ies) &&
7733             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
7734                 goto fail_unlock_rcu;
7735
7736         /* this pointer prefers to be pointed to probe response data
7737          * but is always valid
7738          */
7739         ies = rcu_dereference(res->ies);
7740         if (ies) {
7741                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
7742                                       NL80211_BSS_PAD))
7743                         goto fail_unlock_rcu;
7744                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
7745                                         ies->len, ies->data))
7746                         goto fail_unlock_rcu;
7747         }
7748
7749         /* and this pointer is always (unless driver didn't know) beacon data */
7750         ies = rcu_dereference(res->beacon_ies);
7751         if (ies && ies->from_beacon) {
7752                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
7753                                       NL80211_BSS_PAD))
7754                         goto fail_unlock_rcu;
7755                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
7756                                         ies->len, ies->data))
7757                         goto fail_unlock_rcu;
7758         }
7759         rcu_read_unlock();
7760
7761         if (res->beacon_interval &&
7762             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
7763                 goto nla_put_failure;
7764         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
7765             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
7766             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
7767             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
7768                         jiffies_to_msecs(jiffies - intbss->ts)))
7769                 goto nla_put_failure;
7770
7771         if (intbss->parent_tsf &&
7772             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
7773                                intbss->parent_tsf, NL80211_BSS_PAD) ||
7774              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
7775                      intbss->parent_bssid)))
7776                 goto nla_put_failure;
7777
7778         if (intbss->ts_boottime &&
7779             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
7780                               intbss->ts_boottime, NL80211_BSS_PAD))
7781                 goto nla_put_failure;
7782
7783         switch (rdev->wiphy.signal_type) {
7784         case CFG80211_SIGNAL_TYPE_MBM:
7785                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
7786                         goto nla_put_failure;
7787                 break;
7788         case CFG80211_SIGNAL_TYPE_UNSPEC:
7789                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
7790                         goto nla_put_failure;
7791                 break;
7792         default:
7793                 break;
7794         }
7795
7796         switch (wdev->iftype) {
7797         case NL80211_IFTYPE_P2P_CLIENT:
7798         case NL80211_IFTYPE_STATION:
7799                 if (intbss == wdev->current_bss &&
7800                     nla_put_u32(msg, NL80211_BSS_STATUS,
7801                                 NL80211_BSS_STATUS_ASSOCIATED))
7802                         goto nla_put_failure;
7803                 break;
7804         case NL80211_IFTYPE_ADHOC:
7805                 if (intbss == wdev->current_bss &&
7806                     nla_put_u32(msg, NL80211_BSS_STATUS,
7807                                 NL80211_BSS_STATUS_IBSS_JOINED))
7808                         goto nla_put_failure;
7809                 break;
7810         default:
7811                 break;
7812         }
7813
7814         nla_nest_end(msg, bss);
7815
7816         genlmsg_end(msg, hdr);
7817         return 0;
7818
7819  fail_unlock_rcu:
7820         rcu_read_unlock();
7821  nla_put_failure:
7822         genlmsg_cancel(msg, hdr);
7823         return -EMSGSIZE;
7824 }
7825
7826 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
7827 {
7828         struct cfg80211_registered_device *rdev;
7829         struct cfg80211_internal_bss *scan;
7830         struct wireless_dev *wdev;
7831         int start = cb->args[2], idx = 0;
7832         int err;
7833
7834         rtnl_lock();
7835         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7836         if (err) {
7837                 rtnl_unlock();
7838                 return err;
7839         }
7840
7841         wdev_lock(wdev);
7842         spin_lock_bh(&rdev->bss_lock);
7843         cfg80211_bss_expire(rdev);
7844
7845         cb->seq = rdev->bss_generation;
7846
7847         list_for_each_entry(scan, &rdev->bss_list, list) {
7848                 if (++idx <= start)
7849                         continue;
7850                 if (nl80211_send_bss(skb, cb,
7851                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7852                                 rdev, wdev, scan) < 0) {
7853                         idx--;
7854                         break;
7855                 }
7856         }
7857
7858         spin_unlock_bh(&rdev->bss_lock);
7859         wdev_unlock(wdev);
7860
7861         cb->args[2] = idx;
7862         rtnl_unlock();
7863
7864         return skb->len;
7865 }
7866
7867 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
7868                                int flags, struct net_device *dev,
7869                                bool allow_radio_stats,
7870                                struct survey_info *survey)
7871 {
7872         void *hdr;
7873         struct nlattr *infoattr;
7874
7875         /* skip radio stats if userspace didn't request them */
7876         if (!survey->channel && !allow_radio_stats)
7877                 return 0;
7878
7879         hdr = nl80211hdr_put(msg, portid, seq, flags,
7880                              NL80211_CMD_NEW_SURVEY_RESULTS);
7881         if (!hdr)
7882                 return -ENOMEM;
7883
7884         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
7885                 goto nla_put_failure;
7886
7887         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
7888         if (!infoattr)
7889                 goto nla_put_failure;
7890
7891         if (survey->channel &&
7892             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
7893                         survey->channel->center_freq))
7894                 goto nla_put_failure;
7895
7896         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
7897             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
7898                 goto nla_put_failure;
7899         if ((survey->filled & SURVEY_INFO_IN_USE) &&
7900             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
7901                 goto nla_put_failure;
7902         if ((survey->filled & SURVEY_INFO_TIME) &&
7903             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
7904                         survey->time, NL80211_SURVEY_INFO_PAD))
7905                 goto nla_put_failure;
7906         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
7907             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
7908                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
7909                 goto nla_put_failure;
7910         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
7911             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
7912                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
7913                 goto nla_put_failure;
7914         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
7915             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
7916                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
7917                 goto nla_put_failure;
7918         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
7919             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
7920                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
7921                 goto nla_put_failure;
7922         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
7923             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
7924                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
7925                 goto nla_put_failure;
7926
7927         nla_nest_end(msg, infoattr);
7928
7929         genlmsg_end(msg, hdr);
7930         return 0;
7931
7932  nla_put_failure:
7933         genlmsg_cancel(msg, hdr);
7934         return -EMSGSIZE;
7935 }
7936
7937 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
7938 {
7939         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
7940         struct survey_info survey;
7941         struct cfg80211_registered_device *rdev;
7942         struct wireless_dev *wdev;
7943         int survey_idx = cb->args[2];
7944         int res;
7945         bool radio_stats;
7946
7947         rtnl_lock();
7948         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7949         if (res)
7950                 goto out_err;
7951
7952         /* prepare_wdev_dump parsed the attributes */
7953         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
7954
7955         if (!wdev->netdev) {
7956                 res = -EINVAL;
7957                 goto out_err;
7958         }
7959
7960         if (!rdev->ops->dump_survey) {
7961                 res = -EOPNOTSUPP;
7962                 goto out_err;
7963         }
7964
7965         while (1) {
7966                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
7967                 if (res == -ENOENT)
7968                         break;
7969                 if (res)
7970                         goto out_err;
7971
7972                 /* don't send disabled channels, but do send non-channel data */
7973                 if (survey.channel &&
7974                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
7975                         survey_idx++;
7976                         continue;
7977                 }
7978
7979                 if (nl80211_send_survey(skb,
7980                                 NETLINK_CB(cb->skb).portid,
7981                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7982                                 wdev->netdev, radio_stats, &survey) < 0)
7983                         goto out;
7984                 survey_idx++;
7985         }
7986
7987  out:
7988         cb->args[2] = survey_idx;
7989         res = skb->len;
7990  out_err:
7991         rtnl_unlock();
7992         return res;
7993 }
7994
7995 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
7996 {
7997         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
7998                                   NL80211_WPA_VERSION_2));
7999 }
8000
8001 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
8002 {
8003         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8004         struct net_device *dev = info->user_ptr[1];
8005         struct ieee80211_channel *chan;
8006         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
8007         int err, ssid_len, ie_len = 0, auth_data_len = 0;
8008         enum nl80211_auth_type auth_type;
8009         struct key_parse key;
8010         bool local_state_change;
8011
8012         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8013                 return -EINVAL;
8014
8015         if (!info->attrs[NL80211_ATTR_MAC])
8016                 return -EINVAL;
8017
8018         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
8019                 return -EINVAL;
8020
8021         if (!info->attrs[NL80211_ATTR_SSID])
8022                 return -EINVAL;
8023
8024         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8025                 return -EINVAL;
8026
8027         err = nl80211_parse_key(info, &key);
8028         if (err)
8029                 return err;
8030
8031         if (key.idx >= 0) {
8032                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
8033                         return -EINVAL;
8034                 if (!key.p.key || !key.p.key_len)
8035                         return -EINVAL;
8036                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
8037                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
8038                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
8039                      key.p.key_len != WLAN_KEY_LEN_WEP104))
8040                         return -EINVAL;
8041                 if (key.idx > 3)
8042                         return -EINVAL;
8043         } else {
8044                 key.p.key_len = 0;
8045                 key.p.key = NULL;
8046         }
8047
8048         if (key.idx >= 0) {
8049                 int i;
8050                 bool ok = false;
8051
8052                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
8053                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
8054                                 ok = true;
8055                                 break;
8056                         }
8057                 }
8058                 if (!ok)
8059                         return -EINVAL;
8060         }
8061
8062         if (!rdev->ops->auth)
8063                 return -EOPNOTSUPP;
8064
8065         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8066             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8067                 return -EOPNOTSUPP;
8068
8069         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8070         chan = nl80211_get_valid_chan(&rdev->wiphy,
8071                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8072         if (!chan)
8073                 return -EINVAL;
8074
8075         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8076         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8077
8078         if (info->attrs[NL80211_ATTR_IE]) {
8079                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8080                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8081         }
8082
8083         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8084         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
8085                 return -EINVAL;
8086
8087         if ((auth_type == NL80211_AUTHTYPE_SAE ||
8088              auth_type == NL80211_AUTHTYPE_FILS_SK ||
8089              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
8090              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
8091             !info->attrs[NL80211_ATTR_AUTH_DATA])
8092                 return -EINVAL;
8093
8094         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
8095                 if (auth_type != NL80211_AUTHTYPE_SAE &&
8096                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
8097                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
8098                     auth_type != NL80211_AUTHTYPE_FILS_PK)
8099                         return -EINVAL;
8100                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
8101                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
8102                 /* need to include at least Auth Transaction and Status Code */
8103                 if (auth_data_len < 4)
8104                         return -EINVAL;
8105         }
8106
8107         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8108
8109         /*
8110          * Since we no longer track auth state, ignore
8111          * requests to only change local state.
8112          */
8113         if (local_state_change)
8114                 return 0;
8115
8116         wdev_lock(dev->ieee80211_ptr);
8117         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
8118                                  ssid, ssid_len, ie, ie_len,
8119                                  key.p.key, key.p.key_len, key.idx,
8120                                  auth_data, auth_data_len);
8121         wdev_unlock(dev->ieee80211_ptr);
8122         return err;
8123 }
8124
8125 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
8126                                    struct genl_info *info,
8127                                    struct cfg80211_crypto_settings *settings,
8128                                    int cipher_limit)
8129 {
8130         memset(settings, 0, sizeof(*settings));
8131
8132         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
8133
8134         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
8135                 u16 proto;
8136
8137                 proto = nla_get_u16(
8138                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
8139                 settings->control_port_ethertype = cpu_to_be16(proto);
8140                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
8141                     proto != ETH_P_PAE)
8142                         return -EINVAL;
8143                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
8144                         settings->control_port_no_encrypt = true;
8145         } else
8146                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
8147
8148         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
8149                 void *data;
8150                 int len, i;
8151
8152                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8153                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8154                 settings->n_ciphers_pairwise = len / sizeof(u32);
8155
8156                 if (len % sizeof(u32))
8157                         return -EINVAL;
8158
8159                 if (settings->n_ciphers_pairwise > cipher_limit)
8160                         return -EINVAL;
8161
8162                 memcpy(settings->ciphers_pairwise, data, len);
8163
8164                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
8165                         if (!cfg80211_supported_cipher_suite(
8166                                         &rdev->wiphy,
8167                                         settings->ciphers_pairwise[i]))
8168                                 return -EINVAL;
8169         }
8170
8171         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
8172                 settings->cipher_group =
8173                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
8174                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
8175                                                      settings->cipher_group))
8176                         return -EINVAL;
8177         }
8178
8179         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
8180                 settings->wpa_versions =
8181                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
8182                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
8183                         return -EINVAL;
8184         }
8185
8186         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
8187                 void *data;
8188                 int len;
8189
8190                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
8191                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
8192                 settings->n_akm_suites = len / sizeof(u32);
8193
8194                 if (len % sizeof(u32))
8195                         return -EINVAL;
8196
8197                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
8198                         return -EINVAL;
8199
8200                 memcpy(settings->akm_suites, data, len);
8201         }
8202
8203         if (info->attrs[NL80211_ATTR_PMK]) {
8204                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
8205                         return -EINVAL;
8206                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8207                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
8208                         return -EINVAL;
8209                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
8210         }
8211
8212         return 0;
8213 }
8214
8215 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
8216 {
8217         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8218         struct net_device *dev = info->user_ptr[1];
8219         struct ieee80211_channel *chan;
8220         struct cfg80211_assoc_request req = {};
8221         const u8 *bssid, *ssid;
8222         int err, ssid_len = 0;
8223
8224         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8225                 return -EINVAL;
8226
8227         if (!info->attrs[NL80211_ATTR_MAC] ||
8228             !info->attrs[NL80211_ATTR_SSID] ||
8229             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
8230                 return -EINVAL;
8231
8232         if (!rdev->ops->assoc)
8233                 return -EOPNOTSUPP;
8234
8235         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8236             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8237                 return -EOPNOTSUPP;
8238
8239         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8240
8241         chan = nl80211_get_valid_chan(&rdev->wiphy,
8242                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8243         if (!chan)
8244                 return -EINVAL;
8245
8246         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8247         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8248
8249         if (info->attrs[NL80211_ATTR_IE]) {
8250                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8251                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8252         }
8253
8254         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8255                 enum nl80211_mfp mfp =
8256                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8257                 if (mfp == NL80211_MFP_REQUIRED)
8258                         req.use_mfp = true;
8259                 else if (mfp != NL80211_MFP_NO)
8260                         return -EINVAL;
8261         }
8262
8263         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8264                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8265
8266         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8267                 req.flags |= ASSOC_REQ_DISABLE_HT;
8268
8269         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8270                 memcpy(&req.ht_capa_mask,
8271                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8272                        sizeof(req.ht_capa_mask));
8273
8274         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8275                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8276                         return -EINVAL;
8277                 memcpy(&req.ht_capa,
8278                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8279                        sizeof(req.ht_capa));
8280         }
8281
8282         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8283                 req.flags |= ASSOC_REQ_DISABLE_VHT;
8284
8285         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8286                 memcpy(&req.vht_capa_mask,
8287                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8288                        sizeof(req.vht_capa_mask));
8289
8290         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8291                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8292                         return -EINVAL;
8293                 memcpy(&req.vht_capa,
8294                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8295                        sizeof(req.vht_capa));
8296         }
8297
8298         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8299                 if (!((rdev->wiphy.features &
8300                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8301                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8302                     !wiphy_ext_feature_isset(&rdev->wiphy,
8303                                              NL80211_EXT_FEATURE_RRM))
8304                         return -EINVAL;
8305                 req.flags |= ASSOC_REQ_USE_RRM;
8306         }
8307
8308         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
8309                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
8310                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
8311                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
8312                         return -EINVAL;
8313                 req.fils_nonces =
8314                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
8315         }
8316
8317         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
8318         if (!err) {
8319                 wdev_lock(dev->ieee80211_ptr);
8320
8321                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
8322                                           ssid, ssid_len, &req);
8323
8324                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8325                         dev->ieee80211_ptr->conn_owner_nlportid =
8326                                 info->snd_portid;
8327                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
8328                                bssid, ETH_ALEN);
8329                 }
8330
8331                 wdev_unlock(dev->ieee80211_ptr);
8332         }
8333
8334         return err;
8335 }
8336
8337 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
8338 {
8339         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8340         struct net_device *dev = info->user_ptr[1];
8341         const u8 *ie = NULL, *bssid;
8342         int ie_len = 0, err;
8343         u16 reason_code;
8344         bool local_state_change;
8345
8346         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8347                 return -EINVAL;
8348
8349         if (!info->attrs[NL80211_ATTR_MAC])
8350                 return -EINVAL;
8351
8352         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8353                 return -EINVAL;
8354
8355         if (!rdev->ops->deauth)
8356                 return -EOPNOTSUPP;
8357
8358         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8359             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8360                 return -EOPNOTSUPP;
8361
8362         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8363
8364         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8365         if (reason_code == 0) {
8366                 /* Reason Code 0 is reserved */
8367                 return -EINVAL;
8368         }
8369
8370         if (info->attrs[NL80211_ATTR_IE]) {
8371                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8372                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8373         }
8374
8375         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8376
8377         wdev_lock(dev->ieee80211_ptr);
8378         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
8379                                    local_state_change);
8380         wdev_unlock(dev->ieee80211_ptr);
8381         return err;
8382 }
8383
8384 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
8385 {
8386         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8387         struct net_device *dev = info->user_ptr[1];
8388         const u8 *ie = NULL, *bssid;
8389         int ie_len = 0, err;
8390         u16 reason_code;
8391         bool local_state_change;
8392
8393         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8394                 return -EINVAL;
8395
8396         if (!info->attrs[NL80211_ATTR_MAC])
8397                 return -EINVAL;
8398
8399         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8400                 return -EINVAL;
8401
8402         if (!rdev->ops->disassoc)
8403                 return -EOPNOTSUPP;
8404
8405         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8406             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8407                 return -EOPNOTSUPP;
8408
8409         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8410
8411         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8412         if (reason_code == 0) {
8413                 /* Reason Code 0 is reserved */
8414                 return -EINVAL;
8415         }
8416
8417         if (info->attrs[NL80211_ATTR_IE]) {
8418                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8419                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8420         }
8421
8422         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8423
8424         wdev_lock(dev->ieee80211_ptr);
8425         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
8426                                      local_state_change);
8427         wdev_unlock(dev->ieee80211_ptr);
8428         return err;
8429 }
8430
8431 static bool
8432 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
8433                          int mcast_rate[NUM_NL80211_BANDS],
8434                          int rateval)
8435 {
8436         struct wiphy *wiphy = &rdev->wiphy;
8437         bool found = false;
8438         int band, i;
8439
8440         for (band = 0; band < NUM_NL80211_BANDS; band++) {
8441                 struct ieee80211_supported_band *sband;
8442
8443                 sband = wiphy->bands[band];
8444                 if (!sband)
8445                         continue;
8446
8447                 for (i = 0; i < sband->n_bitrates; i++) {
8448                         if (sband->bitrates[i].bitrate == rateval) {
8449                                 mcast_rate[band] = i + 1;
8450                                 found = true;
8451                                 break;
8452                         }
8453                 }
8454         }
8455
8456         return found;
8457 }
8458
8459 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
8460 {
8461         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8462         struct net_device *dev = info->user_ptr[1];
8463         struct cfg80211_ibss_params ibss;
8464         struct wiphy *wiphy;
8465         struct cfg80211_cached_keys *connkeys = NULL;
8466         int err;
8467
8468         memset(&ibss, 0, sizeof(ibss));
8469
8470         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8471                 return -EINVAL;
8472
8473         if (!info->attrs[NL80211_ATTR_SSID] ||
8474             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8475                 return -EINVAL;
8476
8477         ibss.beacon_interval = 100;
8478
8479         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
8480                 ibss.beacon_interval =
8481                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8482
8483         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
8484                                            ibss.beacon_interval);
8485         if (err)
8486                 return err;
8487
8488         if (!rdev->ops->join_ibss)
8489                 return -EOPNOTSUPP;
8490
8491         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8492                 return -EOPNOTSUPP;
8493
8494         wiphy = &rdev->wiphy;
8495
8496         if (info->attrs[NL80211_ATTR_MAC]) {
8497                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8498
8499                 if (!is_valid_ether_addr(ibss.bssid))
8500                         return -EINVAL;
8501         }
8502         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8503         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8504
8505         if (info->attrs[NL80211_ATTR_IE]) {
8506                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8507                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8508         }
8509
8510         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
8511         if (err)
8512                 return err;
8513
8514         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
8515                                      NL80211_IFTYPE_ADHOC))
8516                 return -EINVAL;
8517
8518         switch (ibss.chandef.width) {
8519         case NL80211_CHAN_WIDTH_5:
8520         case NL80211_CHAN_WIDTH_10:
8521         case NL80211_CHAN_WIDTH_20_NOHT:
8522                 break;
8523         case NL80211_CHAN_WIDTH_20:
8524         case NL80211_CHAN_WIDTH_40:
8525                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8526                         return -EINVAL;
8527                 break;
8528         case NL80211_CHAN_WIDTH_80:
8529         case NL80211_CHAN_WIDTH_80P80:
8530         case NL80211_CHAN_WIDTH_160:
8531                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8532                         return -EINVAL;
8533                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8534                                              NL80211_EXT_FEATURE_VHT_IBSS))
8535                         return -EINVAL;
8536                 break;
8537         default:
8538                 return -EINVAL;
8539         }
8540
8541         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
8542         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
8543
8544         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8545                 u8 *rates =
8546                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8547                 int n_rates =
8548                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8549                 struct ieee80211_supported_band *sband =
8550                         wiphy->bands[ibss.chandef.chan->band];
8551
8552                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8553                                              &ibss.basic_rates);
8554                 if (err)
8555                         return err;
8556         }
8557
8558         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8559                 memcpy(&ibss.ht_capa_mask,
8560                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8561                        sizeof(ibss.ht_capa_mask));
8562
8563         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8564                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8565                         return -EINVAL;
8566                 memcpy(&ibss.ht_capa,
8567                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8568                        sizeof(ibss.ht_capa));
8569         }
8570
8571         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8572             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
8573                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8574                 return -EINVAL;
8575
8576         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8577                 bool no_ht = false;
8578
8579                 connkeys = nl80211_parse_connkeys(rdev,
8580                                           info->attrs[NL80211_ATTR_KEYS],
8581                                           &no_ht);
8582                 if (IS_ERR(connkeys))
8583                         return PTR_ERR(connkeys);
8584
8585                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
8586                     no_ht) {
8587                         kzfree(connkeys);
8588                         return -EINVAL;
8589                 }
8590         }
8591
8592         ibss.control_port =
8593                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
8594
8595         ibss.userspace_handles_dfs =
8596                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
8597
8598         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
8599         if (err)
8600                 kzfree(connkeys);
8601         return err;
8602 }
8603
8604 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
8605 {
8606         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8607         struct net_device *dev = info->user_ptr[1];
8608
8609         if (!rdev->ops->leave_ibss)
8610                 return -EOPNOTSUPP;
8611
8612         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8613                 return -EOPNOTSUPP;
8614
8615         return cfg80211_leave_ibss(rdev, dev, false);
8616 }
8617
8618 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
8619 {
8620         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8621         struct net_device *dev = info->user_ptr[1];
8622         int mcast_rate[NUM_NL80211_BANDS];
8623         u32 nla_rate;
8624         int err;
8625
8626         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
8627             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
8628             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
8629                 return -EOPNOTSUPP;
8630
8631         if (!rdev->ops->set_mcast_rate)
8632                 return -EOPNOTSUPP;
8633
8634         memset(mcast_rate, 0, sizeof(mcast_rate));
8635
8636         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
8637                 return -EINVAL;
8638
8639         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
8640         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
8641                 return -EINVAL;
8642
8643         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
8644
8645         return err;
8646 }
8647
8648 static struct sk_buff *
8649 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
8650                             struct wireless_dev *wdev, int approxlen,
8651                             u32 portid, u32 seq, enum nl80211_commands cmd,
8652                             enum nl80211_attrs attr,
8653                             const struct nl80211_vendor_cmd_info *info,
8654                             gfp_t gfp)
8655 {
8656         struct sk_buff *skb;
8657         void *hdr;
8658         struct nlattr *data;
8659
8660         skb = nlmsg_new(approxlen + 100, gfp);
8661         if (!skb)
8662                 return NULL;
8663
8664         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
8665         if (!hdr) {
8666                 kfree_skb(skb);
8667                 return NULL;
8668         }
8669
8670         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
8671                 goto nla_put_failure;
8672
8673         if (info) {
8674                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
8675                                 info->vendor_id))
8676                         goto nla_put_failure;
8677                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
8678                                 info->subcmd))
8679                         goto nla_put_failure;
8680         }
8681
8682         if (wdev) {
8683                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
8684                                       wdev_id(wdev), NL80211_ATTR_PAD))
8685                         goto nla_put_failure;
8686                 if (wdev->netdev &&
8687                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
8688                                 wdev->netdev->ifindex))
8689                         goto nla_put_failure;
8690         }
8691
8692         data = nla_nest_start(skb, attr);
8693         if (!data)
8694                 goto nla_put_failure;
8695
8696         ((void **)skb->cb)[0] = rdev;
8697         ((void **)skb->cb)[1] = hdr;
8698         ((void **)skb->cb)[2] = data;
8699
8700         return skb;
8701
8702  nla_put_failure:
8703         kfree_skb(skb);
8704         return NULL;
8705 }
8706
8707 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
8708                                            struct wireless_dev *wdev,
8709                                            enum nl80211_commands cmd,
8710                                            enum nl80211_attrs attr,
8711                                            int vendor_event_idx,
8712                                            int approxlen, gfp_t gfp)
8713 {
8714         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
8715         const struct nl80211_vendor_cmd_info *info;
8716
8717         switch (cmd) {
8718         case NL80211_CMD_TESTMODE:
8719                 if (WARN_ON(vendor_event_idx != -1))
8720                         return NULL;
8721                 info = NULL;
8722                 break;
8723         case NL80211_CMD_VENDOR:
8724                 if (WARN_ON(vendor_event_idx < 0 ||
8725                             vendor_event_idx >= wiphy->n_vendor_events))
8726                         return NULL;
8727                 info = &wiphy->vendor_events[vendor_event_idx];
8728                 break;
8729         default:
8730                 WARN_ON(1);
8731                 return NULL;
8732         }
8733
8734         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
8735                                            cmd, attr, info, gfp);
8736 }
8737 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
8738
8739 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
8740 {
8741         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
8742         void *hdr = ((void **)skb->cb)[1];
8743         struct nlattr *data = ((void **)skb->cb)[2];
8744         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
8745
8746         /* clear CB data for netlink core to own from now on */
8747         memset(skb->cb, 0, sizeof(skb->cb));
8748
8749         nla_nest_end(skb, data);
8750         genlmsg_end(skb, hdr);
8751
8752         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
8753                 mcgrp = NL80211_MCGRP_VENDOR;
8754
8755         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
8756                                 mcgrp, gfp);
8757 }
8758 EXPORT_SYMBOL(__cfg80211_send_event_skb);
8759
8760 #ifdef CONFIG_NL80211_TESTMODE
8761 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
8762 {
8763         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8764         struct wireless_dev *wdev =
8765                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
8766         int err;
8767
8768         if (!rdev->ops->testmode_cmd)
8769                 return -EOPNOTSUPP;
8770
8771         if (IS_ERR(wdev)) {
8772                 err = PTR_ERR(wdev);
8773                 if (err != -EINVAL)
8774                         return err;
8775                 wdev = NULL;
8776         } else if (wdev->wiphy != &rdev->wiphy) {
8777                 return -EINVAL;
8778         }
8779
8780         if (!info->attrs[NL80211_ATTR_TESTDATA])
8781                 return -EINVAL;
8782
8783         rdev->cur_cmd_info = info;
8784         err = rdev_testmode_cmd(rdev, wdev,
8785                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
8786                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
8787         rdev->cur_cmd_info = NULL;
8788
8789         return err;
8790 }
8791
8792 static int nl80211_testmode_dump(struct sk_buff *skb,
8793                                  struct netlink_callback *cb)
8794 {
8795         struct cfg80211_registered_device *rdev;
8796         int err;
8797         long phy_idx;
8798         void *data = NULL;
8799         int data_len = 0;
8800
8801         rtnl_lock();
8802
8803         if (cb->args[0]) {
8804                 /*
8805                  * 0 is a valid index, but not valid for args[0],
8806                  * so we need to offset by 1.
8807                  */
8808                 phy_idx = cb->args[0] - 1;
8809
8810                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
8811                 if (!rdev) {
8812                         err = -ENOENT;
8813                         goto out_err;
8814                 }
8815         } else {
8816                 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8817
8818                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
8819                                   attrbuf, nl80211_fam.maxattr,
8820                                   nl80211_policy, NULL);
8821                 if (err)
8822                         goto out_err;
8823
8824                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
8825                 if (IS_ERR(rdev)) {
8826                         err = PTR_ERR(rdev);
8827                         goto out_err;
8828                 }
8829                 phy_idx = rdev->wiphy_idx;
8830
8831                 if (attrbuf[NL80211_ATTR_TESTDATA])
8832                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
8833         }
8834
8835         if (cb->args[1]) {
8836                 data = nla_data((void *)cb->args[1]);
8837                 data_len = nla_len((void *)cb->args[1]);
8838         }
8839
8840         if (!rdev->ops->testmode_dump) {
8841                 err = -EOPNOTSUPP;
8842                 goto out_err;
8843         }
8844
8845         while (1) {
8846                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
8847                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
8848                                            NL80211_CMD_TESTMODE);
8849                 struct nlattr *tmdata;
8850
8851                 if (!hdr)
8852                         break;
8853
8854                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
8855                         genlmsg_cancel(skb, hdr);
8856                         break;
8857                 }
8858
8859                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
8860                 if (!tmdata) {
8861                         genlmsg_cancel(skb, hdr);
8862                         break;
8863                 }
8864                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
8865                 nla_nest_end(skb, tmdata);
8866
8867                 if (err == -ENOBUFS || err == -ENOENT) {
8868                         genlmsg_cancel(skb, hdr);
8869                         break;
8870                 } else if (err) {
8871                         genlmsg_cancel(skb, hdr);
8872                         goto out_err;
8873                 }
8874
8875                 genlmsg_end(skb, hdr);
8876         }
8877
8878         err = skb->len;
8879         /* see above */
8880         cb->args[0] = phy_idx + 1;
8881  out_err:
8882         rtnl_unlock();
8883         return err;
8884 }
8885 #endif
8886
8887 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
8888 {
8889         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8890         struct net_device *dev = info->user_ptr[1];
8891         struct cfg80211_connect_params connect;
8892         struct wiphy *wiphy;
8893         struct cfg80211_cached_keys *connkeys = NULL;
8894         int err;
8895
8896         memset(&connect, 0, sizeof(connect));
8897
8898         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8899                 return -EINVAL;
8900
8901         if (!info->attrs[NL80211_ATTR_SSID] ||
8902             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8903                 return -EINVAL;
8904
8905         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
8906                 connect.auth_type =
8907                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8908                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
8909                                              NL80211_CMD_CONNECT))
8910                         return -EINVAL;
8911         } else
8912                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
8913
8914         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
8915
8916         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
8917             !wiphy_ext_feature_isset(&rdev->wiphy,
8918                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
8919                 return -EINVAL;
8920         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
8921
8922         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
8923                                       NL80211_MAX_NR_CIPHER_SUITES);
8924         if (err)
8925                 return err;
8926
8927         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8928             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8929                 return -EOPNOTSUPP;
8930
8931         wiphy = &rdev->wiphy;
8932
8933         connect.bg_scan_period = -1;
8934         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
8935                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
8936                 connect.bg_scan_period =
8937                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
8938         }
8939
8940         if (info->attrs[NL80211_ATTR_MAC])
8941                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8942         else if (info->attrs[NL80211_ATTR_MAC_HINT])
8943                 connect.bssid_hint =
8944                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
8945         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8946         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8947
8948         if (info->attrs[NL80211_ATTR_IE]) {
8949                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8950                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8951         }
8952
8953         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8954                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8955                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
8956                     !wiphy_ext_feature_isset(&rdev->wiphy,
8957                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
8958                         return -EOPNOTSUPP;
8959
8960                 if (connect.mfp != NL80211_MFP_REQUIRED &&
8961                     connect.mfp != NL80211_MFP_NO &&
8962                     connect.mfp != NL80211_MFP_OPTIONAL)
8963                         return -EINVAL;
8964         } else {
8965                 connect.mfp = NL80211_MFP_NO;
8966         }
8967
8968         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8969                 connect.prev_bssid =
8970                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8971
8972         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8973                 connect.channel = nl80211_get_valid_chan(
8974                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8975                 if (!connect.channel)
8976                         return -EINVAL;
8977         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
8978                 connect.channel_hint = nl80211_get_valid_chan(
8979                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
8980                 if (!connect.channel_hint)
8981                         return -EINVAL;
8982         }
8983
8984         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8985                 connkeys = nl80211_parse_connkeys(rdev,
8986                                           info->attrs[NL80211_ATTR_KEYS], NULL);
8987                 if (IS_ERR(connkeys))
8988                         return PTR_ERR(connkeys);
8989         }
8990
8991         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8992                 connect.flags |= ASSOC_REQ_DISABLE_HT;
8993
8994         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8995                 memcpy(&connect.ht_capa_mask,
8996                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8997                        sizeof(connect.ht_capa_mask));
8998
8999         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9000                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
9001                         kzfree(connkeys);
9002                         return -EINVAL;
9003                 }
9004                 memcpy(&connect.ht_capa,
9005                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9006                        sizeof(connect.ht_capa));
9007         }
9008
9009         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9010                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
9011
9012         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9013                 memcpy(&connect.vht_capa_mask,
9014                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9015                        sizeof(connect.vht_capa_mask));
9016
9017         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9018                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
9019                         kzfree(connkeys);
9020                         return -EINVAL;
9021                 }
9022                 memcpy(&connect.vht_capa,
9023                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9024                        sizeof(connect.vht_capa));
9025         }
9026
9027         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9028                 if (!((rdev->wiphy.features &
9029                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9030                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9031                     !wiphy_ext_feature_isset(&rdev->wiphy,
9032                                              NL80211_EXT_FEATURE_RRM)) {
9033                         kzfree(connkeys);
9034                         return -EINVAL;
9035                 }
9036                 connect.flags |= ASSOC_REQ_USE_RRM;
9037         }
9038
9039         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
9040         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
9041                 kzfree(connkeys);
9042                 return -EOPNOTSUPP;
9043         }
9044
9045         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
9046                 /* bss selection makes no sense if bssid is set */
9047                 if (connect.bssid) {
9048                         kzfree(connkeys);
9049                         return -EINVAL;
9050                 }
9051
9052                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
9053                                        wiphy, &connect.bss_select);
9054                 if (err) {
9055                         kzfree(connkeys);
9056                         return err;
9057                 }
9058         }
9059
9060         if (wiphy_ext_feature_isset(&rdev->wiphy,
9061                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
9062             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9063             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9064             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9065             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9066                 connect.fils_erp_username =
9067                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9068                 connect.fils_erp_username_len =
9069                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9070                 connect.fils_erp_realm =
9071                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9072                 connect.fils_erp_realm_len =
9073                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9074                 connect.fils_erp_next_seq_num =
9075                         nla_get_u16(
9076                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9077                 connect.fils_erp_rrk =
9078                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9079                 connect.fils_erp_rrk_len =
9080                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9081         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9082                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9083                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9084                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9085                 kzfree(connkeys);
9086                 return -EINVAL;
9087         }
9088
9089         wdev_lock(dev->ieee80211_ptr);
9090
9091         err = cfg80211_connect(rdev, dev, &connect, connkeys,
9092                                connect.prev_bssid);
9093         if (err)
9094                 kzfree(connkeys);
9095
9096         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9097                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9098                 if (connect.bssid)
9099                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
9100                                connect.bssid, ETH_ALEN);
9101                 else
9102                         memset(dev->ieee80211_ptr->disconnect_bssid,
9103                                0, ETH_ALEN);
9104         }
9105
9106         wdev_unlock(dev->ieee80211_ptr);
9107
9108         return err;
9109 }
9110
9111 static int nl80211_update_connect_params(struct sk_buff *skb,
9112                                          struct genl_info *info)
9113 {
9114         struct cfg80211_connect_params connect = {};
9115         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9116         struct net_device *dev = info->user_ptr[1];
9117         struct wireless_dev *wdev = dev->ieee80211_ptr;
9118         u32 changed = 0;
9119         int ret;
9120
9121         if (!rdev->ops->update_connect_params)
9122                 return -EOPNOTSUPP;
9123
9124         if (info->attrs[NL80211_ATTR_IE]) {
9125                 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9126                         return -EINVAL;
9127                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9128                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9129                 changed |= UPDATE_ASSOC_IES;
9130         }
9131
9132         wdev_lock(dev->ieee80211_ptr);
9133         if (!wdev->current_bss)
9134                 ret = -ENOLINK;
9135         else
9136                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
9137         wdev_unlock(dev->ieee80211_ptr);
9138
9139         return ret;
9140 }
9141
9142 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
9143 {
9144         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9145         struct net_device *dev = info->user_ptr[1];
9146         u16 reason;
9147         int ret;
9148
9149         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9150                 reason = WLAN_REASON_DEAUTH_LEAVING;
9151         else
9152                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9153
9154         if (reason == 0)
9155                 return -EINVAL;
9156
9157         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9158             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9159                 return -EOPNOTSUPP;
9160
9161         wdev_lock(dev->ieee80211_ptr);
9162         ret = cfg80211_disconnect(rdev, dev, reason, true);
9163         wdev_unlock(dev->ieee80211_ptr);
9164         return ret;
9165 }
9166
9167 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
9168 {
9169         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9170         struct net *net;
9171         int err;
9172
9173         if (info->attrs[NL80211_ATTR_PID]) {
9174                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
9175
9176                 net = get_net_ns_by_pid(pid);
9177         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
9178                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
9179
9180                 net = get_net_ns_by_fd(fd);
9181         } else {
9182                 return -EINVAL;
9183         }
9184
9185         if (IS_ERR(net))
9186                 return PTR_ERR(net);
9187
9188         err = 0;
9189
9190         /* check if anything to do */
9191         if (!net_eq(wiphy_net(&rdev->wiphy), net))
9192                 err = cfg80211_switch_netns(rdev, net);
9193
9194         put_net(net);
9195         return err;
9196 }
9197
9198 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
9199 {
9200         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9201         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
9202                         struct cfg80211_pmksa *pmksa) = NULL;
9203         struct net_device *dev = info->user_ptr[1];
9204         struct cfg80211_pmksa pmksa;
9205
9206         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
9207
9208         if (!info->attrs[NL80211_ATTR_PMKID])
9209                 return -EINVAL;
9210
9211         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
9212
9213         if (info->attrs[NL80211_ATTR_MAC]) {
9214                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9215         } else if (info->attrs[NL80211_ATTR_SSID] &&
9216                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
9217                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
9218                     info->attrs[NL80211_ATTR_PMK])) {
9219                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9220                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9221                 pmksa.cache_id =
9222                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
9223         } else {
9224                 return -EINVAL;
9225         }
9226         if (info->attrs[NL80211_ATTR_PMK]) {
9227                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9228                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
9229         }
9230
9231         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9232             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9233                 return -EOPNOTSUPP;
9234
9235         switch (info->genlhdr->cmd) {
9236         case NL80211_CMD_SET_PMKSA:
9237                 rdev_ops = rdev->ops->set_pmksa;
9238                 break;
9239         case NL80211_CMD_DEL_PMKSA:
9240                 rdev_ops = rdev->ops->del_pmksa;
9241                 break;
9242         default:
9243                 WARN_ON(1);
9244                 break;
9245         }
9246
9247         if (!rdev_ops)
9248                 return -EOPNOTSUPP;
9249
9250         return rdev_ops(&rdev->wiphy, dev, &pmksa);
9251 }
9252
9253 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
9254 {
9255         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9256         struct net_device *dev = info->user_ptr[1];
9257
9258         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9259             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9260                 return -EOPNOTSUPP;
9261
9262         if (!rdev->ops->flush_pmksa)
9263                 return -EOPNOTSUPP;
9264
9265         return rdev_flush_pmksa(rdev, dev);
9266 }
9267
9268 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
9269 {
9270         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9271         struct net_device *dev = info->user_ptr[1];
9272         u8 action_code, dialog_token;
9273         u32 peer_capability = 0;
9274         u16 status_code;
9275         u8 *peer;
9276         bool initiator;
9277
9278         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9279             !rdev->ops->tdls_mgmt)
9280                 return -EOPNOTSUPP;
9281
9282         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
9283             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
9284             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
9285             !info->attrs[NL80211_ATTR_IE] ||
9286             !info->attrs[NL80211_ATTR_MAC])
9287                 return -EINVAL;
9288
9289         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9290         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
9291         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
9292         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
9293         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
9294         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
9295                 peer_capability =
9296                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
9297
9298         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
9299                               dialog_token, status_code, peer_capability,
9300                               initiator,
9301                               nla_data(info->attrs[NL80211_ATTR_IE]),
9302                               nla_len(info->attrs[NL80211_ATTR_IE]));
9303 }
9304
9305 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
9306 {
9307         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9308         struct net_device *dev = info->user_ptr[1];
9309         enum nl80211_tdls_operation operation;
9310         u8 *peer;
9311
9312         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9313             !rdev->ops->tdls_oper)
9314                 return -EOPNOTSUPP;
9315
9316         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
9317             !info->attrs[NL80211_ATTR_MAC])
9318                 return -EINVAL;
9319
9320         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
9321         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9322
9323         return rdev_tdls_oper(rdev, dev, peer, operation);
9324 }
9325
9326 static int nl80211_remain_on_channel(struct sk_buff *skb,
9327                                      struct genl_info *info)
9328 {
9329         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9330         struct wireless_dev *wdev = info->user_ptr[1];
9331         struct cfg80211_chan_def chandef;
9332         const struct cfg80211_chan_def *compat_chandef;
9333         struct sk_buff *msg;
9334         void *hdr;
9335         u64 cookie;
9336         u32 duration;
9337         int err;
9338
9339         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9340             !info->attrs[NL80211_ATTR_DURATION])
9341                 return -EINVAL;
9342
9343         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9344
9345         if (!rdev->ops->remain_on_channel ||
9346             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
9347                 return -EOPNOTSUPP;
9348
9349         /*
9350          * We should be on that channel for at least a minimum amount of
9351          * time (10ms) but no longer than the driver supports.
9352          */
9353         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9354             duration > rdev->wiphy.max_remain_on_channel_duration)
9355                 return -EINVAL;
9356
9357         err = nl80211_parse_chandef(rdev, info, &chandef);
9358         if (err)
9359                 return err;
9360
9361         wdev_lock(wdev);
9362         if (!cfg80211_off_channel_oper_allowed(wdev) &&
9363             !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
9364                 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
9365                                                              &chandef);
9366                 if (compat_chandef != &chandef) {
9367                         wdev_unlock(wdev);
9368                         return -EBUSY;
9369                 }
9370         }
9371         wdev_unlock(wdev);
9372
9373         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9374         if (!msg)
9375                 return -ENOMEM;
9376
9377         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9378                              NL80211_CMD_REMAIN_ON_CHANNEL);
9379         if (!hdr) {
9380                 err = -ENOBUFS;
9381                 goto free_msg;
9382         }
9383
9384         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
9385                                      duration, &cookie);
9386
9387         if (err)
9388                 goto free_msg;
9389
9390         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9391                               NL80211_ATTR_PAD))
9392                 goto nla_put_failure;
9393
9394         genlmsg_end(msg, hdr);
9395
9396         return genlmsg_reply(msg, info);
9397
9398  nla_put_failure:
9399         err = -ENOBUFS;
9400  free_msg:
9401         nlmsg_free(msg);
9402         return err;
9403 }
9404
9405 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
9406                                             struct genl_info *info)
9407 {
9408         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9409         struct wireless_dev *wdev = info->user_ptr[1];
9410         u64 cookie;
9411
9412         if (!info->attrs[NL80211_ATTR_COOKIE])
9413                 return -EINVAL;
9414
9415         if (!rdev->ops->cancel_remain_on_channel)
9416                 return -EOPNOTSUPP;
9417
9418         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9419
9420         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
9421 }
9422
9423 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
9424                                        struct genl_info *info)
9425 {
9426         struct cfg80211_bitrate_mask mask;
9427         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9428         struct net_device *dev = info->user_ptr[1];
9429         int err;
9430
9431         if (!rdev->ops->set_bitrate_mask)
9432                 return -EOPNOTSUPP;
9433
9434         err = nl80211_parse_tx_bitrate_mask(info, &mask);
9435         if (err)
9436                 return err;
9437
9438         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
9439 }
9440
9441 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
9442 {
9443         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9444         struct wireless_dev *wdev = info->user_ptr[1];
9445         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
9446
9447         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
9448                 return -EINVAL;
9449
9450         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
9451                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
9452
9453         switch (wdev->iftype) {
9454         case NL80211_IFTYPE_STATION:
9455         case NL80211_IFTYPE_ADHOC:
9456         case NL80211_IFTYPE_P2P_CLIENT:
9457         case NL80211_IFTYPE_AP:
9458         case NL80211_IFTYPE_AP_VLAN:
9459         case NL80211_IFTYPE_MESH_POINT:
9460         case NL80211_IFTYPE_P2P_GO:
9461         case NL80211_IFTYPE_P2P_DEVICE:
9462                 break;
9463         case NL80211_IFTYPE_NAN:
9464         default:
9465                 return -EOPNOTSUPP;
9466         }
9467
9468         /* not much point in registering if we can't reply */
9469         if (!rdev->ops->mgmt_tx)
9470                 return -EOPNOTSUPP;
9471
9472         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
9473                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
9474                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
9475 }
9476
9477 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
9478 {
9479         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9480         struct wireless_dev *wdev = info->user_ptr[1];
9481         struct cfg80211_chan_def chandef;
9482         int err;
9483         void *hdr = NULL;
9484         u64 cookie;
9485         struct sk_buff *msg = NULL;
9486         struct cfg80211_mgmt_tx_params params = {
9487                 .dont_wait_for_ack =
9488                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
9489         };
9490
9491         if (!info->attrs[NL80211_ATTR_FRAME])
9492                 return -EINVAL;
9493
9494         if (!rdev->ops->mgmt_tx)
9495                 return -EOPNOTSUPP;
9496
9497         switch (wdev->iftype) {
9498         case NL80211_IFTYPE_P2P_DEVICE:
9499                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9500                         return -EINVAL;
9501         case NL80211_IFTYPE_STATION:
9502         case NL80211_IFTYPE_ADHOC:
9503         case NL80211_IFTYPE_P2P_CLIENT:
9504         case NL80211_IFTYPE_AP:
9505         case NL80211_IFTYPE_AP_VLAN:
9506         case NL80211_IFTYPE_MESH_POINT:
9507         case NL80211_IFTYPE_P2P_GO:
9508                 break;
9509         case NL80211_IFTYPE_NAN:
9510         default:
9511                 return -EOPNOTSUPP;
9512         }
9513
9514         if (info->attrs[NL80211_ATTR_DURATION]) {
9515                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9516                         return -EINVAL;
9517                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9518
9519                 /*
9520                  * We should wait on the channel for at least a minimum amount
9521                  * of time (10ms) but no longer than the driver supports.
9522                  */
9523                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9524                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
9525                         return -EINVAL;
9526         }
9527
9528         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
9529
9530         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9531                 return -EINVAL;
9532
9533         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9534
9535         /* get the channel if any has been specified, otherwise pass NULL to
9536          * the driver. The latter will use the current one
9537          */
9538         chandef.chan = NULL;
9539         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9540                 err = nl80211_parse_chandef(rdev, info, &chandef);
9541                 if (err)
9542                         return err;
9543         }
9544
9545         if (!chandef.chan && params.offchan)
9546                 return -EINVAL;
9547
9548         wdev_lock(wdev);
9549         if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
9550                 wdev_unlock(wdev);
9551                 return -EBUSY;
9552         }
9553         wdev_unlock(wdev);
9554
9555         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
9556         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
9557
9558         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
9559                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9560                 int i;
9561
9562                 if (len % sizeof(u16))
9563                         return -EINVAL;
9564
9565                 params.n_csa_offsets = len / sizeof(u16);
9566                 params.csa_offsets =
9567                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9568
9569                 /* check that all the offsets fit the frame */
9570                 for (i = 0; i < params.n_csa_offsets; i++) {
9571                         if (params.csa_offsets[i] >= params.len)
9572                                 return -EINVAL;
9573                 }
9574         }
9575
9576         if (!params.dont_wait_for_ack) {
9577                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9578                 if (!msg)
9579                         return -ENOMEM;
9580
9581                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9582                                      NL80211_CMD_FRAME);
9583                 if (!hdr) {
9584                         err = -ENOBUFS;
9585                         goto free_msg;
9586                 }
9587         }
9588
9589         params.chan = chandef.chan;
9590         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
9591         if (err)
9592                 goto free_msg;
9593
9594         if (msg) {
9595                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9596                                       NL80211_ATTR_PAD))
9597                         goto nla_put_failure;
9598
9599                 genlmsg_end(msg, hdr);
9600                 return genlmsg_reply(msg, info);
9601         }
9602
9603         return 0;
9604
9605  nla_put_failure:
9606         err = -ENOBUFS;
9607  free_msg:
9608         nlmsg_free(msg);
9609         return err;
9610 }
9611
9612 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
9613 {
9614         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9615         struct wireless_dev *wdev = info->user_ptr[1];
9616         u64 cookie;
9617
9618         if (!info->attrs[NL80211_ATTR_COOKIE])
9619                 return -EINVAL;
9620
9621         if (!rdev->ops->mgmt_tx_cancel_wait)
9622                 return -EOPNOTSUPP;
9623
9624         switch (wdev->iftype) {
9625         case NL80211_IFTYPE_STATION:
9626         case NL80211_IFTYPE_ADHOC:
9627         case NL80211_IFTYPE_P2P_CLIENT:
9628         case NL80211_IFTYPE_AP:
9629         case NL80211_IFTYPE_AP_VLAN:
9630         case NL80211_IFTYPE_P2P_GO:
9631         case NL80211_IFTYPE_P2P_DEVICE:
9632                 break;
9633         case NL80211_IFTYPE_NAN:
9634         default:
9635                 return -EOPNOTSUPP;
9636         }
9637
9638         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9639
9640         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
9641 }
9642
9643 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
9644 {
9645         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9646         struct wireless_dev *wdev;
9647         struct net_device *dev = info->user_ptr[1];
9648         u8 ps_state;
9649         bool state;
9650         int err;
9651
9652         if (!info->attrs[NL80211_ATTR_PS_STATE])
9653                 return -EINVAL;
9654
9655         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
9656
9657         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
9658                 return -EINVAL;
9659
9660         wdev = dev->ieee80211_ptr;
9661
9662         if (!rdev->ops->set_power_mgmt)
9663                 return -EOPNOTSUPP;
9664
9665         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
9666
9667         if (state == wdev->ps)
9668                 return 0;
9669
9670         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
9671         if (!err)
9672                 wdev->ps = state;
9673         return err;
9674 }
9675
9676 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
9677 {
9678         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9679         enum nl80211_ps_state ps_state;
9680         struct wireless_dev *wdev;
9681         struct net_device *dev = info->user_ptr[1];
9682         struct sk_buff *msg;
9683         void *hdr;
9684         int err;
9685
9686         wdev = dev->ieee80211_ptr;
9687
9688         if (!rdev->ops->set_power_mgmt)
9689                 return -EOPNOTSUPP;
9690
9691         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9692         if (!msg)
9693                 return -ENOMEM;
9694
9695         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9696                              NL80211_CMD_GET_POWER_SAVE);
9697         if (!hdr) {
9698                 err = -ENOBUFS;
9699                 goto free_msg;
9700         }
9701
9702         if (wdev->ps)
9703                 ps_state = NL80211_PS_ENABLED;
9704         else
9705                 ps_state = NL80211_PS_DISABLED;
9706
9707         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
9708                 goto nla_put_failure;
9709
9710         genlmsg_end(msg, hdr);
9711         return genlmsg_reply(msg, info);
9712
9713  nla_put_failure:
9714         err = -ENOBUFS;
9715  free_msg:
9716         nlmsg_free(msg);
9717         return err;
9718 }
9719
9720 static const struct nla_policy
9721 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
9722         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
9723         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
9724         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
9725         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
9726         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
9727         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
9728         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
9729 };
9730
9731 static int nl80211_set_cqm_txe(struct genl_info *info,
9732                                u32 rate, u32 pkts, u32 intvl)
9733 {
9734         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9735         struct net_device *dev = info->user_ptr[1];
9736         struct wireless_dev *wdev = dev->ieee80211_ptr;
9737
9738         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
9739                 return -EINVAL;
9740
9741         if (!rdev->ops->set_cqm_txe_config)
9742                 return -EOPNOTSUPP;
9743
9744         if (wdev->iftype != NL80211_IFTYPE_STATION &&
9745             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9746                 return -EOPNOTSUPP;
9747
9748         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
9749 }
9750
9751 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
9752                                     struct net_device *dev)
9753 {
9754         struct wireless_dev *wdev = dev->ieee80211_ptr;
9755         s32 last, low, high;
9756         u32 hyst;
9757         int i, n;
9758         int err;
9759
9760         /* RSSI reporting disabled? */
9761         if (!wdev->cqm_config)
9762                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
9763
9764         /*
9765          * Obtain current RSSI value if possible, if not and no RSSI threshold
9766          * event has been received yet, we should receive an event after a
9767          * connection is established and enough beacons received to calculate
9768          * the average.
9769          */
9770         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
9771             rdev->ops->get_station) {
9772                 struct station_info sinfo;
9773                 u8 *mac_addr;
9774
9775                 mac_addr = wdev->current_bss->pub.bssid;
9776
9777                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
9778                 if (err)
9779                         return err;
9780
9781                 if (sinfo.filled & BIT(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
9782                         wdev->cqm_config->last_rssi_event_value =
9783                                 (s8) sinfo.rx_beacon_signal_avg;
9784         }
9785
9786         last = wdev->cqm_config->last_rssi_event_value;
9787         hyst = wdev->cqm_config->rssi_hyst;
9788         n = wdev->cqm_config->n_rssi_thresholds;
9789
9790         for (i = 0; i < n; i++)
9791                 if (last < wdev->cqm_config->rssi_thresholds[i])
9792                         break;
9793
9794         low = i > 0 ?
9795                 (wdev->cqm_config->rssi_thresholds[i - 1] - hyst) : S32_MIN;
9796         high = i < n ?
9797                 (wdev->cqm_config->rssi_thresholds[i] + hyst - 1) : S32_MAX;
9798
9799         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
9800 }
9801
9802 static int nl80211_set_cqm_rssi(struct genl_info *info,
9803                                 const s32 *thresholds, int n_thresholds,
9804                                 u32 hysteresis)
9805 {
9806         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9807         struct net_device *dev = info->user_ptr[1];
9808         struct wireless_dev *wdev = dev->ieee80211_ptr;
9809         int i, err;
9810         s32 prev = S32_MIN;
9811
9812         /* Check all values negative and sorted */
9813         for (i = 0; i < n_thresholds; i++) {
9814                 if (thresholds[i] > 0 || thresholds[i] <= prev)
9815                         return -EINVAL;
9816
9817                 prev = thresholds[i];
9818         }
9819
9820         if (wdev->iftype != NL80211_IFTYPE_STATION &&
9821             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9822                 return -EOPNOTSUPP;
9823
9824         wdev_lock(wdev);
9825         cfg80211_cqm_config_free(wdev);
9826         wdev_unlock(wdev);
9827
9828         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
9829                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
9830                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
9831
9832                 return rdev_set_cqm_rssi_config(rdev, dev,
9833                                                 thresholds[0], hysteresis);
9834         }
9835
9836         if (!wiphy_ext_feature_isset(&rdev->wiphy,
9837                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
9838                 return -EOPNOTSUPP;
9839
9840         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
9841                 n_thresholds = 0;
9842
9843         wdev_lock(wdev);
9844         if (n_thresholds) {
9845                 struct cfg80211_cqm_config *cqm_config;
9846
9847                 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
9848                                      n_thresholds * sizeof(s32), GFP_KERNEL);
9849                 if (!cqm_config) {
9850                         err = -ENOMEM;
9851                         goto unlock;
9852                 }
9853
9854                 cqm_config->rssi_hyst = hysteresis;
9855                 cqm_config->n_rssi_thresholds = n_thresholds;
9856                 memcpy(cqm_config->rssi_thresholds, thresholds,
9857                        n_thresholds * sizeof(s32));
9858
9859                 wdev->cqm_config = cqm_config;
9860         }
9861
9862         err = cfg80211_cqm_rssi_update(rdev, dev);
9863
9864 unlock:
9865         wdev_unlock(wdev);
9866
9867         return err;
9868 }
9869
9870 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
9871 {
9872         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
9873         struct nlattr *cqm;
9874         int err;
9875
9876         cqm = info->attrs[NL80211_ATTR_CQM];
9877         if (!cqm)
9878                 return -EINVAL;
9879
9880         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
9881                                nl80211_attr_cqm_policy, info->extack);
9882         if (err)
9883                 return err;
9884
9885         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
9886             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
9887                 const s32 *thresholds =
9888                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
9889                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
9890                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
9891
9892                 if (len % 4)
9893                         return -EINVAL;
9894
9895                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
9896                                             hysteresis);
9897         }
9898
9899         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
9900             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
9901             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
9902                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
9903                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
9904                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
9905
9906                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
9907         }
9908
9909         return -EINVAL;
9910 }
9911
9912 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
9913 {
9914         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9915         struct net_device *dev = info->user_ptr[1];
9916         struct ocb_setup setup = {};
9917         int err;
9918
9919         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9920         if (err)
9921                 return err;
9922
9923         return cfg80211_join_ocb(rdev, dev, &setup);
9924 }
9925
9926 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
9927 {
9928         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9929         struct net_device *dev = info->user_ptr[1];
9930
9931         return cfg80211_leave_ocb(rdev, dev);
9932 }
9933
9934 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
9935 {
9936         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9937         struct net_device *dev = info->user_ptr[1];
9938         struct mesh_config cfg;
9939         struct mesh_setup setup;
9940         int err;
9941
9942         /* start with default */
9943         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
9944         memcpy(&setup, &default_mesh_setup, sizeof(setup));
9945
9946         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
9947                 /* and parse parameters if given */
9948                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
9949                 if (err)
9950                         return err;
9951         }
9952
9953         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
9954             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
9955                 return -EINVAL;
9956
9957         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
9958         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
9959
9960         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9961             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
9962                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9963                         return -EINVAL;
9964
9965         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
9966                 setup.beacon_interval =
9967                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9968
9969                 err = cfg80211_validate_beacon_int(rdev,
9970                                                    NL80211_IFTYPE_MESH_POINT,
9971                                                    setup.beacon_interval);
9972                 if (err)
9973                         return err;
9974         }
9975
9976         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
9977                 setup.dtim_period =
9978                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
9979                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
9980                         return -EINVAL;
9981         }
9982
9983         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
9984                 /* parse additional setup parameters if given */
9985                 err = nl80211_parse_mesh_setup(info, &setup);
9986                 if (err)
9987                         return err;
9988         }
9989
9990         if (setup.user_mpm)
9991                 cfg.auto_open_plinks = false;
9992
9993         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9994                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9995                 if (err)
9996                         return err;
9997         } else {
9998                 /* cfg80211_join_mesh() will sort it out */
9999                 setup.chandef.chan = NULL;
10000         }
10001
10002         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10003                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10004                 int n_rates =
10005                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10006                 struct ieee80211_supported_band *sband;
10007
10008                 if (!setup.chandef.chan)
10009                         return -EINVAL;
10010
10011                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
10012
10013                 err = ieee80211_get_ratemask(sband, rates, n_rates,
10014                                              &setup.basic_rates);
10015                 if (err)
10016                         return err;
10017         }
10018
10019         if (info->attrs[NL80211_ATTR_TX_RATES]) {
10020                 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
10021                 if (err)
10022                         return err;
10023
10024                 if (!setup.chandef.chan)
10025                         return -EINVAL;
10026
10027                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
10028                                               &setup.beacon_rate);
10029                 if (err)
10030                         return err;
10031         }
10032
10033         setup.userspace_handles_dfs =
10034                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10035
10036         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
10037 }
10038
10039 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
10040 {
10041         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10042         struct net_device *dev = info->user_ptr[1];
10043
10044         return cfg80211_leave_mesh(rdev, dev);
10045 }
10046
10047 #ifdef CONFIG_PM
10048 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
10049                                         struct cfg80211_registered_device *rdev)
10050 {
10051         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
10052         struct nlattr *nl_pats, *nl_pat;
10053         int i, pat_len;
10054
10055         if (!wowlan->n_patterns)
10056                 return 0;
10057
10058         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
10059         if (!nl_pats)
10060                 return -ENOBUFS;
10061
10062         for (i = 0; i < wowlan->n_patterns; i++) {
10063                 nl_pat = nla_nest_start(msg, i + 1);
10064                 if (!nl_pat)
10065                         return -ENOBUFS;
10066                 pat_len = wowlan->patterns[i].pattern_len;
10067                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
10068                             wowlan->patterns[i].mask) ||
10069                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10070                             wowlan->patterns[i].pattern) ||
10071                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10072                                 wowlan->patterns[i].pkt_offset))
10073                         return -ENOBUFS;
10074                 nla_nest_end(msg, nl_pat);
10075         }
10076         nla_nest_end(msg, nl_pats);
10077
10078         return 0;
10079 }
10080
10081 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
10082                                    struct cfg80211_wowlan_tcp *tcp)
10083 {
10084         struct nlattr *nl_tcp;
10085
10086         if (!tcp)
10087                 return 0;
10088
10089         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
10090         if (!nl_tcp)
10091                 return -ENOBUFS;
10092
10093         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
10094             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
10095             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
10096             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
10097             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
10098             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
10099                     tcp->payload_len, tcp->payload) ||
10100             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
10101                         tcp->data_interval) ||
10102             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
10103                     tcp->wake_len, tcp->wake_data) ||
10104             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
10105                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
10106                 return -ENOBUFS;
10107
10108         if (tcp->payload_seq.len &&
10109             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
10110                     sizeof(tcp->payload_seq), &tcp->payload_seq))
10111                 return -ENOBUFS;
10112
10113         if (tcp->payload_tok.len &&
10114             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
10115                     sizeof(tcp->payload_tok) + tcp->tokens_size,
10116                     &tcp->payload_tok))
10117                 return -ENOBUFS;
10118
10119         nla_nest_end(msg, nl_tcp);
10120
10121         return 0;
10122 }
10123
10124 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
10125                                   struct cfg80211_sched_scan_request *req)
10126 {
10127         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
10128         int i;
10129
10130         if (!req)
10131                 return 0;
10132
10133         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
10134         if (!nd)
10135                 return -ENOBUFS;
10136
10137         if (req->n_scan_plans == 1 &&
10138             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
10139                         req->scan_plans[0].interval * 1000))
10140                 return -ENOBUFS;
10141
10142         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
10143                 return -ENOBUFS;
10144
10145         if (req->relative_rssi_set) {
10146                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
10147
10148                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
10149                                req->relative_rssi))
10150                         return -ENOBUFS;
10151
10152                 rssi_adjust.band = req->rssi_adjust.band;
10153                 rssi_adjust.delta = req->rssi_adjust.delta;
10154                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
10155                             sizeof(rssi_adjust), &rssi_adjust))
10156                         return -ENOBUFS;
10157         }
10158
10159         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10160         if (!freqs)
10161                 return -ENOBUFS;
10162
10163         for (i = 0; i < req->n_channels; i++) {
10164                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10165                         return -ENOBUFS;
10166         }
10167
10168         nla_nest_end(msg, freqs);
10169
10170         if (req->n_match_sets) {
10171                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
10172                 if (!matches)
10173                         return -ENOBUFS;
10174
10175                 for (i = 0; i < req->n_match_sets; i++) {
10176                         match = nla_nest_start(msg, i);
10177                         if (!match)
10178                                 return -ENOBUFS;
10179
10180                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
10181                                     req->match_sets[i].ssid.ssid_len,
10182                                     req->match_sets[i].ssid.ssid))
10183                                 return -ENOBUFS;
10184                         nla_nest_end(msg, match);
10185                 }
10186                 nla_nest_end(msg, matches);
10187         }
10188
10189         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
10190         if (!scan_plans)
10191                 return -ENOBUFS;
10192
10193         for (i = 0; i < req->n_scan_plans; i++) {
10194                 scan_plan = nla_nest_start(msg, i + 1);
10195                 if (!scan_plan)
10196                         return -ENOBUFS;
10197
10198                 if (!scan_plan ||
10199                     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
10200                                 req->scan_plans[i].interval) ||
10201                     (req->scan_plans[i].iterations &&
10202                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
10203                                  req->scan_plans[i].iterations)))
10204                         return -ENOBUFS;
10205                 nla_nest_end(msg, scan_plan);
10206         }
10207         nla_nest_end(msg, scan_plans);
10208
10209         nla_nest_end(msg, nd);
10210
10211         return 0;
10212 }
10213
10214 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
10215 {
10216         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10217         struct sk_buff *msg;
10218         void *hdr;
10219         u32 size = NLMSG_DEFAULT_SIZE;
10220
10221         if (!rdev->wiphy.wowlan)
10222                 return -EOPNOTSUPP;
10223
10224         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
10225                 /* adjust size to have room for all the data */
10226                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
10227                         rdev->wiphy.wowlan_config->tcp->payload_len +
10228                         rdev->wiphy.wowlan_config->tcp->wake_len +
10229                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
10230         }
10231
10232         msg = nlmsg_new(size, GFP_KERNEL);
10233         if (!msg)
10234                 return -ENOMEM;
10235
10236         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10237                              NL80211_CMD_GET_WOWLAN);
10238         if (!hdr)
10239                 goto nla_put_failure;
10240
10241         if (rdev->wiphy.wowlan_config) {
10242                 struct nlattr *nl_wowlan;
10243
10244                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10245                 if (!nl_wowlan)
10246                         goto nla_put_failure;
10247
10248                 if ((rdev->wiphy.wowlan_config->any &&
10249                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
10250                     (rdev->wiphy.wowlan_config->disconnect &&
10251                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
10252                     (rdev->wiphy.wowlan_config->magic_pkt &&
10253                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
10254                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
10255                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
10256                     (rdev->wiphy.wowlan_config->eap_identity_req &&
10257                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
10258                     (rdev->wiphy.wowlan_config->four_way_handshake &&
10259                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
10260                     (rdev->wiphy.wowlan_config->rfkill_release &&
10261                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
10262                         goto nla_put_failure;
10263
10264                 if (nl80211_send_wowlan_patterns(msg, rdev))
10265                         goto nla_put_failure;
10266
10267                 if (nl80211_send_wowlan_tcp(msg,
10268                                             rdev->wiphy.wowlan_config->tcp))
10269                         goto nla_put_failure;
10270
10271                 if (nl80211_send_wowlan_nd(
10272                             msg,
10273                             rdev->wiphy.wowlan_config->nd_config))
10274                         goto nla_put_failure;
10275
10276                 nla_nest_end(msg, nl_wowlan);
10277         }
10278
10279         genlmsg_end(msg, hdr);
10280         return genlmsg_reply(msg, info);
10281
10282 nla_put_failure:
10283         nlmsg_free(msg);
10284         return -ENOBUFS;
10285 }
10286
10287 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
10288                                     struct nlattr *attr,
10289                                     struct cfg80211_wowlan *trig)
10290 {
10291         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
10292         struct cfg80211_wowlan_tcp *cfg;
10293         struct nl80211_wowlan_tcp_data_token *tok = NULL;
10294         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
10295         u32 size;
10296         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
10297         int err, port;
10298
10299         if (!rdev->wiphy.wowlan->tcp)
10300                 return -EINVAL;
10301
10302         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr,
10303                                nl80211_wowlan_tcp_policy, NULL);
10304         if (err)
10305                 return err;
10306
10307         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
10308             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
10309             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
10310             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
10311             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
10312             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
10313             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
10314             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
10315                 return -EINVAL;
10316
10317         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
10318         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
10319                 return -EINVAL;
10320
10321         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
10322                         rdev->wiphy.wowlan->tcp->data_interval_max ||
10323             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
10324                 return -EINVAL;
10325
10326         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
10327         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
10328                 return -EINVAL;
10329
10330         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
10331         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
10332                 return -EINVAL;
10333
10334         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
10335                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10336
10337                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10338                 tokens_size = tokln - sizeof(*tok);
10339
10340                 if (!tok->len || tokens_size % tok->len)
10341                         return -EINVAL;
10342                 if (!rdev->wiphy.wowlan->tcp->tok)
10343                         return -EINVAL;
10344                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
10345                         return -EINVAL;
10346                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
10347                         return -EINVAL;
10348                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
10349                         return -EINVAL;
10350                 if (tok->offset + tok->len > data_size)
10351                         return -EINVAL;
10352         }
10353
10354         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
10355                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
10356                 if (!rdev->wiphy.wowlan->tcp->seq)
10357                         return -EINVAL;
10358                 if (seq->len == 0 || seq->len > 4)
10359                         return -EINVAL;
10360                 if (seq->len + seq->offset > data_size)
10361                         return -EINVAL;
10362         }
10363
10364         size = sizeof(*cfg);
10365         size += data_size;
10366         size += wake_size + wake_mask_size;
10367         size += tokens_size;
10368
10369         cfg = kzalloc(size, GFP_KERNEL);
10370         if (!cfg)
10371                 return -ENOMEM;
10372         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
10373         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
10374         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
10375                ETH_ALEN);
10376         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
10377                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
10378         else
10379                 port = 0;
10380 #ifdef CONFIG_INET
10381         /* allocate a socket and port for it and use it */
10382         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
10383                             IPPROTO_TCP, &cfg->sock, 1);
10384         if (err) {
10385                 kfree(cfg);
10386                 return err;
10387         }
10388         if (inet_csk_get_port(cfg->sock->sk, port)) {
10389                 sock_release(cfg->sock);
10390                 kfree(cfg);
10391                 return -EADDRINUSE;
10392         }
10393         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
10394 #else
10395         if (!port) {
10396                 kfree(cfg);
10397                 return -EINVAL;
10398         }
10399         cfg->src_port = port;
10400 #endif
10401
10402         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
10403         cfg->payload_len = data_size;
10404         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
10405         memcpy((void *)cfg->payload,
10406                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
10407                data_size);
10408         if (seq)
10409                 cfg->payload_seq = *seq;
10410         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
10411         cfg->wake_len = wake_size;
10412         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
10413         memcpy((void *)cfg->wake_data,
10414                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
10415                wake_size);
10416         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
10417                          data_size + wake_size;
10418         memcpy((void *)cfg->wake_mask,
10419                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
10420                wake_mask_size);
10421         if (tok) {
10422                 cfg->tokens_size = tokens_size;
10423                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
10424         }
10425
10426         trig->tcp = cfg;
10427
10428         return 0;
10429 }
10430
10431 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
10432                                    const struct wiphy_wowlan_support *wowlan,
10433                                    struct nlattr *attr,
10434                                    struct cfg80211_wowlan *trig)
10435 {
10436         struct nlattr **tb;
10437         int err;
10438
10439         tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
10440         if (!tb)
10441                 return -ENOMEM;
10442
10443         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
10444                 err = -EOPNOTSUPP;
10445                 goto out;
10446         }
10447
10448         err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy,
10449                                NULL);
10450         if (err)
10451                 goto out;
10452
10453         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
10454                                                    wowlan->max_nd_match_sets);
10455         err = PTR_ERR_OR_ZERO(trig->nd_config);
10456         if (err)
10457                 trig->nd_config = NULL;
10458
10459 out:
10460         kfree(tb);
10461         return err;
10462 }
10463
10464 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
10465 {
10466         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10467         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
10468         struct cfg80211_wowlan new_triggers = {};
10469         struct cfg80211_wowlan *ntrig;
10470         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
10471         int err, i;
10472         bool prev_enabled = rdev->wiphy.wowlan_config;
10473         bool regular = false;
10474
10475         if (!wowlan)
10476                 return -EOPNOTSUPP;
10477
10478         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
10479                 cfg80211_rdev_free_wowlan(rdev);
10480                 rdev->wiphy.wowlan_config = NULL;
10481                 goto set_wakeup;
10482         }
10483
10484         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG,
10485                                info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
10486                                nl80211_wowlan_policy, info->extack);
10487         if (err)
10488                 return err;
10489
10490         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
10491                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
10492                         return -EINVAL;
10493                 new_triggers.any = true;
10494         }
10495
10496         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
10497                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
10498                         return -EINVAL;
10499                 new_triggers.disconnect = true;
10500                 regular = true;
10501         }
10502
10503         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
10504                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
10505                         return -EINVAL;
10506                 new_triggers.magic_pkt = true;
10507                 regular = true;
10508         }
10509
10510         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
10511                 return -EINVAL;
10512
10513         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
10514                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
10515                         return -EINVAL;
10516                 new_triggers.gtk_rekey_failure = true;
10517                 regular = true;
10518         }
10519
10520         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
10521                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
10522                         return -EINVAL;
10523                 new_triggers.eap_identity_req = true;
10524                 regular = true;
10525         }
10526
10527         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
10528                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
10529                         return -EINVAL;
10530                 new_triggers.four_way_handshake = true;
10531                 regular = true;
10532         }
10533
10534         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
10535                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
10536                         return -EINVAL;
10537                 new_triggers.rfkill_release = true;
10538                 regular = true;
10539         }
10540
10541         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
10542                 struct nlattr *pat;
10543                 int n_patterns = 0;
10544                 int rem, pat_len, mask_len, pkt_offset;
10545                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10546
10547                 regular = true;
10548
10549                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10550                                     rem)
10551                         n_patterns++;
10552                 if (n_patterns > wowlan->n_patterns)
10553                         return -EINVAL;
10554
10555                 new_triggers.patterns = kcalloc(n_patterns,
10556                                                 sizeof(new_triggers.patterns[0]),
10557                                                 GFP_KERNEL);
10558                 if (!new_triggers.patterns)
10559                         return -ENOMEM;
10560
10561                 new_triggers.n_patterns = n_patterns;
10562                 i = 0;
10563
10564                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10565                                     rem) {
10566                         u8 *mask_pat;
10567
10568                         nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
10569                                          NULL, info->extack);
10570                         err = -EINVAL;
10571                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
10572                             !pat_tb[NL80211_PKTPAT_PATTERN])
10573                                 goto error;
10574                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10575                         mask_len = DIV_ROUND_UP(pat_len, 8);
10576                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10577                                 goto error;
10578                         if (pat_len > wowlan->pattern_max_len ||
10579                             pat_len < wowlan->pattern_min_len)
10580                                 goto error;
10581
10582                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
10583                                 pkt_offset = 0;
10584                         else
10585                                 pkt_offset = nla_get_u32(
10586                                         pat_tb[NL80211_PKTPAT_OFFSET]);
10587                         if (pkt_offset > wowlan->max_pkt_offset)
10588                                 goto error;
10589                         new_triggers.patterns[i].pkt_offset = pkt_offset;
10590
10591                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10592                         if (!mask_pat) {
10593                                 err = -ENOMEM;
10594                                 goto error;
10595                         }
10596                         new_triggers.patterns[i].mask = mask_pat;
10597                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10598                                mask_len);
10599                         mask_pat += mask_len;
10600                         new_triggers.patterns[i].pattern = mask_pat;
10601                         new_triggers.patterns[i].pattern_len = pat_len;
10602                         memcpy(mask_pat,
10603                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10604                                pat_len);
10605                         i++;
10606                 }
10607         }
10608
10609         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
10610                 regular = true;
10611                 err = nl80211_parse_wowlan_tcp(
10612                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
10613                         &new_triggers);
10614                 if (err)
10615                         goto error;
10616         }
10617
10618         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
10619                 regular = true;
10620                 err = nl80211_parse_wowlan_nd(
10621                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
10622                         &new_triggers);
10623                 if (err)
10624                         goto error;
10625         }
10626
10627         /* The 'any' trigger means the device continues operating more or less
10628          * as in its normal operation mode and wakes up the host on most of the
10629          * normal interrupts (like packet RX, ...)
10630          * It therefore makes little sense to combine with the more constrained
10631          * wakeup trigger modes.
10632          */
10633         if (new_triggers.any && regular) {
10634                 err = -EINVAL;
10635                 goto error;
10636         }
10637
10638         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
10639         if (!ntrig) {
10640                 err = -ENOMEM;
10641                 goto error;
10642         }
10643         cfg80211_rdev_free_wowlan(rdev);
10644         rdev->wiphy.wowlan_config = ntrig;
10645
10646  set_wakeup:
10647         if (rdev->ops->set_wakeup &&
10648             prev_enabled != !!rdev->wiphy.wowlan_config)
10649                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
10650
10651         return 0;
10652  error:
10653         for (i = 0; i < new_triggers.n_patterns; i++)
10654                 kfree(new_triggers.patterns[i].mask);
10655         kfree(new_triggers.patterns);
10656         if (new_triggers.tcp && new_triggers.tcp->sock)
10657                 sock_release(new_triggers.tcp->sock);
10658         kfree(new_triggers.tcp);
10659         kfree(new_triggers.nd_config);
10660         return err;
10661 }
10662 #endif
10663
10664 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
10665                                        struct cfg80211_registered_device *rdev)
10666 {
10667         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
10668         int i, j, pat_len;
10669         struct cfg80211_coalesce_rules *rule;
10670
10671         if (!rdev->coalesce->n_rules)
10672                 return 0;
10673
10674         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
10675         if (!nl_rules)
10676                 return -ENOBUFS;
10677
10678         for (i = 0; i < rdev->coalesce->n_rules; i++) {
10679                 nl_rule = nla_nest_start(msg, i + 1);
10680                 if (!nl_rule)
10681                         return -ENOBUFS;
10682
10683                 rule = &rdev->coalesce->rules[i];
10684                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
10685                                 rule->delay))
10686                         return -ENOBUFS;
10687
10688                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
10689                                 rule->condition))
10690                         return -ENOBUFS;
10691
10692                 nl_pats = nla_nest_start(msg,
10693                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
10694                 if (!nl_pats)
10695                         return -ENOBUFS;
10696
10697                 for (j = 0; j < rule->n_patterns; j++) {
10698                         nl_pat = nla_nest_start(msg, j + 1);
10699                         if (!nl_pat)
10700                                 return -ENOBUFS;
10701                         pat_len = rule->patterns[j].pattern_len;
10702                         if (nla_put(msg, NL80211_PKTPAT_MASK,
10703                                     DIV_ROUND_UP(pat_len, 8),
10704                                     rule->patterns[j].mask) ||
10705                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10706                                     rule->patterns[j].pattern) ||
10707                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10708                                         rule->patterns[j].pkt_offset))
10709                                 return -ENOBUFS;
10710                         nla_nest_end(msg, nl_pat);
10711                 }
10712                 nla_nest_end(msg, nl_pats);
10713                 nla_nest_end(msg, nl_rule);
10714         }
10715         nla_nest_end(msg, nl_rules);
10716
10717         return 0;
10718 }
10719
10720 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
10721 {
10722         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10723         struct sk_buff *msg;
10724         void *hdr;
10725
10726         if (!rdev->wiphy.coalesce)
10727                 return -EOPNOTSUPP;
10728
10729         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10730         if (!msg)
10731                 return -ENOMEM;
10732
10733         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10734                              NL80211_CMD_GET_COALESCE);
10735         if (!hdr)
10736                 goto nla_put_failure;
10737
10738         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
10739                 goto nla_put_failure;
10740
10741         genlmsg_end(msg, hdr);
10742         return genlmsg_reply(msg, info);
10743
10744 nla_put_failure:
10745         nlmsg_free(msg);
10746         return -ENOBUFS;
10747 }
10748
10749 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
10750 {
10751         struct cfg80211_coalesce *coalesce = rdev->coalesce;
10752         int i, j;
10753         struct cfg80211_coalesce_rules *rule;
10754
10755         if (!coalesce)
10756                 return;
10757
10758         for (i = 0; i < coalesce->n_rules; i++) {
10759                 rule = &coalesce->rules[i];
10760                 for (j = 0; j < rule->n_patterns; j++)
10761                         kfree(rule->patterns[j].mask);
10762                 kfree(rule->patterns);
10763         }
10764         kfree(coalesce->rules);
10765         kfree(coalesce);
10766         rdev->coalesce = NULL;
10767 }
10768
10769 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
10770                                        struct nlattr *rule,
10771                                        struct cfg80211_coalesce_rules *new_rule)
10772 {
10773         int err, i;
10774         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10775         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
10776         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
10777         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10778
10779         err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule,
10780                                nl80211_coalesce_policy, NULL);
10781         if (err)
10782                 return err;
10783
10784         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
10785                 new_rule->delay =
10786                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
10787         if (new_rule->delay > coalesce->max_delay)
10788                 return -EINVAL;
10789
10790         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
10791                 new_rule->condition =
10792                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
10793         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
10794             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
10795                 return -EINVAL;
10796
10797         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
10798                 return -EINVAL;
10799
10800         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10801                             rem)
10802                 n_patterns++;
10803         if (n_patterns > coalesce->n_patterns)
10804                 return -EINVAL;
10805
10806         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
10807                                      GFP_KERNEL);
10808         if (!new_rule->patterns)
10809                 return -ENOMEM;
10810
10811         new_rule->n_patterns = n_patterns;
10812         i = 0;
10813
10814         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10815                             rem) {
10816                 u8 *mask_pat;
10817
10818                 nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, NULL, NULL);
10819                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
10820                     !pat_tb[NL80211_PKTPAT_PATTERN])
10821                         return -EINVAL;
10822                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10823                 mask_len = DIV_ROUND_UP(pat_len, 8);
10824                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10825                         return -EINVAL;
10826                 if (pat_len > coalesce->pattern_max_len ||
10827                     pat_len < coalesce->pattern_min_len)
10828                         return -EINVAL;
10829
10830                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
10831                         pkt_offset = 0;
10832                 else
10833                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
10834                 if (pkt_offset > coalesce->max_pkt_offset)
10835                         return -EINVAL;
10836                 new_rule->patterns[i].pkt_offset = pkt_offset;
10837
10838                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10839                 if (!mask_pat)
10840                         return -ENOMEM;
10841
10842                 new_rule->patterns[i].mask = mask_pat;
10843                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10844                        mask_len);
10845
10846                 mask_pat += mask_len;
10847                 new_rule->patterns[i].pattern = mask_pat;
10848                 new_rule->patterns[i].pattern_len = pat_len;
10849                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10850                        pat_len);
10851                 i++;
10852         }
10853
10854         return 0;
10855 }
10856
10857 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
10858 {
10859         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10860         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10861         struct cfg80211_coalesce new_coalesce = {};
10862         struct cfg80211_coalesce *n_coalesce;
10863         int err, rem_rule, n_rules = 0, i, j;
10864         struct nlattr *rule;
10865         struct cfg80211_coalesce_rules *tmp_rule;
10866
10867         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
10868                 return -EOPNOTSUPP;
10869
10870         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
10871                 cfg80211_rdev_free_coalesce(rdev);
10872                 rdev_set_coalesce(rdev, NULL);
10873                 return 0;
10874         }
10875
10876         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10877                             rem_rule)
10878                 n_rules++;
10879         if (n_rules > coalesce->n_rules)
10880                 return -EINVAL;
10881
10882         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
10883                                      GFP_KERNEL);
10884         if (!new_coalesce.rules)
10885                 return -ENOMEM;
10886
10887         new_coalesce.n_rules = n_rules;
10888         i = 0;
10889
10890         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10891                             rem_rule) {
10892                 err = nl80211_parse_coalesce_rule(rdev, rule,
10893                                                   &new_coalesce.rules[i]);
10894                 if (err)
10895                         goto error;
10896
10897                 i++;
10898         }
10899
10900         err = rdev_set_coalesce(rdev, &new_coalesce);
10901         if (err)
10902                 goto error;
10903
10904         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
10905         if (!n_coalesce) {
10906                 err = -ENOMEM;
10907                 goto error;
10908         }
10909         cfg80211_rdev_free_coalesce(rdev);
10910         rdev->coalesce = n_coalesce;
10911
10912         return 0;
10913 error:
10914         for (i = 0; i < new_coalesce.n_rules; i++) {
10915                 tmp_rule = &new_coalesce.rules[i];
10916                 for (j = 0; j < tmp_rule->n_patterns; j++)
10917                         kfree(tmp_rule->patterns[j].mask);
10918                 kfree(tmp_rule->patterns);
10919         }
10920         kfree(new_coalesce.rules);
10921
10922         return err;
10923 }
10924
10925 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
10926 {
10927         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10928         struct net_device *dev = info->user_ptr[1];
10929         struct wireless_dev *wdev = dev->ieee80211_ptr;
10930         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
10931         struct cfg80211_gtk_rekey_data rekey_data;
10932         int err;
10933
10934         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
10935                 return -EINVAL;
10936
10937         err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA,
10938                                info->attrs[NL80211_ATTR_REKEY_DATA],
10939                                nl80211_rekey_policy, info->extack);
10940         if (err)
10941                 return err;
10942
10943         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
10944             !tb[NL80211_REKEY_DATA_KCK])
10945                 return -EINVAL;
10946         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
10947                 return -ERANGE;
10948         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
10949                 return -ERANGE;
10950         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
10951                 return -ERANGE;
10952
10953         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
10954         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
10955         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
10956
10957         wdev_lock(wdev);
10958         if (!wdev->current_bss) {
10959                 err = -ENOTCONN;
10960                 goto out;
10961         }
10962
10963         if (!rdev->ops->set_rekey_data) {
10964                 err = -EOPNOTSUPP;
10965                 goto out;
10966         }
10967
10968         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
10969  out:
10970         wdev_unlock(wdev);
10971         return err;
10972 }
10973
10974 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
10975                                              struct genl_info *info)
10976 {
10977         struct net_device *dev = info->user_ptr[1];
10978         struct wireless_dev *wdev = dev->ieee80211_ptr;
10979
10980         if (wdev->iftype != NL80211_IFTYPE_AP &&
10981             wdev->iftype != NL80211_IFTYPE_P2P_GO)
10982                 return -EINVAL;
10983
10984         if (wdev->ap_unexpected_nlportid)
10985                 return -EBUSY;
10986
10987         wdev->ap_unexpected_nlportid = info->snd_portid;
10988         return 0;
10989 }
10990
10991 static int nl80211_probe_client(struct sk_buff *skb,
10992                                 struct genl_info *info)
10993 {
10994         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10995         struct net_device *dev = info->user_ptr[1];
10996         struct wireless_dev *wdev = dev->ieee80211_ptr;
10997         struct sk_buff *msg;
10998         void *hdr;
10999         const u8 *addr;
11000         u64 cookie;
11001         int err;
11002
11003         if (wdev->iftype != NL80211_IFTYPE_AP &&
11004             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11005                 return -EOPNOTSUPP;
11006
11007         if (!info->attrs[NL80211_ATTR_MAC])
11008                 return -EINVAL;
11009
11010         if (!rdev->ops->probe_client)
11011                 return -EOPNOTSUPP;
11012
11013         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11014         if (!msg)
11015                 return -ENOMEM;
11016
11017         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11018                              NL80211_CMD_PROBE_CLIENT);
11019         if (!hdr) {
11020                 err = -ENOBUFS;
11021                 goto free_msg;
11022         }
11023
11024         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11025
11026         err = rdev_probe_client(rdev, dev, addr, &cookie);
11027         if (err)
11028                 goto free_msg;
11029
11030         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11031                               NL80211_ATTR_PAD))
11032                 goto nla_put_failure;
11033
11034         genlmsg_end(msg, hdr);
11035
11036         return genlmsg_reply(msg, info);
11037
11038  nla_put_failure:
11039         err = -ENOBUFS;
11040  free_msg:
11041         nlmsg_free(msg);
11042         return err;
11043 }
11044
11045 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
11046 {
11047         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11048         struct cfg80211_beacon_registration *reg, *nreg;
11049         int rv;
11050
11051         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
11052                 return -EOPNOTSUPP;
11053
11054         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
11055         if (!nreg)
11056                 return -ENOMEM;
11057
11058         /* First, check if already registered. */
11059         spin_lock_bh(&rdev->beacon_registrations_lock);
11060         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11061                 if (reg->nlportid == info->snd_portid) {
11062                         rv = -EALREADY;
11063                         goto out_err;
11064                 }
11065         }
11066         /* Add it to the list */
11067         nreg->nlportid = info->snd_portid;
11068         list_add(&nreg->list, &rdev->beacon_registrations);
11069
11070         spin_unlock_bh(&rdev->beacon_registrations_lock);
11071
11072         return 0;
11073 out_err:
11074         spin_unlock_bh(&rdev->beacon_registrations_lock);
11075         kfree(nreg);
11076         return rv;
11077 }
11078
11079 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
11080 {
11081         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11082         struct wireless_dev *wdev = info->user_ptr[1];
11083         int err;
11084
11085         if (!rdev->ops->start_p2p_device)
11086                 return -EOPNOTSUPP;
11087
11088         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11089                 return -EOPNOTSUPP;
11090
11091         if (wdev_running(wdev))
11092                 return 0;
11093
11094         if (rfkill_blocked(rdev->rfkill))
11095                 return -ERFKILL;
11096
11097         err = rdev_start_p2p_device(rdev, wdev);
11098         if (err)
11099                 return err;
11100
11101         wdev->is_running = true;
11102         rdev->opencount++;
11103
11104         return 0;
11105 }
11106
11107 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
11108 {
11109         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11110         struct wireless_dev *wdev = info->user_ptr[1];
11111
11112         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11113                 return -EOPNOTSUPP;
11114
11115         if (!rdev->ops->stop_p2p_device)
11116                 return -EOPNOTSUPP;
11117
11118         cfg80211_stop_p2p_device(rdev, wdev);
11119
11120         return 0;
11121 }
11122
11123 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
11124 {
11125         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11126         struct wireless_dev *wdev = info->user_ptr[1];
11127         struct cfg80211_nan_conf conf = {};
11128         int err;
11129
11130         if (wdev->iftype != NL80211_IFTYPE_NAN)
11131                 return -EOPNOTSUPP;
11132
11133         if (wdev_running(wdev))
11134                 return -EEXIST;
11135
11136         if (rfkill_blocked(rdev->rfkill))
11137                 return -ERFKILL;
11138
11139         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
11140                 return -EINVAL;
11141
11142         conf.master_pref =
11143                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11144         if (!conf.master_pref)
11145                 return -EINVAL;
11146
11147         if (info->attrs[NL80211_ATTR_BANDS]) {
11148                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11149
11150                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11151                         return -EOPNOTSUPP;
11152
11153                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11154                         return -EINVAL;
11155
11156                 conf.bands = bands;
11157         }
11158
11159         err = rdev_start_nan(rdev, wdev, &conf);
11160         if (err)
11161                 return err;
11162
11163         wdev->is_running = true;
11164         rdev->opencount++;
11165
11166         return 0;
11167 }
11168
11169 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
11170 {
11171         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11172         struct wireless_dev *wdev = info->user_ptr[1];
11173
11174         if (wdev->iftype != NL80211_IFTYPE_NAN)
11175                 return -EOPNOTSUPP;
11176
11177         cfg80211_stop_nan(rdev, wdev);
11178
11179         return 0;
11180 }
11181
11182 static int validate_nan_filter(struct nlattr *filter_attr)
11183 {
11184         struct nlattr *attr;
11185         int len = 0, n_entries = 0, rem;
11186
11187         nla_for_each_nested(attr, filter_attr, rem) {
11188                 len += nla_len(attr);
11189                 n_entries++;
11190         }
11191
11192         if (len >= U8_MAX)
11193                 return -EINVAL;
11194
11195         return n_entries;
11196 }
11197
11198 static int handle_nan_filter(struct nlattr *attr_filter,
11199                              struct cfg80211_nan_func *func,
11200                              bool tx)
11201 {
11202         struct nlattr *attr;
11203         int n_entries, rem, i;
11204         struct cfg80211_nan_func_filter *filter;
11205
11206         n_entries = validate_nan_filter(attr_filter);
11207         if (n_entries < 0)
11208                 return n_entries;
11209
11210         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
11211
11212         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
11213         if (!filter)
11214                 return -ENOMEM;
11215
11216         i = 0;
11217         nla_for_each_nested(attr, attr_filter, rem) {
11218                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
11219                 filter[i].len = nla_len(attr);
11220                 i++;
11221         }
11222         if (tx) {
11223                 func->num_tx_filters = n_entries;
11224                 func->tx_filters = filter;
11225         } else {
11226                 func->num_rx_filters = n_entries;
11227                 func->rx_filters = filter;
11228         }
11229
11230         return 0;
11231 }
11232
11233 static int nl80211_nan_add_func(struct sk_buff *skb,
11234                                 struct genl_info *info)
11235 {
11236         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11237         struct wireless_dev *wdev = info->user_ptr[1];
11238         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
11239         struct cfg80211_nan_func *func;
11240         struct sk_buff *msg = NULL;
11241         void *hdr = NULL;
11242         int err = 0;
11243
11244         if (wdev->iftype != NL80211_IFTYPE_NAN)
11245                 return -EOPNOTSUPP;
11246
11247         if (!wdev_running(wdev))
11248                 return -ENOTCONN;
11249
11250         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
11251                 return -EINVAL;
11252
11253         err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX,
11254                                info->attrs[NL80211_ATTR_NAN_FUNC],
11255                                nl80211_nan_func_policy, info->extack);
11256         if (err)
11257                 return err;
11258
11259         func = kzalloc(sizeof(*func), GFP_KERNEL);
11260         if (!func)
11261                 return -ENOMEM;
11262
11263         func->cookie = wdev->wiphy->cookie_counter++;
11264
11265         if (!tb[NL80211_NAN_FUNC_TYPE] ||
11266             nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
11267                 err = -EINVAL;
11268                 goto out;
11269         }
11270
11271
11272         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
11273
11274         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
11275                 err = -EINVAL;
11276                 goto out;
11277         }
11278
11279         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
11280                sizeof(func->service_id));
11281
11282         func->close_range =
11283                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
11284
11285         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
11286                 func->serv_spec_info_len =
11287                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
11288                 func->serv_spec_info =
11289                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
11290                                 func->serv_spec_info_len,
11291                                 GFP_KERNEL);
11292                 if (!func->serv_spec_info) {
11293                         err = -ENOMEM;
11294                         goto out;
11295                 }
11296         }
11297
11298         if (tb[NL80211_NAN_FUNC_TTL])
11299                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
11300
11301         switch (func->type) {
11302         case NL80211_NAN_FUNC_PUBLISH:
11303                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
11304                         err = -EINVAL;
11305                         goto out;
11306                 }
11307
11308                 func->publish_type =
11309                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
11310                 func->publish_bcast =
11311                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
11312
11313                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
11314                         func->publish_bcast) {
11315                         err = -EINVAL;
11316                         goto out;
11317                 }
11318                 break;
11319         case NL80211_NAN_FUNC_SUBSCRIBE:
11320                 func->subscribe_active =
11321                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
11322                 break;
11323         case NL80211_NAN_FUNC_FOLLOW_UP:
11324                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
11325                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]) {
11326                         err = -EINVAL;
11327                         goto out;
11328                 }
11329
11330                 func->followup_id =
11331                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
11332                 func->followup_reqid =
11333                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
11334                 memcpy(func->followup_dest.addr,
11335                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
11336                        sizeof(func->followup_dest.addr));
11337                 if (func->ttl) {
11338                         err = -EINVAL;
11339                         goto out;
11340                 }
11341                 break;
11342         default:
11343                 err = -EINVAL;
11344                 goto out;
11345         }
11346
11347         if (tb[NL80211_NAN_FUNC_SRF]) {
11348                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
11349
11350                 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
11351                                        tb[NL80211_NAN_FUNC_SRF],
11352                                        nl80211_nan_srf_policy, info->extack);
11353                 if (err)
11354                         goto out;
11355
11356                 func->srf_include =
11357                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
11358
11359                 if (srf_tb[NL80211_NAN_SRF_BF]) {
11360                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
11361                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
11362                                 err = -EINVAL;
11363                                 goto out;
11364                         }
11365
11366                         func->srf_bf_len =
11367                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
11368                         func->srf_bf =
11369                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
11370                                         func->srf_bf_len, GFP_KERNEL);
11371                         if (!func->srf_bf) {
11372                                 err = -ENOMEM;
11373                                 goto out;
11374                         }
11375
11376                         func->srf_bf_idx =
11377                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
11378                 } else {
11379                         struct nlattr *attr, *mac_attr =
11380                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
11381                         int n_entries, rem, i = 0;
11382
11383                         if (!mac_attr) {
11384                                 err = -EINVAL;
11385                                 goto out;
11386                         }
11387
11388                         n_entries = validate_acl_mac_addrs(mac_attr);
11389                         if (n_entries <= 0) {
11390                                 err = -EINVAL;
11391                                 goto out;
11392                         }
11393
11394                         func->srf_num_macs = n_entries;
11395                         func->srf_macs =
11396                                 kzalloc(sizeof(*func->srf_macs) * n_entries,
11397                                         GFP_KERNEL);
11398                         if (!func->srf_macs) {
11399                                 err = -ENOMEM;
11400                                 goto out;
11401                         }
11402
11403                         nla_for_each_nested(attr, mac_attr, rem)
11404                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
11405                                        sizeof(*func->srf_macs));
11406                 }
11407         }
11408
11409         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
11410                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
11411                                         func, true);
11412                 if (err)
11413                         goto out;
11414         }
11415
11416         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
11417                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
11418                                         func, false);
11419                 if (err)
11420                         goto out;
11421         }
11422
11423         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11424         if (!msg) {
11425                 err = -ENOMEM;
11426                 goto out;
11427         }
11428
11429         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11430                              NL80211_CMD_ADD_NAN_FUNCTION);
11431         /* This can't really happen - we just allocated 4KB */
11432         if (WARN_ON(!hdr)) {
11433                 err = -ENOMEM;
11434                 goto out;
11435         }
11436
11437         err = rdev_add_nan_func(rdev, wdev, func);
11438 out:
11439         if (err < 0) {
11440                 cfg80211_free_nan_func(func);
11441                 nlmsg_free(msg);
11442                 return err;
11443         }
11444
11445         /* propagate the instance id and cookie to userspace  */
11446         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
11447                               NL80211_ATTR_PAD))
11448                 goto nla_put_failure;
11449
11450         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11451         if (!func_attr)
11452                 goto nla_put_failure;
11453
11454         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
11455                        func->instance_id))
11456                 goto nla_put_failure;
11457
11458         nla_nest_end(msg, func_attr);
11459
11460         genlmsg_end(msg, hdr);
11461         return genlmsg_reply(msg, info);
11462
11463 nla_put_failure:
11464         nlmsg_free(msg);
11465         return -ENOBUFS;
11466 }
11467
11468 static int nl80211_nan_del_func(struct sk_buff *skb,
11469                                struct genl_info *info)
11470 {
11471         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11472         struct wireless_dev *wdev = info->user_ptr[1];
11473         u64 cookie;
11474
11475         if (wdev->iftype != NL80211_IFTYPE_NAN)
11476                 return -EOPNOTSUPP;
11477
11478         if (!wdev_running(wdev))
11479                 return -ENOTCONN;
11480
11481         if (!info->attrs[NL80211_ATTR_COOKIE])
11482                 return -EINVAL;
11483
11484         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11485
11486         rdev_del_nan_func(rdev, wdev, cookie);
11487
11488         return 0;
11489 }
11490
11491 static int nl80211_nan_change_config(struct sk_buff *skb,
11492                                      struct genl_info *info)
11493 {
11494         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11495         struct wireless_dev *wdev = info->user_ptr[1];
11496         struct cfg80211_nan_conf conf = {};
11497         u32 changed = 0;
11498
11499         if (wdev->iftype != NL80211_IFTYPE_NAN)
11500                 return -EOPNOTSUPP;
11501
11502         if (!wdev_running(wdev))
11503                 return -ENOTCONN;
11504
11505         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
11506                 conf.master_pref =
11507                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11508                 if (conf.master_pref <= 1 || conf.master_pref == 255)
11509                         return -EINVAL;
11510
11511                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
11512         }
11513
11514         if (info->attrs[NL80211_ATTR_BANDS]) {
11515                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11516
11517                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11518                         return -EOPNOTSUPP;
11519
11520                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11521                         return -EINVAL;
11522
11523                 conf.bands = bands;
11524                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
11525         }
11526
11527         if (!changed)
11528                 return -EINVAL;
11529
11530         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
11531 }
11532
11533 void cfg80211_nan_match(struct wireless_dev *wdev,
11534                         struct cfg80211_nan_match_params *match, gfp_t gfp)
11535 {
11536         struct wiphy *wiphy = wdev->wiphy;
11537         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11538         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
11539         struct sk_buff *msg;
11540         void *hdr;
11541
11542         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
11543                 return;
11544
11545         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11546         if (!msg)
11547                 return;
11548
11549         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
11550         if (!hdr) {
11551                 nlmsg_free(msg);
11552                 return;
11553         }
11554
11555         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11556             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11557                                          wdev->netdev->ifindex)) ||
11558             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11559                               NL80211_ATTR_PAD))
11560                 goto nla_put_failure;
11561
11562         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
11563                               NL80211_ATTR_PAD) ||
11564             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
11565                 goto nla_put_failure;
11566
11567         match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
11568         if (!match_attr)
11569                 goto nla_put_failure;
11570
11571         local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
11572         if (!local_func_attr)
11573                 goto nla_put_failure;
11574
11575         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
11576                 goto nla_put_failure;
11577
11578         nla_nest_end(msg, local_func_attr);
11579
11580         peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
11581         if (!peer_func_attr)
11582                 goto nla_put_failure;
11583
11584         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
11585             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
11586                 goto nla_put_failure;
11587
11588         if (match->info && match->info_len &&
11589             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
11590                     match->info))
11591                 goto nla_put_failure;
11592
11593         nla_nest_end(msg, peer_func_attr);
11594         nla_nest_end(msg, match_attr);
11595         genlmsg_end(msg, hdr);
11596
11597         if (!wdev->owner_nlportid)
11598                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11599                                         msg, 0, NL80211_MCGRP_NAN, gfp);
11600         else
11601                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11602                                 wdev->owner_nlportid);
11603
11604         return;
11605
11606 nla_put_failure:
11607         nlmsg_free(msg);
11608 }
11609 EXPORT_SYMBOL(cfg80211_nan_match);
11610
11611 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
11612                                   u8 inst_id,
11613                                   enum nl80211_nan_func_term_reason reason,
11614                                   u64 cookie, gfp_t gfp)
11615 {
11616         struct wiphy *wiphy = wdev->wiphy;
11617         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11618         struct sk_buff *msg;
11619         struct nlattr *func_attr;
11620         void *hdr;
11621
11622         if (WARN_ON(!inst_id))
11623                 return;
11624
11625         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11626         if (!msg)
11627                 return;
11628
11629         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
11630         if (!hdr) {
11631                 nlmsg_free(msg);
11632                 return;
11633         }
11634
11635         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11636             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11637                                          wdev->netdev->ifindex)) ||
11638             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11639                               NL80211_ATTR_PAD))
11640                 goto nla_put_failure;
11641
11642         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11643                               NL80211_ATTR_PAD))
11644                 goto nla_put_failure;
11645
11646         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11647         if (!func_attr)
11648                 goto nla_put_failure;
11649
11650         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
11651             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
11652                 goto nla_put_failure;
11653
11654         nla_nest_end(msg, func_attr);
11655         genlmsg_end(msg, hdr);
11656
11657         if (!wdev->owner_nlportid)
11658                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11659                                         msg, 0, NL80211_MCGRP_NAN, gfp);
11660         else
11661                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11662                                 wdev->owner_nlportid);
11663
11664         return;
11665
11666 nla_put_failure:
11667         nlmsg_free(msg);
11668 }
11669 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
11670
11671 static int nl80211_get_protocol_features(struct sk_buff *skb,
11672                                          struct genl_info *info)
11673 {
11674         void *hdr;
11675         struct sk_buff *msg;
11676
11677         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11678         if (!msg)
11679                 return -ENOMEM;
11680
11681         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11682                              NL80211_CMD_GET_PROTOCOL_FEATURES);
11683         if (!hdr)
11684                 goto nla_put_failure;
11685
11686         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
11687                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
11688                 goto nla_put_failure;
11689
11690         genlmsg_end(msg, hdr);
11691         return genlmsg_reply(msg, info);
11692
11693  nla_put_failure:
11694         kfree_skb(msg);
11695         return -ENOBUFS;
11696 }
11697
11698 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
11699 {
11700         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11701         struct cfg80211_update_ft_ies_params ft_params;
11702         struct net_device *dev = info->user_ptr[1];
11703
11704         if (!rdev->ops->update_ft_ies)
11705                 return -EOPNOTSUPP;
11706
11707         if (!info->attrs[NL80211_ATTR_MDID] ||
11708             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
11709                 return -EINVAL;
11710
11711         memset(&ft_params, 0, sizeof(ft_params));
11712         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
11713         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11714         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11715
11716         return rdev_update_ft_ies(rdev, dev, &ft_params);
11717 }
11718
11719 static int nl80211_crit_protocol_start(struct sk_buff *skb,
11720                                        struct genl_info *info)
11721 {
11722         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11723         struct wireless_dev *wdev = info->user_ptr[1];
11724         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
11725         u16 duration;
11726         int ret;
11727
11728         if (!rdev->ops->crit_proto_start)
11729                 return -EOPNOTSUPP;
11730
11731         if (WARN_ON(!rdev->ops->crit_proto_stop))
11732                 return -EINVAL;
11733
11734         if (rdev->crit_proto_nlportid)
11735                 return -EBUSY;
11736
11737         /* determine protocol if provided */
11738         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
11739                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
11740
11741         if (proto >= NUM_NL80211_CRIT_PROTO)
11742                 return -EINVAL;
11743
11744         /* timeout must be provided */
11745         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
11746                 return -EINVAL;
11747
11748         duration =
11749                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
11750
11751         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
11752                 return -ERANGE;
11753
11754         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
11755         if (!ret)
11756                 rdev->crit_proto_nlportid = info->snd_portid;
11757
11758         return ret;
11759 }
11760
11761 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
11762                                       struct genl_info *info)
11763 {
11764         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11765         struct wireless_dev *wdev = info->user_ptr[1];
11766
11767         if (!rdev->ops->crit_proto_stop)
11768                 return -EOPNOTSUPP;
11769
11770         if (rdev->crit_proto_nlportid) {
11771                 rdev->crit_proto_nlportid = 0;
11772                 rdev_crit_proto_stop(rdev, wdev);
11773         }
11774         return 0;
11775 }
11776
11777 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
11778 {
11779         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11780         struct wireless_dev *wdev =
11781                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
11782         int i, err;
11783         u32 vid, subcmd;
11784
11785         if (!rdev->wiphy.vendor_commands)
11786                 return -EOPNOTSUPP;
11787
11788         if (IS_ERR(wdev)) {
11789                 err = PTR_ERR(wdev);
11790                 if (err != -EINVAL)
11791                         return err;
11792                 wdev = NULL;
11793         } else if (wdev->wiphy != &rdev->wiphy) {
11794                 return -EINVAL;
11795         }
11796
11797         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
11798             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
11799                 return -EINVAL;
11800
11801         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
11802         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
11803         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
11804                 const struct wiphy_vendor_command *vcmd;
11805                 void *data = NULL;
11806                 int len = 0;
11807
11808                 vcmd = &rdev->wiphy.vendor_commands[i];
11809
11810                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
11811                         continue;
11812
11813                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
11814                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
11815                         if (!wdev)
11816                                 return -EINVAL;
11817                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
11818                             !wdev->netdev)
11819                                 return -EINVAL;
11820
11821                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
11822                                 if (!wdev_running(wdev))
11823                                         return -ENETDOWN;
11824                         }
11825
11826                         if (!vcmd->doit)
11827                                 return -EOPNOTSUPP;
11828                 } else {
11829                         wdev = NULL;
11830                 }
11831
11832                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
11833                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11834                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11835                 }
11836
11837                 rdev->cur_cmd_info = info;
11838                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
11839                                                           data, len);
11840                 rdev->cur_cmd_info = NULL;
11841                 return err;
11842         }
11843
11844         return -EOPNOTSUPP;
11845 }
11846
11847 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
11848                                        struct netlink_callback *cb,
11849                                        struct cfg80211_registered_device **rdev,
11850                                        struct wireless_dev **wdev)
11851 {
11852         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
11853         u32 vid, subcmd;
11854         unsigned int i;
11855         int vcmd_idx = -1;
11856         int err;
11857         void *data = NULL;
11858         unsigned int data_len = 0;
11859
11860         if (cb->args[0]) {
11861                 /* subtract the 1 again here */
11862                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
11863                 struct wireless_dev *tmp;
11864
11865                 if (!wiphy)
11866                         return -ENODEV;
11867                 *rdev = wiphy_to_rdev(wiphy);
11868                 *wdev = NULL;
11869
11870                 if (cb->args[1]) {
11871                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
11872                                 if (tmp->identifier == cb->args[1] - 1) {
11873                                         *wdev = tmp;
11874                                         break;
11875                                 }
11876                         }
11877                 }
11878
11879                 /* keep rtnl locked in successful case */
11880                 return 0;
11881         }
11882
11883         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf,
11884                           nl80211_fam.maxattr, nl80211_policy, NULL);
11885         if (err)
11886                 return err;
11887
11888         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
11889             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
11890                 return -EINVAL;
11891
11892         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
11893         if (IS_ERR(*wdev))
11894                 *wdev = NULL;
11895
11896         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
11897         if (IS_ERR(*rdev))
11898                 return PTR_ERR(*rdev);
11899
11900         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
11901         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
11902
11903         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
11904                 const struct wiphy_vendor_command *vcmd;
11905
11906                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
11907
11908                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
11909                         continue;
11910
11911                 if (!vcmd->dumpit)
11912                         return -EOPNOTSUPP;
11913
11914                 vcmd_idx = i;
11915                 break;
11916         }
11917
11918         if (vcmd_idx < 0)
11919                 return -EOPNOTSUPP;
11920
11921         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
11922                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
11923                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
11924         }
11925
11926         /* 0 is the first index - add 1 to parse only once */
11927         cb->args[0] = (*rdev)->wiphy_idx + 1;
11928         /* add 1 to know if it was NULL */
11929         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
11930         cb->args[2] = vcmd_idx;
11931         cb->args[3] = (unsigned long)data;
11932         cb->args[4] = data_len;
11933
11934         /* keep rtnl locked in successful case */
11935         return 0;
11936 }
11937
11938 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
11939                                    struct netlink_callback *cb)
11940 {
11941         struct cfg80211_registered_device *rdev;
11942         struct wireless_dev *wdev;
11943         unsigned int vcmd_idx;
11944         const struct wiphy_vendor_command *vcmd;
11945         void *data;
11946         int data_len;
11947         int err;
11948         struct nlattr *vendor_data;
11949
11950         rtnl_lock();
11951         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
11952         if (err)
11953                 goto out;
11954
11955         vcmd_idx = cb->args[2];
11956         data = (void *)cb->args[3];
11957         data_len = cb->args[4];
11958         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
11959
11960         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
11961                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
11962                 if (!wdev) {
11963                         err = -EINVAL;
11964                         goto out;
11965                 }
11966                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
11967                     !wdev->netdev) {
11968                         err = -EINVAL;
11969                         goto out;
11970                 }
11971
11972                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
11973                         if (!wdev_running(wdev)) {
11974                                 err = -ENETDOWN;
11975                                 goto out;
11976                         }
11977                 }
11978         }
11979
11980         while (1) {
11981                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
11982                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
11983                                            NL80211_CMD_VENDOR);
11984                 if (!hdr)
11985                         break;
11986
11987                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11988                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
11989                                                wdev_id(wdev),
11990                                                NL80211_ATTR_PAD))) {
11991                         genlmsg_cancel(skb, hdr);
11992                         break;
11993                 }
11994
11995                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
11996                 if (!vendor_data) {
11997                         genlmsg_cancel(skb, hdr);
11998                         break;
11999                 }
12000
12001                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
12002                                    (unsigned long *)&cb->args[5]);
12003                 nla_nest_end(skb, vendor_data);
12004
12005                 if (err == -ENOBUFS || err == -ENOENT) {
12006                         genlmsg_cancel(skb, hdr);
12007                         break;
12008                 } else if (err) {
12009                         genlmsg_cancel(skb, hdr);
12010                         goto out;
12011                 }
12012
12013                 genlmsg_end(skb, hdr);
12014         }
12015
12016         err = skb->len;
12017  out:
12018         rtnl_unlock();
12019         return err;
12020 }
12021
12022 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
12023                                            enum nl80211_commands cmd,
12024                                            enum nl80211_attrs attr,
12025                                            int approxlen)
12026 {
12027         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12028
12029         if (WARN_ON(!rdev->cur_cmd_info))
12030                 return NULL;
12031
12032         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
12033                                            rdev->cur_cmd_info->snd_portid,
12034                                            rdev->cur_cmd_info->snd_seq,
12035                                            cmd, attr, NULL, GFP_KERNEL);
12036 }
12037 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
12038
12039 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
12040 {
12041         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12042         void *hdr = ((void **)skb->cb)[1];
12043         struct nlattr *data = ((void **)skb->cb)[2];
12044
12045         /* clear CB data for netlink core to own from now on */
12046         memset(skb->cb, 0, sizeof(skb->cb));
12047
12048         if (WARN_ON(!rdev->cur_cmd_info)) {
12049                 kfree_skb(skb);
12050                 return -EINVAL;
12051         }
12052
12053         nla_nest_end(skb, data);
12054         genlmsg_end(skb, hdr);
12055         return genlmsg_reply(skb, rdev->cur_cmd_info);
12056 }
12057 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
12058
12059 static int nl80211_set_qos_map(struct sk_buff *skb,
12060                                struct genl_info *info)
12061 {
12062         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12063         struct cfg80211_qos_map *qos_map = NULL;
12064         struct net_device *dev = info->user_ptr[1];
12065         u8 *pos, len, num_des, des_len, des;
12066         int ret;
12067
12068         if (!rdev->ops->set_qos_map)
12069                 return -EOPNOTSUPP;
12070
12071         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
12072                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
12073                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
12074
12075                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
12076                     len > IEEE80211_QOS_MAP_LEN_MAX)
12077                         return -EINVAL;
12078
12079                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
12080                 if (!qos_map)
12081                         return -ENOMEM;
12082
12083                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
12084                 if (num_des) {
12085                         des_len = num_des *
12086                                 sizeof(struct cfg80211_dscp_exception);
12087                         memcpy(qos_map->dscp_exception, pos, des_len);
12088                         qos_map->num_des = num_des;
12089                         for (des = 0; des < num_des; des++) {
12090                                 if (qos_map->dscp_exception[des].up > 7) {
12091                                         kfree(qos_map);
12092                                         return -EINVAL;
12093                                 }
12094                         }
12095                         pos += des_len;
12096                 }
12097                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
12098         }
12099
12100         wdev_lock(dev->ieee80211_ptr);
12101         ret = nl80211_key_allowed(dev->ieee80211_ptr);
12102         if (!ret)
12103                 ret = rdev_set_qos_map(rdev, dev, qos_map);
12104         wdev_unlock(dev->ieee80211_ptr);
12105
12106         kfree(qos_map);
12107         return ret;
12108 }
12109
12110 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
12111 {
12112         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12113         struct net_device *dev = info->user_ptr[1];
12114         struct wireless_dev *wdev = dev->ieee80211_ptr;
12115         const u8 *peer;
12116         u8 tsid, up;
12117         u16 admitted_time = 0;
12118         int err;
12119
12120         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
12121                 return -EOPNOTSUPP;
12122
12123         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
12124             !info->attrs[NL80211_ATTR_USER_PRIO])
12125                 return -EINVAL;
12126
12127         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12128         if (tsid >= IEEE80211_NUM_TIDS)
12129                 return -EINVAL;
12130
12131         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
12132         if (up >= IEEE80211_NUM_UPS)
12133                 return -EINVAL;
12134
12135         /* WMM uses TIDs 0-7 even for TSPEC */
12136         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
12137                 /* TODO: handle 802.11 TSPEC/admission control
12138                  * need more attributes for that (e.g. BA session requirement);
12139                  * change the WMM adminssion test above to allow both then
12140                  */
12141                 return -EINVAL;
12142         }
12143
12144         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12145
12146         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
12147                 admitted_time =
12148                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
12149                 if (!admitted_time)
12150                         return -EINVAL;
12151         }
12152
12153         wdev_lock(wdev);
12154         switch (wdev->iftype) {
12155         case NL80211_IFTYPE_STATION:
12156         case NL80211_IFTYPE_P2P_CLIENT:
12157                 if (wdev->current_bss)
12158                         break;
12159                 err = -ENOTCONN;
12160                 goto out;
12161         default:
12162                 err = -EOPNOTSUPP;
12163                 goto out;
12164         }
12165
12166         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
12167
12168  out:
12169         wdev_unlock(wdev);
12170         return err;
12171 }
12172
12173 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
12174 {
12175         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12176         struct net_device *dev = info->user_ptr[1];
12177         struct wireless_dev *wdev = dev->ieee80211_ptr;
12178         const u8 *peer;
12179         u8 tsid;
12180         int err;
12181
12182         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
12183                 return -EINVAL;
12184
12185         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12186         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12187
12188         wdev_lock(wdev);
12189         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
12190         wdev_unlock(wdev);
12191
12192         return err;
12193 }
12194
12195 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
12196                                        struct genl_info *info)
12197 {
12198         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12199         struct net_device *dev = info->user_ptr[1];
12200         struct wireless_dev *wdev = dev->ieee80211_ptr;
12201         struct cfg80211_chan_def chandef = {};
12202         const u8 *addr;
12203         u8 oper_class;
12204         int err;
12205
12206         if (!rdev->ops->tdls_channel_switch ||
12207             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12208                 return -EOPNOTSUPP;
12209
12210         switch (dev->ieee80211_ptr->iftype) {
12211         case NL80211_IFTYPE_STATION:
12212         case NL80211_IFTYPE_P2P_CLIENT:
12213                 break;
12214         default:
12215                 return -EOPNOTSUPP;
12216         }
12217
12218         if (!info->attrs[NL80211_ATTR_MAC] ||
12219             !info->attrs[NL80211_ATTR_OPER_CLASS])
12220                 return -EINVAL;
12221
12222         err = nl80211_parse_chandef(rdev, info, &chandef);
12223         if (err)
12224                 return err;
12225
12226         /*
12227          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
12228          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
12229          * specification is not defined for them.
12230          */
12231         if (chandef.chan->band == NL80211_BAND_2GHZ &&
12232             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
12233             chandef.width != NL80211_CHAN_WIDTH_20)
12234                 return -EINVAL;
12235
12236         /* we will be active on the TDLS link */
12237         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
12238                                            wdev->iftype))
12239                 return -EINVAL;
12240
12241         /* don't allow switching to DFS channels */
12242         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
12243                 return -EINVAL;
12244
12245         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12246         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
12247
12248         wdev_lock(wdev);
12249         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
12250         wdev_unlock(wdev);
12251
12252         return err;
12253 }
12254
12255 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
12256                                               struct genl_info *info)
12257 {
12258         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12259         struct net_device *dev = info->user_ptr[1];
12260         struct wireless_dev *wdev = dev->ieee80211_ptr;
12261         const u8 *addr;
12262
12263         if (!rdev->ops->tdls_channel_switch ||
12264             !rdev->ops->tdls_cancel_channel_switch ||
12265             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12266                 return -EOPNOTSUPP;
12267
12268         switch (dev->ieee80211_ptr->iftype) {
12269         case NL80211_IFTYPE_STATION:
12270         case NL80211_IFTYPE_P2P_CLIENT:
12271                 break;
12272         default:
12273                 return -EOPNOTSUPP;
12274         }
12275
12276         if (!info->attrs[NL80211_ATTR_MAC])
12277                 return -EINVAL;
12278
12279         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12280
12281         wdev_lock(wdev);
12282         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
12283         wdev_unlock(wdev);
12284
12285         return 0;
12286 }
12287
12288 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
12289                                             struct genl_info *info)
12290 {
12291         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12292         struct net_device *dev = info->user_ptr[1];
12293         struct wireless_dev *wdev = dev->ieee80211_ptr;
12294         const struct nlattr *nla;
12295         bool enabled;
12296
12297         if (!rdev->ops->set_multicast_to_unicast)
12298                 return -EOPNOTSUPP;
12299
12300         if (wdev->iftype != NL80211_IFTYPE_AP &&
12301             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12302                 return -EOPNOTSUPP;
12303
12304         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
12305         enabled = nla_get_flag(nla);
12306
12307         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
12308 }
12309
12310 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
12311 {
12312         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12313         struct net_device *dev = info->user_ptr[1];
12314         struct wireless_dev *wdev = dev->ieee80211_ptr;
12315         struct cfg80211_pmk_conf pmk_conf = {};
12316         int ret;
12317
12318         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12319             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12320                 return -EOPNOTSUPP;
12321
12322         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12323                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12324                 return -EOPNOTSUPP;
12325
12326         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
12327                 return -EINVAL;
12328
12329         wdev_lock(wdev);
12330         if (!wdev->current_bss) {
12331                 ret = -ENOTCONN;
12332                 goto out;
12333         }
12334
12335         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12336         if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
12337                 ret = -EINVAL;
12338                 goto out;
12339         }
12340
12341         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12342         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12343         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
12344             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
12345                 ret = -EINVAL;
12346                 goto out;
12347         }
12348
12349         if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
12350                 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12351
12352                 if (r0_name_len != WLAN_PMK_NAME_LEN) {
12353                         ret = -EINVAL;
12354                         goto out;
12355                 }
12356
12357                 pmk_conf.pmk_r0_name =
12358                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12359         }
12360
12361         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
12362 out:
12363         wdev_unlock(wdev);
12364         return ret;
12365 }
12366
12367 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
12368 {
12369         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12370         struct net_device *dev = info->user_ptr[1];
12371         struct wireless_dev *wdev = dev->ieee80211_ptr;
12372         const u8 *aa;
12373         int ret;
12374
12375         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12376             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12377                 return -EOPNOTSUPP;
12378
12379         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12380                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12381                 return -EOPNOTSUPP;
12382
12383         if (!info->attrs[NL80211_ATTR_MAC])
12384                 return -EINVAL;
12385
12386         wdev_lock(wdev);
12387         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12388         ret = rdev_del_pmk(rdev, dev, aa);
12389         wdev_unlock(wdev);
12390
12391         return ret;
12392 }
12393
12394 #define NL80211_FLAG_NEED_WIPHY         0x01
12395 #define NL80211_FLAG_NEED_NETDEV        0x02
12396 #define NL80211_FLAG_NEED_RTNL          0x04
12397 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
12398 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
12399                                          NL80211_FLAG_CHECK_NETDEV_UP)
12400 #define NL80211_FLAG_NEED_WDEV          0x10
12401 /* If a netdev is associated, it must be UP, P2P must be started */
12402 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
12403                                          NL80211_FLAG_CHECK_NETDEV_UP)
12404 #define NL80211_FLAG_CLEAR_SKB          0x20
12405
12406 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
12407                             struct genl_info *info)
12408 {
12409         struct cfg80211_registered_device *rdev;
12410         struct wireless_dev *wdev;
12411         struct net_device *dev;
12412         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
12413
12414         if (rtnl)
12415                 rtnl_lock();
12416
12417         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
12418                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
12419                 if (IS_ERR(rdev)) {
12420                         if (rtnl)
12421                                 rtnl_unlock();
12422                         return PTR_ERR(rdev);
12423                 }
12424                 info->user_ptr[0] = rdev;
12425         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
12426                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
12427                 ASSERT_RTNL();
12428
12429                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
12430                                                   info->attrs);
12431                 if (IS_ERR(wdev)) {
12432                         if (rtnl)
12433                                 rtnl_unlock();
12434                         return PTR_ERR(wdev);
12435                 }
12436
12437                 dev = wdev->netdev;
12438                 rdev = wiphy_to_rdev(wdev->wiphy);
12439
12440                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
12441                         if (!dev) {
12442                                 if (rtnl)
12443                                         rtnl_unlock();
12444                                 return -EINVAL;
12445                         }
12446
12447                         info->user_ptr[1] = dev;
12448                 } else {
12449                         info->user_ptr[1] = wdev;
12450                 }
12451
12452                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
12453                     !wdev_running(wdev)) {
12454                         if (rtnl)
12455                                 rtnl_unlock();
12456                         return -ENETDOWN;
12457                 }
12458
12459                 if (dev)
12460                         dev_hold(dev);
12461
12462                 info->user_ptr[0] = rdev;
12463         }
12464
12465         return 0;
12466 }
12467
12468 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
12469                               struct genl_info *info)
12470 {
12471         if (info->user_ptr[1]) {
12472                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
12473                         struct wireless_dev *wdev = info->user_ptr[1];
12474
12475                         if (wdev->netdev)
12476                                 dev_put(wdev->netdev);
12477                 } else {
12478                         dev_put(info->user_ptr[1]);
12479                 }
12480         }
12481
12482         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
12483                 rtnl_unlock();
12484
12485         /* If needed, clear the netlink message payload from the SKB
12486          * as it might contain key data that shouldn't stick around on
12487          * the heap after the SKB is freed. The netlink message header
12488          * is still needed for further processing, so leave it intact.
12489          */
12490         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
12491                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
12492
12493                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
12494         }
12495 }
12496
12497 static const struct genl_ops nl80211_ops[] = {
12498         {
12499                 .cmd = NL80211_CMD_GET_WIPHY,
12500                 .doit = nl80211_get_wiphy,
12501                 .dumpit = nl80211_dump_wiphy,
12502                 .done = nl80211_dump_wiphy_done,
12503                 .policy = nl80211_policy,
12504                 /* can be retrieved by unprivileged users */
12505                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12506                                   NL80211_FLAG_NEED_RTNL,
12507         },
12508         {
12509                 .cmd = NL80211_CMD_SET_WIPHY,
12510                 .doit = nl80211_set_wiphy,
12511                 .policy = nl80211_policy,
12512                 .flags = GENL_UNS_ADMIN_PERM,
12513                 .internal_flags = NL80211_FLAG_NEED_RTNL,
12514         },
12515         {
12516                 .cmd = NL80211_CMD_GET_INTERFACE,
12517                 .doit = nl80211_get_interface,
12518                 .dumpit = nl80211_dump_interface,
12519                 .policy = nl80211_policy,
12520                 /* can be retrieved by unprivileged users */
12521                 .internal_flags = NL80211_FLAG_NEED_WDEV |
12522                                   NL80211_FLAG_NEED_RTNL,
12523         },
12524         {
12525                 .cmd = NL80211_CMD_SET_INTERFACE,
12526                 .doit = nl80211_set_interface,
12527                 .policy = nl80211_policy,
12528                 .flags = GENL_UNS_ADMIN_PERM,
12529                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12530                                   NL80211_FLAG_NEED_RTNL,
12531         },
12532         {
12533                 .cmd = NL80211_CMD_NEW_INTERFACE,
12534                 .doit = nl80211_new_interface,
12535                 .policy = nl80211_policy,
12536                 .flags = GENL_UNS_ADMIN_PERM,
12537                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12538                                   NL80211_FLAG_NEED_RTNL,
12539         },
12540         {
12541                 .cmd = NL80211_CMD_DEL_INTERFACE,
12542                 .doit = nl80211_del_interface,
12543                 .policy = nl80211_policy,
12544                 .flags = GENL_UNS_ADMIN_PERM,
12545                 .internal_flags = NL80211_FLAG_NEED_WDEV |
12546                                   NL80211_FLAG_NEED_RTNL,
12547         },
12548         {
12549                 .cmd = NL80211_CMD_GET_KEY,
12550                 .doit = nl80211_get_key,
12551                 .policy = nl80211_policy,
12552                 .flags = GENL_UNS_ADMIN_PERM,
12553                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12554                                   NL80211_FLAG_NEED_RTNL,
12555         },
12556         {
12557                 .cmd = NL80211_CMD_SET_KEY,
12558                 .doit = nl80211_set_key,
12559                 .policy = nl80211_policy,
12560                 .flags = GENL_UNS_ADMIN_PERM,
12561                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12562                                   NL80211_FLAG_NEED_RTNL |
12563                                   NL80211_FLAG_CLEAR_SKB,
12564         },
12565         {
12566                 .cmd = NL80211_CMD_NEW_KEY,
12567                 .doit = nl80211_new_key,
12568                 .policy = nl80211_policy,
12569                 .flags = GENL_UNS_ADMIN_PERM,
12570                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12571                                   NL80211_FLAG_NEED_RTNL |
12572                                   NL80211_FLAG_CLEAR_SKB,
12573         },
12574         {
12575                 .cmd = NL80211_CMD_DEL_KEY,
12576                 .doit = nl80211_del_key,
12577                 .policy = nl80211_policy,
12578                 .flags = GENL_UNS_ADMIN_PERM,
12579                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12580                                   NL80211_FLAG_NEED_RTNL,
12581         },
12582         {
12583                 .cmd = NL80211_CMD_SET_BEACON,
12584                 .policy = nl80211_policy,
12585                 .flags = GENL_UNS_ADMIN_PERM,
12586                 .doit = nl80211_set_beacon,
12587                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12588                                   NL80211_FLAG_NEED_RTNL,
12589         },
12590         {
12591                 .cmd = NL80211_CMD_START_AP,
12592                 .policy = nl80211_policy,
12593                 .flags = GENL_UNS_ADMIN_PERM,
12594                 .doit = nl80211_start_ap,
12595                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12596                                   NL80211_FLAG_NEED_RTNL,
12597         },
12598         {
12599                 .cmd = NL80211_CMD_STOP_AP,
12600                 .policy = nl80211_policy,
12601                 .flags = GENL_UNS_ADMIN_PERM,
12602                 .doit = nl80211_stop_ap,
12603                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12604                                   NL80211_FLAG_NEED_RTNL,
12605         },
12606         {
12607                 .cmd = NL80211_CMD_GET_STATION,
12608                 .doit = nl80211_get_station,
12609                 .dumpit = nl80211_dump_station,
12610                 .policy = nl80211_policy,
12611                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12612                                   NL80211_FLAG_NEED_RTNL,
12613         },
12614         {
12615                 .cmd = NL80211_CMD_SET_STATION,
12616                 .doit = nl80211_set_station,
12617                 .policy = nl80211_policy,
12618                 .flags = GENL_UNS_ADMIN_PERM,
12619                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12620                                   NL80211_FLAG_NEED_RTNL,
12621         },
12622         {
12623                 .cmd = NL80211_CMD_NEW_STATION,
12624                 .doit = nl80211_new_station,
12625                 .policy = nl80211_policy,
12626                 .flags = GENL_UNS_ADMIN_PERM,
12627                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12628                                   NL80211_FLAG_NEED_RTNL,
12629         },
12630         {
12631                 .cmd = NL80211_CMD_DEL_STATION,
12632                 .doit = nl80211_del_station,
12633                 .policy = nl80211_policy,
12634                 .flags = GENL_UNS_ADMIN_PERM,
12635                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12636                                   NL80211_FLAG_NEED_RTNL,
12637         },
12638         {
12639                 .cmd = NL80211_CMD_GET_MPATH,
12640                 .doit = nl80211_get_mpath,
12641                 .dumpit = nl80211_dump_mpath,
12642                 .policy = nl80211_policy,
12643                 .flags = GENL_UNS_ADMIN_PERM,
12644                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12645                                   NL80211_FLAG_NEED_RTNL,
12646         },
12647         {
12648                 .cmd = NL80211_CMD_GET_MPP,
12649                 .doit = nl80211_get_mpp,
12650                 .dumpit = nl80211_dump_mpp,
12651                 .policy = nl80211_policy,
12652                 .flags = GENL_UNS_ADMIN_PERM,
12653                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12654                                   NL80211_FLAG_NEED_RTNL,
12655         },
12656         {
12657                 .cmd = NL80211_CMD_SET_MPATH,
12658                 .doit = nl80211_set_mpath,
12659                 .policy = nl80211_policy,
12660                 .flags = GENL_UNS_ADMIN_PERM,
12661                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12662                                   NL80211_FLAG_NEED_RTNL,
12663         },
12664         {
12665                 .cmd = NL80211_CMD_NEW_MPATH,
12666                 .doit = nl80211_new_mpath,
12667                 .policy = nl80211_policy,
12668                 .flags = GENL_UNS_ADMIN_PERM,
12669                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12670                                   NL80211_FLAG_NEED_RTNL,
12671         },
12672         {
12673                 .cmd = NL80211_CMD_DEL_MPATH,
12674                 .doit = nl80211_del_mpath,
12675                 .policy = nl80211_policy,
12676                 .flags = GENL_UNS_ADMIN_PERM,
12677                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12678                                   NL80211_FLAG_NEED_RTNL,
12679         },
12680         {
12681                 .cmd = NL80211_CMD_SET_BSS,
12682                 .doit = nl80211_set_bss,
12683                 .policy = nl80211_policy,
12684                 .flags = GENL_UNS_ADMIN_PERM,
12685                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12686                                   NL80211_FLAG_NEED_RTNL,
12687         },
12688         {
12689                 .cmd = NL80211_CMD_GET_REG,
12690                 .doit = nl80211_get_reg_do,
12691                 .dumpit = nl80211_get_reg_dump,
12692                 .policy = nl80211_policy,
12693                 .internal_flags = NL80211_FLAG_NEED_RTNL,
12694                 /* can be retrieved by unprivileged users */
12695         },
12696 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
12697         {
12698                 .cmd = NL80211_CMD_SET_REG,
12699                 .doit = nl80211_set_reg,
12700                 .policy = nl80211_policy,
12701                 .flags = GENL_ADMIN_PERM,
12702                 .internal_flags = NL80211_FLAG_NEED_RTNL,
12703         },
12704 #endif
12705         {
12706                 .cmd = NL80211_CMD_REQ_SET_REG,
12707                 .doit = nl80211_req_set_reg,
12708                 .policy = nl80211_policy,
12709                 .flags = GENL_ADMIN_PERM,
12710         },
12711         {
12712                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
12713                 .doit = nl80211_get_mesh_config,
12714                 .policy = nl80211_policy,
12715                 /* can be retrieved by unprivileged users */
12716                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12717                                   NL80211_FLAG_NEED_RTNL,
12718         },
12719         {
12720                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
12721                 .doit = nl80211_update_mesh_config,
12722                 .policy = nl80211_policy,
12723                 .flags = GENL_UNS_ADMIN_PERM,
12724                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12725                                   NL80211_FLAG_NEED_RTNL,
12726         },
12727         {
12728                 .cmd = NL80211_CMD_TRIGGER_SCAN,
12729                 .doit = nl80211_trigger_scan,
12730                 .policy = nl80211_policy,
12731                 .flags = GENL_UNS_ADMIN_PERM,
12732                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12733                                   NL80211_FLAG_NEED_RTNL,
12734         },
12735         {
12736                 .cmd = NL80211_CMD_ABORT_SCAN,
12737                 .doit = nl80211_abort_scan,
12738                 .policy = nl80211_policy,
12739                 .flags = GENL_UNS_ADMIN_PERM,
12740                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12741                                   NL80211_FLAG_NEED_RTNL,
12742         },
12743         {
12744                 .cmd = NL80211_CMD_GET_SCAN,
12745                 .policy = nl80211_policy,
12746                 .dumpit = nl80211_dump_scan,
12747         },
12748         {
12749                 .cmd = NL80211_CMD_START_SCHED_SCAN,
12750                 .doit = nl80211_start_sched_scan,
12751                 .policy = nl80211_policy,
12752                 .flags = GENL_UNS_ADMIN_PERM,
12753                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12754                                   NL80211_FLAG_NEED_RTNL,
12755         },
12756         {
12757                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
12758                 .doit = nl80211_stop_sched_scan,
12759                 .policy = nl80211_policy,
12760                 .flags = GENL_UNS_ADMIN_PERM,
12761                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12762                                   NL80211_FLAG_NEED_RTNL,
12763         },
12764         {
12765                 .cmd = NL80211_CMD_AUTHENTICATE,
12766                 .doit = nl80211_authenticate,
12767                 .policy = nl80211_policy,
12768                 .flags = GENL_UNS_ADMIN_PERM,
12769                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12770                                   NL80211_FLAG_NEED_RTNL |
12771                                   NL80211_FLAG_CLEAR_SKB,
12772         },
12773         {
12774                 .cmd = NL80211_CMD_ASSOCIATE,
12775                 .doit = nl80211_associate,
12776                 .policy = nl80211_policy,
12777                 .flags = GENL_UNS_ADMIN_PERM,
12778                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12779                                   NL80211_FLAG_NEED_RTNL,
12780         },
12781         {
12782                 .cmd = NL80211_CMD_DEAUTHENTICATE,
12783                 .doit = nl80211_deauthenticate,
12784                 .policy = nl80211_policy,
12785                 .flags = GENL_UNS_ADMIN_PERM,
12786                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12787                                   NL80211_FLAG_NEED_RTNL,
12788         },
12789         {
12790                 .cmd = NL80211_CMD_DISASSOCIATE,
12791                 .doit = nl80211_disassociate,
12792                 .policy = nl80211_policy,
12793                 .flags = GENL_UNS_ADMIN_PERM,
12794                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12795                                   NL80211_FLAG_NEED_RTNL,
12796         },
12797         {
12798                 .cmd = NL80211_CMD_JOIN_IBSS,
12799                 .doit = nl80211_join_ibss,
12800                 .policy = nl80211_policy,
12801                 .flags = GENL_UNS_ADMIN_PERM,
12802                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12803                                   NL80211_FLAG_NEED_RTNL,
12804         },
12805         {
12806                 .cmd = NL80211_CMD_LEAVE_IBSS,
12807                 .doit = nl80211_leave_ibss,
12808                 .policy = nl80211_policy,
12809                 .flags = GENL_UNS_ADMIN_PERM,
12810                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12811                                   NL80211_FLAG_NEED_RTNL,
12812         },
12813 #ifdef CONFIG_NL80211_TESTMODE
12814         {
12815                 .cmd = NL80211_CMD_TESTMODE,
12816                 .doit = nl80211_testmode_do,
12817                 .dumpit = nl80211_testmode_dump,
12818                 .policy = nl80211_policy,
12819                 .flags = GENL_UNS_ADMIN_PERM,
12820                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12821                                   NL80211_FLAG_NEED_RTNL,
12822         },
12823 #endif
12824         {
12825                 .cmd = NL80211_CMD_CONNECT,
12826                 .doit = nl80211_connect,
12827                 .policy = nl80211_policy,
12828                 .flags = GENL_UNS_ADMIN_PERM,
12829                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12830                                   NL80211_FLAG_NEED_RTNL,
12831         },
12832         {
12833                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
12834                 .doit = nl80211_update_connect_params,
12835                 .policy = nl80211_policy,
12836                 .flags = GENL_ADMIN_PERM,
12837                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12838                                   NL80211_FLAG_NEED_RTNL,
12839         },
12840         {
12841                 .cmd = NL80211_CMD_DISCONNECT,
12842                 .doit = nl80211_disconnect,
12843                 .policy = nl80211_policy,
12844                 .flags = GENL_UNS_ADMIN_PERM,
12845                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12846                                   NL80211_FLAG_NEED_RTNL,
12847         },
12848         {
12849                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
12850                 .doit = nl80211_wiphy_netns,
12851                 .policy = nl80211_policy,
12852                 .flags = GENL_UNS_ADMIN_PERM,
12853                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12854                                   NL80211_FLAG_NEED_RTNL,
12855         },
12856         {
12857                 .cmd = NL80211_CMD_GET_SURVEY,
12858                 .policy = nl80211_policy,
12859                 .dumpit = nl80211_dump_survey,
12860         },
12861         {
12862                 .cmd = NL80211_CMD_SET_PMKSA,
12863                 .doit = nl80211_setdel_pmksa,
12864                 .policy = nl80211_policy,
12865                 .flags = GENL_UNS_ADMIN_PERM,
12866                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12867                                   NL80211_FLAG_NEED_RTNL,
12868         },
12869         {
12870                 .cmd = NL80211_CMD_DEL_PMKSA,
12871                 .doit = nl80211_setdel_pmksa,
12872                 .policy = nl80211_policy,
12873                 .flags = GENL_UNS_ADMIN_PERM,
12874                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12875                                   NL80211_FLAG_NEED_RTNL,
12876         },
12877         {
12878                 .cmd = NL80211_CMD_FLUSH_PMKSA,
12879                 .doit = nl80211_flush_pmksa,
12880                 .policy = nl80211_policy,
12881                 .flags = GENL_UNS_ADMIN_PERM,
12882                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12883                                   NL80211_FLAG_NEED_RTNL,
12884         },
12885         {
12886                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
12887                 .doit = nl80211_remain_on_channel,
12888                 .policy = nl80211_policy,
12889                 .flags = GENL_UNS_ADMIN_PERM,
12890                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12891                                   NL80211_FLAG_NEED_RTNL,
12892         },
12893         {
12894                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
12895                 .doit = nl80211_cancel_remain_on_channel,
12896                 .policy = nl80211_policy,
12897                 .flags = GENL_UNS_ADMIN_PERM,
12898                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12899                                   NL80211_FLAG_NEED_RTNL,
12900         },
12901         {
12902                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
12903                 .doit = nl80211_set_tx_bitrate_mask,
12904                 .policy = nl80211_policy,
12905                 .flags = GENL_UNS_ADMIN_PERM,
12906                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12907                                   NL80211_FLAG_NEED_RTNL,
12908         },
12909         {
12910                 .cmd = NL80211_CMD_REGISTER_FRAME,
12911                 .doit = nl80211_register_mgmt,
12912                 .policy = nl80211_policy,
12913                 .flags = GENL_UNS_ADMIN_PERM,
12914                 .internal_flags = NL80211_FLAG_NEED_WDEV |
12915                                   NL80211_FLAG_NEED_RTNL,
12916         },
12917         {
12918                 .cmd = NL80211_CMD_FRAME,
12919                 .doit = nl80211_tx_mgmt,
12920                 .policy = nl80211_policy,
12921                 .flags = GENL_UNS_ADMIN_PERM,
12922                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12923                                   NL80211_FLAG_NEED_RTNL,
12924         },
12925         {
12926                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
12927                 .doit = nl80211_tx_mgmt_cancel_wait,
12928                 .policy = nl80211_policy,
12929                 .flags = GENL_UNS_ADMIN_PERM,
12930                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12931                                   NL80211_FLAG_NEED_RTNL,
12932         },
12933         {
12934                 .cmd = NL80211_CMD_SET_POWER_SAVE,
12935                 .doit = nl80211_set_power_save,
12936                 .policy = nl80211_policy,
12937                 .flags = GENL_UNS_ADMIN_PERM,
12938                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12939                                   NL80211_FLAG_NEED_RTNL,
12940         },
12941         {
12942                 .cmd = NL80211_CMD_GET_POWER_SAVE,
12943                 .doit = nl80211_get_power_save,
12944                 .policy = nl80211_policy,
12945                 /* can be retrieved by unprivileged users */
12946                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12947                                   NL80211_FLAG_NEED_RTNL,
12948         },
12949         {
12950                 .cmd = NL80211_CMD_SET_CQM,
12951                 .doit = nl80211_set_cqm,
12952                 .policy = nl80211_policy,
12953                 .flags = GENL_UNS_ADMIN_PERM,
12954                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12955                                   NL80211_FLAG_NEED_RTNL,
12956         },
12957         {
12958                 .cmd = NL80211_CMD_SET_CHANNEL,
12959                 .doit = nl80211_set_channel,
12960                 .policy = nl80211_policy,
12961                 .flags = GENL_UNS_ADMIN_PERM,
12962                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12963                                   NL80211_FLAG_NEED_RTNL,
12964         },
12965         {
12966                 .cmd = NL80211_CMD_SET_WDS_PEER,
12967                 .doit = nl80211_set_wds_peer,
12968                 .policy = nl80211_policy,
12969                 .flags = GENL_UNS_ADMIN_PERM,
12970                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12971                                   NL80211_FLAG_NEED_RTNL,
12972         },
12973         {
12974                 .cmd = NL80211_CMD_JOIN_MESH,
12975                 .doit = nl80211_join_mesh,
12976                 .policy = nl80211_policy,
12977                 .flags = GENL_UNS_ADMIN_PERM,
12978                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12979                                   NL80211_FLAG_NEED_RTNL,
12980         },
12981         {
12982                 .cmd = NL80211_CMD_LEAVE_MESH,
12983                 .doit = nl80211_leave_mesh,
12984                 .policy = nl80211_policy,
12985                 .flags = GENL_UNS_ADMIN_PERM,
12986                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12987                                   NL80211_FLAG_NEED_RTNL,
12988         },
12989         {
12990                 .cmd = NL80211_CMD_JOIN_OCB,
12991                 .doit = nl80211_join_ocb,
12992                 .policy = nl80211_policy,
12993                 .flags = GENL_UNS_ADMIN_PERM,
12994                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12995                                   NL80211_FLAG_NEED_RTNL,
12996         },
12997         {
12998                 .cmd = NL80211_CMD_LEAVE_OCB,
12999                 .doit = nl80211_leave_ocb,
13000                 .policy = nl80211_policy,
13001                 .flags = GENL_UNS_ADMIN_PERM,
13002                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13003                                   NL80211_FLAG_NEED_RTNL,
13004         },
13005 #ifdef CONFIG_PM
13006         {
13007                 .cmd = NL80211_CMD_GET_WOWLAN,
13008                 .doit = nl80211_get_wowlan,
13009                 .policy = nl80211_policy,
13010                 /* can be retrieved by unprivileged users */
13011                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13012                                   NL80211_FLAG_NEED_RTNL,
13013         },
13014         {
13015                 .cmd = NL80211_CMD_SET_WOWLAN,
13016                 .doit = nl80211_set_wowlan,
13017                 .policy = nl80211_policy,
13018                 .flags = GENL_UNS_ADMIN_PERM,
13019                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13020                                   NL80211_FLAG_NEED_RTNL,
13021         },
13022 #endif
13023         {
13024                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
13025                 .doit = nl80211_set_rekey_data,
13026                 .policy = nl80211_policy,
13027                 .flags = GENL_UNS_ADMIN_PERM,
13028                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13029                                   NL80211_FLAG_NEED_RTNL |
13030                                   NL80211_FLAG_CLEAR_SKB,
13031         },
13032         {
13033                 .cmd = NL80211_CMD_TDLS_MGMT,
13034                 .doit = nl80211_tdls_mgmt,
13035                 .policy = nl80211_policy,
13036                 .flags = GENL_UNS_ADMIN_PERM,
13037                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13038                                   NL80211_FLAG_NEED_RTNL,
13039         },
13040         {
13041                 .cmd = NL80211_CMD_TDLS_OPER,
13042                 .doit = nl80211_tdls_oper,
13043                 .policy = nl80211_policy,
13044                 .flags = GENL_UNS_ADMIN_PERM,
13045                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13046                                   NL80211_FLAG_NEED_RTNL,
13047         },
13048         {
13049                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
13050                 .doit = nl80211_register_unexpected_frame,
13051                 .policy = nl80211_policy,
13052                 .flags = GENL_UNS_ADMIN_PERM,
13053                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13054                                   NL80211_FLAG_NEED_RTNL,
13055         },
13056         {
13057                 .cmd = NL80211_CMD_PROBE_CLIENT,
13058                 .doit = nl80211_probe_client,
13059                 .policy = nl80211_policy,
13060                 .flags = GENL_UNS_ADMIN_PERM,
13061                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13062                                   NL80211_FLAG_NEED_RTNL,
13063         },
13064         {
13065                 .cmd = NL80211_CMD_REGISTER_BEACONS,
13066                 .doit = nl80211_register_beacons,
13067                 .policy = nl80211_policy,
13068                 .flags = GENL_UNS_ADMIN_PERM,
13069                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13070                                   NL80211_FLAG_NEED_RTNL,
13071         },
13072         {
13073                 .cmd = NL80211_CMD_SET_NOACK_MAP,
13074                 .doit = nl80211_set_noack_map,
13075                 .policy = nl80211_policy,
13076                 .flags = GENL_UNS_ADMIN_PERM,
13077                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13078                                   NL80211_FLAG_NEED_RTNL,
13079         },
13080         {
13081                 .cmd = NL80211_CMD_START_P2P_DEVICE,
13082                 .doit = nl80211_start_p2p_device,
13083                 .policy = nl80211_policy,
13084                 .flags = GENL_UNS_ADMIN_PERM,
13085                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13086                                   NL80211_FLAG_NEED_RTNL,
13087         },
13088         {
13089                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
13090                 .doit = nl80211_stop_p2p_device,
13091                 .policy = nl80211_policy,
13092                 .flags = GENL_UNS_ADMIN_PERM,
13093                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13094                                   NL80211_FLAG_NEED_RTNL,
13095         },
13096         {
13097                 .cmd = NL80211_CMD_START_NAN,
13098                 .doit = nl80211_start_nan,
13099                 .policy = nl80211_policy,
13100                 .flags = GENL_ADMIN_PERM,
13101                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13102                                   NL80211_FLAG_NEED_RTNL,
13103         },
13104         {
13105                 .cmd = NL80211_CMD_STOP_NAN,
13106                 .doit = nl80211_stop_nan,
13107                 .policy = nl80211_policy,
13108                 .flags = GENL_ADMIN_PERM,
13109                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13110                                   NL80211_FLAG_NEED_RTNL,
13111         },
13112         {
13113                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
13114                 .doit = nl80211_nan_add_func,
13115                 .policy = nl80211_policy,
13116                 .flags = GENL_ADMIN_PERM,
13117                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13118                                   NL80211_FLAG_NEED_RTNL,
13119         },
13120         {
13121                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
13122                 .doit = nl80211_nan_del_func,
13123                 .policy = nl80211_policy,
13124                 .flags = GENL_ADMIN_PERM,
13125                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13126                                   NL80211_FLAG_NEED_RTNL,
13127         },
13128         {
13129                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
13130                 .doit = nl80211_nan_change_config,
13131                 .policy = nl80211_policy,
13132                 .flags = GENL_ADMIN_PERM,
13133                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13134                                   NL80211_FLAG_NEED_RTNL,
13135         },
13136         {
13137                 .cmd = NL80211_CMD_SET_MCAST_RATE,
13138                 .doit = nl80211_set_mcast_rate,
13139                 .policy = nl80211_policy,
13140                 .flags = GENL_UNS_ADMIN_PERM,
13141                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13142                                   NL80211_FLAG_NEED_RTNL,
13143         },
13144         {
13145                 .cmd = NL80211_CMD_SET_MAC_ACL,
13146                 .doit = nl80211_set_mac_acl,
13147                 .policy = nl80211_policy,
13148                 .flags = GENL_UNS_ADMIN_PERM,
13149                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13150                                   NL80211_FLAG_NEED_RTNL,
13151         },
13152         {
13153                 .cmd = NL80211_CMD_RADAR_DETECT,
13154                 .doit = nl80211_start_radar_detection,
13155                 .policy = nl80211_policy,
13156                 .flags = GENL_UNS_ADMIN_PERM,
13157                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13158                                   NL80211_FLAG_NEED_RTNL,
13159         },
13160         {
13161                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
13162                 .doit = nl80211_get_protocol_features,
13163                 .policy = nl80211_policy,
13164         },
13165         {
13166                 .cmd = NL80211_CMD_UPDATE_FT_IES,
13167                 .doit = nl80211_update_ft_ies,
13168                 .policy = nl80211_policy,
13169                 .flags = GENL_UNS_ADMIN_PERM,
13170                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13171                                   NL80211_FLAG_NEED_RTNL,
13172         },
13173         {
13174                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
13175                 .doit = nl80211_crit_protocol_start,
13176                 .policy = nl80211_policy,
13177                 .flags = GENL_UNS_ADMIN_PERM,
13178                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13179                                   NL80211_FLAG_NEED_RTNL,
13180         },
13181         {
13182                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
13183                 .doit = nl80211_crit_protocol_stop,
13184                 .policy = nl80211_policy,
13185                 .flags = GENL_UNS_ADMIN_PERM,
13186                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13187                                   NL80211_FLAG_NEED_RTNL,
13188         },
13189         {
13190                 .cmd = NL80211_CMD_GET_COALESCE,
13191                 .doit = nl80211_get_coalesce,
13192                 .policy = nl80211_policy,
13193                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13194                                   NL80211_FLAG_NEED_RTNL,
13195         },
13196         {
13197                 .cmd = NL80211_CMD_SET_COALESCE,
13198                 .doit = nl80211_set_coalesce,
13199                 .policy = nl80211_policy,
13200                 .flags = GENL_UNS_ADMIN_PERM,
13201                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13202                                   NL80211_FLAG_NEED_RTNL,
13203         },
13204         {
13205                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
13206                 .doit = nl80211_channel_switch,
13207                 .policy = nl80211_policy,
13208                 .flags = GENL_UNS_ADMIN_PERM,
13209                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13210                                   NL80211_FLAG_NEED_RTNL,
13211         },
13212         {
13213                 .cmd = NL80211_CMD_VENDOR,
13214                 .doit = nl80211_vendor_cmd,
13215                 .dumpit = nl80211_vendor_cmd_dump,
13216                 .policy = nl80211_policy,
13217                 .flags = GENL_UNS_ADMIN_PERM,
13218                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13219                                   NL80211_FLAG_NEED_RTNL,
13220         },
13221         {
13222                 .cmd = NL80211_CMD_SET_QOS_MAP,
13223                 .doit = nl80211_set_qos_map,
13224                 .policy = nl80211_policy,
13225                 .flags = GENL_UNS_ADMIN_PERM,
13226                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13227                                   NL80211_FLAG_NEED_RTNL,
13228         },
13229         {
13230                 .cmd = NL80211_CMD_ADD_TX_TS,
13231                 .doit = nl80211_add_tx_ts,
13232                 .policy = nl80211_policy,
13233                 .flags = GENL_UNS_ADMIN_PERM,
13234                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13235                                   NL80211_FLAG_NEED_RTNL,
13236         },
13237         {
13238                 .cmd = NL80211_CMD_DEL_TX_TS,
13239                 .doit = nl80211_del_tx_ts,
13240                 .policy = nl80211_policy,
13241                 .flags = GENL_UNS_ADMIN_PERM,
13242                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13243                                   NL80211_FLAG_NEED_RTNL,
13244         },
13245         {
13246                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
13247                 .doit = nl80211_tdls_channel_switch,
13248                 .policy = nl80211_policy,
13249                 .flags = GENL_UNS_ADMIN_PERM,
13250                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13251                                   NL80211_FLAG_NEED_RTNL,
13252         },
13253         {
13254                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
13255                 .doit = nl80211_tdls_cancel_channel_switch,
13256                 .policy = nl80211_policy,
13257                 .flags = GENL_UNS_ADMIN_PERM,
13258                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13259                                   NL80211_FLAG_NEED_RTNL,
13260         },
13261         {
13262                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
13263                 .doit = nl80211_set_multicast_to_unicast,
13264                 .policy = nl80211_policy,
13265                 .flags = GENL_UNS_ADMIN_PERM,
13266                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13267                                   NL80211_FLAG_NEED_RTNL,
13268         },
13269         {
13270                 .cmd = NL80211_CMD_SET_PMK,
13271                 .doit = nl80211_set_pmk,
13272                 .policy = nl80211_policy,
13273                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13274                                   NL80211_FLAG_NEED_RTNL,
13275         },
13276         {
13277                 .cmd = NL80211_CMD_DEL_PMK,
13278                 .doit = nl80211_del_pmk,
13279                 .policy = nl80211_policy,
13280                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13281                                   NL80211_FLAG_NEED_RTNL,
13282         },
13283
13284 };
13285
13286 static struct genl_family nl80211_fam __ro_after_init = {
13287         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
13288         .hdrsize = 0,                   /* no private header */
13289         .version = 1,                   /* no particular meaning now */
13290         .maxattr = NL80211_ATTR_MAX,
13291         .netnsok = true,
13292         .pre_doit = nl80211_pre_doit,
13293         .post_doit = nl80211_post_doit,
13294         .module = THIS_MODULE,
13295         .ops = nl80211_ops,
13296         .n_ops = ARRAY_SIZE(nl80211_ops),
13297         .mcgrps = nl80211_mcgrps,
13298         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
13299 };
13300
13301 /* notification functions */
13302
13303 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
13304                           enum nl80211_commands cmd)
13305 {
13306         struct sk_buff *msg;
13307         struct nl80211_dump_wiphy_state state = {};
13308
13309         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
13310                 cmd != NL80211_CMD_DEL_WIPHY);
13311
13312         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13313         if (!msg)
13314                 return;
13315
13316         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
13317                 nlmsg_free(msg);
13318                 return;
13319         }
13320
13321         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13322                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13323 }
13324
13325 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
13326                                 struct wireless_dev *wdev,
13327                                 enum nl80211_commands cmd)
13328 {
13329         struct sk_buff *msg;
13330
13331         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
13332                 cmd != NL80211_CMD_DEL_INTERFACE);
13333
13334         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13335         if (!msg)
13336                 return;
13337
13338         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev,
13339                                cmd == NL80211_CMD_DEL_INTERFACE) < 0) {
13340                 nlmsg_free(msg);
13341                 return;
13342         }
13343
13344         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13345                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13346 }
13347
13348 static int nl80211_add_scan_req(struct sk_buff *msg,
13349                                 struct cfg80211_registered_device *rdev)
13350 {
13351         struct cfg80211_scan_request *req = rdev->scan_req;
13352         struct nlattr *nest;
13353         int i;
13354
13355         if (WARN_ON(!req))
13356                 return 0;
13357
13358         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
13359         if (!nest)
13360                 goto nla_put_failure;
13361         for (i = 0; i < req->n_ssids; i++) {
13362                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
13363                         goto nla_put_failure;
13364         }
13365         nla_nest_end(msg, nest);
13366
13367         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13368         if (!nest)
13369                 goto nla_put_failure;
13370         for (i = 0; i < req->n_channels; i++) {
13371                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13372                         goto nla_put_failure;
13373         }
13374         nla_nest_end(msg, nest);
13375
13376         if (req->ie &&
13377             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
13378                 goto nla_put_failure;
13379
13380         if (req->flags &&
13381             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
13382                 goto nla_put_failure;
13383
13384         if (req->info.scan_start_tsf &&
13385             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
13386                                req->info.scan_start_tsf, NL80211_BSS_PAD) ||
13387              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
13388                      req->info.tsf_bssid)))
13389                 goto nla_put_failure;
13390
13391         return 0;
13392  nla_put_failure:
13393         return -ENOBUFS;
13394 }
13395
13396 static int nl80211_prep_scan_msg(struct sk_buff *msg,
13397                                  struct cfg80211_registered_device *rdev,
13398                                  struct wireless_dev *wdev,
13399                                  u32 portid, u32 seq, int flags,
13400                                  u32 cmd)
13401 {
13402         void *hdr;
13403
13404         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
13405         if (!hdr)
13406                 return -1;
13407
13408         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13409             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13410                                          wdev->netdev->ifindex)) ||
13411             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13412                               NL80211_ATTR_PAD))
13413                 goto nla_put_failure;
13414
13415         /* ignore errors and send incomplete event anyway */
13416         nl80211_add_scan_req(msg, rdev);
13417
13418         genlmsg_end(msg, hdr);
13419         return 0;
13420
13421  nla_put_failure:
13422         genlmsg_cancel(msg, hdr);
13423         return -EMSGSIZE;
13424 }
13425
13426 static int
13427 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
13428                             struct cfg80211_sched_scan_request *req, u32 cmd)
13429 {
13430         void *hdr;
13431
13432         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13433         if (!hdr)
13434                 return -1;
13435
13436         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
13437                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
13438             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
13439             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
13440                               NL80211_ATTR_PAD))
13441                 goto nla_put_failure;
13442
13443         genlmsg_end(msg, hdr);
13444         return 0;
13445
13446  nla_put_failure:
13447         genlmsg_cancel(msg, hdr);
13448         return -EMSGSIZE;
13449 }
13450
13451 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
13452                              struct wireless_dev *wdev)
13453 {
13454         struct sk_buff *msg;
13455
13456         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13457         if (!msg)
13458                 return;
13459
13460         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
13461                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
13462                 nlmsg_free(msg);
13463                 return;
13464         }
13465
13466         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13467                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
13468 }
13469
13470 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
13471                                        struct wireless_dev *wdev, bool aborted)
13472 {
13473         struct sk_buff *msg;
13474
13475         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13476         if (!msg)
13477                 return NULL;
13478
13479         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
13480                                   aborted ? NL80211_CMD_SCAN_ABORTED :
13481                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
13482                 nlmsg_free(msg);
13483                 return NULL;
13484         }
13485
13486         return msg;
13487 }
13488
13489 /* send message created by nl80211_build_scan_msg() */
13490 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
13491                            struct sk_buff *msg)
13492 {
13493         if (!msg)
13494                 return;
13495
13496         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13497                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
13498 }
13499
13500 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
13501 {
13502         struct sk_buff *msg;
13503
13504         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13505         if (!msg)
13506                 return;
13507
13508         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
13509                 nlmsg_free(msg);
13510                 return;
13511         }
13512
13513         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
13514                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
13515 }
13516
13517 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
13518                                           struct regulatory_request *request)
13519 {
13520         /* Userspace can always count this one always being set */
13521         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
13522                 goto nla_put_failure;
13523
13524         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
13525                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13526                                NL80211_REGDOM_TYPE_WORLD))
13527                         goto nla_put_failure;
13528         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
13529                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13530                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
13531                         goto nla_put_failure;
13532         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
13533                    request->intersect) {
13534                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13535                                NL80211_REGDOM_TYPE_INTERSECTION))
13536                         goto nla_put_failure;
13537         } else {
13538                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13539                                NL80211_REGDOM_TYPE_COUNTRY) ||
13540                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
13541                                    request->alpha2))
13542                         goto nla_put_failure;
13543         }
13544
13545         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
13546                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
13547
13548                 if (wiphy &&
13549                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
13550                         goto nla_put_failure;
13551
13552                 if (wiphy &&
13553                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
13554                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
13555                         goto nla_put_failure;
13556         }
13557
13558         return true;
13559
13560 nla_put_failure:
13561         return false;
13562 }
13563
13564 /*
13565  * This can happen on global regulatory changes or device specific settings
13566  * based on custom regulatory domains.
13567  */
13568 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
13569                                      struct regulatory_request *request)
13570 {
13571         struct sk_buff *msg;
13572         void *hdr;
13573
13574         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13575         if (!msg)
13576                 return;
13577
13578         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
13579         if (!hdr) {
13580                 nlmsg_free(msg);
13581                 return;
13582         }
13583
13584         if (nl80211_reg_change_event_fill(msg, request) == false)
13585                 goto nla_put_failure;
13586
13587         genlmsg_end(msg, hdr);
13588
13589         rcu_read_lock();
13590         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
13591                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
13592         rcu_read_unlock();
13593
13594         return;
13595
13596 nla_put_failure:
13597         genlmsg_cancel(msg, hdr);
13598         nlmsg_free(msg);
13599 }
13600
13601 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
13602                                     struct net_device *netdev,
13603                                     const u8 *buf, size_t len,
13604                                     enum nl80211_commands cmd, gfp_t gfp,
13605                                     int uapsd_queues)
13606 {
13607         struct sk_buff *msg;
13608         void *hdr;
13609
13610         msg = nlmsg_new(100 + len, gfp);
13611         if (!msg)
13612                 return;
13613
13614         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13615         if (!hdr) {
13616                 nlmsg_free(msg);
13617                 return;
13618         }
13619
13620         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13621             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13622             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
13623                 goto nla_put_failure;
13624
13625         if (uapsd_queues >= 0) {
13626                 struct nlattr *nla_wmm =
13627                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
13628                 if (!nla_wmm)
13629                         goto nla_put_failure;
13630
13631                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
13632                                uapsd_queues))
13633                         goto nla_put_failure;
13634
13635                 nla_nest_end(msg, nla_wmm);
13636         }
13637
13638         genlmsg_end(msg, hdr);
13639
13640         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13641                                 NL80211_MCGRP_MLME, gfp);
13642         return;
13643
13644  nla_put_failure:
13645         genlmsg_cancel(msg, hdr);
13646         nlmsg_free(msg);
13647 }
13648
13649 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
13650                           struct net_device *netdev, const u8 *buf,
13651                           size_t len, gfp_t gfp)
13652 {
13653         nl80211_send_mlme_event(rdev, netdev, buf, len,
13654                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
13655 }
13656
13657 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
13658                            struct net_device *netdev, const u8 *buf,
13659                            size_t len, gfp_t gfp, int uapsd_queues)
13660 {
13661         nl80211_send_mlme_event(rdev, netdev, buf, len,
13662                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
13663 }
13664
13665 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
13666                          struct net_device *netdev, const u8 *buf,
13667                          size_t len, gfp_t gfp)
13668 {
13669         nl80211_send_mlme_event(rdev, netdev, buf, len,
13670                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
13671 }
13672
13673 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
13674                            struct net_device *netdev, const u8 *buf,
13675                            size_t len, gfp_t gfp)
13676 {
13677         nl80211_send_mlme_event(rdev, netdev, buf, len,
13678                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
13679 }
13680
13681 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
13682                                   size_t len)
13683 {
13684         struct wireless_dev *wdev = dev->ieee80211_ptr;
13685         struct wiphy *wiphy = wdev->wiphy;
13686         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13687         const struct ieee80211_mgmt *mgmt = (void *)buf;
13688         u32 cmd;
13689
13690         if (WARN_ON(len < 2))
13691                 return;
13692
13693         if (ieee80211_is_deauth(mgmt->frame_control))
13694                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
13695         else
13696                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
13697
13698         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
13699         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
13700 }
13701 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
13702
13703 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
13704                                       struct net_device *netdev, int cmd,
13705                                       const u8 *addr, gfp_t gfp)
13706 {
13707         struct sk_buff *msg;
13708         void *hdr;
13709
13710         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13711         if (!msg)
13712                 return;
13713
13714         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13715         if (!hdr) {
13716                 nlmsg_free(msg);
13717                 return;
13718         }
13719
13720         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13721             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13722             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
13723             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
13724                 goto nla_put_failure;
13725
13726         genlmsg_end(msg, hdr);
13727
13728         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13729                                 NL80211_MCGRP_MLME, gfp);
13730         return;
13731
13732  nla_put_failure:
13733         genlmsg_cancel(msg, hdr);
13734         nlmsg_free(msg);
13735 }
13736
13737 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
13738                                struct net_device *netdev, const u8 *addr,
13739                                gfp_t gfp)
13740 {
13741         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
13742                                   addr, gfp);
13743 }
13744
13745 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
13746                                 struct net_device *netdev, const u8 *addr,
13747                                 gfp_t gfp)
13748 {
13749         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
13750                                   addr, gfp);
13751 }
13752
13753 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
13754                                  struct net_device *netdev,
13755                                  struct cfg80211_connect_resp_params *cr,
13756                                  gfp_t gfp)
13757 {
13758         struct sk_buff *msg;
13759         void *hdr;
13760
13761         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
13762                         cr->fils_kek_len + cr->pmk_len +
13763                         (cr->pmkid ? WLAN_PMKID_LEN : 0), gfp);
13764         if (!msg)
13765                 return;
13766
13767         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
13768         if (!hdr) {
13769                 nlmsg_free(msg);
13770                 return;
13771         }
13772
13773         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13774             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13775             (cr->bssid &&
13776              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
13777             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
13778                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
13779                         cr->status) ||
13780             (cr->status < 0 &&
13781              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
13782               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
13783                           cr->timeout_reason))) ||
13784             (cr->req_ie &&
13785              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
13786             (cr->resp_ie &&
13787              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
13788                      cr->resp_ie)) ||
13789             (cr->update_erp_next_seq_num &&
13790              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
13791                          cr->fils_erp_next_seq_num)) ||
13792             (cr->status == WLAN_STATUS_SUCCESS &&
13793              ((cr->fils_kek &&
13794                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils_kek_len,
13795                        cr->fils_kek)) ||
13796               (cr->pmk &&
13797                nla_put(msg, NL80211_ATTR_PMK, cr->pmk_len, cr->pmk)) ||
13798               (cr->pmkid &&
13799                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->pmkid)))))
13800                 goto nla_put_failure;
13801
13802         genlmsg_end(msg, hdr);
13803
13804         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13805                                 NL80211_MCGRP_MLME, gfp);
13806         return;
13807
13808  nla_put_failure:
13809         genlmsg_cancel(msg, hdr);
13810         nlmsg_free(msg);
13811 }
13812
13813 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
13814                          struct net_device *netdev,
13815                          struct cfg80211_roam_info *info, gfp_t gfp)
13816 {
13817         struct sk_buff *msg;
13818         void *hdr;
13819         const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
13820
13821         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len, gfp);
13822         if (!msg)
13823                 return;
13824
13825         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
13826         if (!hdr) {
13827                 nlmsg_free(msg);
13828                 return;
13829         }
13830
13831         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13832             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13833             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
13834             (info->req_ie &&
13835              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
13836                      info->req_ie)) ||
13837             (info->resp_ie &&
13838              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
13839                      info->resp_ie)))
13840                 goto nla_put_failure;
13841
13842         genlmsg_end(msg, hdr);
13843
13844         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13845                                 NL80211_MCGRP_MLME, gfp);
13846         return;
13847
13848  nla_put_failure:
13849         genlmsg_cancel(msg, hdr);
13850         nlmsg_free(msg);
13851 }
13852
13853 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
13854                                   struct net_device *netdev, const u8 *bssid)
13855 {
13856         struct sk_buff *msg;
13857         void *hdr;
13858
13859         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13860         if (!msg)
13861                 return;
13862
13863         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
13864         if (!hdr) {
13865                 nlmsg_free(msg);
13866                 return;
13867         }
13868
13869         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
13870                 goto nla_put_failure;
13871
13872         genlmsg_end(msg, hdr);
13873
13874         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13875                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13876         return;
13877
13878  nla_put_failure:
13879         genlmsg_cancel(msg, hdr);
13880         nlmsg_free(msg);
13881 }
13882
13883 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
13884                                struct net_device *netdev, u16 reason,
13885                                const u8 *ie, size_t ie_len, bool from_ap)
13886 {
13887         struct sk_buff *msg;
13888         void *hdr;
13889
13890         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
13891         if (!msg)
13892                 return;
13893
13894         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
13895         if (!hdr) {
13896                 nlmsg_free(msg);
13897                 return;
13898         }
13899
13900         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13901             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13902             (from_ap && reason &&
13903              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
13904             (from_ap &&
13905              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
13906             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
13907                 goto nla_put_failure;
13908
13909         genlmsg_end(msg, hdr);
13910
13911         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13912                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13913         return;
13914
13915  nla_put_failure:
13916         genlmsg_cancel(msg, hdr);
13917         nlmsg_free(msg);
13918 }
13919
13920 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
13921                              struct net_device *netdev, const u8 *bssid,
13922                              gfp_t gfp)
13923 {
13924         struct sk_buff *msg;
13925         void *hdr;
13926
13927         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13928         if (!msg)
13929                 return;
13930
13931         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
13932         if (!hdr) {
13933                 nlmsg_free(msg);
13934                 return;
13935         }
13936
13937         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13938             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13939             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
13940                 goto nla_put_failure;
13941
13942         genlmsg_end(msg, hdr);
13943
13944         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13945                                 NL80211_MCGRP_MLME, gfp);
13946         return;
13947
13948  nla_put_failure:
13949         genlmsg_cancel(msg, hdr);
13950         nlmsg_free(msg);
13951 }
13952
13953 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
13954                                         const u8* ie, u8 ie_len, gfp_t gfp)
13955 {
13956         struct wireless_dev *wdev = dev->ieee80211_ptr;
13957         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13958         struct sk_buff *msg;
13959         void *hdr;
13960
13961         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
13962                 return;
13963
13964         trace_cfg80211_notify_new_peer_candidate(dev, addr);
13965
13966         msg = nlmsg_new(100 + ie_len, gfp);
13967         if (!msg)
13968                 return;
13969
13970         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
13971         if (!hdr) {
13972                 nlmsg_free(msg);
13973                 return;
13974         }
13975
13976         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13977             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13978             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
13979             (ie_len && ie &&
13980              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
13981                 goto nla_put_failure;
13982
13983         genlmsg_end(msg, hdr);
13984
13985         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13986                                 NL80211_MCGRP_MLME, gfp);
13987         return;
13988
13989  nla_put_failure:
13990         genlmsg_cancel(msg, hdr);
13991         nlmsg_free(msg);
13992 }
13993 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
13994
13995 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
13996                                  struct net_device *netdev, const u8 *addr,
13997                                  enum nl80211_key_type key_type, int key_id,
13998                                  const u8 *tsc, gfp_t gfp)
13999 {
14000         struct sk_buff *msg;
14001         void *hdr;
14002
14003         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14004         if (!msg)
14005                 return;
14006
14007         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
14008         if (!hdr) {
14009                 nlmsg_free(msg);
14010                 return;
14011         }
14012
14013         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14014             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14015             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
14016             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
14017             (key_id != -1 &&
14018              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
14019             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
14020                 goto nla_put_failure;
14021
14022         genlmsg_end(msg, hdr);
14023
14024         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14025                                 NL80211_MCGRP_MLME, gfp);
14026         return;
14027
14028  nla_put_failure:
14029         genlmsg_cancel(msg, hdr);
14030         nlmsg_free(msg);
14031 }
14032
14033 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
14034                                     struct ieee80211_channel *channel_before,
14035                                     struct ieee80211_channel *channel_after)
14036 {
14037         struct sk_buff *msg;
14038         void *hdr;
14039         struct nlattr *nl_freq;
14040
14041         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
14042         if (!msg)
14043                 return;
14044
14045         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
14046         if (!hdr) {
14047                 nlmsg_free(msg);
14048                 return;
14049         }
14050
14051         /*
14052          * Since we are applying the beacon hint to a wiphy we know its
14053          * wiphy_idx is valid
14054          */
14055         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
14056                 goto nla_put_failure;
14057
14058         /* Before */
14059         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
14060         if (!nl_freq)
14061                 goto nla_put_failure;
14062         if (nl80211_msg_put_channel(msg, channel_before, false))
14063                 goto nla_put_failure;
14064         nla_nest_end(msg, nl_freq);
14065
14066         /* After */
14067         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
14068         if (!nl_freq)
14069                 goto nla_put_failure;
14070         if (nl80211_msg_put_channel(msg, channel_after, false))
14071                 goto nla_put_failure;
14072         nla_nest_end(msg, nl_freq);
14073
14074         genlmsg_end(msg, hdr);
14075
14076         rcu_read_lock();
14077         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14078                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14079         rcu_read_unlock();
14080
14081         return;
14082
14083 nla_put_failure:
14084         genlmsg_cancel(msg, hdr);
14085         nlmsg_free(msg);
14086 }
14087
14088 static void nl80211_send_remain_on_chan_event(
14089         int cmd, struct cfg80211_registered_device *rdev,
14090         struct wireless_dev *wdev, u64 cookie,
14091         struct ieee80211_channel *chan,
14092         unsigned int duration, gfp_t gfp)
14093 {
14094         struct sk_buff *msg;
14095         void *hdr;
14096
14097         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14098         if (!msg)
14099                 return;
14100
14101         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14102         if (!hdr) {
14103                 nlmsg_free(msg);
14104                 return;
14105         }
14106
14107         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14108             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14109                                          wdev->netdev->ifindex)) ||
14110             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14111                               NL80211_ATTR_PAD) ||
14112             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
14113             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
14114                         NL80211_CHAN_NO_HT) ||
14115             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14116                               NL80211_ATTR_PAD))
14117                 goto nla_put_failure;
14118
14119         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
14120             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
14121                 goto nla_put_failure;
14122
14123         genlmsg_end(msg, hdr);
14124
14125         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14126                                 NL80211_MCGRP_MLME, gfp);
14127         return;
14128
14129  nla_put_failure:
14130         genlmsg_cancel(msg, hdr);
14131         nlmsg_free(msg);
14132 }
14133
14134 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
14135                                struct ieee80211_channel *chan,
14136                                unsigned int duration, gfp_t gfp)
14137 {
14138         struct wiphy *wiphy = wdev->wiphy;
14139         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14140
14141         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
14142         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
14143                                           rdev, wdev, cookie, chan,
14144                                           duration, gfp);
14145 }
14146 EXPORT_SYMBOL(cfg80211_ready_on_channel);
14147
14148 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
14149                                         struct ieee80211_channel *chan,
14150                                         gfp_t gfp)
14151 {
14152         struct wiphy *wiphy = wdev->wiphy;
14153         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14154
14155         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
14156         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
14157                                           rdev, wdev, cookie, chan, 0, gfp);
14158 }
14159 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
14160
14161 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
14162                       struct station_info *sinfo, gfp_t gfp)
14163 {
14164         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14165         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14166         struct sk_buff *msg;
14167
14168         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
14169
14170         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14171         if (!msg)
14172                 return;
14173
14174         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
14175                                  rdev, dev, mac_addr, sinfo) < 0) {
14176                 nlmsg_free(msg);
14177                 return;
14178         }
14179
14180         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14181                                 NL80211_MCGRP_MLME, gfp);
14182 }
14183 EXPORT_SYMBOL(cfg80211_new_sta);
14184
14185 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
14186                             struct station_info *sinfo, gfp_t gfp)
14187 {
14188         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14189         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14190         struct sk_buff *msg;
14191         struct station_info empty_sinfo = {};
14192
14193         if (!sinfo)
14194                 sinfo = &empty_sinfo;
14195
14196         trace_cfg80211_del_sta(dev, mac_addr);
14197
14198         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14199         if (!msg)
14200                 return;
14201
14202         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
14203                                  rdev, dev, mac_addr, sinfo) < 0) {
14204                 nlmsg_free(msg);
14205                 return;
14206         }
14207
14208         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14209                                 NL80211_MCGRP_MLME, gfp);
14210 }
14211 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
14212
14213 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
14214                           enum nl80211_connect_failed_reason reason,
14215                           gfp_t gfp)
14216 {
14217         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14218         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14219         struct sk_buff *msg;
14220         void *hdr;
14221
14222         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
14223         if (!msg)
14224                 return;
14225
14226         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
14227         if (!hdr) {
14228                 nlmsg_free(msg);
14229                 return;
14230         }
14231
14232         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14233             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
14234             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
14235                 goto nla_put_failure;
14236
14237         genlmsg_end(msg, hdr);
14238
14239         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14240                                 NL80211_MCGRP_MLME, gfp);
14241         return;
14242
14243  nla_put_failure:
14244         genlmsg_cancel(msg, hdr);
14245         nlmsg_free(msg);
14246 }
14247 EXPORT_SYMBOL(cfg80211_conn_failed);
14248
14249 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
14250                                        const u8 *addr, gfp_t gfp)
14251 {
14252         struct wireless_dev *wdev = dev->ieee80211_ptr;
14253         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14254         struct sk_buff *msg;
14255         void *hdr;
14256         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
14257
14258         if (!nlportid)
14259                 return false;
14260
14261         msg = nlmsg_new(100, gfp);
14262         if (!msg)
14263                 return true;
14264
14265         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14266         if (!hdr) {
14267                 nlmsg_free(msg);
14268                 return true;
14269         }
14270
14271         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14272             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14273             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14274                 goto nla_put_failure;
14275
14276         genlmsg_end(msg, hdr);
14277         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14278         return true;
14279
14280  nla_put_failure:
14281         genlmsg_cancel(msg, hdr);
14282         nlmsg_free(msg);
14283         return true;
14284 }
14285
14286 bool cfg80211_rx_spurious_frame(struct net_device *dev,
14287                                 const u8 *addr, gfp_t gfp)
14288 {
14289         struct wireless_dev *wdev = dev->ieee80211_ptr;
14290         bool ret;
14291
14292         trace_cfg80211_rx_spurious_frame(dev, addr);
14293
14294         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14295                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
14296                 trace_cfg80211_return_bool(false);
14297                 return false;
14298         }
14299         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
14300                                          addr, gfp);
14301         trace_cfg80211_return_bool(ret);
14302         return ret;
14303 }
14304 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
14305
14306 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
14307                                         const u8 *addr, gfp_t gfp)
14308 {
14309         struct wireless_dev *wdev = dev->ieee80211_ptr;
14310         bool ret;
14311
14312         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
14313
14314         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14315                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
14316                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
14317                 trace_cfg80211_return_bool(false);
14318                 return false;
14319         }
14320         ret = __nl80211_unexpected_frame(dev,
14321                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
14322                                          addr, gfp);
14323         trace_cfg80211_return_bool(ret);
14324         return ret;
14325 }
14326 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
14327
14328 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
14329                       struct wireless_dev *wdev, u32 nlportid,
14330                       int freq, int sig_dbm,
14331                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
14332 {
14333         struct net_device *netdev = wdev->netdev;
14334         struct sk_buff *msg;
14335         void *hdr;
14336
14337         msg = nlmsg_new(100 + len, gfp);
14338         if (!msg)
14339                 return -ENOMEM;
14340
14341         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14342         if (!hdr) {
14343                 nlmsg_free(msg);
14344                 return -ENOMEM;
14345         }
14346
14347         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14348             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14349                                         netdev->ifindex)) ||
14350             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14351                               NL80211_ATTR_PAD) ||
14352             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
14353             (sig_dbm &&
14354              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14355             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14356             (flags &&
14357              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
14358                 goto nla_put_failure;
14359
14360         genlmsg_end(msg, hdr);
14361
14362         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14363
14364  nla_put_failure:
14365         genlmsg_cancel(msg, hdr);
14366         nlmsg_free(msg);
14367         return -ENOBUFS;
14368 }
14369
14370 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
14371                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
14372 {
14373         struct wiphy *wiphy = wdev->wiphy;
14374         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14375         struct net_device *netdev = wdev->netdev;
14376         struct sk_buff *msg;
14377         void *hdr;
14378
14379         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
14380
14381         msg = nlmsg_new(100 + len, gfp);
14382         if (!msg)
14383                 return;
14384
14385         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
14386         if (!hdr) {
14387                 nlmsg_free(msg);
14388                 return;
14389         }
14390
14391         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14392             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14393                                    netdev->ifindex)) ||
14394             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14395                               NL80211_ATTR_PAD) ||
14396             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14397             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14398                               NL80211_ATTR_PAD) ||
14399             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
14400                 goto nla_put_failure;
14401
14402         genlmsg_end(msg, hdr);
14403
14404         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14405                                 NL80211_MCGRP_MLME, gfp);
14406         return;
14407
14408  nla_put_failure:
14409         genlmsg_cancel(msg, hdr);
14410         nlmsg_free(msg);
14411 }
14412 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
14413
14414 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
14415                                             const char *mac, gfp_t gfp)
14416 {
14417         struct wireless_dev *wdev = dev->ieee80211_ptr;
14418         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14419         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14420         void **cb;
14421
14422         if (!msg)
14423                 return NULL;
14424
14425         cb = (void **)msg->cb;
14426
14427         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
14428         if (!cb[0]) {
14429                 nlmsg_free(msg);
14430                 return NULL;
14431         }
14432
14433         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14434             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
14435                 goto nla_put_failure;
14436
14437         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
14438                 goto nla_put_failure;
14439
14440         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
14441         if (!cb[1])
14442                 goto nla_put_failure;
14443
14444         cb[2] = rdev;
14445
14446         return msg;
14447  nla_put_failure:
14448         nlmsg_free(msg);
14449         return NULL;
14450 }
14451
14452 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
14453 {
14454         void **cb = (void **)msg->cb;
14455         struct cfg80211_registered_device *rdev = cb[2];
14456
14457         nla_nest_end(msg, cb[1]);
14458         genlmsg_end(msg, cb[0]);
14459
14460         memset(msg->cb, 0, sizeof(msg->cb));
14461
14462         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14463                                 NL80211_MCGRP_MLME, gfp);
14464 }
14465
14466 void cfg80211_cqm_rssi_notify(struct net_device *dev,
14467                               enum nl80211_cqm_rssi_threshold_event rssi_event,
14468                               s32 rssi_level, gfp_t gfp)
14469 {
14470         struct sk_buff *msg;
14471         struct wireless_dev *wdev = dev->ieee80211_ptr;
14472         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14473
14474         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
14475
14476         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
14477                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
14478                 return;
14479
14480         if (wdev->cqm_config) {
14481                 wdev->cqm_config->last_rssi_event_value = rssi_level;
14482
14483                 cfg80211_cqm_rssi_update(rdev, dev);
14484
14485                 if (rssi_level == 0)
14486                         rssi_level = wdev->cqm_config->last_rssi_event_value;
14487         }
14488
14489         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
14490         if (!msg)
14491                 return;
14492
14493         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
14494                         rssi_event))
14495                 goto nla_put_failure;
14496
14497         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
14498                                       rssi_level))
14499                 goto nla_put_failure;
14500
14501         cfg80211_send_cqm(msg, gfp);
14502
14503         return;
14504
14505  nla_put_failure:
14506         nlmsg_free(msg);
14507 }
14508 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
14509
14510 void cfg80211_cqm_txe_notify(struct net_device *dev,
14511                              const u8 *peer, u32 num_packets,
14512                              u32 rate, u32 intvl, gfp_t gfp)
14513 {
14514         struct sk_buff *msg;
14515
14516         msg = cfg80211_prepare_cqm(dev, peer, gfp);
14517         if (!msg)
14518                 return;
14519
14520         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
14521                 goto nla_put_failure;
14522
14523         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
14524                 goto nla_put_failure;
14525
14526         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
14527                 goto nla_put_failure;
14528
14529         cfg80211_send_cqm(msg, gfp);
14530         return;
14531
14532  nla_put_failure:
14533         nlmsg_free(msg);
14534 }
14535 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
14536
14537 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
14538                                  const u8 *peer, u32 num_packets, gfp_t gfp)
14539 {
14540         struct sk_buff *msg;
14541
14542         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
14543
14544         msg = cfg80211_prepare_cqm(dev, peer, gfp);
14545         if (!msg)
14546                 return;
14547
14548         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
14549                 goto nla_put_failure;
14550
14551         cfg80211_send_cqm(msg, gfp);
14552         return;
14553
14554  nla_put_failure:
14555         nlmsg_free(msg);
14556 }
14557 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
14558
14559 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
14560 {
14561         struct sk_buff *msg;
14562
14563         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
14564         if (!msg)
14565                 return;
14566
14567         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
14568                 goto nla_put_failure;
14569
14570         cfg80211_send_cqm(msg, gfp);
14571         return;
14572
14573  nla_put_failure:
14574         nlmsg_free(msg);
14575 }
14576 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
14577
14578 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
14579                                      struct net_device *netdev, const u8 *bssid,
14580                                      const u8 *replay_ctr, gfp_t gfp)
14581 {
14582         struct sk_buff *msg;
14583         struct nlattr *rekey_attr;
14584         void *hdr;
14585
14586         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14587         if (!msg)
14588                 return;
14589
14590         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
14591         if (!hdr) {
14592                 nlmsg_free(msg);
14593                 return;
14594         }
14595
14596         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14597             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14598             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14599                 goto nla_put_failure;
14600
14601         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
14602         if (!rekey_attr)
14603                 goto nla_put_failure;
14604
14605         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
14606                     NL80211_REPLAY_CTR_LEN, replay_ctr))
14607                 goto nla_put_failure;
14608
14609         nla_nest_end(msg, rekey_attr);
14610
14611         genlmsg_end(msg, hdr);
14612
14613         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14614                                 NL80211_MCGRP_MLME, gfp);
14615         return;
14616
14617  nla_put_failure:
14618         genlmsg_cancel(msg, hdr);
14619         nlmsg_free(msg);
14620 }
14621
14622 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
14623                                const u8 *replay_ctr, gfp_t gfp)
14624 {
14625         struct wireless_dev *wdev = dev->ieee80211_ptr;
14626         struct wiphy *wiphy = wdev->wiphy;
14627         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14628
14629         trace_cfg80211_gtk_rekey_notify(dev, bssid);
14630         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
14631 }
14632 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
14633
14634 static void
14635 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
14636                                struct net_device *netdev, int index,
14637                                const u8 *bssid, bool preauth, gfp_t gfp)
14638 {
14639         struct sk_buff *msg;
14640         struct nlattr *attr;
14641         void *hdr;
14642
14643         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14644         if (!msg)
14645                 return;
14646
14647         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
14648         if (!hdr) {
14649                 nlmsg_free(msg);
14650                 return;
14651         }
14652
14653         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14654             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
14655                 goto nla_put_failure;
14656
14657         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
14658         if (!attr)
14659                 goto nla_put_failure;
14660
14661         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
14662             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
14663             (preauth &&
14664              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
14665                 goto nla_put_failure;
14666
14667         nla_nest_end(msg, attr);
14668
14669         genlmsg_end(msg, hdr);
14670
14671         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14672                                 NL80211_MCGRP_MLME, gfp);
14673         return;
14674
14675  nla_put_failure:
14676         genlmsg_cancel(msg, hdr);
14677         nlmsg_free(msg);
14678 }
14679
14680 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
14681                                      const u8 *bssid, bool preauth, gfp_t gfp)
14682 {
14683         struct wireless_dev *wdev = dev->ieee80211_ptr;
14684         struct wiphy *wiphy = wdev->wiphy;
14685         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14686
14687         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
14688         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
14689 }
14690 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
14691
14692 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
14693                                      struct net_device *netdev,
14694                                      struct cfg80211_chan_def *chandef,
14695                                      gfp_t gfp,
14696                                      enum nl80211_commands notif,
14697                                      u8 count)
14698 {
14699         struct sk_buff *msg;
14700         void *hdr;
14701
14702         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14703         if (!msg)
14704                 return;
14705
14706         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
14707         if (!hdr) {
14708                 nlmsg_free(msg);
14709                 return;
14710         }
14711
14712         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
14713                 goto nla_put_failure;
14714
14715         if (nl80211_send_chandef(msg, chandef))
14716                 goto nla_put_failure;
14717
14718         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
14719             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
14720                         goto nla_put_failure;
14721
14722         genlmsg_end(msg, hdr);
14723
14724         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14725                                 NL80211_MCGRP_MLME, gfp);
14726         return;
14727
14728  nla_put_failure:
14729         genlmsg_cancel(msg, hdr);
14730         nlmsg_free(msg);
14731 }
14732
14733 void cfg80211_ch_switch_notify(struct net_device *dev,
14734                                struct cfg80211_chan_def *chandef)
14735 {
14736         struct wireless_dev *wdev = dev->ieee80211_ptr;
14737         struct wiphy *wiphy = wdev->wiphy;
14738         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14739
14740         ASSERT_WDEV_LOCK(wdev);
14741
14742         trace_cfg80211_ch_switch_notify(dev, chandef);
14743
14744         wdev->chandef = *chandef;
14745         wdev->preset_chandef = *chandef;
14746         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
14747                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
14748 }
14749 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
14750
14751 void cfg80211_ch_switch_started_notify(struct net_device *dev,
14752                                        struct cfg80211_chan_def *chandef,
14753                                        u8 count)
14754 {
14755         struct wireless_dev *wdev = dev->ieee80211_ptr;
14756         struct wiphy *wiphy = wdev->wiphy;
14757         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14758
14759         trace_cfg80211_ch_switch_started_notify(dev, chandef);
14760
14761         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
14762                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
14763 }
14764 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
14765
14766 void
14767 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
14768                      const struct cfg80211_chan_def *chandef,
14769                      enum nl80211_radar_event event,
14770                      struct net_device *netdev, gfp_t gfp)
14771 {
14772         struct sk_buff *msg;
14773         void *hdr;
14774
14775         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14776         if (!msg)
14777                 return;
14778
14779         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
14780         if (!hdr) {
14781                 nlmsg_free(msg);
14782                 return;
14783         }
14784
14785         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
14786                 goto nla_put_failure;
14787
14788         /* NOP and radar events don't need a netdev parameter */
14789         if (netdev) {
14790                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
14791
14792                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14793                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14794                                       NL80211_ATTR_PAD))
14795                         goto nla_put_failure;
14796         }
14797
14798         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
14799                 goto nla_put_failure;
14800
14801         if (nl80211_send_chandef(msg, chandef))
14802                 goto nla_put_failure;
14803
14804         genlmsg_end(msg, hdr);
14805
14806         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14807                                 NL80211_MCGRP_MLME, gfp);
14808         return;
14809
14810  nla_put_failure:
14811         genlmsg_cancel(msg, hdr);
14812         nlmsg_free(msg);
14813 }
14814
14815 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
14816                            u64 cookie, bool acked, gfp_t gfp)
14817 {
14818         struct wireless_dev *wdev = dev->ieee80211_ptr;
14819         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14820         struct sk_buff *msg;
14821         void *hdr;
14822
14823         trace_cfg80211_probe_status(dev, addr, cookie, acked);
14824
14825         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14826
14827         if (!msg)
14828                 return;
14829
14830         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
14831         if (!hdr) {
14832                 nlmsg_free(msg);
14833                 return;
14834         }
14835
14836         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14837             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14838             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14839             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14840                               NL80211_ATTR_PAD) ||
14841             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
14842                 goto nla_put_failure;
14843
14844         genlmsg_end(msg, hdr);
14845
14846         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14847                                 NL80211_MCGRP_MLME, gfp);
14848         return;
14849
14850  nla_put_failure:
14851         genlmsg_cancel(msg, hdr);
14852         nlmsg_free(msg);
14853 }
14854 EXPORT_SYMBOL(cfg80211_probe_status);
14855
14856 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
14857                                  const u8 *frame, size_t len,
14858                                  int freq, int sig_dbm)
14859 {
14860         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14861         struct sk_buff *msg;
14862         void *hdr;
14863         struct cfg80211_beacon_registration *reg;
14864
14865         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
14866
14867         spin_lock_bh(&rdev->beacon_registrations_lock);
14868         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14869                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
14870                 if (!msg) {
14871                         spin_unlock_bh(&rdev->beacon_registrations_lock);
14872                         return;
14873                 }
14874
14875                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14876                 if (!hdr)
14877                         goto nla_put_failure;
14878
14879                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14880                     (freq &&
14881                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
14882                     (sig_dbm &&
14883                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14884                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
14885                         goto nla_put_failure;
14886
14887                 genlmsg_end(msg, hdr);
14888
14889                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
14890         }
14891         spin_unlock_bh(&rdev->beacon_registrations_lock);
14892         return;
14893
14894  nla_put_failure:
14895         spin_unlock_bh(&rdev->beacon_registrations_lock);
14896         if (hdr)
14897                 genlmsg_cancel(msg, hdr);
14898         nlmsg_free(msg);
14899 }
14900 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
14901
14902 #ifdef CONFIG_PM
14903 static int cfg80211_net_detect_results(struct sk_buff *msg,
14904                                        struct cfg80211_wowlan_wakeup *wakeup)
14905 {
14906         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
14907         struct nlattr *nl_results, *nl_match, *nl_freqs;
14908         int i, j;
14909
14910         nl_results = nla_nest_start(
14911                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
14912         if (!nl_results)
14913                 return -EMSGSIZE;
14914
14915         for (i = 0; i < nd->n_matches; i++) {
14916                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
14917
14918                 nl_match = nla_nest_start(msg, i);
14919                 if (!nl_match)
14920                         break;
14921
14922                 /* The SSID attribute is optional in nl80211, but for
14923                  * simplicity reasons it's always present in the
14924                  * cfg80211 structure.  If a driver can't pass the
14925                  * SSID, that needs to be changed.  A zero length SSID
14926                  * is still a valid SSID (wildcard), so it cannot be
14927                  * used for this purpose.
14928                  */
14929                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
14930                             match->ssid.ssid)) {
14931                         nla_nest_cancel(msg, nl_match);
14932                         goto out;
14933                 }
14934
14935                 if (match->n_channels) {
14936                         nl_freqs = nla_nest_start(
14937                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
14938                         if (!nl_freqs) {
14939                                 nla_nest_cancel(msg, nl_match);
14940                                 goto out;
14941                         }
14942
14943                         for (j = 0; j < match->n_channels; j++) {
14944                                 if (nla_put_u32(msg, j, match->channels[j])) {
14945                                         nla_nest_cancel(msg, nl_freqs);
14946                                         nla_nest_cancel(msg, nl_match);
14947                                         goto out;
14948                                 }
14949                         }
14950
14951                         nla_nest_end(msg, nl_freqs);
14952                 }
14953
14954                 nla_nest_end(msg, nl_match);
14955         }
14956
14957 out:
14958         nla_nest_end(msg, nl_results);
14959         return 0;
14960 }
14961
14962 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
14963                                    struct cfg80211_wowlan_wakeup *wakeup,
14964                                    gfp_t gfp)
14965 {
14966         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14967         struct sk_buff *msg;
14968         void *hdr;
14969         int size = 200;
14970
14971         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
14972
14973         if (wakeup)
14974                 size += wakeup->packet_present_len;
14975
14976         msg = nlmsg_new(size, gfp);
14977         if (!msg)
14978                 return;
14979
14980         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
14981         if (!hdr)
14982                 goto free_msg;
14983
14984         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14985             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14986                               NL80211_ATTR_PAD))
14987                 goto free_msg;
14988
14989         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14990                                         wdev->netdev->ifindex))
14991                 goto free_msg;
14992
14993         if (wakeup) {
14994                 struct nlattr *reasons;
14995
14996                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
14997                 if (!reasons)
14998                         goto free_msg;
14999
15000                 if (wakeup->disconnect &&
15001                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
15002                         goto free_msg;
15003                 if (wakeup->magic_pkt &&
15004                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
15005                         goto free_msg;
15006                 if (wakeup->gtk_rekey_failure &&
15007                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
15008                         goto free_msg;
15009                 if (wakeup->eap_identity_req &&
15010                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
15011                         goto free_msg;
15012                 if (wakeup->four_way_handshake &&
15013                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
15014                         goto free_msg;
15015                 if (wakeup->rfkill_release &&
15016                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
15017                         goto free_msg;
15018
15019                 if (wakeup->pattern_idx >= 0 &&
15020                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
15021                                 wakeup->pattern_idx))
15022                         goto free_msg;
15023
15024                 if (wakeup->tcp_match &&
15025                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
15026                         goto free_msg;
15027
15028                 if (wakeup->tcp_connlost &&
15029                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
15030                         goto free_msg;
15031
15032                 if (wakeup->tcp_nomoretokens &&
15033                     nla_put_flag(msg,
15034                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
15035                         goto free_msg;
15036
15037                 if (wakeup->packet) {
15038                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
15039                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
15040
15041                         if (!wakeup->packet_80211) {
15042                                 pkt_attr =
15043                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
15044                                 len_attr =
15045                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
15046                         }
15047
15048                         if (wakeup->packet_len &&
15049                             nla_put_u32(msg, len_attr, wakeup->packet_len))
15050                                 goto free_msg;
15051
15052                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
15053                                     wakeup->packet))
15054                                 goto free_msg;
15055                 }
15056
15057                 if (wakeup->net_detect &&
15058                     cfg80211_net_detect_results(msg, wakeup))
15059                                 goto free_msg;
15060
15061                 nla_nest_end(msg, reasons);
15062         }
15063
15064         genlmsg_end(msg, hdr);
15065
15066         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15067                                 NL80211_MCGRP_MLME, gfp);
15068         return;
15069
15070  free_msg:
15071         nlmsg_free(msg);
15072 }
15073 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
15074 #endif
15075
15076 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
15077                                 enum nl80211_tdls_operation oper,
15078                                 u16 reason_code, gfp_t gfp)
15079 {
15080         struct wireless_dev *wdev = dev->ieee80211_ptr;
15081         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15082         struct sk_buff *msg;
15083         void *hdr;
15084
15085         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
15086                                          reason_code);
15087
15088         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15089         if (!msg)
15090                 return;
15091
15092         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
15093         if (!hdr) {
15094                 nlmsg_free(msg);
15095                 return;
15096         }
15097
15098         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15099             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15100             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
15101             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
15102             (reason_code > 0 &&
15103              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
15104                 goto nla_put_failure;
15105
15106         genlmsg_end(msg, hdr);
15107
15108         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15109                                 NL80211_MCGRP_MLME, gfp);
15110         return;
15111
15112  nla_put_failure:
15113         genlmsg_cancel(msg, hdr);
15114         nlmsg_free(msg);
15115 }
15116 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
15117
15118 static int nl80211_netlink_notify(struct notifier_block * nb,
15119                                   unsigned long state,
15120                                   void *_notify)
15121 {
15122         struct netlink_notify *notify = _notify;
15123         struct cfg80211_registered_device *rdev;
15124         struct wireless_dev *wdev;
15125         struct cfg80211_beacon_registration *reg, *tmp;
15126
15127         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
15128                 return NOTIFY_DONE;
15129
15130         rcu_read_lock();
15131
15132         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
15133                 struct cfg80211_sched_scan_request *sched_scan_req;
15134
15135                 list_for_each_entry_rcu(sched_scan_req,
15136                                         &rdev->sched_scan_req_list,
15137                                         list) {
15138                         if (sched_scan_req->owner_nlportid == notify->portid) {
15139                                 sched_scan_req->nl_owner_dead = true;
15140                                 schedule_work(&rdev->sched_scan_stop_wk);
15141                         }
15142                 }
15143
15144                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
15145                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
15146
15147                         if (wdev->owner_nlportid == notify->portid) {
15148                                 wdev->nl_owner_dead = true;
15149                                 schedule_work(&rdev->destroy_work);
15150                         } else if (wdev->conn_owner_nlportid == notify->portid) {
15151                                 schedule_work(&wdev->disconnect_wk);
15152                         }
15153                 }
15154
15155                 spin_lock_bh(&rdev->beacon_registrations_lock);
15156                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
15157                                          list) {
15158                         if (reg->nlportid == notify->portid) {
15159                                 list_del(&reg->list);
15160                                 kfree(reg);
15161                                 break;
15162                         }
15163                 }
15164                 spin_unlock_bh(&rdev->beacon_registrations_lock);
15165         }
15166
15167         rcu_read_unlock();
15168
15169         /*
15170          * It is possible that the user space process that is controlling the
15171          * indoor setting disappeared, so notify the regulatory core.
15172          */
15173         regulatory_netlink_notify(notify->portid);
15174         return NOTIFY_OK;
15175 }
15176
15177 static struct notifier_block nl80211_netlink_notifier = {
15178         .notifier_call = nl80211_netlink_notify,
15179 };
15180
15181 void cfg80211_ft_event(struct net_device *netdev,
15182                        struct cfg80211_ft_event_params *ft_event)
15183 {
15184         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
15185         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15186         struct sk_buff *msg;
15187         void *hdr;
15188
15189         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
15190
15191         if (!ft_event->target_ap)
15192                 return;
15193
15194         msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL);
15195         if (!msg)
15196                 return;
15197
15198         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
15199         if (!hdr)
15200                 goto out;
15201
15202         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15203             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15204             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
15205                 goto out;
15206
15207         if (ft_event->ies &&
15208             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
15209                 goto out;
15210         if (ft_event->ric_ies &&
15211             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
15212                     ft_event->ric_ies))
15213                 goto out;
15214
15215         genlmsg_end(msg, hdr);
15216
15217         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15218                                 NL80211_MCGRP_MLME, GFP_KERNEL);
15219         return;
15220  out:
15221         nlmsg_free(msg);
15222 }
15223 EXPORT_SYMBOL(cfg80211_ft_event);
15224
15225 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
15226 {
15227         struct cfg80211_registered_device *rdev;
15228         struct sk_buff *msg;
15229         void *hdr;
15230         u32 nlportid;
15231
15232         rdev = wiphy_to_rdev(wdev->wiphy);
15233         if (!rdev->crit_proto_nlportid)
15234                 return;
15235
15236         nlportid = rdev->crit_proto_nlportid;
15237         rdev->crit_proto_nlportid = 0;
15238
15239         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15240         if (!msg)
15241                 return;
15242
15243         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
15244         if (!hdr)
15245                 goto nla_put_failure;
15246
15247         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15248             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15249                               NL80211_ATTR_PAD))
15250                 goto nla_put_failure;
15251
15252         genlmsg_end(msg, hdr);
15253
15254         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15255         return;
15256
15257  nla_put_failure:
15258         if (hdr)
15259                 genlmsg_cancel(msg, hdr);
15260         nlmsg_free(msg);
15261 }
15262 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
15263
15264 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
15265 {
15266         struct wiphy *wiphy = wdev->wiphy;
15267         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15268         struct sk_buff *msg;
15269         void *hdr;
15270
15271         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15272         if (!msg)
15273                 return;
15274
15275         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
15276         if (!hdr)
15277                 goto out;
15278
15279         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15280             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
15281             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15282                               NL80211_ATTR_PAD))
15283                 goto out;
15284
15285         genlmsg_end(msg, hdr);
15286
15287         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
15288                                 NL80211_MCGRP_MLME, GFP_KERNEL);
15289         return;
15290  out:
15291         nlmsg_free(msg);
15292 }
15293
15294 /* initialisation/exit functions */
15295
15296 int __init nl80211_init(void)
15297 {
15298         int err;
15299
15300         err = genl_register_family(&nl80211_fam);
15301         if (err)
15302                 return err;
15303
15304         err = netlink_register_notifier(&nl80211_netlink_notifier);
15305         if (err)
15306                 goto err_out;
15307
15308         return 0;
15309  err_out:
15310         genl_unregister_family(&nl80211_fam);
15311         return err;
15312 }
15313
15314 void nl80211_exit(void)
15315 {
15316         netlink_unregister_notifier(&nl80211_netlink_notifier);
15317         genl_unregister_family(&nl80211_fam);
15318 }