net/wireless/nl80211.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * This is the new netlink-based wireless configuration interface.
   4  *
   5  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright 2013-2014  Intel Mobile Communications GmbH
   7  * Copyright 2015-2017  Intel Deutschland GmbH
   8  * Copyright (C) 2018-2019 Intel Corporation
   9  */
  10
  11 #include <linux/if.h>
  12 #include <linux/module.h>
  13 #include <linux/err.h>
  14 #include <linux/slab.h>
  15 #include <linux/list.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/ieee80211.h>
  18 #include <linux/nl80211.h>
  19 #include <linux/rtnetlink.h>
  20 #include <linux/netlink.h>
  21 #include <linux/nospec.h>
  22 #include <linux/etherdevice.h>
  23 #include <linux/if_vlan.h>
  24 #include <net/net_namespace.h>
  25 #include <net/genetlink.h>
  26 #include <net/cfg80211.h>
  27 #include <net/sock.h>
  28 #include <net/inet_connection_sock.h>
  29 #include "core.h"
  30 #include "nl80211.h"
  31 #include "reg.h"
  32 #include "rdev-ops.h"
  33
  34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  35                                    struct genl_info *info,
  36                                    struct cfg80211_crypto_settings *settings,
  37                                    int cipher_limit);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam;
  41
  42 /* multicast groups */
  43 enum nl80211_multicast_groups {
  44         NL80211_MCGRP_CONFIG,
  45         NL80211_MCGRP_SCAN,
  46         NL80211_MCGRP_REGULATORY,
  47         NL80211_MCGRP_MLME,
  48         NL80211_MCGRP_VENDOR,
  49         NL80211_MCGRP_NAN,
  50         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  51 };
  52
  53 static const struct genl_multicast_group nl80211_mcgrps[] = {
  54         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  55         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  56         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  57         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  58         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  59         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  60 #ifdef CONFIG_NL80211_TESTMODE
  61         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  62 #endif
  63 };
  64
  65 /* returns ERR_PTR values */
  66 static struct wireless_dev *
  67 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  68 {
  69         struct cfg80211_registered_device *rdev;
  70         struct wireless_dev *result = NULL;
  71         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  72         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  73         u64 wdev_id;
  74         int wiphy_idx = -1;
  75         int ifidx = -1;
  76
  77         ASSERT_RTNL();
  78
  79         if (!have_ifidx && !have_wdev_id)
  80                 return ERR_PTR(-EINVAL);
  81
  82         if (have_ifidx)
  83                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  84         if (have_wdev_id) {
  85                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  86                 wiphy_idx = wdev_id >> 32;
  87         }
  88
  89         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  90                 struct wireless_dev *wdev;
  91
  92                 if (wiphy_net(&rdev->wiphy) != netns)
  93                         continue;
  94
  95                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  96                         continue;
  97
  98                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  99                         if (have_ifidx && wdev->netdev &&
 100                             wdev->netdev->ifindex == ifidx) {
 101                                 result = wdev;
 102                                 break;
 103                         }
 104                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 105                                 result = wdev;
 106                                 break;
 107                         }
 108                 }
 109
 110                 if (result)
 111                         break;
 112         }
 113
 114         if (result)
 115                 return result;
 116         return ERR_PTR(-ENODEV);
 117 }
 118
 119 static struct cfg80211_registered_device *
 120 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 121 {
 122         struct cfg80211_registered_device *rdev = NULL, *tmp;
 123         struct net_device *netdev;
 124
 125         ASSERT_RTNL();
 126
 127         if (!attrs[NL80211_ATTR_WIPHY] &&
 128             !attrs[NL80211_ATTR_IFINDEX] &&
 129             !attrs[NL80211_ATTR_WDEV])
 130                 return ERR_PTR(-EINVAL);
 131
 132         if (attrs[NL80211_ATTR_WIPHY])
 133                 rdev = cfg80211_rdev_by_wiphy_idx(
 134                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 135
 136         if (attrs[NL80211_ATTR_WDEV]) {
 137                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 138                 struct wireless_dev *wdev;
 139                 bool found = false;
 140
 141                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 142                 if (tmp) {
 143                         /* make sure wdev exists */
 144                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 145                                 if (wdev->identifier != (u32)wdev_id)
 146                                         continue;
 147                                 found = true;
 148                                 break;
 149                         }
 150
 151                         if (!found)
 152                                 tmp = NULL;
 153
 154                         if (rdev && tmp != rdev)
 155                                 return ERR_PTR(-EINVAL);
 156                         rdev = tmp;
 157                 }
 158         }
 159
 160         if (attrs[NL80211_ATTR_IFINDEX]) {
 161                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 162
 163                 netdev = __dev_get_by_index(netns, ifindex);
 164                 if (netdev) {
 165                         if (netdev->ieee80211_ptr)
 166                                 tmp = wiphy_to_rdev(
 167                                         netdev->ieee80211_ptr->wiphy);
 168                         else
 169                                 tmp = NULL;
 170
 171                         /* not wireless device -- return error */
 172                         if (!tmp)
 173                                 return ERR_PTR(-EINVAL);
 174
 175                         /* mismatch -- return error */
 176                         if (rdev && tmp != rdev)
 177                                 return ERR_PTR(-EINVAL);
 178
 179                         rdev = tmp;
 180                 }
 181         }
 182
 183         if (!rdev)
 184                 return ERR_PTR(-ENODEV);
 185
 186         if (netns != wiphy_net(&rdev->wiphy))
 187                 return ERR_PTR(-ENODEV);
 188
 189         return rdev;
 190 }
 191
 192 /*
 193  * This function returns a pointer to the driver
 194  * that the genl_info item that is passed refers to.
 195  *
 196  * The result of this can be a PTR_ERR and hence must
 197  * be checked with IS_ERR() for errors.
 198  */
 199 static struct cfg80211_registered_device *
 200 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 201 {
 202         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 203 }
 204
 205 static int validate_beacon_head(const struct nlattr *attr,
 206                                 struct netlink_ext_ack *extack)
 207 {
 208         const u8 *data = nla_data(attr);
 209         unsigned int len = nla_len(attr);
 210         const struct element *elem;
 211         const struct ieee80211_mgmt *mgmt = (void *)data;
 212         unsigned int fixedlen = offsetof(struct ieee80211_mgmt,
 213                                          u.beacon.variable);
 214
 215         if (len < fixedlen)
 216                 goto err;
 217
 218         if (ieee80211_hdrlen(mgmt->frame_control) !=
 219             offsetof(struct ieee80211_mgmt, u.beacon))
 220                 goto err;
 221
 222         data += fixedlen;
 223         len -= fixedlen;
 224
 225         for_each_element(elem, data, len) {
 226                 /* nothing */
 227         }
 228
 229         if (for_each_element_completed(elem, data, len))
 230                 return 0;
 231
 232 err:
 233         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
 234         return -EINVAL;
 235 }
 236
 237 static int validate_ie_attr(const struct nlattr *attr,
 238                             struct netlink_ext_ack *extack)
 239 {
 240         const u8 *data = nla_data(attr);
 241         unsigned int len = nla_len(attr);
 242         const struct element *elem;
 243
 244         for_each_element(elem, data, len) {
 245                 /* nothing */
 246         }
 247
 248         if (for_each_element_completed(elem, data, len))
 249                 return 0;
 250
 251         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 252         return -EINVAL;
 253 }
 254
 255 /* policy for the attributes */
 256 static const struct nla_policy
 257 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 258         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 259         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 260                                         .len = U8_MAX },
 261         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 262                                              .len = U8_MAX },
 263 };
 264
 265 static const struct nla_policy
 266 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 267         [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
 268         [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
 269         [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
 270                 NLA_POLICY_MAX(NLA_U8, 15),
 271         [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
 272         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
 273                 NLA_POLICY_MAX(NLA_U8, 15),
 274         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
 275                 NLA_POLICY_MAX(NLA_U8, 31),
 276         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
 277         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
 278         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
 279 };
 280
 281 static const struct nla_policy
 282 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 283         [NL80211_PMSR_TYPE_FTM] =
 284                 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
 285 };
 286
 287 static const struct nla_policy
 288 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
 289         [NL80211_PMSR_REQ_ATTR_DATA] =
 290                 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
 291         [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
 292 };
 293
 294 static const struct nla_policy
 295 nl80211_psmr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 296         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
 297         /*
 298          * we could specify this again to be the top-level policy,
 299          * but that would open us up to recursion problems ...
 300          */
 301         [NL80211_PMSR_PEER_ATTR_CHAN] = { .type = NLA_NESTED },
 302         [NL80211_PMSR_PEER_ATTR_REQ] =
 303                 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 304         [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
 305 };
 306
 307 static const struct nla_policy
 308 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 309         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 310         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 311         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 312         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 313         [NL80211_PMSR_ATTR_PEERS] =
 314                 NLA_POLICY_NESTED_ARRAY(nl80211_psmr_peer_attr_policy),
 315 };
 316
 317 static const struct nla_policy
 318 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
 319         [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
 320                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 321         [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
 322                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 323 };
 324
 325 const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 326         [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
 327         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 328         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 329                                       .len = 20-1 },
 330         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 331
 332         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 333         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 334         [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
 335                                                 NL80211_EDMG_CHANNELS_MIN,
 336                                                 NL80211_EDMG_CHANNELS_MAX),
 337         [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
 338                                                 NL80211_EDMG_BW_CONFIG_MIN,
 339                                                 NL80211_EDMG_BW_CONFIG_MAX),
 340
 341         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 342         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 343         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 344
 345         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 346         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 347         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 348         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 349         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 350         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 351
 352         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 353         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 354         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 355
 356         [NL80211_ATTR_MAC] = { .type = NLA_EXACT_LEN_WARN, .len = ETH_ALEN },
 357         [NL80211_ATTR_PREV_BSSID] = {
 358                 .type = NLA_EXACT_LEN_WARN,
 359                 .len = ETH_ALEN
 360         },
 361
 362         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 363         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 364                                     .len = WLAN_MAX_KEY_LEN },
 365         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 5),
 366         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 367         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 368         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 369         [NL80211_ATTR_KEY_TYPE] =
 370                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 371
 372         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 373         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 374         [NL80211_ATTR_BEACON_HEAD] =
 375                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
 376                                        IEEE80211_MAX_DATA_LEN),
 377         [NL80211_ATTR_BEACON_TAIL] =
 378                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 379                                        IEEE80211_MAX_DATA_LEN),
 380         [NL80211_ATTR_STA_AID] =
 381                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 382         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 383         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 384         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 385                                                .len = NL80211_MAX_SUPP_RATES },
 386         [NL80211_ATTR_STA_PLINK_ACTION] =
 387                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 388         [NL80211_ATTR_STA_TX_POWER_SETTING] =
 389                 NLA_POLICY_RANGE(NLA_U8,
 390                                  NL80211_TX_POWER_AUTOMATIC,
 391                                  NL80211_TX_POWER_FIXED),
 392         [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
 393         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 394         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 395         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 396                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 397         [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
 398
 399         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 400         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 401
 402         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 403         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 404         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 405         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 406                                            .len = NL80211_MAX_SUPP_RATES },
 407         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 408
 409         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 410         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 411
 412         [NL80211_ATTR_HT_CAPABILITY] = {
 413                 .type = NLA_EXACT_LEN_WARN,
 414                 .len = NL80211_HT_CAPABILITY_LEN
 415         },
 416
 417         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 418         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 419                                                    validate_ie_attr,
 420                                                    IEEE80211_MAX_DATA_LEN),
 421         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 422         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 423
 424         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 425                                 .len = IEEE80211_MAX_SSID_LEN },
 426         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 427         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 428         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 429         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 430         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 431                                                   NL80211_MFP_NO,
 432                                                   NL80211_MFP_OPTIONAL),
 433         [NL80211_ATTR_STA_FLAGS2] = {
 434                 .len = sizeof(struct nl80211_sta_flag_update),
 435         },
 436         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 437         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 438         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 439         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 440         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 441         [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
 442         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 443         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 444         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 445         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 446         [NL80211_ATTR_PMKID] = {
 447                 .type = NLA_EXACT_LEN_WARN,
 448                 .len = WLAN_PMKID_LEN
 449         },
 450         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 451         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 452         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 453         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 454                                  .len = IEEE80211_MAX_DATA_LEN },
 455         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 456         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 457                                                    NL80211_PS_DISABLED,
 458                                                    NL80211_PS_ENABLED),
 459         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 460         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 461         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 462         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 463         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 464         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 465         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 466         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 467         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 468         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 469         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 470         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 471         [NL80211_ATTR_STA_PLINK_STATE] =
 472                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 473         [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
 474         [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
 475         [NL80211_ATTR_MESH_PEER_AID] =
 476                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 477         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 478         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 479         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 480         [NL80211_ATTR_HIDDEN_SSID] =
 481                 NLA_POLICY_RANGE(NLA_U32,
 482                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 483                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 484         [NL80211_ATTR_IE_PROBE_RESP] =
 485                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 486                                        IEEE80211_MAX_DATA_LEN),
 487         [NL80211_ATTR_IE_ASSOC_RESP] =
 488                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 489                                        IEEE80211_MAX_DATA_LEN),
 490         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 491         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 492         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 493         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 494         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 495         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 496         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 497         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 498         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 499         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 500         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 501                                       .len = IEEE80211_MAX_DATA_LEN },
 502         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 503         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 504         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 505                 .len = NL80211_HT_CAPABILITY_LEN
 506         },
 507         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 508         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 509         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 510         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 511         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 512         [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
 513         [NL80211_ATTR_VHT_CAPABILITY] = {
 514                 .type = NLA_EXACT_LEN_WARN,
 515                 .len = NL80211_VHT_CAPABILITY_LEN
 516         },
 517         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 518         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 519         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 520         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 521                 NLA_POLICY_RANGE(NLA_U32,
 522                                  NL80211_MESH_POWER_UNKNOWN + 1,
 523                                  NL80211_MESH_POWER_MAX),
 524         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 525         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 526         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 527         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 528         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 529         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 530         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 531                 .len = NL80211_VHT_CAPABILITY_LEN,
 532         },
 533         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 534         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 535                                   .len = IEEE80211_MAX_DATA_LEN },
 536         [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
 537         [NL80211_ATTR_MAX_CRIT_PROT_DURATION] = { .type = NLA_U16 },
 538         [NL80211_ATTR_PEER_AID] =
 539                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 540         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 541         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 542         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 543         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 544         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 545         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 546         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 547         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 548         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 549         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 550         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 551         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 552         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 553                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 554         [NL80211_ATTR_MAC_HINT] = {
 555                 .type = NLA_EXACT_LEN_WARN,
 556                 .len = ETH_ALEN
 557         },
 558         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 559         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 560         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 561         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 562         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 563         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 564         [NL80211_ATTR_USER_PRIO] =
 565                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 566         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 567         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 568         [NL80211_ATTR_MAC_MASK] = {
 569                 .type = NLA_EXACT_LEN_WARN,
 570                 .len = ETH_ALEN
 571         },
 572         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 573         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 574         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 575         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 576         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 577         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 578         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 579                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 580         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 581                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 582         },
 583         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = {
 584                 .type = NLA_EXACT_LEN_WARN,
 585                 .len = ETH_ALEN
 586         },
 587         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 588         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 589         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 590         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 591                                     .len = FILS_MAX_KEK_LEN },
 592         [NL80211_ATTR_FILS_NONCES] = {
 593                 .type = NLA_EXACT_LEN_WARN,
 594                 .len = 2 * FILS_NONCE_LEN
 595         },
 596         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 597         [NL80211_ATTR_BSSID] = { .type = NLA_EXACT_LEN_WARN, .len = ETH_ALEN },
 598         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 599         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 600                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 601         },
 602         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 603         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 604                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 605         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 606                                           .len = FILS_ERP_MAX_REALM_LEN },
 607         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 608         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 609                                         .len = FILS_ERP_MAX_RRK_LEN },
 610         [NL80211_ATTR_FILS_CACHE_ID] = { .type = NLA_EXACT_LEN_WARN, .len = 2 },
 611         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 612         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 613         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 614
 615         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 616         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 617         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 618         [NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
 619                                          .len = NL80211_HE_MAX_CAPABILITY_LEN },
 620
 621         [NL80211_ATTR_FTM_RESPONDER] = {
 622                 .type = NLA_NESTED,
 623                 .validation_data = nl80211_ftm_responder_policy,
 624         },
 625         [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
 626         [NL80211_ATTR_PEER_MEASUREMENTS] =
 627                 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
 628         [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 629         [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
 630                                         .len = SAE_PASSWORD_MAX_LEN },
 631         [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
 632         [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
 633         [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
 634 };
 635
 636 /* policy for the key attributes */
 637 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 638         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 639         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 640         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 641         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 642         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 643         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 644         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 645         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 646         [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
 647 };
 648
 649 /* policy for the key default flags */
 650 static const struct nla_policy
 651 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 652         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 653         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 654 };
 655
 656 #ifdef CONFIG_PM
 657 /* policy for WoWLAN attributes */
 658 static const struct nla_policy
 659 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 660         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 661         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 662         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 663         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 664         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 665         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 666         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 667         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 668         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 669         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 670 };
 671
 672 static const struct nla_policy
 673 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 674         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 675         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 676         [NL80211_WOWLAN_TCP_DST_MAC] = {
 677                 .type = NLA_EXACT_LEN_WARN,
 678                 .len = ETH_ALEN
 679         },
 680         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 681         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 682         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .type = NLA_MIN_LEN, .len = 1 },
 683         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 684                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 685         },
 686         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 687                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 688         },
 689         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 690         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .type = NLA_MIN_LEN, .len = 1 },
 691         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .type = NLA_MIN_LEN, .len = 1 },
 692 };
 693 #endif /* CONFIG_PM */
 694
 695 /* policy for coalesce rule attributes */
 696 static const struct nla_policy
 697 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 698         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 699         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 700                 NLA_POLICY_RANGE(NLA_U32,
 701                                  NL80211_COALESCE_CONDITION_MATCH,
 702                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 703         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 704 };
 705
 706 /* policy for GTK rekey offload attributes */
 707 static const struct nla_policy
 708 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 709         [NL80211_REKEY_DATA_KEK] = {
 710                 .type = NLA_EXACT_LEN_WARN,
 711                 .len = NL80211_KEK_LEN,
 712         },
 713         [NL80211_REKEY_DATA_KCK] = {
 714                 .type = NLA_EXACT_LEN_WARN,
 715                 .len = NL80211_KCK_LEN,
 716         },
 717         [NL80211_REKEY_DATA_REPLAY_CTR] = {
 718                 .type = NLA_EXACT_LEN_WARN,
 719                 .len = NL80211_REPLAY_CTR_LEN
 720         },
 721 };
 722
 723 static const struct nla_policy
 724 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
 725         [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
 726         [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
 727         [NL80211_BAND_6GHZ] = { .type = NLA_S32 },
 728         [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
 729 };
 730
 731 static const struct nla_policy
 732 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 733         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 734                                                  .len = IEEE80211_MAX_SSID_LEN },
 735         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = {
 736                 .type = NLA_EXACT_LEN_WARN,
 737                 .len = ETH_ALEN
 738         },
 739         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 740         [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
 741                 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
 742 };
 743
 744 static const struct nla_policy
 745 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 746         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 747         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 748 };
 749
 750 static const struct nla_policy
 751 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 752         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 753         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 754         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 755                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 756         },
 757 };
 758
 759 /* policy for NAN function attributes */
 760 static const struct nla_policy
 761 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 762         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 763         [NL80211_NAN_FUNC_SERVICE_ID] = {
 764                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 765         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 766         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 767         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 768         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 769         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 770         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = {
 771                 .type = NLA_EXACT_LEN_WARN,
 772                 .len = ETH_ALEN
 773         },
 774         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 775         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 776         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 777                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 778         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 779         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 780         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 781         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 782         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 783 };
 784
 785 /* policy for Service Response Filter attributes */
 786 static const struct nla_policy
 787 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 788         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 789         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 790                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 791         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 792         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 793 };
 794
 795 /* policy for packet pattern attributes */
 796 static const struct nla_policy
 797 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 798         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 799         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 800         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 801 };
 802
 803 int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 804                               struct cfg80211_registered_device **rdev,
 805                               struct wireless_dev **wdev)
 806 {
 807         int err;
 808
 809         if (!cb->args[0]) {
 810                 struct nlattr **attrbuf;
 811
 812                 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
 813                                   GFP_KERNEL);
 814                 if (!attrbuf)
 815                         return -ENOMEM;
 816
 817                 err = nlmsg_parse_deprecated(cb->nlh,
 818                                              GENL_HDRLEN + nl80211_fam.hdrsize,
 819                                              attrbuf, nl80211_fam.maxattr,
 820                                              nl80211_policy, NULL);
 821                 if (err) {
 822                         kfree(attrbuf);
 823                         return err;
 824                 }
 825
 826                 *wdev = __cfg80211_wdev_from_attrs(sock_net(cb->skb->sk),
 827                                                    attrbuf);
 828                 kfree(attrbuf);
 829                 if (IS_ERR(*wdev))
 830                         return PTR_ERR(*wdev);
 831                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 832                 /* 0 is the first index - add 1 to parse only once */
 833                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 834                 cb->args[1] = (*wdev)->identifier;
 835         } else {
 836                 /* subtract the 1 again here */
 837                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 838                 struct wireless_dev *tmp;
 839
 840                 if (!wiphy)
 841                         return -ENODEV;
 842                 *rdev = wiphy_to_rdev(wiphy);
 843                 *wdev = NULL;
 844
 845                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 846                         if (tmp->identifier == cb->args[1]) {
 847                                 *wdev = tmp;
 848                                 break;
 849                         }
 850                 }
 851
 852                 if (!*wdev)
 853                         return -ENODEV;
 854         }
 855
 856         return 0;
 857 }
 858
 859 /* message building helper */
 860 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 861                      int flags, u8 cmd)
 862 {
 863         /* since there is no private header just add the generic one */
 864         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 865 }
 866
 867 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
 868                                      const struct ieee80211_reg_rule *rule)
 869 {
 870         int j;
 871         struct nlattr *nl_wmm_rules =
 872                 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
 873
 874         if (!nl_wmm_rules)
 875                 goto nla_put_failure;
 876
 877         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
 878                 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
 879
 880                 if (!nl_wmm_rule)
 881                         goto nla_put_failure;
 882
 883                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
 884                                 rule->wmm_rule.client[j].cw_min) ||
 885                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
 886                                 rule->wmm_rule.client[j].cw_max) ||
 887                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
 888                                rule->wmm_rule.client[j].aifsn) ||
 889                     nla_put_u16(msg, NL80211_WMMR_TXOP,
 890                                 rule->wmm_rule.client[j].cot))
 891                         goto nla_put_failure;
 892
 893                 nla_nest_end(msg, nl_wmm_rule);
 894         }
 895         nla_nest_end(msg, nl_wmm_rules);
 896
 897         return 0;
 898
 899 nla_put_failure:
 900         return -ENOBUFS;
 901 }
 902
 903 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
 904                                    struct ieee80211_channel *chan,
 905                                    bool large)
 906 {
 907         /* Some channels must be completely excluded from the
 908          * list to protect old user-space tools from breaking
 909          */
 910         if (!large && chan->flags &
 911             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 912                 return 0;
 913
 914         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 915                         chan->center_freq))
 916                 goto nla_put_failure;
 917
 918         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 919             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 920                 goto nla_put_failure;
 921         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 922                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 923                         goto nla_put_failure;
 924                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 925                         goto nla_put_failure;
 926         }
 927         if (chan->flags & IEEE80211_CHAN_RADAR) {
 928                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 929                         goto nla_put_failure;
 930                 if (large) {
 931                         u32 time;
 932
 933                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 934
 935                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 936                                         chan->dfs_state))
 937                                 goto nla_put_failure;
 938                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 939                                         time))
 940                                 goto nla_put_failure;
 941                         if (nla_put_u32(msg,
 942                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 943                                         chan->dfs_cac_ms))
 944                                 goto nla_put_failure;
 945                 }
 946         }
 947
 948         if (large) {
 949                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 950                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 951                         goto nla_put_failure;
 952                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 953                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 954                         goto nla_put_failure;
 955                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 956                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 957                         goto nla_put_failure;
 958                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 959                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 960                         goto nla_put_failure;
 961                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 962                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 963                         goto nla_put_failure;
 964                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 965                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 966                         goto nla_put_failure;
 967                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 968                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 969                         goto nla_put_failure;
 970                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 971                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 972                         goto nla_put_failure;
 973         }
 974
 975         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 976                         DBM_TO_MBM(chan->max_power)))
 977                 goto nla_put_failure;
 978
 979         if (large) {
 980                 const struct ieee80211_reg_rule *rule =
 981                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
 982
 983                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
 984                         if (nl80211_msg_put_wmm_rules(msg, rule))
 985                                 goto nla_put_failure;
 986                 }
 987         }
 988
 989         return 0;
 990
 991  nla_put_failure:
 992         return -ENOBUFS;
 993 }
 994
 995 static bool nl80211_put_txq_stats(struct sk_buff *msg,
 996                                   struct cfg80211_txq_stats *txqstats,
 997                                   int attrtype)
 998 {
 999         struct nlattr *txqattr;
1000
1001 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
1002         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
1003             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1004                 return false;                                             \
1005         } while (0)
1006
1007         txqattr = nla_nest_start_noflag(msg, attrtype);
1008         if (!txqattr)
1009                 return false;
1010
1011         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1012         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1013         PUT_TXQVAL_U32(FLOWS, flows);
1014         PUT_TXQVAL_U32(DROPS, drops);
1015         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1016         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1017         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1018         PUT_TXQVAL_U32(COLLISIONS, collisions);
1019         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1020         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1021         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1022         nla_nest_end(msg, txqattr);
1023
1024 #undef PUT_TXQVAL_U32
1025         return true;
1026 }
1027
1028 /* netlink command implementations */
1029
1030 struct key_parse {
1031         struct key_params p;
1032         int idx;
1033         int type;
1034         bool def, defmgmt;
1035         bool def_uni, def_multi;
1036 };
1037
1038 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1039                                  struct key_parse *k)
1040 {
1041         struct nlattr *tb[NL80211_KEY_MAX + 1];
1042         int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1043                                               nl80211_key_policy,
1044                                               info->extack);
1045         if (err)
1046                 return err;
1047
1048         k->def = !!tb[NL80211_KEY_DEFAULT];
1049         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1050
1051         if (k->def) {
1052                 k->def_uni = true;
1053                 k->def_multi = true;
1054         }
1055         if (k->defmgmt)
1056                 k->def_multi = true;
1057
1058         if (tb[NL80211_KEY_IDX])
1059                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1060
1061         if (tb[NL80211_KEY_DATA]) {
1062                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1063                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1064         }
1065
1066         if (tb[NL80211_KEY_SEQ]) {
1067                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1068                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1069         }
1070
1071         if (tb[NL80211_KEY_CIPHER])
1072                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1073
1074         if (tb[NL80211_KEY_TYPE])
1075                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1076
1077         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1078                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1079
1080                 err = nla_parse_nested_deprecated(kdt,
1081                                                   NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1082                                                   tb[NL80211_KEY_DEFAULT_TYPES],
1083                                                   nl80211_key_default_policy,
1084                                                   info->extack);
1085                 if (err)
1086                         return err;
1087
1088                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1089                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1090         }
1091
1092         if (tb[NL80211_KEY_MODE])
1093                 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1094
1095         return 0;
1096 }
1097
1098 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1099 {
1100         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1101                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1102                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1103         }
1104
1105         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1106                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1107                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1108         }
1109
1110         if (info->attrs[NL80211_ATTR_KEY_IDX])
1111                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1112
1113         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1114                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1115
1116         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1117         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1118
1119         if (k->def) {
1120                 k->def_uni = true;
1121                 k->def_multi = true;
1122         }
1123         if (k->defmgmt)
1124                 k->def_multi = true;
1125
1126         if (info->attrs[NL80211_ATTR_KEY_TYPE])
1127                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1128
1129         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1130                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1131                 int err = nla_parse_nested_deprecated(kdt,
1132                                                       NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1133                                                       info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1134                                                       nl80211_key_default_policy,
1135                                                       info->extack);
1136                 if (err)
1137                         return err;
1138
1139                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1140                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1141         }
1142
1143         return 0;
1144 }
1145
1146 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1147 {
1148         int err;
1149
1150         memset(k, 0, sizeof(*k));
1151         k->idx = -1;
1152         k->type = -1;
1153
1154         if (info->attrs[NL80211_ATTR_KEY])
1155                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1156         else
1157                 err = nl80211_parse_key_old(info, k);
1158
1159         if (err)
1160                 return err;
1161
1162         if (k->def && k->defmgmt) {
1163                 GENL_SET_ERR_MSG(info, "key with def && defmgmt is invalid");
1164                 return -EINVAL;
1165         }
1166
1167         if (k->defmgmt) {
1168                 if (k->def_uni || !k->def_multi) {
1169                         GENL_SET_ERR_MSG(info, "defmgmt key must be mcast");
1170                         return -EINVAL;
1171                 }
1172         }
1173
1174         if (k->idx != -1) {
1175                 if (k->defmgmt) {
1176                         if (k->idx < 4 || k->idx > 5) {
1177                                 GENL_SET_ERR_MSG(info,
1178                                                  "defmgmt key idx not 4 or 5");
1179                                 return -EINVAL;
1180                         }
1181                 } else if (k->def) {
1182                         if (k->idx < 0 || k->idx > 3) {
1183                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1184                                 return -EINVAL;
1185                         }
1186                 } else {
1187                         if (k->idx < 0 || k->idx > 5) {
1188                                 GENL_SET_ERR_MSG(info, "key idx not 0-5");
1189                                 return -EINVAL;
1190                         }
1191                 }
1192         }
1193
1194         return 0;
1195 }
1196
1197 static struct cfg80211_cached_keys *
1198 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1199                        struct genl_info *info, bool *no_ht)
1200 {
1201         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1202         struct key_parse parse;
1203         struct nlattr *key;
1204         struct cfg80211_cached_keys *result;
1205         int rem, err, def = 0;
1206         bool have_key = false;
1207
1208         nla_for_each_nested(key, keys, rem) {
1209                 have_key = true;
1210                 break;
1211         }
1212
1213         if (!have_key)
1214                 return NULL;
1215
1216         result = kzalloc(sizeof(*result), GFP_KERNEL);
1217         if (!result)
1218                 return ERR_PTR(-ENOMEM);
1219
1220         result->def = -1;
1221
1222         nla_for_each_nested(key, keys, rem) {
1223                 memset(&parse, 0, sizeof(parse));
1224                 parse.idx = -1;
1225
1226                 err = nl80211_parse_key_new(info, key, &parse);
1227                 if (err)
1228                         goto error;
1229                 err = -EINVAL;
1230                 if (!parse.p.key)
1231                         goto error;
1232                 if (parse.idx < 0 || parse.idx > 3) {
1233                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1234                         goto error;
1235                 }
1236                 if (parse.def) {
1237                         if (def) {
1238                                 GENL_SET_ERR_MSG(info,
1239                                                  "only one key can be default");
1240                                 goto error;
1241                         }
1242                         def = 1;
1243                         result->def = parse.idx;
1244                         if (!parse.def_uni || !parse.def_multi)
1245                                 goto error;
1246                 } else if (parse.defmgmt)
1247                         goto error;
1248                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1249                                                      parse.idx, false, NULL);
1250                 if (err)
1251                         goto error;
1252                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1253                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1254                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1255                         err = -EINVAL;
1256                         goto error;
1257                 }
1258                 result->params[parse.idx].cipher = parse.p.cipher;
1259                 result->params[parse.idx].key_len = parse.p.key_len;
1260                 result->params[parse.idx].key = result->data[parse.idx];
1261                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1262
1263                 /* must be WEP key if we got here */
1264                 if (no_ht)
1265                         *no_ht = true;
1266         }
1267
1268         if (result->def < 0) {
1269                 err = -EINVAL;
1270                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1271                 goto error;
1272         }
1273
1274         return result;
1275  error:
1276         kfree(result);
1277         return ERR_PTR(err);
1278 }
1279
1280 static int nl80211_key_allowed(struct wireless_dev *wdev)
1281 {
1282         ASSERT_WDEV_LOCK(wdev);
1283
1284         switch (wdev->iftype) {
1285         case NL80211_IFTYPE_AP:
1286         case NL80211_IFTYPE_AP_VLAN:
1287         case NL80211_IFTYPE_P2P_GO:
1288         case NL80211_IFTYPE_MESH_POINT:
1289                 break;
1290         case NL80211_IFTYPE_ADHOC:
1291         case NL80211_IFTYPE_STATION:
1292         case NL80211_IFTYPE_P2P_CLIENT:
1293                 if (!wdev->current_bss)
1294                         return -ENOLINK;
1295                 break;
1296         case NL80211_IFTYPE_UNSPECIFIED:
1297         case NL80211_IFTYPE_OCB:
1298         case NL80211_IFTYPE_MONITOR:
1299         case NL80211_IFTYPE_NAN:
1300         case NL80211_IFTYPE_P2P_DEVICE:
1301         case NL80211_IFTYPE_WDS:
1302         case NUM_NL80211_IFTYPES:
1303                 return -EINVAL;
1304         }
1305
1306         return 0;
1307 }
1308
1309 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1310                                                         struct nlattr *tb)
1311 {
1312         struct ieee80211_channel *chan;
1313
1314         if (tb == NULL)
1315                 return NULL;
1316         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
1317         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1318                 return NULL;
1319         return chan;
1320 }
1321
1322 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1323 {
1324         struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1325         int i;
1326
1327         if (!nl_modes)
1328                 goto nla_put_failure;
1329
1330         i = 0;
1331         while (ifmodes) {
1332                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1333                         goto nla_put_failure;
1334                 ifmodes >>= 1;
1335                 i++;
1336         }
1337
1338         nla_nest_end(msg, nl_modes);
1339         return 0;
1340
1341 nla_put_failure:
1342         return -ENOBUFS;
1343 }
1344
1345 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1346                                           struct sk_buff *msg,
1347                                           bool large)
1348 {
1349         struct nlattr *nl_combis;
1350         int i, j;
1351
1352         nl_combis = nla_nest_start_noflag(msg,
1353                                           NL80211_ATTR_INTERFACE_COMBINATIONS);
1354         if (!nl_combis)
1355                 goto nla_put_failure;
1356
1357         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1358                 const struct ieee80211_iface_combination *c;
1359                 struct nlattr *nl_combi, *nl_limits;
1360
1361                 c = &wiphy->iface_combinations[i];
1362
1363                 nl_combi = nla_nest_start_noflag(msg, i + 1);
1364                 if (!nl_combi)
1365                         goto nla_put_failure;
1366
1367                 nl_limits = nla_nest_start_noflag(msg,
1368                                                   NL80211_IFACE_COMB_LIMITS);
1369                 if (!nl_limits)
1370                         goto nla_put_failure;
1371
1372                 for (j = 0; j < c->n_limits; j++) {
1373                         struct nlattr *nl_limit;
1374
1375                         nl_limit = nla_nest_start_noflag(msg, j + 1);
1376                         if (!nl_limit)
1377                                 goto nla_put_failure;
1378                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1379                                         c->limits[j].max))
1380                                 goto nla_put_failure;
1381                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1382                                                 c->limits[j].types))
1383                                 goto nla_put_failure;
1384                         nla_nest_end(msg, nl_limit);
1385                 }
1386
1387                 nla_nest_end(msg, nl_limits);
1388
1389                 if (c->beacon_int_infra_match &&
1390                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1391                         goto nla_put_failure;
1392                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1393                                 c->num_different_channels) ||
1394                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1395                                 c->max_interfaces))
1396                         goto nla_put_failure;
1397                 if (large &&
1398                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1399                                 c->radar_detect_widths) ||
1400                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1401                                 c->radar_detect_regions)))
1402                         goto nla_put_failure;
1403                 if (c->beacon_int_min_gcd &&
1404                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1405                                 c->beacon_int_min_gcd))
1406                         goto nla_put_failure;
1407
1408                 nla_nest_end(msg, nl_combi);
1409         }
1410
1411         nla_nest_end(msg, nl_combis);
1412
1413         return 0;
1414 nla_put_failure:
1415         return -ENOBUFS;
1416 }
1417
1418 #ifdef CONFIG_PM
1419 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1420                                         struct sk_buff *msg)
1421 {
1422         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1423         struct nlattr *nl_tcp;
1424
1425         if (!tcp)
1426                 return 0;
1427
1428         nl_tcp = nla_nest_start_noflag(msg,
1429                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1430         if (!nl_tcp)
1431                 return -ENOBUFS;
1432
1433         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1434                         tcp->data_payload_max))
1435                 return -ENOBUFS;
1436
1437         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1438                         tcp->data_payload_max))
1439                 return -ENOBUFS;
1440
1441         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1442                 return -ENOBUFS;
1443
1444         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1445                                 sizeof(*tcp->tok), tcp->tok))
1446                 return -ENOBUFS;
1447
1448         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1449                         tcp->data_interval_max))
1450                 return -ENOBUFS;
1451
1452         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1453                         tcp->wake_payload_max))
1454                 return -ENOBUFS;
1455
1456         nla_nest_end(msg, nl_tcp);
1457         return 0;
1458 }
1459
1460 static int nl80211_send_wowlan(struct sk_buff *msg,
1461                                struct cfg80211_registered_device *rdev,
1462                                bool large)
1463 {
1464         struct nlattr *nl_wowlan;
1465
1466         if (!rdev->wiphy.wowlan)
1467                 return 0;
1468
1469         nl_wowlan = nla_nest_start_noflag(msg,
1470                                           NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1471         if (!nl_wowlan)
1472                 return -ENOBUFS;
1473
1474         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1475              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1476             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1477              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1478             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1479              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1480             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1481              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1482             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1483              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1484             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1485              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1486             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1487              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1488             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1489              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1490                 return -ENOBUFS;
1491
1492         if (rdev->wiphy.wowlan->n_patterns) {
1493                 struct nl80211_pattern_support pat = {
1494                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1495                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1496                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1497                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1498                 };
1499
1500                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1501                             sizeof(pat), &pat))
1502                         return -ENOBUFS;
1503         }
1504
1505         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1506             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1507                         rdev->wiphy.wowlan->max_nd_match_sets))
1508                 return -ENOBUFS;
1509
1510         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1511                 return -ENOBUFS;
1512
1513         nla_nest_end(msg, nl_wowlan);
1514
1515         return 0;
1516 }
1517 #endif
1518
1519 static int nl80211_send_coalesce(struct sk_buff *msg,
1520                                  struct cfg80211_registered_device *rdev)
1521 {
1522         struct nl80211_coalesce_rule_support rule;
1523
1524         if (!rdev->wiphy.coalesce)
1525                 return 0;
1526
1527         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1528         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1529         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1530         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1531         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1532         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1533
1534         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1535                 return -ENOBUFS;
1536
1537         return 0;
1538 }
1539
1540 static int
1541 nl80211_send_iftype_data(struct sk_buff *msg,
1542                          const struct ieee80211_sband_iftype_data *iftdata)
1543 {
1544         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1545
1546         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1547                                 iftdata->types_mask))
1548                 return -ENOBUFS;
1549
1550         if (he_cap->has_he) {
1551                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1552                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1553                             he_cap->he_cap_elem.mac_cap_info) ||
1554                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1555                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1556                             he_cap->he_cap_elem.phy_cap_info) ||
1557                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1558                             sizeof(he_cap->he_mcs_nss_supp),
1559                             &he_cap->he_mcs_nss_supp) ||
1560                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1561                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1562                         return -ENOBUFS;
1563         }
1564
1565         return 0;
1566 }
1567
1568 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1569                                       struct ieee80211_supported_band *sband)
1570 {
1571         struct nlattr *nl_rates, *nl_rate;
1572         struct ieee80211_rate *rate;
1573         int i;
1574
1575         /* add HT info */
1576         if (sband->ht_cap.ht_supported &&
1577             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1578                      sizeof(sband->ht_cap.mcs),
1579                      &sband->ht_cap.mcs) ||
1580              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1581                          sband->ht_cap.cap) ||
1582              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1583                         sband->ht_cap.ampdu_factor) ||
1584              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1585                         sband->ht_cap.ampdu_density)))
1586                 return -ENOBUFS;
1587
1588         /* add VHT info */
1589         if (sband->vht_cap.vht_supported &&
1590             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1591                      sizeof(sband->vht_cap.vht_mcs),
1592                      &sband->vht_cap.vht_mcs) ||
1593              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1594                          sband->vht_cap.cap)))
1595                 return -ENOBUFS;
1596
1597         if (sband->n_iftype_data) {
1598                 struct nlattr *nl_iftype_data =
1599                         nla_nest_start_noflag(msg,
1600                                               NL80211_BAND_ATTR_IFTYPE_DATA);
1601                 int err;
1602
1603                 if (!nl_iftype_data)
1604                         return -ENOBUFS;
1605
1606                 for (i = 0; i < sband->n_iftype_data; i++) {
1607                         struct nlattr *iftdata;
1608
1609                         iftdata = nla_nest_start_noflag(msg, i + 1);
1610                         if (!iftdata)
1611                                 return -ENOBUFS;
1612
1613                         err = nl80211_send_iftype_data(msg,
1614                                                        &sband->iftype_data[i]);
1615                         if (err)
1616                                 return err;
1617
1618                         nla_nest_end(msg, iftdata);
1619                 }
1620
1621                 nla_nest_end(msg, nl_iftype_data);
1622         }
1623
1624         /* add EDMG info */
1625         if (sband->edmg_cap.channels &&
1626             (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
1627                        sband->edmg_cap.channels) ||
1628             nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
1629                        sband->edmg_cap.bw_config)))
1630
1631                 return -ENOBUFS;
1632
1633         /* add bitrates */
1634         nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1635         if (!nl_rates)
1636                 return -ENOBUFS;
1637
1638         for (i = 0; i < sband->n_bitrates; i++) {
1639                 nl_rate = nla_nest_start_noflag(msg, i);
1640                 if (!nl_rate)
1641                         return -ENOBUFS;
1642
1643                 rate = &sband->bitrates[i];
1644                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1645                                 rate->bitrate))
1646                         return -ENOBUFS;
1647                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1648                     nla_put_flag(msg,
1649                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1650                         return -ENOBUFS;
1651
1652                 nla_nest_end(msg, nl_rate);
1653         }
1654
1655         nla_nest_end(msg, nl_rates);
1656
1657         return 0;
1658 }
1659
1660 static int
1661 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1662                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1663 {
1664         u16 stypes;
1665         struct nlattr *nl_ftypes, *nl_ifs;
1666         enum nl80211_iftype ift;
1667         int i;
1668
1669         if (!mgmt_stypes)
1670                 return 0;
1671
1672         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
1673         if (!nl_ifs)
1674                 return -ENOBUFS;
1675
1676         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1677                 nl_ftypes = nla_nest_start_noflag(msg, ift);
1678                 if (!nl_ftypes)
1679                         return -ENOBUFS;
1680                 i = 0;
1681                 stypes = mgmt_stypes[ift].tx;
1682                 while (stypes) {
1683                         if ((stypes & 1) &&
1684                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1685                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1686                                 return -ENOBUFS;
1687                         stypes >>= 1;
1688                         i++;
1689                 }
1690                 nla_nest_end(msg, nl_ftypes);
1691         }
1692
1693         nla_nest_end(msg, nl_ifs);
1694
1695         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
1696         if (!nl_ifs)
1697                 return -ENOBUFS;
1698
1699         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1700                 nl_ftypes = nla_nest_start_noflag(msg, ift);
1701                 if (!nl_ftypes)
1702                         return -ENOBUFS;
1703                 i = 0;
1704                 stypes = mgmt_stypes[ift].rx;
1705                 while (stypes) {
1706                         if ((stypes & 1) &&
1707                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1708                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1709                                 return -ENOBUFS;
1710                         stypes >>= 1;
1711                         i++;
1712                 }
1713                 nla_nest_end(msg, nl_ftypes);
1714         }
1715         nla_nest_end(msg, nl_ifs);
1716
1717         return 0;
1718 }
1719
1720 #define CMD(op, n)                                                      \
1721          do {                                                           \
1722                 if (rdev->ops->op) {                                    \
1723                         i++;                                            \
1724                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1725                                 goto nla_put_failure;                   \
1726                 }                                                       \
1727         } while (0)
1728
1729 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1730                                         struct sk_buff *msg)
1731 {
1732         int i = 0;
1733
1734         /*
1735          * do *NOT* add anything into this function, new things need to be
1736          * advertised only to new versions of userspace that can deal with
1737          * the split (and they can't possibly care about new features...
1738          */
1739         CMD(add_virtual_intf, NEW_INTERFACE);
1740         CMD(change_virtual_intf, SET_INTERFACE);
1741         CMD(add_key, NEW_KEY);
1742         CMD(start_ap, START_AP);
1743         CMD(add_station, NEW_STATION);
1744         CMD(add_mpath, NEW_MPATH);
1745         CMD(update_mesh_config, SET_MESH_CONFIG);
1746         CMD(change_bss, SET_BSS);
1747         CMD(auth, AUTHENTICATE);
1748         CMD(assoc, ASSOCIATE);
1749         CMD(deauth, DEAUTHENTICATE);
1750         CMD(disassoc, DISASSOCIATE);
1751         CMD(join_ibss, JOIN_IBSS);
1752         CMD(join_mesh, JOIN_MESH);
1753         CMD(set_pmksa, SET_PMKSA);
1754         CMD(del_pmksa, DEL_PMKSA);
1755         CMD(flush_pmksa, FLUSH_PMKSA);
1756         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1757                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1758         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1759         CMD(mgmt_tx, FRAME);
1760         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1761         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1762                 i++;
1763                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1764                         goto nla_put_failure;
1765         }
1766         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1767             rdev->ops->join_mesh) {
1768                 i++;
1769                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1770                         goto nla_put_failure;
1771         }
1772         CMD(set_wds_peer, SET_WDS_PEER);
1773         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1774                 CMD(tdls_mgmt, TDLS_MGMT);
1775                 CMD(tdls_oper, TDLS_OPER);
1776         }
1777         if (rdev->wiphy.max_sched_scan_reqs)
1778                 CMD(sched_scan_start, START_SCHED_SCAN);
1779         CMD(probe_client, PROBE_CLIENT);
1780         CMD(set_noack_map, SET_NOACK_MAP);
1781         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1782                 i++;
1783                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1784                         goto nla_put_failure;
1785         }
1786         CMD(start_p2p_device, START_P2P_DEVICE);
1787         CMD(set_mcast_rate, SET_MCAST_RATE);
1788 #ifdef CONFIG_NL80211_TESTMODE
1789         CMD(testmode_cmd, TESTMODE);
1790 #endif
1791
1792         if (rdev->ops->connect || rdev->ops->auth) {
1793                 i++;
1794                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1795                         goto nla_put_failure;
1796         }
1797
1798         if (rdev->ops->disconnect || rdev->ops->deauth) {
1799                 i++;
1800                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1801                         goto nla_put_failure;
1802         }
1803
1804         return i;
1805  nla_put_failure:
1806         return -ENOBUFS;
1807 }
1808
1809 static int
1810 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
1811                            struct sk_buff *msg)
1812 {
1813         struct nlattr *ftm;
1814
1815         if (!cap->ftm.supported)
1816                 return 0;
1817
1818         ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
1819         if (!ftm)
1820                 return -ENOBUFS;
1821
1822         if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
1823                 return -ENOBUFS;
1824         if (cap->ftm.non_asap &&
1825             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
1826                 return -ENOBUFS;
1827         if (cap->ftm.request_lci &&
1828             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
1829                 return -ENOBUFS;
1830         if (cap->ftm.request_civicloc &&
1831             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
1832                 return -ENOBUFS;
1833         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
1834                         cap->ftm.preambles))
1835                 return -ENOBUFS;
1836         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
1837                         cap->ftm.bandwidths))
1838                 return -ENOBUFS;
1839         if (cap->ftm.max_bursts_exponent >= 0 &&
1840             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
1841                         cap->ftm.max_bursts_exponent))
1842                 return -ENOBUFS;
1843         if (cap->ftm.max_ftms_per_burst &&
1844             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
1845                         cap->ftm.max_ftms_per_burst))
1846                 return -ENOBUFS;
1847
1848         nla_nest_end(msg, ftm);
1849         return 0;
1850 }
1851
1852 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
1853                                   struct sk_buff *msg)
1854 {
1855         const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
1856         struct nlattr *pmsr, *caps;
1857
1858         if (!cap)
1859                 return 0;
1860
1861         /*
1862          * we don't need to clean up anything here since the caller
1863          * will genlmsg_cancel() if we fail
1864          */
1865
1866         pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
1867         if (!pmsr)
1868                 return -ENOBUFS;
1869
1870         if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
1871                 return -ENOBUFS;
1872
1873         if (cap->report_ap_tsf &&
1874             nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
1875                 return -ENOBUFS;
1876
1877         if (cap->randomize_mac_addr &&
1878             nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
1879                 return -ENOBUFS;
1880
1881         caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
1882         if (!caps)
1883                 return -ENOBUFS;
1884
1885         if (nl80211_send_pmsr_ftm_capa(cap, msg))
1886                 return -ENOBUFS;
1887
1888         nla_nest_end(msg, caps);
1889         nla_nest_end(msg, pmsr);
1890
1891         return 0;
1892 }
1893
1894 struct nl80211_dump_wiphy_state {
1895         s64 filter_wiphy;
1896         long start;
1897         long split_start, band_start, chan_start, capa_start;
1898         bool split;
1899 };
1900
1901 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1902                               enum nl80211_commands cmd,
1903                               struct sk_buff *msg, u32 portid, u32 seq,
1904                               int flags, struct nl80211_dump_wiphy_state *state)
1905 {
1906         void *hdr;
1907         struct nlattr *nl_bands, *nl_band;
1908         struct nlattr *nl_freqs, *nl_freq;
1909         struct nlattr *nl_cmds;
1910         enum nl80211_band band;
1911         struct ieee80211_channel *chan;
1912         int i;
1913         const struct ieee80211_txrx_stypes *mgmt_stypes =
1914                                 rdev->wiphy.mgmt_stypes;
1915         u32 features;
1916
1917         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1918         if (!hdr)
1919                 return -ENOBUFS;
1920
1921         if (WARN_ON(!state))
1922                 return -EINVAL;
1923
1924         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1925             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1926                            wiphy_name(&rdev->wiphy)) ||
1927             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1928                         cfg80211_rdev_list_generation))
1929                 goto nla_put_failure;
1930
1931         if (cmd != NL80211_CMD_NEW_WIPHY)
1932                 goto finish;
1933
1934         switch (state->split_start) {
1935         case 0:
1936                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1937                                rdev->wiphy.retry_short) ||
1938                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1939                                rdev->wiphy.retry_long) ||
1940                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1941                                 rdev->wiphy.frag_threshold) ||
1942                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1943                                 rdev->wiphy.rts_threshold) ||
1944                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1945                                rdev->wiphy.coverage_class) ||
1946                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1947                                rdev->wiphy.max_scan_ssids) ||
1948                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1949                                rdev->wiphy.max_sched_scan_ssids) ||
1950                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1951                                 rdev->wiphy.max_scan_ie_len) ||
1952                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1953                                 rdev->wiphy.max_sched_scan_ie_len) ||
1954                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1955                                rdev->wiphy.max_match_sets) ||
1956                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1957                                 rdev->wiphy.max_sched_scan_plans) ||
1958                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1959                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1960                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1961                                 rdev->wiphy.max_sched_scan_plan_iterations))
1962                         goto nla_put_failure;
1963
1964                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1965                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1966                         goto nla_put_failure;
1967                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1968                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1969                         goto nla_put_failure;
1970                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1971                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1972                         goto nla_put_failure;
1973                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1974                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1975                         goto nla_put_failure;
1976                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1977                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1978                         goto nla_put_failure;
1979                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1980                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1981                         goto nla_put_failure;
1982                 state->split_start++;
1983                 if (state->split)
1984                         break;
1985                 /* fall through */
1986         case 1:
1987                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1988                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1989                             rdev->wiphy.cipher_suites))
1990                         goto nla_put_failure;
1991
1992                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1993                                rdev->wiphy.max_num_pmkids))
1994                         goto nla_put_failure;
1995
1996                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1997                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1998                         goto nla_put_failure;
1999
2000                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2001                                 rdev->wiphy.available_antennas_tx) ||
2002                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2003                                 rdev->wiphy.available_antennas_rx))
2004                         goto nla_put_failure;
2005
2006                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2007                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2008                                 rdev->wiphy.probe_resp_offload))
2009                         goto nla_put_failure;
2010
2011                 if ((rdev->wiphy.available_antennas_tx ||
2012                      rdev->wiphy.available_antennas_rx) &&
2013                     rdev->ops->get_antenna) {
2014                         u32 tx_ant = 0, rx_ant = 0;
2015                         int res;
2016
2017                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2018                         if (!res) {
2019                                 if (nla_put_u32(msg,
2020                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
2021                                                 tx_ant) ||
2022                                     nla_put_u32(msg,
2023                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
2024                                                 rx_ant))
2025                                         goto nla_put_failure;
2026                         }
2027                 }
2028
2029                 state->split_start++;
2030                 if (state->split)
2031                         break;
2032                 /* fall through */
2033         case 2:
2034                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2035                                         rdev->wiphy.interface_modes))
2036                                 goto nla_put_failure;
2037                 state->split_start++;
2038                 if (state->split)
2039                         break;
2040                 /* fall through */
2041         case 3:
2042                 nl_bands = nla_nest_start_noflag(msg,
2043                                                  NL80211_ATTR_WIPHY_BANDS);
2044                 if (!nl_bands)
2045                         goto nla_put_failure;
2046
2047                 for (band = state->band_start;
2048                      band < NUM_NL80211_BANDS; band++) {
2049                         struct ieee80211_supported_band *sband;
2050
2051                         sband = rdev->wiphy.bands[band];
2052
2053                         if (!sband)
2054                                 continue;
2055
2056                         nl_band = nla_nest_start_noflag(msg, band);
2057                         if (!nl_band)
2058                                 goto nla_put_failure;
2059
2060                         switch (state->chan_start) {
2061                         case 0:
2062                                 if (nl80211_send_band_rateinfo(msg, sband))
2063                                         goto nla_put_failure;
2064                                 state->chan_start++;
2065                                 if (state->split)
2066                                         break;
2067                                 /* fall through */
2068                         default:
2069                                 /* add frequencies */
2070                                 nl_freqs = nla_nest_start_noflag(msg,
2071                                                                  NL80211_BAND_ATTR_FREQS);
2072                                 if (!nl_freqs)
2073                                         goto nla_put_failure;
2074
2075                                 for (i = state->chan_start - 1;
2076                                      i < sband->n_channels;
2077                                      i++) {
2078                                         nl_freq = nla_nest_start_noflag(msg,
2079                                                                         i);
2080                                         if (!nl_freq)
2081                                                 goto nla_put_failure;
2082
2083                                         chan = &sband->channels[i];
2084
2085                                         if (nl80211_msg_put_channel(
2086                                                         msg, &rdev->wiphy, chan,
2087                                                         state->split))
2088                                                 goto nla_put_failure;
2089
2090                                         nla_nest_end(msg, nl_freq);
2091                                         if (state->split)
2092                                                 break;
2093                                 }
2094                                 if (i < sband->n_channels)
2095                                         state->chan_start = i + 2;
2096                                 else
2097                                         state->chan_start = 0;
2098                                 nla_nest_end(msg, nl_freqs);
2099                         }
2100
2101                         nla_nest_end(msg, nl_band);
2102
2103                         if (state->split) {
2104                                 /* start again here */
2105                                 if (state->chan_start)
2106                                         band--;
2107                                 break;
2108                         }
2109                 }
2110                 nla_nest_end(msg, nl_bands);
2111
2112                 if (band < NUM_NL80211_BANDS)
2113                         state->band_start = band + 1;
2114                 else
2115                         state->band_start = 0;
2116
2117                 /* if bands & channels are done, continue outside */
2118                 if (state->band_start == 0 && state->chan_start == 0)
2119                         state->split_start++;
2120                 if (state->split)
2121                         break;
2122                 /* fall through */
2123         case 4:
2124                 nl_cmds = nla_nest_start_noflag(msg,
2125                                                 NL80211_ATTR_SUPPORTED_COMMANDS);
2126                 if (!nl_cmds)
2127                         goto nla_put_failure;
2128
2129                 i = nl80211_add_commands_unsplit(rdev, msg);
2130                 if (i < 0)
2131                         goto nla_put_failure;
2132                 if (state->split) {
2133                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
2134                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2135                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2136                                 CMD(channel_switch, CHANNEL_SWITCH);
2137                         CMD(set_qos_map, SET_QOS_MAP);
2138                         if (rdev->wiphy.features &
2139                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2140                                 CMD(add_tx_ts, ADD_TX_TS);
2141                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2142                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2143                         CMD(update_ft_ies, UPDATE_FT_IES);
2144                 }
2145 #undef CMD
2146
2147                 nla_nest_end(msg, nl_cmds);
2148                 state->split_start++;
2149                 if (state->split)
2150                         break;
2151                 /* fall through */
2152         case 5:
2153                 if (rdev->ops->remain_on_channel &&
2154                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2155                     nla_put_u32(msg,
2156                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2157                                 rdev->wiphy.max_remain_on_channel_duration))
2158                         goto nla_put_failure;
2159
2160                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2161                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2162                         goto nla_put_failure;
2163
2164                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2165                         goto nla_put_failure;
2166                 state->split_start++;
2167                 if (state->split)
2168                         break;
2169                 /* fall through */
2170         case 6:
2171 #ifdef CONFIG_PM
2172                 if (nl80211_send_wowlan(msg, rdev, state->split))
2173                         goto nla_put_failure;
2174                 state->split_start++;
2175                 if (state->split)
2176                         break;
2177 #else
2178                 state->split_start++;
2179 #endif
2180                 /* fall through */
2181         case 7:
2182                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2183                                         rdev->wiphy.software_iftypes))
2184                         goto nla_put_failure;
2185
2186                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2187                                                    state->split))
2188                         goto nla_put_failure;
2189
2190                 state->split_start++;
2191                 if (state->split)
2192                         break;
2193                 /* fall through */
2194         case 8:
2195                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2196                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2197                                 rdev->wiphy.ap_sme_capa))
2198                         goto nla_put_failure;
2199
2200                 features = rdev->wiphy.features;
2201                 /*
2202                  * We can only add the per-channel limit information if the
2203                  * dump is split, otherwise it makes it too big. Therefore
2204                  * only advertise it in that case.
2205                  */
2206                 if (state->split)
2207                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2208                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2209                         goto nla_put_failure;
2210
2211                 if (rdev->wiphy.ht_capa_mod_mask &&
2212                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2213                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
2214                             rdev->wiphy.ht_capa_mod_mask))
2215                         goto nla_put_failure;
2216
2217                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2218                     rdev->wiphy.max_acl_mac_addrs &&
2219                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2220                                 rdev->wiphy.max_acl_mac_addrs))
2221                         goto nla_put_failure;
2222
2223                 /*
2224                  * Any information below this point is only available to
2225                  * applications that can deal with it being split. This
2226                  * helps ensure that newly added capabilities don't break
2227                  * older tools by overrunning their buffers.
2228                  *
2229                  * We still increment split_start so that in the split
2230                  * case we'll continue with more data in the next round,
2231                  * but break unconditionally so unsplit data stops here.
2232                  */
2233                 state->split_start++;
2234                 break;
2235         case 9:
2236                 if (rdev->wiphy.extended_capabilities &&
2237                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2238                              rdev->wiphy.extended_capabilities_len,
2239                              rdev->wiphy.extended_capabilities) ||
2240                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2241                              rdev->wiphy.extended_capabilities_len,
2242                              rdev->wiphy.extended_capabilities_mask)))
2243                         goto nla_put_failure;
2244
2245                 if (rdev->wiphy.vht_capa_mod_mask &&
2246                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2247                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
2248                             rdev->wiphy.vht_capa_mod_mask))
2249                         goto nla_put_failure;
2250
2251                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2252                             rdev->wiphy.perm_addr))
2253                         goto nla_put_failure;
2254
2255                 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2256                     nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2257                             rdev->wiphy.addr_mask))
2258                         goto nla_put_failure;
2259
2260                 if (rdev->wiphy.n_addresses > 1) {
2261                         void *attr;
2262
2263                         attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2264                         if (!attr)
2265                                 goto nla_put_failure;
2266
2267                         for (i = 0; i < rdev->wiphy.n_addresses; i++)
2268                                 if (nla_put(msg, i + 1, ETH_ALEN,
2269                                             rdev->wiphy.addresses[i].addr))
2270                                         goto nla_put_failure;
2271
2272                         nla_nest_end(msg, attr);
2273                 }
2274
2275                 state->split_start++;
2276                 break;
2277         case 10:
2278                 if (nl80211_send_coalesce(msg, rdev))
2279                         goto nla_put_failure;
2280
2281                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2282                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2283                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2284                         goto nla_put_failure;
2285
2286                 if (rdev->wiphy.max_ap_assoc_sta &&
2287                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2288                                 rdev->wiphy.max_ap_assoc_sta))
2289                         goto nla_put_failure;
2290
2291                 state->split_start++;
2292                 break;
2293         case 11:
2294                 if (rdev->wiphy.n_vendor_commands) {
2295                         const struct nl80211_vendor_cmd_info *info;
2296                         struct nlattr *nested;
2297
2298                         nested = nla_nest_start_noflag(msg,
2299                                                        NL80211_ATTR_VENDOR_DATA);
2300                         if (!nested)
2301                                 goto nla_put_failure;
2302
2303                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2304                                 info = &rdev->wiphy.vendor_commands[i].info;
2305                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2306                                         goto nla_put_failure;
2307                         }
2308                         nla_nest_end(msg, nested);
2309                 }
2310
2311                 if (rdev->wiphy.n_vendor_events) {
2312                         const struct nl80211_vendor_cmd_info *info;
2313                         struct nlattr *nested;
2314
2315                         nested = nla_nest_start_noflag(msg,
2316                                                        NL80211_ATTR_VENDOR_EVENTS);
2317                         if (!nested)
2318                                 goto nla_put_failure;
2319
2320                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2321                                 info = &rdev->wiphy.vendor_events[i];
2322                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2323                                         goto nla_put_failure;
2324                         }
2325                         nla_nest_end(msg, nested);
2326                 }
2327                 state->split_start++;
2328                 break;
2329         case 12:
2330                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2331                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2332                                rdev->wiphy.max_num_csa_counters))
2333                         goto nla_put_failure;
2334
2335                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2336                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2337                         goto nla_put_failure;
2338
2339                 if (rdev->wiphy.max_sched_scan_reqs &&
2340                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2341                                 rdev->wiphy.max_sched_scan_reqs))
2342                         goto nla_put_failure;
2343
2344                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2345                             sizeof(rdev->wiphy.ext_features),
2346                             rdev->wiphy.ext_features))
2347                         goto nla_put_failure;
2348
2349                 if (rdev->wiphy.bss_select_support) {
2350                         struct nlattr *nested;
2351                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2352
2353                         nested = nla_nest_start_noflag(msg,
2354                                                        NL80211_ATTR_BSS_SELECT);
2355                         if (!nested)
2356                                 goto nla_put_failure;
2357
2358                         i = 0;
2359                         while (bss_select_support) {
2360                                 if ((bss_select_support & 1) &&
2361                                     nla_put_flag(msg, i))
2362                                         goto nla_put_failure;
2363                                 i++;
2364                                 bss_select_support >>= 1;
2365                         }
2366                         nla_nest_end(msg, nested);
2367                 }
2368
2369                 state->split_start++;
2370                 break;
2371         case 13:
2372                 if (rdev->wiphy.num_iftype_ext_capab &&
2373                     rdev->wiphy.iftype_ext_capab) {
2374                         struct nlattr *nested_ext_capab, *nested;
2375
2376                         nested = nla_nest_start_noflag(msg,
2377                                                        NL80211_ATTR_IFTYPE_EXT_CAPA);
2378                         if (!nested)
2379                                 goto nla_put_failure;
2380
2381                         for (i = state->capa_start;
2382                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2383                                 const struct wiphy_iftype_ext_capab *capab;
2384
2385                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2386
2387                                 nested_ext_capab = nla_nest_start_noflag(msg,
2388                                                                          i);
2389                                 if (!nested_ext_capab ||
2390                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2391                                                 capab->iftype) ||
2392                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2393                                             capab->extended_capabilities_len,
2394                                             capab->extended_capabilities) ||
2395                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2396                                             capab->extended_capabilities_len,
2397                                             capab->extended_capabilities_mask))
2398                                         goto nla_put_failure;
2399
2400                                 nla_nest_end(msg, nested_ext_capab);
2401                                 if (state->split)
2402                                         break;
2403                         }
2404                         nla_nest_end(msg, nested);
2405                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2406                                 state->capa_start = i + 1;
2407                                 break;
2408                         }
2409                 }
2410
2411                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2412                                 rdev->wiphy.nan_supported_bands))
2413                         goto nla_put_failure;
2414
2415                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2416                                             NL80211_EXT_FEATURE_TXQS)) {
2417                         struct cfg80211_txq_stats txqstats = {};
2418                         int res;
2419
2420                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2421                         if (!res &&
2422                             !nl80211_put_txq_stats(msg, &txqstats,
2423                                                    NL80211_ATTR_TXQ_STATS))
2424                                 goto nla_put_failure;
2425
2426                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2427                                         rdev->wiphy.txq_limit))
2428                                 goto nla_put_failure;
2429                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2430                                         rdev->wiphy.txq_memory_limit))
2431                                 goto nla_put_failure;
2432                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2433                                         rdev->wiphy.txq_quantum))
2434                                 goto nla_put_failure;
2435                 }
2436
2437                 state->split_start++;
2438                 break;
2439         case 14:
2440                 if (nl80211_send_pmsr_capa(rdev, msg))
2441                         goto nla_put_failure;
2442
2443                 state->split_start++;
2444                 break;
2445         case 15:
2446                 if (rdev->wiphy.akm_suites &&
2447                     nla_put(msg, NL80211_ATTR_AKM_SUITES,
2448                             sizeof(u32) * rdev->wiphy.n_akm_suites,
2449                             rdev->wiphy.akm_suites))
2450                         goto nla_put_failure;
2451
2452                 /* done */
2453                 state->split_start = 0;
2454                 break;
2455         }
2456  finish:
2457         genlmsg_end(msg, hdr);
2458         return 0;
2459
2460  nla_put_failure:
2461         genlmsg_cancel(msg, hdr);
2462         return -EMSGSIZE;
2463 }
2464
2465 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2466                                     struct netlink_callback *cb,
2467                                     struct nl80211_dump_wiphy_state *state)
2468 {
2469         struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
2470         int ret;
2471
2472         if (!tb)
2473                 return -ENOMEM;
2474
2475         ret = nlmsg_parse_deprecated(cb->nlh,
2476                                      GENL_HDRLEN + nl80211_fam.hdrsize,
2477                                      tb, nl80211_fam.maxattr,
2478                                      nl80211_policy, NULL);
2479         /* ignore parse errors for backward compatibility */
2480         if (ret) {
2481                 ret = 0;
2482                 goto out;
2483         }
2484
2485         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2486         if (tb[NL80211_ATTR_WIPHY])
2487                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2488         if (tb[NL80211_ATTR_WDEV])
2489                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2490         if (tb[NL80211_ATTR_IFINDEX]) {
2491                 struct net_device *netdev;
2492                 struct cfg80211_registered_device *rdev;
2493                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2494
2495                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2496                 if (!netdev) {
2497                         ret = -ENODEV;
2498                         goto out;
2499                 }
2500                 if (netdev->ieee80211_ptr) {
2501                         rdev = wiphy_to_rdev(
2502                                 netdev->ieee80211_ptr->wiphy);
2503                         state->filter_wiphy = rdev->wiphy_idx;
2504                 }
2505         }
2506
2507         ret = 0;
2508 out:
2509         kfree(tb);
2510         return ret;
2511 }
2512
2513 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2514 {
2515         int idx = 0, ret;
2516         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2517         struct cfg80211_registered_device *rdev;
2518
2519         rtnl_lock();
2520         if (!state) {
2521                 state = kzalloc(sizeof(*state), GFP_KERNEL);
2522                 if (!state) {
2523                         rtnl_unlock();
2524                         return -ENOMEM;
2525                 }
2526                 state->filter_wiphy = -1;
2527                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2528                 if (ret) {
2529                         kfree(state);
2530                         rtnl_unlock();
2531                         return ret;
2532                 }
2533                 cb->args[0] = (long)state;
2534         }
2535
2536         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2537                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2538                         continue;
2539                 if (++idx <= state->start)
2540                         continue;
2541                 if (state->filter_wiphy != -1 &&
2542                     state->filter_wiphy != rdev->wiphy_idx)
2543                         continue;
2544                 /* attempt to fit multiple wiphy data chunks into the skb */
2545                 do {
2546                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2547                                                  skb,
2548                                                  NETLINK_CB(cb->skb).portid,
2549                                                  cb->nlh->nlmsg_seq,
2550                                                  NLM_F_MULTI, state);
2551                         if (ret < 0) {
2552                                 /*
2553                                  * If sending the wiphy data didn't fit (ENOBUFS
2554                                  * or EMSGSIZE returned), this SKB is still
2555                                  * empty (so it's not too big because another
2556                                  * wiphy dataset is already in the skb) and
2557                                  * we've not tried to adjust the dump allocation
2558                                  * yet ... then adjust the alloc size to be
2559                                  * bigger, and return 1 but with the empty skb.
2560                                  * This results in an empty message being RX'ed
2561                                  * in userspace, but that is ignored.
2562                                  *
2563                                  * We can then retry with the larger buffer.
2564                                  */
2565                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2566                                     !skb->len && !state->split &&
2567                                     cb->min_dump_alloc < 4096) {
2568                                         cb->min_dump_alloc = 4096;
2569                                         state->split_start = 0;
2570                                         rtnl_unlock();
2571                                         return 1;
2572                                 }
2573                                 idx--;
2574                                 break;
2575                         }
2576                 } while (state->split_start > 0);
2577                 break;
2578         }
2579         rtnl_unlock();
2580
2581         state->start = idx;
2582
2583         return skb->len;
2584 }
2585
2586 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2587 {
2588         kfree((void *)cb->args[0]);
2589         return 0;
2590 }
2591
2592 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2593 {
2594         struct sk_buff *msg;
2595         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2596         struct nl80211_dump_wiphy_state state = {};
2597
2598         msg = nlmsg_new(4096, GFP_KERNEL);
2599         if (!msg)
2600                 return -ENOMEM;
2601
2602         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2603                                info->snd_portid, info->snd_seq, 0,
2604                                &state) < 0) {
2605                 nlmsg_free(msg);
2606                 return -ENOBUFS;
2607         }
2608
2609         return genlmsg_reply(msg, info);
2610 }
2611
2612 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2613         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2614         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2615         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2616         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2617         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2618 };
2619
2620 static int parse_txq_params(struct nlattr *tb[],
2621                             struct ieee80211_txq_params *txq_params)
2622 {
2623         u8 ac;
2624
2625         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2626             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2627             !tb[NL80211_TXQ_ATTR_AIFS])
2628                 return -EINVAL;
2629
2630         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2631         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2632         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2633         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2634         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2635
2636         if (ac >= NL80211_NUM_ACS)
2637                 return -EINVAL;
2638         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2639         return 0;
2640 }
2641
2642 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2643 {
2644         /*
2645          * You can only set the channel explicitly for WDS interfaces,
2646          * all others have their channel managed via their respective
2647          * "establish a connection" command (connect, join, ...)
2648          *
2649          * For AP/GO and mesh mode, the channel can be set with the
2650          * channel userspace API, but is only stored and passed to the
2651          * low-level driver when the AP starts or the mesh is joined.
2652          * This is for backward compatibility, userspace can also give
2653          * the channel in the start-ap or join-mesh commands instead.
2654          *
2655          * Monitors are special as they are normally slaved to
2656          * whatever else is going on, so they have their own special
2657          * operation to set the monitor channel if possible.
2658          */
2659         return !wdev ||
2660                 wdev->iftype == NL80211_IFTYPE_AP ||
2661                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2662                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2663                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2664 }
2665
2666 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2667                           struct genl_info *info,
2668                           struct cfg80211_chan_def *chandef)
2669 {
2670         struct netlink_ext_ack *extack = info->extack;
2671         struct nlattr **attrs = info->attrs;
2672         u32 control_freq;
2673
2674         if (!attrs[NL80211_ATTR_WIPHY_FREQ])
2675                 return -EINVAL;
2676
2677         control_freq = nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]);
2678
2679         memset(chandef, 0, sizeof(*chandef));
2680
2681         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2682         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2683         chandef->center_freq1 = control_freq;
2684         chandef->center_freq2 = 0;
2685
2686         /* Primary channel not allowed */
2687         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
2688                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
2689                                     "Channel is disabled");
2690                 return -EINVAL;
2691         }
2692
2693         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2694                 enum nl80211_channel_type chantype;
2695
2696                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2697
2698                 switch (chantype) {
2699                 case NL80211_CHAN_NO_HT:
2700                 case NL80211_CHAN_HT20:
2701                 case NL80211_CHAN_HT40PLUS:
2702                 case NL80211_CHAN_HT40MINUS:
2703                         cfg80211_chandef_create(chandef, chandef->chan,
2704                                                 chantype);
2705                         /* user input for center_freq is incorrect */
2706                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
2707                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
2708                                 NL_SET_ERR_MSG_ATTR(extack,
2709                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
2710                                                     "bad center frequency 1");
2711                                 return -EINVAL;
2712                         }
2713                         /* center_freq2 must be zero */
2714                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
2715                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
2716                                 NL_SET_ERR_MSG_ATTR(extack,
2717                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
2718                                                     "center frequency 2 can't be used");
2719                                 return -EINVAL;
2720                         }
2721                         break;
2722                 default:
2723                         NL_SET_ERR_MSG_ATTR(extack,
2724                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
2725                                             "invalid channel type");
2726                         return -EINVAL;
2727                 }
2728         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2729                 chandef->width =
2730                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2731                 if (attrs[NL80211_ATTR_CENTER_FREQ1])
2732                         chandef->center_freq1 =
2733                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
2734                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
2735                         chandef->center_freq2 =
2736                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
2737         }
2738
2739         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
2740                 chandef->edmg.channels =
2741                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
2742
2743                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
2744                         chandef->edmg.bw_config =
2745                      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
2746         } else {
2747                 chandef->edmg.bw_config = 0;
2748                 chandef->edmg.channels = 0;
2749         }
2750
2751         if (!cfg80211_chandef_valid(chandef)) {
2752                 NL_SET_ERR_MSG(extack, "invalid channel definition");
2753                 return -EINVAL;
2754         }
2755
2756         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2757                                      IEEE80211_CHAN_DISABLED)) {
2758                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
2759                 return -EINVAL;
2760         }
2761
2762         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2763              chandef->width == NL80211_CHAN_WIDTH_10) &&
2764             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
2765                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
2766                 return -EINVAL;
2767         }
2768
2769         return 0;
2770 }
2771
2772 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2773                                  struct net_device *dev,
2774                                  struct genl_info *info)
2775 {
2776         struct cfg80211_chan_def chandef;
2777         int result;
2778         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2779         struct wireless_dev *wdev = NULL;
2780
2781         if (dev)
2782                 wdev = dev->ieee80211_ptr;
2783         if (!nl80211_can_set_dev_channel(wdev))
2784                 return -EOPNOTSUPP;
2785         if (wdev)
2786                 iftype = wdev->iftype;
2787
2788         result = nl80211_parse_chandef(rdev, info, &chandef);
2789         if (result)
2790                 return result;
2791
2792         switch (iftype) {
2793         case NL80211_IFTYPE_AP:
2794         case NL80211_IFTYPE_P2P_GO:
2795                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2796                                                    iftype)) {
2797                         result = -EINVAL;
2798                         break;
2799                 }
2800                 if (wdev->beacon_interval) {
2801                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2802                             !(rdev->wiphy.features &
2803                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2804                                 result = -EBUSY;
2805                                 break;
2806                         }
2807
2808                         /* Only allow dynamic channel width changes */
2809                         if (chandef.chan != wdev->preset_chandef.chan) {
2810                                 result = -EBUSY;
2811                                 break;
2812                         }
2813                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2814                         if (result)
2815                                 break;
2816                 }
2817                 wdev->preset_chandef = chandef;
2818                 result = 0;
2819                 break;
2820         case NL80211_IFTYPE_MESH_POINT:
2821                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2822                 break;
2823         case NL80211_IFTYPE_MONITOR:
2824                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2825                 break;
2826         default:
2827                 result = -EINVAL;
2828         }
2829
2830         return result;
2831 }
2832
2833 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2834 {
2835         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2836         struct net_device *netdev = info->user_ptr[1];
2837
2838         return __nl80211_set_channel(rdev, netdev, info);
2839 }
2840
2841 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2842 {
2843         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2844         struct net_device *dev = info->user_ptr[1];
2845         struct wireless_dev *wdev = dev->ieee80211_ptr;
2846         const u8 *bssid;
2847
2848         if (!info->attrs[NL80211_ATTR_MAC])
2849                 return -EINVAL;
2850
2851         if (netif_running(dev))
2852                 return -EBUSY;
2853
2854         if (!rdev->ops->set_wds_peer)
2855                 return -EOPNOTSUPP;
2856
2857         if (wdev->iftype != NL80211_IFTYPE_WDS)
2858                 return -EOPNOTSUPP;
2859
2860         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2861         return rdev_set_wds_peer(rdev, dev, bssid);
2862 }
2863
2864 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2865 {
2866         struct cfg80211_registered_device *rdev;
2867         struct net_device *netdev = NULL;
2868         struct wireless_dev *wdev;
2869         int result = 0, rem_txq_params = 0;
2870         struct nlattr *nl_txq_params;
2871         u32 changed;
2872         u8 retry_short = 0, retry_long = 0;
2873         u32 frag_threshold = 0, rts_threshold = 0;
2874         u8 coverage_class = 0;
2875         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
2876
2877         ASSERT_RTNL();
2878
2879         /*
2880          * Try to find the wiphy and netdev. Normally this
2881          * function shouldn't need the netdev, but this is
2882          * done for backward compatibility -- previously
2883          * setting the channel was done per wiphy, but now
2884          * it is per netdev. Previous userland like hostapd
2885          * also passed a netdev to set_wiphy, so that it is
2886          * possible to let that go to the right netdev!
2887          */
2888
2889         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2890                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2891
2892                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2893                 if (netdev && netdev->ieee80211_ptr)
2894                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2895                 else
2896                         netdev = NULL;
2897         }
2898
2899         if (!netdev) {
2900                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2901                                                   info->attrs);
2902                 if (IS_ERR(rdev))
2903                         return PTR_ERR(rdev);
2904                 wdev = NULL;
2905                 netdev = NULL;
2906                 result = 0;
2907         } else
2908                 wdev = netdev->ieee80211_ptr;
2909
2910         /*
2911          * end workaround code, by now the rdev is available
2912          * and locked, and wdev may or may not be NULL.
2913          */
2914
2915         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2916                 result = cfg80211_dev_rename(
2917                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2918
2919         if (result)
2920                 return result;
2921
2922         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2923                 struct ieee80211_txq_params txq_params;
2924                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2925
2926                 if (!rdev->ops->set_txq_params)
2927                         return -EOPNOTSUPP;
2928
2929                 if (!netdev)
2930                         return -EINVAL;
2931
2932                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2933                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2934                         return -EINVAL;
2935
2936                 if (!netif_running(netdev))
2937                         return -ENETDOWN;
2938
2939                 nla_for_each_nested(nl_txq_params,
2940                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2941                                     rem_txq_params) {
2942                         result = nla_parse_nested_deprecated(tb,
2943                                                              NL80211_TXQ_ATTR_MAX,
2944                                                              nl_txq_params,
2945                                                              txq_params_policy,
2946                                                              info->extack);
2947                         if (result)
2948                                 return result;
2949                         result = parse_txq_params(tb, &txq_params);
2950                         if (result)
2951                                 return result;
2952
2953                         result = rdev_set_txq_params(rdev, netdev,
2954                                                      &txq_params);
2955                         if (result)
2956                                 return result;
2957                 }
2958         }
2959
2960         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2961                 result = __nl80211_set_channel(
2962                         rdev,
2963                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2964                         info);
2965                 if (result)
2966                         return result;
2967         }
2968
2969         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2970                 struct wireless_dev *txp_wdev = wdev;
2971                 enum nl80211_tx_power_setting type;
2972                 int idx, mbm = 0;
2973
2974                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2975                         txp_wdev = NULL;
2976
2977                 if (!rdev->ops->set_tx_power)
2978                         return -EOPNOTSUPP;
2979
2980                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2981                 type = nla_get_u32(info->attrs[idx]);
2982
2983                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2984                     (type != NL80211_TX_POWER_AUTOMATIC))
2985                         return -EINVAL;
2986
2987                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2988                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2989                         mbm = nla_get_u32(info->attrs[idx]);
2990                 }
2991
2992                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2993                 if (result)
2994                         return result;
2995         }
2996
2997         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2998             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2999                 u32 tx_ant, rx_ant;
3000
3001                 if ((!rdev->wiphy.available_antennas_tx &&
3002                      !rdev->wiphy.available_antennas_rx) ||
3003                     !rdev->ops->set_antenna)
3004                         return -EOPNOTSUPP;
3005
3006                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3007                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3008
3009                 /* reject antenna configurations which don't match the
3010                  * available antenna masks, except for the "all" mask */
3011                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3012                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
3013                         return -EINVAL;
3014
3015                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3016                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3017
3018                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3019                 if (result)
3020                         return result;
3021         }
3022
3023         changed = 0;
3024
3025         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3026                 retry_short = nla_get_u8(
3027                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3028
3029                 changed |= WIPHY_PARAM_RETRY_SHORT;
3030         }
3031
3032         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3033                 retry_long = nla_get_u8(
3034                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3035
3036                 changed |= WIPHY_PARAM_RETRY_LONG;
3037         }
3038
3039         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3040                 frag_threshold = nla_get_u32(
3041                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3042                 if (frag_threshold < 256)
3043                         return -EINVAL;
3044
3045                 if (frag_threshold != (u32) -1) {
3046                         /*
3047                          * Fragments (apart from the last one) are required to
3048                          * have even length. Make the fragmentation code
3049                          * simpler by stripping LSB should someone try to use
3050                          * odd threshold value.
3051                          */
3052                         frag_threshold &= ~0x1;
3053                 }
3054                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3055         }
3056
3057         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3058                 rts_threshold = nla_get_u32(
3059                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3060                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3061         }
3062
3063         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3064                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
3065                         return -EINVAL;
3066
3067                 coverage_class = nla_get_u8(
3068                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3069                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
3070         }
3071
3072         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3073                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
3074                         return -EOPNOTSUPP;
3075
3076                 changed |= WIPHY_PARAM_DYN_ACK;
3077         }
3078
3079         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3080                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3081                                              NL80211_EXT_FEATURE_TXQS))
3082                         return -EOPNOTSUPP;
3083                 txq_limit = nla_get_u32(
3084                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3085                 changed |= WIPHY_PARAM_TXQ_LIMIT;
3086         }
3087
3088         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3089                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3090                                              NL80211_EXT_FEATURE_TXQS))
3091                         return -EOPNOTSUPP;
3092                 txq_memory_limit = nla_get_u32(
3093                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3094                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3095         }
3096
3097         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3098                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3099                                              NL80211_EXT_FEATURE_TXQS))
3100                         return -EOPNOTSUPP;
3101                 txq_quantum = nla_get_u32(
3102                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3103                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3104         }
3105
3106         if (changed) {
3107                 u8 old_retry_short, old_retry_long;
3108                 u32 old_frag_threshold, old_rts_threshold;
3109                 u8 old_coverage_class;
3110                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3111
3112                 if (!rdev->ops->set_wiphy_params)
3113                         return -EOPNOTSUPP;
3114
3115                 old_retry_short = rdev->wiphy.retry_short;
3116                 old_retry_long = rdev->wiphy.retry_long;
3117                 old_frag_threshold = rdev->wiphy.frag_threshold;
3118                 old_rts_threshold = rdev->wiphy.rts_threshold;
3119                 old_coverage_class = rdev->wiphy.coverage_class;
3120                 old_txq_limit = rdev->wiphy.txq_limit;
3121                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3122                 old_txq_quantum = rdev->wiphy.txq_quantum;
3123
3124                 if (changed & WIPHY_PARAM_RETRY_SHORT)
3125                         rdev->wiphy.retry_short = retry_short;
3126                 if (changed & WIPHY_PARAM_RETRY_LONG)
3127                         rdev->wiphy.retry_long = retry_long;
3128                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3129                         rdev->wiphy.frag_threshold = frag_threshold;
3130                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3131                         rdev->wiphy.rts_threshold = rts_threshold;
3132                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3133                         rdev->wiphy.coverage_class = coverage_class;
3134                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3135                         rdev->wiphy.txq_limit = txq_limit;
3136                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3137                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
3138                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3139                         rdev->wiphy.txq_quantum = txq_quantum;
3140
3141                 result = rdev_set_wiphy_params(rdev, changed);
3142                 if (result) {
3143                         rdev->wiphy.retry_short = old_retry_short;
3144                         rdev->wiphy.retry_long = old_retry_long;
3145                         rdev->wiphy.frag_threshold = old_frag_threshold;
3146                         rdev->wiphy.rts_threshold = old_rts_threshold;
3147                         rdev->wiphy.coverage_class = old_coverage_class;
3148                         rdev->wiphy.txq_limit = old_txq_limit;
3149                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3150                         rdev->wiphy.txq_quantum = old_txq_quantum;
3151                         return result;
3152                 }
3153         }
3154         return 0;
3155 }
3156
3157 static int nl80211_send_chandef(struct sk_buff *msg,
3158                                 const struct cfg80211_chan_def *chandef)
3159 {
3160         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3161                 return -EINVAL;
3162
3163         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3164                         chandef->chan->center_freq))
3165                 return -ENOBUFS;
3166         switch (chandef->width) {
3167         case NL80211_CHAN_WIDTH_20_NOHT:
3168         case NL80211_CHAN_WIDTH_20:
3169         case NL80211_CHAN_WIDTH_40:
3170                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3171                                 cfg80211_get_chandef_type(chandef)))
3172                         return -ENOBUFS;
3173                 break;
3174         default:
3175                 break;
3176         }
3177         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3178                 return -ENOBUFS;
3179         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3180                 return -ENOBUFS;
3181         if (chandef->center_freq2 &&
3182             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3183                 return -ENOBUFS;
3184         return 0;
3185 }
3186
3187 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3188                               struct cfg80211_registered_device *rdev,
3189                               struct wireless_dev *wdev,
3190                               enum nl80211_commands cmd)
3191 {
3192         struct net_device *dev = wdev->netdev;
3193         void *hdr;
3194
3195         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3196                 cmd != NL80211_CMD_DEL_INTERFACE &&
3197                 cmd != NL80211_CMD_SET_INTERFACE);
3198
3199         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3200         if (!hdr)
3201                 return -1;
3202
3203         if (dev &&
3204             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3205              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3206                 goto nla_put_failure;
3207
3208         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3209             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3210             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3211                               NL80211_ATTR_PAD) ||
3212             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3213             nla_put_u32(msg, NL80211_ATTR_GENERATION,
3214                         rdev->devlist_generation ^
3215                         (cfg80211_rdev_list_generation << 2)) ||
3216             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3217                 goto nla_put_failure;
3218
3219         if (rdev->ops->get_channel) {
3220                 int ret;
3221                 struct cfg80211_chan_def chandef = {};
3222
3223                 ret = rdev_get_channel(rdev, wdev, &chandef);
3224                 if (ret == 0) {
3225                         if (nl80211_send_chandef(msg, &chandef))
3226                                 goto nla_put_failure;
3227                 }
3228         }
3229
3230         if (rdev->ops->get_tx_power) {
3231                 int dbm, ret;
3232
3233                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3234                 if (ret == 0 &&
3235                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3236                                 DBM_TO_MBM(dbm)))
3237                         goto nla_put_failure;
3238         }
3239
3240         wdev_lock(wdev);
3241         switch (wdev->iftype) {
3242         case NL80211_IFTYPE_AP:
3243                 if (wdev->ssid_len &&
3244                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
3245                         goto nla_put_failure_locked;
3246                 break;
3247         case NL80211_IFTYPE_STATION:
3248         case NL80211_IFTYPE_P2P_CLIENT:
3249         case NL80211_IFTYPE_ADHOC: {
3250                 const u8 *ssid_ie;
3251                 if (!wdev->current_bss)
3252                         break;
3253                 rcu_read_lock();
3254                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
3255                                                WLAN_EID_SSID);
3256                 if (ssid_ie &&
3257                     nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
3258                         goto nla_put_failure_rcu_locked;
3259                 rcu_read_unlock();
3260                 break;
3261                 }
3262         default:
3263                 /* nothing */
3264                 break;
3265         }
3266         wdev_unlock(wdev);
3267
3268         if (rdev->ops->get_txq_stats) {
3269                 struct cfg80211_txq_stats txqstats = {};
3270                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3271
3272                 if (ret == 0 &&
3273                     !nl80211_put_txq_stats(msg, &txqstats,
3274                                            NL80211_ATTR_TXQ_STATS))
3275                         goto nla_put_failure;
3276         }
3277
3278         genlmsg_end(msg, hdr);
3279         return 0;
3280
3281  nla_put_failure_rcu_locked:
3282         rcu_read_unlock();
3283  nla_put_failure_locked:
3284         wdev_unlock(wdev);
3285  nla_put_failure:
3286         genlmsg_cancel(msg, hdr);
3287         return -EMSGSIZE;
3288 }
3289
3290 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3291 {
3292         int wp_idx = 0;
3293         int if_idx = 0;
3294         int wp_start = cb->args[0];
3295         int if_start = cb->args[1];
3296         int filter_wiphy = -1;
3297         struct cfg80211_registered_device *rdev;
3298         struct wireless_dev *wdev;
3299         int ret;
3300
3301         rtnl_lock();
3302         if (!cb->args[2]) {
3303                 struct nl80211_dump_wiphy_state state = {
3304                         .filter_wiphy = -1,
3305                 };
3306
3307                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3308                 if (ret)
3309                         goto out_unlock;
3310
3311                 filter_wiphy = state.filter_wiphy;
3312
3313                 /*
3314                  * if filtering, set cb->args[2] to +1 since 0 is the default
3315                  * value needed to determine that parsing is necessary.
3316                  */
3317                 if (filter_wiphy >= 0)
3318                         cb->args[2] = filter_wiphy + 1;
3319                 else
3320                         cb->args[2] = -1;
3321         } else if (cb->args[2] > 0) {
3322                 filter_wiphy = cb->args[2] - 1;
3323         }
3324
3325         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3326                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3327                         continue;
3328                 if (wp_idx < wp_start) {
3329                         wp_idx++;
3330                         continue;
3331                 }
3332
3333                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3334                         continue;
3335
3336                 if_idx = 0;
3337
3338                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3339                         if (if_idx < if_start) {
3340                                 if_idx++;
3341                                 continue;
3342                         }
3343                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
3344                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
3345                                                rdev, wdev,
3346                                                NL80211_CMD_NEW_INTERFACE) < 0) {
3347                                 goto out;
3348                         }
3349                         if_idx++;
3350                 }
3351
3352                 wp_idx++;
3353         }
3354  out:
3355         cb->args[0] = wp_idx;
3356         cb->args[1] = if_idx;
3357
3358         ret = skb->len;
3359  out_unlock:
3360         rtnl_unlock();
3361
3362         return ret;
3363 }
3364
3365 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3366 {
3367         struct sk_buff *msg;
3368         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3369         struct wireless_dev *wdev = info->user_ptr[1];
3370
3371         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3372         if (!msg)
3373                 return -ENOMEM;
3374
3375         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3376                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3377                 nlmsg_free(msg);
3378                 return -ENOBUFS;
3379         }
3380
3381         return genlmsg_reply(msg, info);
3382 }
3383
3384 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3385         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3386         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3387         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
3388         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
3389         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
3390         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
3391 };
3392
3393 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
3394 {
3395         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
3396         int flag;
3397
3398         *mntrflags = 0;
3399
3400         if (!nla)
3401                 return -EINVAL;
3402
3403         if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
3404                 return -EINVAL;
3405
3406         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3407                 if (flags[flag])
3408                         *mntrflags |= (1<<flag);
3409
3410         *mntrflags |= MONITOR_FLAG_CHANGED;
3411
3412         return 0;
3413 }
3414
3415 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3416                                      enum nl80211_iftype type,
3417                                      struct genl_info *info,
3418                                      struct vif_params *params)
3419 {
3420         bool change = false;
3421         int err;
3422
3423         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3424                 if (type != NL80211_IFTYPE_MONITOR)
3425                         return -EINVAL;
3426
3427                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3428                                           &params->flags);
3429                 if (err)
3430                         return err;
3431
3432                 change = true;
3433         }
3434
3435         if (params->flags & MONITOR_FLAG_ACTIVE &&
3436             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3437                 return -EOPNOTSUPP;
3438
3439         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3440                 const u8 *mumimo_groups;
3441                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3442
3443                 if (type != NL80211_IFTYPE_MONITOR)
3444                         return -EINVAL;
3445
3446                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3447                         return -EOPNOTSUPP;
3448
3449                 mumimo_groups =
3450                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3451
3452                 /* bits 0 and 63 are reserved and must be zero */
3453                 if ((mumimo_groups[0] & BIT(0)) ||
3454                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3455                         return -EINVAL;
3456
3457                 params->vht_mumimo_groups = mumimo_groups;
3458                 change = true;
3459         }
3460
3461         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3462                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3463
3464                 if (type != NL80211_IFTYPE_MONITOR)
3465                         return -EINVAL;
3466
3467                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3468                         return -EOPNOTSUPP;
3469
3470                 params->vht_mumimo_follow_addr =
3471                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3472                 change = true;
3473         }
3474
3475         return change ? 1 : 0;
3476 }
3477
3478 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3479                                struct net_device *netdev, u8 use_4addr,
3480                                enum nl80211_iftype iftype)
3481 {
3482         if (!use_4addr) {
3483                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
3484                         return -EBUSY;
3485                 return 0;
3486         }
3487
3488         switch (iftype) {
3489         case NL80211_IFTYPE_AP_VLAN:
3490                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3491                         return 0;
3492                 break;
3493         case NL80211_IFTYPE_STATION:
3494                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3495                         return 0;
3496                 break;
3497         default:
3498                 break;
3499         }
3500
3501         return -EOPNOTSUPP;
3502 }
3503
3504 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3505 {
3506         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3507         struct vif_params params;
3508         int err;
3509         enum nl80211_iftype otype, ntype;
3510         struct net_device *dev = info->user_ptr[1];
3511         bool change = false;
3512
3513         memset(&params, 0, sizeof(params));
3514
3515         otype = ntype = dev->ieee80211_ptr->iftype;
3516
3517         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3518                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3519                 if (otype != ntype)
3520                         change = true;
3521         }
3522
3523         if (info->attrs[NL80211_ATTR_MESH_ID]) {
3524                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3525
3526                 if (ntype != NL80211_IFTYPE_MESH_POINT)
3527                         return -EINVAL;
3528                 if (netif_running(dev))
3529                         return -EBUSY;
3530
3531                 wdev_lock(wdev);
3532                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3533                              IEEE80211_MAX_MESH_ID_LEN);
3534                 wdev->mesh_id_up_len =
3535                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3536                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3537                        wdev->mesh_id_up_len);
3538                 wdev_unlock(wdev);
3539         }
3540
3541         if (info->attrs[NL80211_ATTR_4ADDR]) {
3542                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3543                 change = true;
3544                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3545                 if (err)
3546                         return err;
3547         } else {
3548                 params.use_4addr = -1;
3549         }
3550
3551         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
3552         if (err < 0)
3553                 return err;
3554         if (err > 0)
3555                 change = true;
3556
3557         if (change)
3558                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
3559         else
3560                 err = 0;
3561
3562         if (!err && params.use_4addr != -1)
3563                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3564
3565         if (change && !err) {
3566                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3567
3568                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
3569         }
3570
3571         return err;
3572 }
3573
3574 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3575 {
3576         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3577         struct vif_params params;
3578         struct wireless_dev *wdev;
3579         struct sk_buff *msg;
3580         int err;
3581         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3582
3583         /* to avoid failing a new interface creation due to pending removal */
3584         cfg80211_destroy_ifaces(rdev);
3585
3586         memset(&params, 0, sizeof(params));
3587
3588         if (!info->attrs[NL80211_ATTR_IFNAME])
3589                 return -EINVAL;
3590
3591         if (info->attrs[NL80211_ATTR_IFTYPE])
3592                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3593
3594         if (!rdev->ops->add_virtual_intf)
3595                 return -EOPNOTSUPP;
3596
3597         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3598              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3599             info->attrs[NL80211_ATTR_MAC]) {
3600                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3601                            ETH_ALEN);
3602                 if (!is_valid_ether_addr(params.macaddr))
3603                         return -EADDRNOTAVAIL;
3604         }
3605
3606         if (info->attrs[NL80211_ATTR_4ADDR]) {
3607                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3608                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3609                 if (err)
3610                         return err;
3611         }
3612
3613         if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
3614                 return -EOPNOTSUPP;
3615
3616         err = nl80211_parse_mon_options(rdev, type, info, &params);
3617         if (err < 0)
3618                 return err;
3619
3620         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3621         if (!msg)
3622                 return -ENOMEM;
3623
3624         wdev = rdev_add_virtual_intf(rdev,
3625                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3626                                 NET_NAME_USER, type, &params);
3627         if (WARN_ON(!wdev)) {
3628                 nlmsg_free(msg);
3629                 return -EPROTO;
3630         } else if (IS_ERR(wdev)) {
3631                 nlmsg_free(msg);
3632                 return PTR_ERR(wdev);
3633         }
3634
3635         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3636                 wdev->owner_nlportid = info->snd_portid;
3637
3638         switch (type) {
3639         case NL80211_IFTYPE_MESH_POINT:
3640                 if (!info->attrs[NL80211_ATTR_MESH_ID])
3641                         break;
3642                 wdev_lock(wdev);
3643                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3644                              IEEE80211_MAX_MESH_ID_LEN);
3645                 wdev->mesh_id_up_len =
3646                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3647                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3648                        wdev->mesh_id_up_len);
3649                 wdev_unlock(wdev);
3650                 break;
3651         case NL80211_IFTYPE_NAN:
3652         case NL80211_IFTYPE_P2P_DEVICE:
3653                 /*
3654                  * P2P Device and NAN do not have a netdev, so don't go
3655                  * through the netdev notifier and must be added here
3656                  */
3657                 cfg80211_init_wdev(rdev, wdev);
3658                 break;
3659         default:
3660                 break;
3661         }
3662
3663         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3664                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3665                 nlmsg_free(msg);
3666                 return -ENOBUFS;
3667         }
3668
3669         return genlmsg_reply(msg, info);
3670 }
3671
3672 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3673 {
3674         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3675         struct wireless_dev *wdev = info->user_ptr[1];
3676
3677         if (!rdev->ops->del_virtual_intf)
3678                 return -EOPNOTSUPP;
3679
3680         /*
3681          * If we remove a wireless device without a netdev then clear
3682          * user_ptr[1] so that nl80211_post_doit won't dereference it
3683          * to check if it needs to do dev_put(). Otherwise it crashes
3684          * since the wdev has been freed, unlike with a netdev where
3685          * we need the dev_put() for the netdev to really be freed.
3686          */
3687         if (!wdev->netdev)
3688                 info->user_ptr[1] = NULL;
3689
3690         return rdev_del_virtual_intf(rdev, wdev);
3691 }
3692
3693 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3694 {
3695         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3696         struct net_device *dev = info->user_ptr[1];
3697         u16 noack_map;
3698
3699         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3700                 return -EINVAL;
3701
3702         if (!rdev->ops->set_noack_map)
3703                 return -EOPNOTSUPP;
3704
3705         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3706
3707         return rdev_set_noack_map(rdev, dev, noack_map);
3708 }
3709
3710 struct get_key_cookie {
3711         struct sk_buff *msg;
3712         int error;
3713         int idx;
3714 };
3715
3716 static void get_key_callback(void *c, struct key_params *params)
3717 {
3718         struct nlattr *key;
3719         struct get_key_cookie *cookie = c;
3720
3721         if ((params->key &&
3722              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3723                      params->key_len, params->key)) ||
3724             (params->seq &&
3725              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3726                      params->seq_len, params->seq)) ||
3727             (params->cipher &&
3728              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3729                          params->cipher)))
3730                 goto nla_put_failure;
3731
3732         key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
3733         if (!key)
3734                 goto nla_put_failure;
3735
3736         if ((params->key &&
3737              nla_put(cookie->msg, NL80211_KEY_DATA,
3738                      params->key_len, params->key)) ||
3739             (params->seq &&
3740              nla_put(cookie->msg, NL80211_KEY_SEQ,
3741                      params->seq_len, params->seq)) ||
3742             (params->cipher &&
3743              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3744                          params->cipher)))
3745                 goto nla_put_failure;
3746
3747         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
3748                 goto nla_put_failure;
3749
3750         nla_nest_end(cookie->msg, key);
3751
3752         return;
3753  nla_put_failure:
3754         cookie->error = 1;
3755 }
3756
3757 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3758 {
3759         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3760         int err;
3761         struct net_device *dev = info->user_ptr[1];
3762         u8 key_idx = 0;
3763         const u8 *mac_addr = NULL;
3764         bool pairwise;
3765         struct get_key_cookie cookie = {
3766                 .error = 0,
3767         };
3768         void *hdr;
3769         struct sk_buff *msg;
3770
3771         if (info->attrs[NL80211_ATTR_KEY_IDX])
3772                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3773
3774         if (info->attrs[NL80211_ATTR_MAC])
3775                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3776
3777         pairwise = !!mac_addr;
3778         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3779                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3780
3781                 if (kt != NL80211_KEYTYPE_GROUP &&
3782                     kt != NL80211_KEYTYPE_PAIRWISE)
3783                         return -EINVAL;
3784                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3785         }
3786
3787         if (!rdev->ops->get_key)
3788                 return -EOPNOTSUPP;
3789
3790         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3791                 return -ENOENT;
3792
3793         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3794         if (!msg)
3795                 return -ENOMEM;
3796
3797         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3798                              NL80211_CMD_NEW_KEY);
3799         if (!hdr)
3800                 goto nla_put_failure;
3801
3802         cookie.msg = msg;
3803         cookie.idx = key_idx;
3804
3805         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3806             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3807                 goto nla_put_failure;
3808         if (mac_addr &&
3809             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3810                 goto nla_put_failure;
3811
3812         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3813                            get_key_callback);
3814
3815         if (err)
3816                 goto free_msg;
3817
3818         if (cookie.error)
3819                 goto nla_put_failure;
3820
3821         genlmsg_end(msg, hdr);
3822         return genlmsg_reply(msg, info);
3823
3824  nla_put_failure:
3825         err = -ENOBUFS;
3826  free_msg:
3827         nlmsg_free(msg);
3828         return err;
3829 }
3830
3831 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3832 {
3833         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3834         struct key_parse key;
3835         int err;
3836         struct net_device *dev = info->user_ptr[1];
3837
3838         err = nl80211_parse_key(info, &key);
3839         if (err)
3840                 return err;
3841
3842         if (key.idx < 0)
3843                 return -EINVAL;
3844
3845         /* Only support setting default key and
3846          * Extended Key ID action NL80211_KEY_SET_TX.
3847          */
3848         if (!key.def && !key.defmgmt &&
3849             !(key.p.mode == NL80211_KEY_SET_TX))
3850                 return -EINVAL;
3851
3852         wdev_lock(dev->ieee80211_ptr);
3853
3854         if (key.def) {
3855                 if (!rdev->ops->set_default_key) {
3856                         err = -EOPNOTSUPP;
3857                         goto out;
3858                 }
3859
3860                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3861                 if (err)
3862                         goto out;
3863
3864                 err = rdev_set_default_key(rdev, dev, key.idx,
3865                                                  key.def_uni, key.def_multi);
3866
3867                 if (err)
3868                         goto out;
3869
3870 #ifdef CONFIG_CFG80211_WEXT
3871                 dev->ieee80211_ptr->wext.default_key = key.idx;
3872 #endif
3873         } else if (key.defmgmt) {
3874                 if (key.def_uni || !key.def_multi) {
3875                         err = -EINVAL;
3876                         goto out;
3877                 }
3878
3879                 if (!rdev->ops->set_default_mgmt_key) {
3880                         err = -EOPNOTSUPP;
3881                         goto out;
3882                 }
3883
3884                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3885                 if (err)
3886                         goto out;
3887
3888                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3889                 if (err)
3890                         goto out;
3891
3892 #ifdef CONFIG_CFG80211_WEXT
3893                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3894 #endif
3895         } else if (key.p.mode == NL80211_KEY_SET_TX &&
3896                    wiphy_ext_feature_isset(&rdev->wiphy,
3897                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
3898                 u8 *mac_addr = NULL;
3899
3900                 if (info->attrs[NL80211_ATTR_MAC])
3901                         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3902
3903                 if (!mac_addr || key.idx < 0 || key.idx > 1) {
3904                         err = -EINVAL;
3905                         goto out;
3906                 }
3907
3908                 err = rdev_add_key(rdev, dev, key.idx,
3909                                    NL80211_KEYTYPE_PAIRWISE,
3910                                    mac_addr, &key.p);
3911         } else {
3912                 err = -EINVAL;
3913         }
3914  out:
3915         wdev_unlock(dev->ieee80211_ptr);
3916
3917         return err;
3918 }
3919
3920 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3921 {
3922         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3923         int err;
3924         struct net_device *dev = info->user_ptr[1];
3925         struct key_parse key;
3926         const u8 *mac_addr = NULL;
3927
3928         err = nl80211_parse_key(info, &key);
3929         if (err)
3930                 return err;
3931
3932         if (!key.p.key)
3933                 return -EINVAL;
3934
3935         if (info->attrs[NL80211_ATTR_MAC])
3936                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3937
3938         if (key.type == -1) {
3939                 if (mac_addr)
3940                         key.type = NL80211_KEYTYPE_PAIRWISE;
3941                 else
3942                         key.type = NL80211_KEYTYPE_GROUP;
3943         }
3944
3945         /* for now */
3946         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3947             key.type != NL80211_KEYTYPE_GROUP)
3948                 return -EINVAL;
3949
3950         if (key.type == NL80211_KEYTYPE_GROUP &&
3951             info->attrs[NL80211_ATTR_VLAN_ID])
3952                 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
3953
3954         if (!rdev->ops->add_key)
3955                 return -EOPNOTSUPP;
3956
3957         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3958                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3959                                            mac_addr))
3960                 return -EINVAL;
3961
3962         wdev_lock(dev->ieee80211_ptr);
3963         err = nl80211_key_allowed(dev->ieee80211_ptr);
3964         if (!err)
3965                 err = rdev_add_key(rdev, dev, key.idx,
3966                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3967                                     mac_addr, &key.p);
3968         wdev_unlock(dev->ieee80211_ptr);
3969
3970         return err;
3971 }
3972
3973 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3974 {
3975         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3976         int err;
3977         struct net_device *dev = info->user_ptr[1];
3978         u8 *mac_addr = NULL;
3979         struct key_parse key;
3980
3981         err = nl80211_parse_key(info, &key);
3982         if (err)
3983                 return err;
3984
3985         if (info->attrs[NL80211_ATTR_MAC])
3986                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3987
3988         if (key.type == -1) {
3989                 if (mac_addr)
3990                         key.type = NL80211_KEYTYPE_PAIRWISE;
3991                 else
3992                         key.type = NL80211_KEYTYPE_GROUP;
3993         }
3994
3995         /* for now */
3996         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3997             key.type != NL80211_KEYTYPE_GROUP)
3998                 return -EINVAL;
3999
4000         if (!rdev->ops->del_key)
4001                 return -EOPNOTSUPP;
4002
4003         wdev_lock(dev->ieee80211_ptr);
4004         err = nl80211_key_allowed(dev->ieee80211_ptr);
4005
4006         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4007             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4008                 err = -ENOENT;
4009
4010         if (!err)
4011                 err = rdev_del_key(rdev, dev, key.idx,
4012                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4013                                    mac_addr);
4014
4015 #ifdef CONFIG_CFG80211_WEXT
4016         if (!err) {
4017                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
4018                         dev->ieee80211_ptr->wext.default_key = -1;
4019                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
4020                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
4021         }
4022 #endif
4023         wdev_unlock(dev->ieee80211_ptr);
4024
4025         return err;
4026 }
4027
4028 /* This function returns an error or the number of nested attributes */
4029 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
4030 {
4031         struct nlattr *attr;
4032         int n_entries = 0, tmp;
4033
4034         nla_for_each_nested(attr, nl_attr, tmp) {
4035                 if (nla_len(attr) != ETH_ALEN)
4036                         return -EINVAL;
4037
4038                 n_entries++;
4039         }
4040
4041         return n_entries;
4042 }
4043
4044 /*
4045  * This function parses ACL information and allocates memory for ACL data.
4046  * On successful return, the calling function is responsible to free the
4047  * ACL buffer returned by this function.
4048  */
4049 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
4050                                                 struct genl_info *info)
4051 {
4052         enum nl80211_acl_policy acl_policy;
4053         struct nlattr *attr;
4054         struct cfg80211_acl_data *acl;
4055         int i = 0, n_entries, tmp;
4056
4057         if (!wiphy->max_acl_mac_addrs)
4058                 return ERR_PTR(-EOPNOTSUPP);
4059
4060         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
4061                 return ERR_PTR(-EINVAL);
4062
4063         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
4064         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
4065             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
4066                 return ERR_PTR(-EINVAL);
4067
4068         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
4069                 return ERR_PTR(-EINVAL);
4070
4071         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
4072         if (n_entries < 0)
4073                 return ERR_PTR(n_entries);
4074
4075         if (n_entries > wiphy->max_acl_mac_addrs)
4076                 return ERR_PTR(-ENOTSUPP);
4077
4078         acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
4079         if (!acl)
4080                 return ERR_PTR(-ENOMEM);
4081
4082         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
4083                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
4084                 i++;
4085         }
4086
4087         acl->n_acl_entries = n_entries;
4088         acl->acl_policy = acl_policy;
4089
4090         return acl;
4091 }
4092
4093 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
4094 {
4095         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4096         struct net_device *dev = info->user_ptr[1];
4097         struct cfg80211_acl_data *acl;
4098         int err;
4099
4100         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4101             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4102                 return -EOPNOTSUPP;
4103
4104         if (!dev->ieee80211_ptr->beacon_interval)
4105                 return -EINVAL;
4106
4107         acl = parse_acl_data(&rdev->wiphy, info);
4108         if (IS_ERR(acl))
4109                 return PTR_ERR(acl);
4110
4111         err = rdev_set_mac_acl(rdev, dev, acl);
4112
4113         kfree(acl);
4114
4115         return err;
4116 }
4117
4118 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4119                            u8 *rates, u8 rates_len)
4120 {
4121         u8 i;
4122         u32 mask = 0;
4123
4124         for (i = 0; i < rates_len; i++) {
4125                 int rate = (rates[i] & 0x7f) * 5;
4126                 int ridx;
4127
4128                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4129                         struct ieee80211_rate *srate =
4130                                 &sband->bitrates[ridx];
4131                         if (rate == srate->bitrate) {
4132                                 mask |= 1 << ridx;
4133                                 break;
4134                         }
4135                 }
4136                 if (ridx == sband->n_bitrates)
4137                         return 0; /* rate not found */
4138         }
4139
4140         return mask;
4141 }
4142
4143 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4144                                u8 *rates, u8 rates_len,
4145                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4146 {
4147         u8 i;
4148
4149         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4150
4151         for (i = 0; i < rates_len; i++) {
4152                 int ridx, rbit;
4153
4154                 ridx = rates[i] / 8;
4155                 rbit = BIT(rates[i] % 8);
4156
4157                 /* check validity */
4158                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4159                         return false;
4160
4161                 /* check availability */
4162                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4163                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4164                         mcs[ridx] |= rbit;
4165                 else
4166                         return false;
4167         }
4168
4169         return true;
4170 }
4171
4172 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4173 {
4174         u16 mcs_mask = 0;
4175
4176         switch (vht_mcs_map) {
4177         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4178                 break;
4179         case IEEE80211_VHT_MCS_SUPPORT_0_7:
4180                 mcs_mask = 0x00FF;
4181                 break;
4182         case IEEE80211_VHT_MCS_SUPPORT_0_8:
4183                 mcs_mask = 0x01FF;
4184                 break;
4185         case IEEE80211_VHT_MCS_SUPPORT_0_9:
4186                 mcs_mask = 0x03FF;
4187                 break;
4188         default:
4189                 break;
4190         }
4191
4192         return mcs_mask;
4193 }
4194
4195 static void vht_build_mcs_mask(u16 vht_mcs_map,
4196                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
4197 {
4198         u8 nss;
4199
4200         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
4201                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
4202                 vht_mcs_map >>= 2;
4203         }
4204 }
4205
4206 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
4207                              struct nl80211_txrate_vht *txrate,
4208                              u16 mcs[NL80211_VHT_NSS_MAX])
4209 {
4210         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4211         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
4212         u8 i;
4213
4214         if (!sband->vht_cap.vht_supported)
4215                 return false;
4216
4217         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
4218
4219         /* Build vht_mcs_mask from VHT capabilities */
4220         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4221
4222         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4223                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4224                         mcs[i] = txrate->mcs[i];
4225                 else
4226                         return false;
4227         }
4228
4229         return true;
4230 }
4231
4232 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4233         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4234                                     .len = NL80211_MAX_SUPP_RATES },
4235         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
4236                                 .len = NL80211_MAX_SUPP_HT_RATES },
4237         [NL80211_TXRATE_VHT] = {
4238                 .type = NLA_EXACT_LEN_WARN,
4239                 .len = sizeof(struct nl80211_txrate_vht),
4240         },
4241         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
4242 };
4243
4244 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
4245                                          struct cfg80211_bitrate_mask *mask)
4246 {
4247         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4248         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4249         int rem, i;
4250         struct nlattr *tx_rates;
4251         struct ieee80211_supported_band *sband;
4252         u16 vht_tx_mcs_map;
4253
4254         memset(mask, 0, sizeof(*mask));
4255         /* Default to all rates enabled */
4256         for (i = 0; i < NUM_NL80211_BANDS; i++) {
4257                 sband = rdev->wiphy.bands[i];
4258
4259                 if (!sband)
4260                         continue;
4261
4262                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
4263                 memcpy(mask->control[i].ht_mcs,
4264                        sband->ht_cap.mcs.rx_mask,
4265                        sizeof(mask->control[i].ht_mcs));
4266
4267                 if (!sband->vht_cap.vht_supported)
4268                         continue;
4269
4270                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4271                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
4272         }
4273
4274         /* if no rates are given set it back to the defaults */
4275         if (!info->attrs[NL80211_ATTR_TX_RATES])
4276                 goto out;
4277
4278         /* The nested attribute uses enum nl80211_band as the index. This maps
4279          * directly to the enum nl80211_band values used in cfg80211.
4280          */
4281         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
4282         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
4283                 enum nl80211_band band = nla_type(tx_rates);
4284                 int err;
4285
4286                 if (band < 0 || band >= NUM_NL80211_BANDS)
4287                         return -EINVAL;
4288                 sband = rdev->wiphy.bands[band];
4289                 if (sband == NULL)
4290                         return -EINVAL;
4291                 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
4292                                                   tx_rates,
4293                                                   nl80211_txattr_policy,
4294                                                   info->extack);
4295                 if (err)
4296                         return err;
4297                 if (tb[NL80211_TXRATE_LEGACY]) {
4298                         mask->control[band].legacy = rateset_to_mask(
4299                                 sband,
4300                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4301                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4302                         if ((mask->control[band].legacy == 0) &&
4303                             nla_len(tb[NL80211_TXRATE_LEGACY]))
4304                                 return -EINVAL;
4305                 }
4306                 if (tb[NL80211_TXRATE_HT]) {
4307                         if (!ht_rateset_to_mask(
4308                                         sband,
4309                                         nla_data(tb[NL80211_TXRATE_HT]),
4310                                         nla_len(tb[NL80211_TXRATE_HT]),
4311                                         mask->control[band].ht_mcs))
4312                                 return -EINVAL;
4313                 }
4314                 if (tb[NL80211_TXRATE_VHT]) {
4315                         if (!vht_set_mcs_mask(
4316                                         sband,
4317                                         nla_data(tb[NL80211_TXRATE_VHT]),
4318                                         mask->control[band].vht_mcs))
4319                                 return -EINVAL;
4320                 }
4321                 if (tb[NL80211_TXRATE_GI]) {
4322                         mask->control[band].gi =
4323                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
4324                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
4325                                 return -EINVAL;
4326                 }
4327
4328                 if (mask->control[band].legacy == 0) {
4329                         /* don't allow empty legacy rates if HT or VHT
4330                          * are not even supported.
4331                          */
4332                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
4333                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
4334                                 return -EINVAL;
4335
4336                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
4337                                 if (mask->control[band].ht_mcs[i])
4338                                         goto out;
4339
4340                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
4341                                 if (mask->control[band].vht_mcs[i])
4342                                         goto out;
4343
4344                         /* legacy and mcs rates may not be both empty */
4345                         return -EINVAL;
4346                 }
4347         }
4348
4349 out:
4350         return 0;
4351 }
4352
4353 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
4354                                    enum nl80211_band band,
4355                                    struct cfg80211_bitrate_mask *beacon_rate)
4356 {
4357         u32 count_ht, count_vht, i;
4358         u32 rate = beacon_rate->control[band].legacy;
4359
4360         /* Allow only one rate */
4361         if (hweight32(rate) > 1)
4362                 return -EINVAL;
4363
4364         count_ht = 0;
4365         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
4366                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
4367                         return -EINVAL;
4368                 } else if (beacon_rate->control[band].ht_mcs[i]) {
4369                         count_ht++;
4370                         if (count_ht > 1)
4371                                 return -EINVAL;
4372                 }
4373                 if (count_ht && rate)
4374                         return -EINVAL;
4375         }
4376
4377         count_vht = 0;
4378         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4379                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
4380                         return -EINVAL;
4381                 } else if (beacon_rate->control[band].vht_mcs[i]) {
4382                         count_vht++;
4383                         if (count_vht > 1)
4384                                 return -EINVAL;
4385                 }
4386                 if (count_vht && rate)
4387                         return -EINVAL;
4388         }
4389
4390         if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
4391                 return -EINVAL;
4392
4393         if (rate &&
4394             !wiphy_ext_feature_isset(&rdev->wiphy,
4395                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
4396                 return -EINVAL;
4397         if (count_ht &&
4398             !wiphy_ext_feature_isset(&rdev->wiphy,
4399                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
4400                 return -EINVAL;
4401         if (count_vht &&
4402             !wiphy_ext_feature_isset(&rdev->wiphy,
4403                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
4404                 return -EINVAL;
4405
4406         return 0;
4407 }
4408
4409 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
4410                                 struct nlattr *attrs[],
4411                                 struct cfg80211_beacon_data *bcn)
4412 {
4413         bool haveinfo = false;
4414         int err;
4415
4416         memset(bcn, 0, sizeof(*bcn));
4417
4418         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4419                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4420                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4421                 if (!bcn->head_len)
4422                         return -EINVAL;
4423                 haveinfo = true;
4424         }
4425
4426         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4427                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4428                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4429                 haveinfo = true;
4430         }
4431
4432         if (!haveinfo)
4433                 return -EINVAL;
4434
4435         if (attrs[NL80211_ATTR_IE]) {
4436                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
4437                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
4438         }
4439
4440         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
4441                 bcn->proberesp_ies =
4442                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4443                 bcn->proberesp_ies_len =
4444                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4445         }
4446
4447         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
4448                 bcn->assocresp_ies =
4449                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4450                 bcn->assocresp_ies_len =
4451                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4452         }
4453
4454         if (attrs[NL80211_ATTR_PROBE_RESP]) {
4455                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
4456                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
4457         }
4458
4459         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
4460                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
4461
4462                 err = nla_parse_nested_deprecated(tb,
4463                                                   NL80211_FTM_RESP_ATTR_MAX,
4464                                                   attrs[NL80211_ATTR_FTM_RESPONDER],
4465                                                   NULL, NULL);
4466                 if (err)
4467                         return err;
4468
4469                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
4470                     wiphy_ext_feature_isset(&rdev->wiphy,
4471                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
4472                         bcn->ftm_responder = 1;
4473                 else
4474                         return -EOPNOTSUPP;
4475
4476                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
4477                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
4478                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
4479                 }
4480
4481                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
4482                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4483                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4484                 }
4485         } else {
4486                 bcn->ftm_responder = -1;
4487         }
4488
4489         return 0;
4490 }
4491
4492 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
4493                                     struct ieee80211_he_obss_pd *he_obss_pd)
4494 {
4495         struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
4496         int err;
4497
4498         err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
4499                                he_obss_pd_policy, NULL);
4500         if (err)
4501                 return err;
4502
4503         if (!tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] ||
4504             !tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
4505                 return -EINVAL;
4506
4507         he_obss_pd->min_offset =
4508                 nla_get_u32(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
4509         he_obss_pd->max_offset =
4510                 nla_get_u32(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
4511
4512         if (he_obss_pd->min_offset >= he_obss_pd->max_offset)
4513                 return -EINVAL;
4514
4515         he_obss_pd->enable = true;
4516
4517         return 0;
4518 }
4519
4520 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
4521                                             const u8 *rates)
4522 {
4523         int i;
4524
4525         if (!rates)
4526                 return;
4527
4528         for (i = 0; i < rates[1]; i++) {
4529                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
4530                         params->ht_required = true;
4531                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
4532                         params->vht_required = true;
4533         }
4534 }
4535
4536 /*
4537  * Since the nl80211 API didn't include, from the beginning, attributes about
4538  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
4539  * benefit of drivers that rebuild IEs in the firmware.
4540  */
4541 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
4542 {
4543         const struct cfg80211_beacon_data *bcn = &params->beacon;
4544         size_t ies_len = bcn->tail_len;
4545         const u8 *ies = bcn->tail;
4546         const u8 *rates;
4547         const u8 *cap;
4548
4549         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
4550         nl80211_check_ap_rate_selectors(params, rates);
4551
4552         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
4553         nl80211_check_ap_rate_selectors(params, rates);
4554
4555         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
4556         if (cap && cap[1] >= sizeof(*params->ht_cap))
4557                 params->ht_cap = (void *)(cap + 2);
4558         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
4559         if (cap && cap[1] >= sizeof(*params->vht_cap))
4560                 params->vht_cap = (void *)(cap + 2);
4561         cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
4562         if (cap && cap[1] >= sizeof(*params->he_cap) + 1)
4563                 params->he_cap = (void *)(cap + 3);
4564 }
4565
4566 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
4567                                    struct cfg80211_ap_settings *params)
4568 {
4569         struct wireless_dev *wdev;
4570         bool ret = false;
4571
4572         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4573                 if (wdev->iftype != NL80211_IFTYPE_AP &&
4574                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
4575                         continue;
4576
4577                 if (!wdev->preset_chandef.chan)
4578                         continue;
4579
4580                 params->chandef = wdev->preset_chandef;
4581                 ret = true;
4582                 break;
4583         }
4584
4585         return ret;
4586 }
4587
4588 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
4589                                     enum nl80211_auth_type auth_type,
4590                                     enum nl80211_commands cmd)
4591 {
4592         if (auth_type > NL80211_AUTHTYPE_MAX)
4593                 return false;
4594
4595         switch (cmd) {
4596         case NL80211_CMD_AUTHENTICATE:
4597                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4598                     auth_type == NL80211_AUTHTYPE_SAE)
4599                         return false;
4600                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4601                                              NL80211_EXT_FEATURE_FILS_STA) &&
4602                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4603                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4604                      auth_type == NL80211_AUTHTYPE_FILS_PK))
4605                         return false;
4606                 return true;
4607         case NL80211_CMD_CONNECT:
4608                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4609                     !wiphy_ext_feature_isset(&rdev->wiphy,
4610                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
4611                     auth_type == NL80211_AUTHTYPE_SAE)
4612                         return false;
4613
4614                 /* FILS with SK PFS or PK not supported yet */
4615                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4616                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4617                         return false;
4618                 if (!wiphy_ext_feature_isset(
4619                             &rdev->wiphy,
4620                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
4621                     auth_type == NL80211_AUTHTYPE_FILS_SK)
4622                         return false;
4623                 return true;
4624         case NL80211_CMD_START_AP:
4625                 /* SAE not supported yet */
4626                 if (auth_type == NL80211_AUTHTYPE_SAE)
4627                         return false;
4628                 /* FILS not supported yet */
4629                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4630                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4631                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4632                         return false;
4633                 return true;
4634         default:
4635                 return false;
4636         }
4637 }
4638
4639 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
4640 {
4641         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4642         struct net_device *dev = info->user_ptr[1];
4643         struct wireless_dev *wdev = dev->ieee80211_ptr;
4644         struct cfg80211_ap_settings params;
4645         int err;
4646
4647         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4648             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4649                 return -EOPNOTSUPP;
4650
4651         if (!rdev->ops->start_ap)
4652                 return -EOPNOTSUPP;
4653
4654         if (wdev->beacon_interval)
4655                 return -EALREADY;
4656
4657         memset(&params, 0, sizeof(params));
4658
4659         /* these are required for START_AP */
4660         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
4661             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
4662             !info->attrs[NL80211_ATTR_BEACON_HEAD])
4663                 return -EINVAL;
4664
4665         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon);
4666         if (err)
4667                 return err;
4668
4669         params.beacon_interval =
4670                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4671         params.dtim_period =
4672                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
4673
4674         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
4675                                            params.beacon_interval);
4676         if (err)
4677                 return err;
4678
4679         /*
4680          * In theory, some of these attributes should be required here
4681          * but since they were not used when the command was originally
4682          * added, keep them optional for old user space programs to let
4683          * them continue to work with drivers that do not need the
4684          * additional information -- drivers must check!
4685          */
4686         if (info->attrs[NL80211_ATTR_SSID]) {
4687                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4688                 params.ssid_len =
4689                         nla_len(info->attrs[NL80211_ATTR_SSID]);
4690                 if (params.ssid_len == 0 ||
4691                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
4692                         return -EINVAL;
4693         }
4694
4695         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
4696                 params.hidden_ssid = nla_get_u32(
4697                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
4698
4699         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4700
4701         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4702                 params.auth_type = nla_get_u32(
4703                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
4704                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
4705                                              NL80211_CMD_START_AP))
4706                         return -EINVAL;
4707         } else
4708                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4709
4710         err = nl80211_crypto_settings(rdev, info, &params.crypto,
4711                                       NL80211_MAX_NR_CIPHER_SUITES);
4712         if (err)
4713                 return err;
4714
4715         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
4716                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
4717                         return -EOPNOTSUPP;
4718                 params.inactivity_timeout = nla_get_u16(
4719                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
4720         }
4721
4722         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4723                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4724                         return -EINVAL;
4725                 params.p2p_ctwindow =
4726                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4727                 if (params.p2p_ctwindow != 0 &&
4728                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4729                         return -EINVAL;
4730         }
4731
4732         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4733                 u8 tmp;
4734
4735                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4736                         return -EINVAL;
4737                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4738                 params.p2p_opp_ps = tmp;
4739                 if (params.p2p_opp_ps != 0 &&
4740                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4741                         return -EINVAL;
4742         }
4743
4744         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4745                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
4746                 if (err)
4747                         return err;
4748         } else if (wdev->preset_chandef.chan) {
4749                 params.chandef = wdev->preset_chandef;
4750         } else if (!nl80211_get_ap_channel(rdev, &params))
4751                 return -EINVAL;
4752
4753         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4754                                            wdev->iftype))
4755                 return -EINVAL;
4756
4757         if (info->attrs[NL80211_ATTR_TX_RATES]) {
4758                 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4759                 if (err)
4760                         return err;
4761
4762                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4763                                               &params.beacon_rate);
4764                 if (err)
4765                         return err;
4766         }
4767
4768         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4769                 params.smps_mode =
4770                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4771                 switch (params.smps_mode) {
4772                 case NL80211_SMPS_OFF:
4773                         break;
4774                 case NL80211_SMPS_STATIC:
4775                         if (!(rdev->wiphy.features &
4776                               NL80211_FEATURE_STATIC_SMPS))
4777                                 return -EINVAL;
4778                         break;
4779                 case NL80211_SMPS_DYNAMIC:
4780                         if (!(rdev->wiphy.features &
4781                               NL80211_FEATURE_DYNAMIC_SMPS))
4782                                 return -EINVAL;
4783                         break;
4784                 default:
4785                         return -EINVAL;
4786                 }
4787         } else {
4788                 params.smps_mode = NL80211_SMPS_OFF;
4789         }
4790
4791         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4792         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4793                 return -EOPNOTSUPP;
4794
4795         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4796                 params.acl = parse_acl_data(&rdev->wiphy, info);
4797                 if (IS_ERR(params.acl))
4798                         return PTR_ERR(params.acl);
4799         }
4800
4801         params.twt_responder =
4802                     nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
4803
4804         if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
4805                 err = nl80211_parse_he_obss_pd(
4806                                         info->attrs[NL80211_ATTR_HE_OBSS_PD],
4807                                         &params.he_obss_pd);
4808                 goto out;
4809         }
4810
4811         nl80211_calculate_ap_params(&params);
4812
4813         if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
4814                 params.flags |= AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
4815
4816         wdev_lock(wdev);
4817         err = rdev_start_ap(rdev, dev, &params);
4818         if (!err) {
4819                 wdev->preset_chandef = params.chandef;
4820                 wdev->beacon_interval = params.beacon_interval;
4821                 wdev->chandef = params.chandef;
4822                 wdev->ssid_len = params.ssid_len;
4823                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4824
4825                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4826                         wdev->conn_owner_nlportid = info->snd_portid;
4827         }
4828         wdev_unlock(wdev);
4829
4830 out:
4831         kfree(params.acl);
4832
4833         return err;
4834 }
4835
4836 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4837 {
4838         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4839         struct net_device *dev = info->user_ptr[1];
4840         struct wireless_dev *wdev = dev->ieee80211_ptr;
4841         struct cfg80211_beacon_data params;
4842         int err;
4843
4844         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4845             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4846                 return -EOPNOTSUPP;
4847
4848         if (!rdev->ops->change_beacon)
4849                 return -EOPNOTSUPP;
4850
4851         if (!wdev->beacon_interval)
4852                 return -EINVAL;
4853
4854         err = nl80211_parse_beacon(rdev, info->attrs, &params);
4855         if (err)
4856                 return err;
4857
4858         wdev_lock(wdev);
4859         err = rdev_change_beacon(rdev, dev, &params);
4860         wdev_unlock(wdev);
4861
4862         return err;
4863 }
4864
4865 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4866 {
4867         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4868         struct net_device *dev = info->user_ptr[1];
4869
4870         return cfg80211_stop_ap(rdev, dev, false);
4871 }
4872
4873 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4874         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4875         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4876         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4877         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4878         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4879         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4880 };
4881
4882 static int parse_station_flags(struct genl_info *info,
4883                                enum nl80211_iftype iftype,
4884                                struct station_parameters *params)
4885 {
4886         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4887         struct nlattr *nla;
4888         int flag;
4889
4890         /*
4891          * Try parsing the new attribute first so userspace
4892          * can specify both for older kernels.
4893          */
4894         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4895         if (nla) {
4896                 struct nl80211_sta_flag_update *sta_flags;
4897
4898                 sta_flags = nla_data(nla);
4899                 params->sta_flags_mask = sta_flags->mask;
4900                 params->sta_flags_set = sta_flags->set;
4901                 params->sta_flags_set &= params->sta_flags_mask;
4902                 if ((params->sta_flags_mask |
4903                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4904                         return -EINVAL;
4905                 return 0;
4906         }
4907
4908         /* if present, parse the old attribute */
4909
4910         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4911         if (!nla)
4912                 return 0;
4913
4914         if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
4915                 return -EINVAL;
4916
4917         /*
4918          * Only allow certain flags for interface types so that
4919          * other attributes are silently ignored. Remember that
4920          * this is backward compatibility code with old userspace
4921          * and shouldn't be hit in other cases anyway.
4922          */
4923         switch (iftype) {
4924         case NL80211_IFTYPE_AP:
4925         case NL80211_IFTYPE_AP_VLAN:
4926         case NL80211_IFTYPE_P2P_GO:
4927                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4928                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4929                                          BIT(NL80211_STA_FLAG_WME) |
4930                                          BIT(NL80211_STA_FLAG_MFP);
4931                 break;
4932         case NL80211_IFTYPE_P2P_CLIENT:
4933         case NL80211_IFTYPE_STATION:
4934                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4935                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
4936                 break;
4937         case NL80211_IFTYPE_MESH_POINT:
4938                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4939                                          BIT(NL80211_STA_FLAG_MFP) |
4940                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
4941                 break;
4942         default:
4943                 return -EINVAL;
4944         }
4945
4946         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4947                 if (flags[flag]) {
4948                         params->sta_flags_set |= (1<<flag);
4949
4950                         /* no longer support new API additions in old API */
4951                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4952                                 return -EINVAL;
4953                 }
4954         }
4955
4956         return 0;
4957 }
4958
4959 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
4960 {
4961         struct nlattr *rate;
4962         u32 bitrate;
4963         u16 bitrate_compat;
4964         enum nl80211_rate_info rate_flg;
4965
4966         rate = nla_nest_start_noflag(msg, attr);
4967         if (!rate)
4968                 return false;
4969
4970         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4971         bitrate = cfg80211_calculate_bitrate(info);
4972         /* report 16-bit bitrate only if we can */
4973         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4974         if (bitrate > 0 &&
4975             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4976                 return false;
4977         if (bitrate_compat > 0 &&
4978             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4979                 return false;
4980
4981         switch (info->bw) {
4982         case RATE_INFO_BW_5:
4983                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4984                 break;
4985         case RATE_INFO_BW_10:
4986                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4987                 break;
4988         default:
4989                 WARN_ON(1);
4990                 /* fall through */
4991         case RATE_INFO_BW_20:
4992                 rate_flg = 0;
4993                 break;
4994         case RATE_INFO_BW_40:
4995                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4996                 break;
4997         case RATE_INFO_BW_80:
4998                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4999                 break;
5000         case RATE_INFO_BW_160:
5001                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
5002                 break;
5003         case RATE_INFO_BW_HE_RU:
5004                 rate_flg = 0;
5005                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
5006         }
5007
5008         if (rate_flg && nla_put_flag(msg, rate_flg))
5009                 return false;
5010
5011         if (info->flags & RATE_INFO_FLAGS_MCS) {
5012                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
5013                         return false;
5014                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
5015                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
5016                         return false;
5017         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
5018                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
5019                         return false;
5020                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
5021                         return false;
5022                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
5023                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
5024                         return false;
5025         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
5026                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
5027                         return false;
5028                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
5029                         return false;
5030                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
5031                         return false;
5032                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
5033                         return false;
5034                 if (info->bw == RATE_INFO_BW_HE_RU &&
5035                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
5036                                info->he_ru_alloc))
5037                         return false;
5038         }
5039
5040         nla_nest_end(msg, rate);
5041         return true;
5042 }
5043
5044 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
5045                                int id)
5046 {
5047         void *attr;
5048         int i = 0;
5049
5050         if (!mask)
5051                 return true;
5052
5053         attr = nla_nest_start_noflag(msg, id);
5054         if (!attr)
5055                 return false;
5056
5057         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
5058                 if (!(mask & BIT(i)))
5059                         continue;
5060
5061                 if (nla_put_u8(msg, i, signal[i]))
5062                         return false;
5063         }
5064
5065         nla_nest_end(msg, attr);
5066
5067         return true;
5068 }
5069
5070 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
5071                                 u32 seq, int flags,
5072                                 struct cfg80211_registered_device *rdev,
5073                                 struct net_device *dev,
5074                                 const u8 *mac_addr, struct station_info *sinfo)
5075 {
5076         void *hdr;
5077         struct nlattr *sinfoattr, *bss_param;
5078
5079         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
5080         if (!hdr) {
5081                 cfg80211_sinfo_release_content(sinfo);
5082                 return -1;
5083         }
5084
5085         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5086             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
5087             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
5088                 goto nla_put_failure;
5089
5090         sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
5091         if (!sinfoattr)
5092                 goto nla_put_failure;
5093
5094 #define PUT_SINFO(attr, memb, type) do {                                \
5095         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
5096         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
5097             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
5098                              sinfo->memb))                              \
5099                 goto nla_put_failure;                                   \
5100         } while (0)
5101 #define PUT_SINFO_U64(attr, memb) do {                                  \
5102         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
5103             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
5104                               sinfo->memb, NL80211_STA_INFO_PAD))       \
5105                 goto nla_put_failure;                                   \
5106         } while (0)
5107
5108         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
5109         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
5110         PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
5111
5112         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
5113                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
5114             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
5115                         (u32)sinfo->rx_bytes))
5116                 goto nla_put_failure;
5117
5118         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
5119                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
5120             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
5121                         (u32)sinfo->tx_bytes))
5122                 goto nla_put_failure;
5123
5124         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
5125         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
5126         PUT_SINFO(LLID, llid, u16);
5127         PUT_SINFO(PLID, plid, u16);
5128         PUT_SINFO(PLINK_STATE, plink_state, u8);
5129         PUT_SINFO_U64(RX_DURATION, rx_duration);
5130         PUT_SINFO_U64(TX_DURATION, tx_duration);
5131
5132         if (wiphy_ext_feature_isset(&rdev->wiphy,
5133                                     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5134                 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
5135
5136         switch (rdev->wiphy.signal_type) {
5137         case CFG80211_SIGNAL_TYPE_MBM:
5138                 PUT_SINFO(SIGNAL, signal, u8);
5139                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
5140                 break;
5141         default:
5142                 break;
5143         }
5144         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
5145                 if (!nl80211_put_signal(msg, sinfo->chains,
5146                                         sinfo->chain_signal,
5147                                         NL80211_STA_INFO_CHAIN_SIGNAL))
5148                         goto nla_put_failure;
5149         }
5150         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
5151                 if (!nl80211_put_signal(msg, sinfo->chains,
5152                                         sinfo->chain_signal_avg,
5153                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
5154                         goto nla_put_failure;
5155         }
5156         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
5157                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
5158                                           NL80211_STA_INFO_TX_BITRATE))
5159                         goto nla_put_failure;
5160         }
5161         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
5162                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
5163                                           NL80211_STA_INFO_RX_BITRATE))
5164                         goto nla_put_failure;
5165         }
5166
5167         PUT_SINFO(RX_PACKETS, rx_packets, u32);
5168         PUT_SINFO(TX_PACKETS, tx_packets, u32);
5169         PUT_SINFO(TX_RETRIES, tx_retries, u32);
5170         PUT_SINFO(TX_FAILED, tx_failed, u32);
5171         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
5172         PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
5173         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
5174         PUT_SINFO(LOCAL_PM, local_pm, u32);
5175         PUT_SINFO(PEER_PM, peer_pm, u32);
5176         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
5177         PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
5178
5179         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
5180                 bss_param = nla_nest_start_noflag(msg,
5181                                                   NL80211_STA_INFO_BSS_PARAM);
5182                 if (!bss_param)
5183                         goto nla_put_failure;
5184
5185                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
5186                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
5187                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
5188                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
5189                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
5190                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
5191                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
5192                                sinfo->bss_param.dtim_period) ||
5193                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
5194                                 sinfo->bss_param.beacon_interval))
5195                         goto nla_put_failure;
5196
5197                 nla_nest_end(msg, bss_param);
5198         }
5199         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
5200             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
5201                     sizeof(struct nl80211_sta_flag_update),
5202                     &sinfo->sta_flags))
5203                 goto nla_put_failure;
5204
5205         PUT_SINFO_U64(T_OFFSET, t_offset);
5206         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
5207         PUT_SINFO_U64(BEACON_RX, rx_beacon);
5208         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
5209         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
5210         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
5211         if (wiphy_ext_feature_isset(&rdev->wiphy,
5212                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
5213                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
5214                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
5215         }
5216
5217 #undef PUT_SINFO
5218 #undef PUT_SINFO_U64
5219
5220         if (sinfo->pertid) {
5221                 struct nlattr *tidsattr;
5222                 int tid;
5223
5224                 tidsattr = nla_nest_start_noflag(msg,
5225                                                  NL80211_STA_INFO_TID_STATS);
5226                 if (!tidsattr)
5227                         goto nla_put_failure;
5228
5229                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
5230                         struct cfg80211_tid_stats *tidstats;
5231                         struct nlattr *tidattr;
5232
5233                         tidstats = &sinfo->pertid[tid];
5234
5235                         if (!tidstats->filled)
5236                                 continue;
5237
5238                         tidattr = nla_nest_start_noflag(msg, tid + 1);
5239                         if (!tidattr)
5240                                 goto nla_put_failure;
5241
5242 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
5243         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
5244             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
5245                               tidstats->memb, NL80211_TID_STATS_PAD))   \
5246                 goto nla_put_failure;                                   \
5247         } while (0)
5248
5249                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
5250                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
5251                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
5252                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
5253
5254 #undef PUT_TIDVAL_U64
5255                         if ((tidstats->filled &
5256                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
5257                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
5258                                                    NL80211_TID_STATS_TXQ_STATS))
5259                                 goto nla_put_failure;
5260
5261                         nla_nest_end(msg, tidattr);
5262                 }
5263
5264                 nla_nest_end(msg, tidsattr);
5265         }
5266
5267         nla_nest_end(msg, sinfoattr);
5268
5269         if (sinfo->assoc_req_ies_len &&
5270             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
5271                     sinfo->assoc_req_ies))
5272                 goto nla_put_failure;
5273
5274         cfg80211_sinfo_release_content(sinfo);
5275         genlmsg_end(msg, hdr);
5276         return 0;
5277
5278  nla_put_failure:
5279         cfg80211_sinfo_release_content(sinfo);
5280         genlmsg_cancel(msg, hdr);
5281         return -EMSGSIZE;
5282 }
5283
5284 static int nl80211_dump_station(struct sk_buff *skb,
5285                                 struct netlink_callback *cb)
5286 {
5287         struct station_info sinfo;
5288         struct cfg80211_registered_device *rdev;
5289         struct wireless_dev *wdev;
5290         u8 mac_addr[ETH_ALEN];
5291         int sta_idx = cb->args[2];
5292         int err;
5293
5294         rtnl_lock();
5295         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5296         if (err)
5297                 goto out_err;
5298
5299         if (!wdev->netdev) {
5300                 err = -EINVAL;
5301                 goto out_err;
5302         }
5303
5304         if (!rdev->ops->dump_station) {
5305                 err = -EOPNOTSUPP;
5306                 goto out_err;
5307         }
5308
5309         while (1) {
5310                 memset(&sinfo, 0, sizeof(sinfo));
5311                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
5312                                         mac_addr, &sinfo);
5313                 if (err == -ENOENT)
5314                         break;
5315                 if (err)
5316                         goto out_err;
5317
5318                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
5319                                 NETLINK_CB(cb->skb).portid,
5320                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5321                                 rdev, wdev->netdev, mac_addr,
5322                                 &sinfo) < 0)
5323                         goto out;
5324
5325                 sta_idx++;
5326         }
5327
5328  out:
5329         cb->args[2] = sta_idx;
5330         err = skb->len;
5331  out_err:
5332         rtnl_unlock();
5333
5334         return err;
5335 }
5336
5337 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
5338 {
5339         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5340         struct net_device *dev = info->user_ptr[1];
5341         struct station_info sinfo;
5342         struct sk_buff *msg;
5343         u8 *mac_addr = NULL;
5344         int err;
5345
5346         memset(&sinfo, 0, sizeof(sinfo));
5347
5348         if (!info->attrs[NL80211_ATTR_MAC])
5349                 return -EINVAL;
5350
5351         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5352
5353         if (!rdev->ops->get_station)
5354                 return -EOPNOTSUPP;
5355
5356         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
5357         if (err)
5358                 return err;
5359
5360         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5361         if (!msg) {
5362                 cfg80211_sinfo_release_content(&sinfo);
5363                 return -ENOMEM;
5364         }
5365
5366         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
5367                                  info->snd_portid, info->snd_seq, 0,
5368                                  rdev, dev, mac_addr, &sinfo) < 0) {
5369                 nlmsg_free(msg);
5370                 return -ENOBUFS;
5371         }
5372
5373         return genlmsg_reply(msg, info);
5374 }
5375
5376 int cfg80211_check_station_change(struct wiphy *wiphy,
5377                                   struct station_parameters *params,
5378                                   enum cfg80211_station_type statype)
5379 {
5380         if (params->listen_interval != -1 &&
5381             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5382                 return -EINVAL;
5383
5384         if (params->support_p2p_ps != -1 &&
5385             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5386                 return -EINVAL;
5387
5388         if (params->aid &&
5389             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
5390             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5391                 return -EINVAL;
5392
5393         /* When you run into this, adjust the code below for the new flag */
5394         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5395
5396         switch (statype) {
5397         case CFG80211_STA_MESH_PEER_KERNEL:
5398         case CFG80211_STA_MESH_PEER_USER:
5399                 /*
5400                  * No ignoring the TDLS flag here -- the userspace mesh
5401                  * code doesn't have the bug of including TDLS in the
5402                  * mask everywhere.
5403                  */
5404                 if (params->sta_flags_mask &
5405                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5406                                   BIT(NL80211_STA_FLAG_MFP) |
5407                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
5408                         return -EINVAL;
5409                 break;
5410         case CFG80211_STA_TDLS_PEER_SETUP:
5411         case CFG80211_STA_TDLS_PEER_ACTIVE:
5412                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5413                         return -EINVAL;
5414                 /* ignore since it can't change */
5415                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5416                 break;
5417         default:
5418                 /* disallow mesh-specific things */
5419                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
5420                         return -EINVAL;
5421                 if (params->local_pm)
5422                         return -EINVAL;
5423                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5424                         return -EINVAL;
5425         }
5426
5427         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
5428             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
5429                 /* TDLS can't be set, ... */
5430                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
5431                         return -EINVAL;
5432                 /*
5433                  * ... but don't bother the driver with it. This works around
5434                  * a hostapd/wpa_supplicant issue -- it always includes the
5435                  * TLDS_PEER flag in the mask even for AP mode.
5436                  */
5437                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5438         }
5439
5440         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
5441             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5442                 /* reject other things that can't change */
5443                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
5444                         return -EINVAL;
5445                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
5446                         return -EINVAL;
5447                 if (params->supported_rates)
5448                         return -EINVAL;
5449                 if (params->ext_capab || params->ht_capa || params->vht_capa ||
5450                     params->he_capa)
5451                         return -EINVAL;
5452         }
5453
5454         if (statype != CFG80211_STA_AP_CLIENT &&
5455             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5456                 if (params->vlan)
5457                         return -EINVAL;
5458         }
5459
5460         switch (statype) {
5461         case CFG80211_STA_AP_MLME_CLIENT:
5462                 /* Use this only for authorizing/unauthorizing a station */
5463                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5464                         return -EOPNOTSUPP;
5465                 break;
5466         case CFG80211_STA_AP_CLIENT:
5467         case CFG80211_STA_AP_CLIENT_UNASSOC:
5468                 /* accept only the listed bits */
5469                 if (params->sta_flags_mask &
5470                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5471                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5472                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
5473                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5474                                   BIT(NL80211_STA_FLAG_WME) |
5475                                   BIT(NL80211_STA_FLAG_MFP)))
5476                         return -EINVAL;
5477
5478                 /* but authenticated/associated only if driver handles it */
5479                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5480                     params->sta_flags_mask &
5481                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5482                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
5483                         return -EINVAL;
5484                 break;
5485         case CFG80211_STA_IBSS:
5486         case CFG80211_STA_AP_STA:
5487                 /* reject any changes other than AUTHORIZED */
5488                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
5489                         return -EINVAL;
5490                 break;
5491         case CFG80211_STA_TDLS_PEER_SETUP:
5492                 /* reject any changes other than AUTHORIZED or WME */
5493                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5494                                                BIT(NL80211_STA_FLAG_WME)))
5495                         return -EINVAL;
5496                 /* force (at least) rates when authorizing */
5497                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
5498                     !params->supported_rates)
5499                         return -EINVAL;
5500                 break;
5501         case CFG80211_STA_TDLS_PEER_ACTIVE:
5502                 /* reject any changes */
5503                 return -EINVAL;
5504         case CFG80211_STA_MESH_PEER_KERNEL:
5505                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5506                         return -EINVAL;
5507                 break;
5508         case CFG80211_STA_MESH_PEER_USER:
5509                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
5510                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
5511                         return -EINVAL;
5512                 break;
5513         }
5514
5515         /*
5516          * Older kernel versions ignored this attribute entirely, so don't
5517          * reject attempts to update it but mark it as unused instead so the
5518          * driver won't look at the data.
5519          */
5520         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
5521             statype != CFG80211_STA_TDLS_PEER_SETUP)
5522                 params->opmode_notif_used = false;
5523
5524         return 0;
5525 }
5526 EXPORT_SYMBOL(cfg80211_check_station_change);
5527
5528 /*
5529  * Get vlan interface making sure it is running and on the right wiphy.
5530  */
5531 static struct net_device *get_vlan(struct genl_info *info,
5532                                    struct cfg80211_registered_device *rdev)
5533 {
5534         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
5535         struct net_device *v;
5536         int ret;
5537
5538         if (!vlanattr)
5539                 return NULL;
5540
5541         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
5542         if (!v)
5543                 return ERR_PTR(-ENODEV);
5544
5545         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
5546                 ret = -EINVAL;
5547                 goto error;
5548         }
5549
5550         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5551             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5552             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5553                 ret = -EINVAL;
5554                 goto error;
5555         }
5556
5557         if (!netif_running(v)) {
5558                 ret = -ENETDOWN;
5559                 goto error;
5560         }
5561
5562         return v;
5563  error:
5564         dev_put(v);
5565         return ERR_PTR(ret);
5566 }
5567
5568 static const struct nla_policy
5569 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
5570         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
5571         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
5572 };
5573
5574 static int nl80211_parse_sta_wme(struct genl_info *info,
5575                                  struct station_parameters *params)
5576 {
5577         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
5578         struct nlattr *nla;
5579         int err;
5580
5581         /* parse WME attributes if present */
5582         if (!info->attrs[NL80211_ATTR_STA_WME])
5583                 return 0;
5584
5585         nla = info->attrs[NL80211_ATTR_STA_WME];
5586         err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
5587                                           nl80211_sta_wme_policy,
5588                                           info->extack);
5589         if (err)
5590                 return err;
5591
5592         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
5593                 params->uapsd_queues = nla_get_u8(
5594                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
5595         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
5596                 return -EINVAL;
5597
5598         if (tb[NL80211_STA_WME_MAX_SP])
5599                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
5600
5601         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
5602                 return -EINVAL;
5603
5604         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
5605
5606         return 0;
5607 }
5608
5609 static int nl80211_parse_sta_channel_info(struct genl_info *info,
5610                                       struct station_parameters *params)
5611 {
5612         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
5613                 params->supported_channels =
5614                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5615                 params->supported_channels_len =
5616                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5617                 /*
5618                  * Need to include at least one (first channel, number of
5619                  * channels) tuple for each subband, and must have proper
5620                  * tuples for the rest of the data as well.
5621                  */
5622                 if (params->supported_channels_len < 2)
5623                         return -EINVAL;
5624                 if (params->supported_channels_len % 2)
5625                         return -EINVAL;
5626         }
5627
5628         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
5629                 params->supported_oper_classes =
5630                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5631                 params->supported_oper_classes_len =
5632                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5633                 /*
5634                  * The value of the Length field of the Supported Operating
5635                  * Classes element is between 2 and 253.
5636                  */
5637                 if (params->supported_oper_classes_len < 2 ||
5638                     params->supported_oper_classes_len > 253)
5639                         return -EINVAL;
5640         }
5641         return 0;
5642 }
5643
5644 static int nl80211_set_station_tdls(struct genl_info *info,
5645                                     struct station_parameters *params)
5646 {
5647         int err;
5648         /* Dummy STA entry gets updated once the peer capabilities are known */
5649         if (info->attrs[NL80211_ATTR_PEER_AID])
5650                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5651         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5652                 params->ht_capa =
5653                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5654         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5655                 params->vht_capa =
5656                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5657         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5658                 params->he_capa =
5659                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5660                 params->he_capa_len =
5661                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5662
5663                 if (params->he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5664                         return -EINVAL;
5665         }
5666
5667         err = nl80211_parse_sta_channel_info(info, params);
5668         if (err)
5669                 return err;
5670
5671         return nl80211_parse_sta_wme(info, params);
5672 }
5673
5674 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
5675                                              struct station_parameters *params)
5676 {
5677         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5678         int idx;
5679
5680         if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
5681                 if (!rdev->ops->set_tx_power ||
5682                     !wiphy_ext_feature_isset(&rdev->wiphy,
5683                                          NL80211_EXT_FEATURE_STA_TX_PWR))
5684                         return -EOPNOTSUPP;
5685
5686                 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
5687                 params->txpwr.type = nla_get_u8(info->attrs[idx]);
5688
5689                 if (params->txpwr.type == NL80211_TX_POWER_LIMITED) {
5690                         idx = NL80211_ATTR_STA_TX_POWER;
5691
5692                         if (info->attrs[idx])
5693                                 params->txpwr.power =
5694                                         nla_get_s16(info->attrs[idx]);
5695                         else
5696                                 return -EINVAL;
5697                 }
5698                 params->sta_modify_mask |= STATION_PARAM_APPLY_STA_TXPOWER;
5699         }
5700
5701         return 0;
5702 }
5703
5704 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
5705 {
5706         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5707         struct net_device *dev = info->user_ptr[1];
5708         struct station_parameters params;
5709         u8 *mac_addr;
5710         int err;
5711
5712         memset(&params, 0, sizeof(params));
5713
5714         if (!rdev->ops->change_station)
5715                 return -EOPNOTSUPP;
5716
5717         /*
5718          * AID and listen_interval properties can be set only for unassociated
5719          * station. Include these parameters here and will check them in
5720          * cfg80211_check_station_change().
5721          */
5722         if (info->attrs[NL80211_ATTR_STA_AID])
5723                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5724
5725         if (info->attrs[NL80211_ATTR_VLAN_ID])
5726                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
5727
5728         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5729                 params.listen_interval =
5730                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5731         else
5732                 params.listen_interval = -1;
5733
5734         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
5735                 params.support_p2p_ps =
5736                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5737         else
5738                 params.support_p2p_ps = -1;
5739
5740         if (!info->attrs[NL80211_ATTR_MAC])
5741                 return -EINVAL;
5742
5743         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5744
5745         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
5746                 params.supported_rates =
5747                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5748                 params.supported_rates_len =
5749                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5750         }
5751
5752         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5753                 params.capability =
5754                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5755                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5756         }
5757
5758         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5759                 params.ext_capab =
5760                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5761                 params.ext_capab_len =
5762                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5763         }
5764
5765         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5766                 return -EINVAL;
5767
5768         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
5769                 params.plink_action =
5770                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5771
5772         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
5773                 params.plink_state =
5774                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
5775                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
5776                         params.peer_aid = nla_get_u16(
5777                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
5778                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
5779         }
5780
5781         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
5782                 params.local_pm = nla_get_u32(
5783                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
5784
5785         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5786                 params.opmode_notif_used = true;
5787                 params.opmode_notif =
5788                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5789         }
5790
5791         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
5792                 params.airtime_weight =
5793                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
5794
5795         if (params.airtime_weight &&
5796             !wiphy_ext_feature_isset(&rdev->wiphy,
5797                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5798                 return -EOPNOTSUPP;
5799
5800         err = nl80211_parse_sta_txpower_setting(info, &params);
5801         if (err)
5802                 return err;
5803
5804         /* Include parameters for TDLS peer (will check later) */
5805         err = nl80211_set_station_tdls(info, &params);
5806         if (err)
5807                 return err;
5808
5809         params.vlan = get_vlan(info, rdev);
5810         if (IS_ERR(params.vlan))
5811                 return PTR_ERR(params.vlan);
5812
5813         switch (dev->ieee80211_ptr->iftype) {
5814         case NL80211_IFTYPE_AP:
5815         case NL80211_IFTYPE_AP_VLAN:
5816         case NL80211_IFTYPE_P2P_GO:
5817         case NL80211_IFTYPE_P2P_CLIENT:
5818         case NL80211_IFTYPE_STATION:
5819         case NL80211_IFTYPE_ADHOC:
5820         case NL80211_IFTYPE_MESH_POINT:
5821                 break;
5822         default:
5823                 err = -EOPNOTSUPP;
5824                 goto out_put_vlan;
5825         }
5826
5827         /* driver will call cfg80211_check_station_change() */
5828         err = rdev_change_station(rdev, dev, mac_addr, &params);
5829
5830  out_put_vlan:
5831         if (params.vlan)
5832                 dev_put(params.vlan);
5833
5834         return err;
5835 }
5836
5837 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
5838 {
5839         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5840         int err;
5841         struct net_device *dev = info->user_ptr[1];
5842         struct station_parameters params;
5843         u8 *mac_addr = NULL;
5844         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5845                          BIT(NL80211_STA_FLAG_ASSOCIATED);
5846
5847         memset(&params, 0, sizeof(params));
5848
5849         if (!rdev->ops->add_station)
5850                 return -EOPNOTSUPP;
5851
5852         if (!info->attrs[NL80211_ATTR_MAC])
5853                 return -EINVAL;
5854
5855         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5856                 return -EINVAL;
5857
5858         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
5859                 return -EINVAL;
5860
5861         if (!info->attrs[NL80211_ATTR_STA_AID] &&
5862             !info->attrs[NL80211_ATTR_PEER_AID])
5863                 return -EINVAL;
5864
5865         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5866         params.supported_rates =
5867                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5868         params.supported_rates_len =
5869                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5870         params.listen_interval =
5871                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5872
5873         if (info->attrs[NL80211_ATTR_VLAN_ID])
5874                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
5875
5876         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5877                 params.support_p2p_ps =
5878                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5879         } else {
5880                 /*
5881                  * if not specified, assume it's supported for P2P GO interface,
5882                  * and is NOT supported for AP interface
5883                  */
5884                 params.support_p2p_ps =
5885                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5886         }
5887
5888         if (info->attrs[NL80211_ATTR_PEER_AID])
5889                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5890         else
5891                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5892
5893         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5894                 params.capability =
5895                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5896                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5897         }
5898
5899         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5900                 params.ext_capab =
5901                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5902                 params.ext_capab_len =
5903                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5904         }
5905
5906         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5907                 params.ht_capa =
5908                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5909
5910         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5911                 params.vht_capa =
5912                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5913
5914         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5915                 params.he_capa =
5916                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5917                 params.he_capa_len =
5918                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5919
5920                 /* max len is validated in nla policy */
5921                 if (params.he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5922                         return -EINVAL;
5923         }
5924
5925         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5926                 params.opmode_notif_used = true;
5927                 params.opmode_notif =
5928                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5929         }
5930
5931         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
5932                 params.plink_action =
5933                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5934
5935         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
5936                 params.airtime_weight =
5937                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
5938
5939         if (params.airtime_weight &&
5940             !wiphy_ext_feature_isset(&rdev->wiphy,
5941                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5942                 return -EOPNOTSUPP;
5943
5944         err = nl80211_parse_sta_txpower_setting(info, &params);
5945         if (err)
5946                 return err;
5947
5948         err = nl80211_parse_sta_channel_info(info, &params);
5949         if (err)
5950                 return err;
5951
5952         err = nl80211_parse_sta_wme(info, &params);
5953         if (err)
5954                 return err;
5955
5956         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5957                 return -EINVAL;
5958
5959         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5960          * as userspace might just pass through the capabilities from the IEs
5961          * directly, rather than enforcing this restriction and returning an
5962          * error in this case.
5963          */
5964         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5965                 params.ht_capa = NULL;
5966                 params.vht_capa = NULL;
5967
5968                 /* HE requires WME */
5969                 if (params.he_capa_len)
5970                         return -EINVAL;
5971         }
5972
5973         /* When you run into this, adjust the code below for the new flag */
5974         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5975
5976         switch (dev->ieee80211_ptr->iftype) {
5977         case NL80211_IFTYPE_AP:
5978         case NL80211_IFTYPE_AP_VLAN:
5979         case NL80211_IFTYPE_P2P_GO:
5980                 /* ignore WME attributes if iface/sta is not capable */
5981                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5982                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5983                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5984
5985                 /* TDLS peers cannot be added */
5986                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5987                     info->attrs[NL80211_ATTR_PEER_AID])
5988                         return -EINVAL;
5989                 /* but don't bother the driver with it */
5990                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5991
5992                 /* allow authenticated/associated only if driver handles it */
5993                 if (!(rdev->wiphy.features &
5994                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5995                     params.sta_flags_mask & auth_assoc)
5996                         return -EINVAL;
5997
5998                 /* Older userspace, or userspace wanting to be compatible with
5999                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
6000                  * and assoc flags in the mask, but assumes the station will be
6001                  * added as associated anyway since this was the required driver
6002                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
6003                  * introduced.
6004                  * In order to not bother drivers with this quirk in the API
6005                  * set the flags in both the mask and set for new stations in
6006                  * this case.
6007                  */
6008                 if (!(params.sta_flags_mask & auth_assoc)) {
6009                         params.sta_flags_mask |= auth_assoc;
6010                         params.sta_flags_set |= auth_assoc;
6011                 }
6012
6013                 /* must be last in here for error handling */
6014                 params.vlan = get_vlan(info, rdev);
6015                 if (IS_ERR(params.vlan))
6016                         return PTR_ERR(params.vlan);
6017                 break;
6018         case NL80211_IFTYPE_MESH_POINT:
6019                 /* ignore uAPSD data */
6020                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6021
6022                 /* associated is disallowed */
6023                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
6024                         return -EINVAL;
6025                 /* TDLS peers cannot be added */
6026                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
6027                     info->attrs[NL80211_ATTR_PEER_AID])
6028                         return -EINVAL;
6029                 break;
6030         case NL80211_IFTYPE_STATION:
6031         case NL80211_IFTYPE_P2P_CLIENT:
6032                 /* ignore uAPSD data */
6033                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6034
6035                 /* these are disallowed */
6036                 if (params.sta_flags_mask &
6037                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
6038                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
6039                         return -EINVAL;
6040                 /* Only TDLS peers can be added */
6041                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6042                         return -EINVAL;
6043                 /* Can only add if TDLS ... */
6044                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
6045                         return -EOPNOTSUPP;
6046                 /* ... with external setup is supported */
6047                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
6048                         return -EOPNOTSUPP;
6049                 /*
6050                  * Older wpa_supplicant versions always mark the TDLS peer
6051                  * as authorized, but it shouldn't yet be.
6052                  */
6053                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
6054                 break;
6055         default:
6056                 return -EOPNOTSUPP;
6057         }
6058
6059         /* be aware of params.vlan when changing code here */
6060
6061         err = rdev_add_station(rdev, dev, mac_addr, &params);
6062
6063         if (params.vlan)
6064                 dev_put(params.vlan);
6065         return err;
6066 }
6067
6068 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
6069 {
6070         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6071         struct net_device *dev = info->user_ptr[1];
6072         struct station_del_parameters params;
6073
6074         memset(&params, 0, sizeof(params));
6075
6076         if (info->attrs[NL80211_ATTR_MAC])
6077                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
6078
6079         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6080             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
6081             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
6082             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6083                 return -EINVAL;
6084
6085         if (!rdev->ops->del_station)
6086                 return -EOPNOTSUPP;
6087
6088         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
6089                 params.subtype =
6090                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
6091                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
6092                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
6093                         return -EINVAL;
6094         } else {
6095                 /* Default to Deauthentication frame */
6096                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
6097         }
6098
6099         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
6100                 params.reason_code =
6101                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6102                 if (params.reason_code == 0)
6103                         return -EINVAL; /* 0 is reserved */
6104         } else {
6105                 /* Default to reason code 2 */
6106                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
6107         }
6108
6109         return rdev_del_station(rdev, dev, &params);
6110 }
6111
6112 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
6113                                 int flags, struct net_device *dev,
6114                                 u8 *dst, u8 *next_hop,
6115                                 struct mpath_info *pinfo)
6116 {
6117         void *hdr;
6118         struct nlattr *pinfoattr;
6119
6120         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
6121         if (!hdr)
6122                 return -1;
6123
6124         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6125             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
6126             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
6127             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
6128                 goto nla_put_failure;
6129
6130         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
6131         if (!pinfoattr)
6132                 goto nla_put_failure;
6133         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
6134             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
6135                         pinfo->frame_qlen))
6136                 goto nla_put_failure;
6137         if (((pinfo->filled & MPATH_INFO_SN) &&
6138              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
6139             ((pinfo->filled & MPATH_INFO_METRIC) &&
6140              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
6141                          pinfo->metric)) ||
6142             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
6143              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
6144                          pinfo->exptime)) ||
6145             ((pinfo->filled & MPATH_INFO_FLAGS) &&
6146              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
6147                         pinfo->flags)) ||
6148             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
6149              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
6150                          pinfo->discovery_timeout)) ||
6151             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
6152              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
6153                         pinfo->discovery_retries)) ||
6154             ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
6155              nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
6156                         pinfo->hop_count)) ||
6157             ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
6158              nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
6159                          pinfo->path_change_count)))
6160                 goto nla_put_failure;
6161
6162         nla_nest_end(msg, pinfoattr);
6163
6164         genlmsg_end(msg, hdr);
6165         return 0;
6166
6167  nla_put_failure:
6168         genlmsg_cancel(msg, hdr);
6169         return -EMSGSIZE;
6170 }
6171
6172 static int nl80211_dump_mpath(struct sk_buff *skb,
6173                               struct netlink_callback *cb)
6174 {
6175         struct mpath_info pinfo;
6176         struct cfg80211_registered_device *rdev;
6177         struct wireless_dev *wdev;
6178         u8 dst[ETH_ALEN];
6179         u8 next_hop[ETH_ALEN];
6180         int path_idx = cb->args[2];
6181         int err;
6182
6183         rtnl_lock();
6184         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
6185         if (err)
6186                 goto out_err;
6187
6188         if (!rdev->ops->dump_mpath) {
6189                 err = -EOPNOTSUPP;
6190                 goto out_err;
6191         }
6192
6193         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6194                 err = -EOPNOTSUPP;
6195                 goto out_err;
6196         }
6197
6198         while (1) {
6199                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
6200                                       next_hop, &pinfo);
6201                 if (err == -ENOENT)
6202                         break;
6203                 if (err)
6204                         goto out_err;
6205
6206                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
6207                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
6208                                        wdev->netdev, dst, next_hop,
6209                                        &pinfo) < 0)
6210                         goto out;
6211
6212                 path_idx++;
6213         }
6214
6215  out:
6216         cb->args[2] = path_idx;
6217         err = skb->len;
6218  out_err:
6219         rtnl_unlock();
6220         return err;
6221 }
6222
6223 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
6224 {
6225         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6226         int err;
6227         struct net_device *dev = info->user_ptr[1];
6228         struct mpath_info pinfo;
6229         struct sk_buff *msg;
6230         u8 *dst = NULL;
6231         u8 next_hop[ETH_ALEN];
6232
6233         memset(&pinfo, 0, sizeof(pinfo));
6234
6235         if (!info->attrs[NL80211_ATTR_MAC])
6236                 return -EINVAL;
6237
6238         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6239
6240         if (!rdev->ops->get_mpath)
6241                 return -EOPNOTSUPP;
6242
6243         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6244                 return -EOPNOTSUPP;
6245
6246         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
6247         if (err)
6248                 return err;
6249
6250         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6251         if (!msg)
6252                 return -ENOMEM;
6253
6254         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6255                                  dev, dst, next_hop, &pinfo) < 0) {
6256                 nlmsg_free(msg);
6257                 return -ENOBUFS;
6258         }
6259
6260         return genlmsg_reply(msg, info);
6261 }
6262
6263 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
6264 {
6265         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6266         struct net_device *dev = info->user_ptr[1];
6267         u8 *dst = NULL;
6268         u8 *next_hop = NULL;
6269
6270         if (!info->attrs[NL80211_ATTR_MAC])
6271                 return -EINVAL;
6272
6273         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6274                 return -EINVAL;
6275
6276         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6277         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6278
6279         if (!rdev->ops->change_mpath)
6280                 return -EOPNOTSUPP;
6281
6282         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6283                 return -EOPNOTSUPP;
6284
6285         return rdev_change_mpath(rdev, dev, dst, next_hop);
6286 }
6287
6288 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
6289 {
6290         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6291         struct net_device *dev = info->user_ptr[1];
6292         u8 *dst = NULL;
6293         u8 *next_hop = NULL;
6294
6295         if (!info->attrs[NL80211_ATTR_MAC])
6296                 return -EINVAL;
6297
6298         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6299                 return -EINVAL;
6300
6301         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6302         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6303
6304         if (!rdev->ops->add_mpath)
6305                 return -EOPNOTSUPP;
6306
6307         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6308                 return -EOPNOTSUPP;
6309
6310         return rdev_add_mpath(rdev, dev, dst, next_hop);
6311 }
6312
6313 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
6314 {
6315         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6316         struct net_device *dev = info->user_ptr[1];
6317         u8 *dst = NULL;
6318
6319         if (info->attrs[NL80211_ATTR_MAC])
6320                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6321
6322         if (!rdev->ops->del_mpath)
6323                 return -EOPNOTSUPP;
6324
6325         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6326                 return -EOPNOTSUPP;
6327
6328         return rdev_del_mpath(rdev, dev, dst);
6329 }
6330
6331 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
6332 {
6333         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6334         int err;
6335         struct net_device *dev = info->user_ptr[1];
6336         struct mpath_info pinfo;
6337         struct sk_buff *msg;
6338         u8 *dst = NULL;
6339         u8 mpp[ETH_ALEN];
6340
6341         memset(&pinfo, 0, sizeof(pinfo));
6342
6343         if (!info->attrs[NL80211_ATTR_MAC])
6344                 return -EINVAL;
6345
6346         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6347
6348         if (!rdev->ops->get_mpp)
6349                 return -EOPNOTSUPP;
6350
6351         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6352                 return -EOPNOTSUPP;
6353
6354         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
6355         if (err)
6356                 return err;
6357
6358         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6359         if (!msg)
6360                 return -ENOMEM;
6361
6362         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6363                                dev, dst, mpp, &pinfo) < 0) {
6364                 nlmsg_free(msg);
6365                 return -ENOBUFS;
6366         }
6367
6368         return genlmsg_reply(msg, info);
6369 }
6370
6371 static int nl80211_dump_mpp(struct sk_buff *skb,
6372                             struct netlink_callback *cb)
6373 {
6374         struct mpath_info pinfo;
6375         struct cfg80211_registered_device *rdev;
6376         struct wireless_dev *wdev;
6377         u8 dst[ETH_ALEN];
6378         u8 mpp[ETH_ALEN];
6379         int path_idx = cb->args[2];
6380         int err;
6381
6382         rtnl_lock();
6383         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
6384         if (err)
6385                 goto out_err;
6386
6387         if (!rdev->ops->dump_mpp) {
6388                 err = -EOPNOTSUPP;
6389                 goto out_err;
6390         }
6391
6392         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6393                 err = -EOPNOTSUPP;
6394                 goto out_err;
6395         }
6396
6397         while (1) {
6398                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
6399                                     mpp, &pinfo);
6400                 if (err == -ENOENT)
6401                         break;
6402                 if (err)
6403                         goto out_err;
6404
6405                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
6406                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
6407                                        wdev->netdev, dst, mpp,
6408                                        &pinfo) < 0)
6409                         goto out;
6410
6411                 path_idx++;
6412         }
6413
6414  out:
6415         cb->args[2] = path_idx;
6416         err = skb->len;
6417  out_err:
6418         rtnl_unlock();
6419         return err;
6420 }
6421
6422 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
6423 {
6424         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6425         struct net_device *dev = info->user_ptr[1];
6426         struct wireless_dev *wdev = dev->ieee80211_ptr;
6427         struct bss_parameters params;
6428         int err;
6429
6430         memset(&params, 0, sizeof(params));
6431         /* default to not changing parameters */
6432         params.use_cts_prot = -1;
6433         params.use_short_preamble = -1;
6434         params.use_short_slot_time = -1;
6435         params.ap_isolate = -1;
6436         params.ht_opmode = -1;
6437         params.p2p_ctwindow = -1;
6438         params.p2p_opp_ps = -1;
6439
6440         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
6441                 params.use_cts_prot =
6442                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
6443         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
6444                 params.use_short_preamble =
6445                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
6446         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
6447                 params.use_short_slot_time =
6448                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
6449         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6450                 params.basic_rates =
6451                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6452                 params.basic_rates_len =
6453                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6454         }
6455         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
6456                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
6457         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
6458                 params.ht_opmode =
6459                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
6460
6461         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6462                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6463                         return -EINVAL;
6464                 params.p2p_ctwindow =
6465                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6466                 if (params.p2p_ctwindow != 0 &&
6467                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
6468                         return -EINVAL;
6469         }
6470
6471         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6472                 u8 tmp;
6473
6474                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6475                         return -EINVAL;
6476                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6477                 params.p2p_opp_ps = tmp;
6478                 if (params.p2p_opp_ps &&
6479                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
6480                         return -EINVAL;
6481         }
6482
6483         if (!rdev->ops->change_bss)
6484                 return -EOPNOTSUPP;
6485
6486         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6487             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6488                 return -EOPNOTSUPP;
6489
6490         wdev_lock(wdev);
6491         err = rdev_change_bss(rdev, dev, &params);
6492         wdev_unlock(wdev);
6493
6494         return err;
6495 }
6496
6497 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
6498 {
6499         char *data = NULL;
6500         bool is_indoor;
6501         enum nl80211_user_reg_hint_type user_reg_hint_type;
6502         u32 owner_nlportid;
6503
6504         /*
6505          * You should only get this when cfg80211 hasn't yet initialized
6506          * completely when built-in to the kernel right between the time
6507          * window between nl80211_init() and regulatory_init(), if that is
6508          * even possible.
6509          */
6510         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
6511                 return -EINPROGRESS;
6512
6513         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
6514                 user_reg_hint_type =
6515                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
6516         else
6517                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
6518
6519         switch (user_reg_hint_type) {
6520         case NL80211_USER_REG_HINT_USER:
6521         case NL80211_USER_REG_HINT_CELL_BASE:
6522                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6523                         return -EINVAL;
6524
6525                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6526                 return regulatory_hint_user(data, user_reg_hint_type);
6527         case NL80211_USER_REG_HINT_INDOOR:
6528                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
6529                         owner_nlportid = info->snd_portid;
6530                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
6531                 } else {
6532                         owner_nlportid = 0;
6533                         is_indoor = true;
6534                 }
6535
6536                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
6537         default:
6538                 return -EINVAL;
6539         }
6540 }
6541
6542 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
6543 {
6544         return reg_reload_regdb();
6545 }
6546
6547 static int nl80211_get_mesh_config(struct sk_buff *skb,
6548                                    struct genl_info *info)
6549 {
6550         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6551         struct net_device *dev = info->user_ptr[1];
6552         struct wireless_dev *wdev = dev->ieee80211_ptr;
6553         struct mesh_config cur_params;
6554         int err = 0;
6555         void *hdr;
6556         struct nlattr *pinfoattr;
6557         struct sk_buff *msg;
6558
6559         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6560                 return -EOPNOTSUPP;
6561
6562         if (!rdev->ops->get_mesh_config)
6563                 return -EOPNOTSUPP;
6564
6565         wdev_lock(wdev);
6566         /* If not connected, get default parameters */
6567         if (!wdev->mesh_id_len)
6568                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
6569         else
6570                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
6571         wdev_unlock(wdev);
6572
6573         if (err)
6574                 return err;
6575
6576         /* Draw up a netlink message to send back */
6577         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6578         if (!msg)
6579                 return -ENOMEM;
6580         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6581                              NL80211_CMD_GET_MESH_CONFIG);
6582         if (!hdr)
6583                 goto out;
6584         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
6585         if (!pinfoattr)
6586                 goto nla_put_failure;
6587         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6588             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
6589                         cur_params.dot11MeshRetryTimeout) ||
6590             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
6591                         cur_params.dot11MeshConfirmTimeout) ||
6592             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
6593                         cur_params.dot11MeshHoldingTimeout) ||
6594             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
6595                         cur_params.dot11MeshMaxPeerLinks) ||
6596             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
6597                        cur_params.dot11MeshMaxRetries) ||
6598             nla_put_u8(msg, NL80211_MESHCONF_TTL,
6599                        cur_params.dot11MeshTTL) ||
6600             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
6601                        cur_params.element_ttl) ||
6602             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6603                        cur_params.auto_open_plinks) ||
6604             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6605                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
6606             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6607                        cur_params.dot11MeshHWMPmaxPREQretries) ||
6608             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
6609                         cur_params.path_refresh_time) ||
6610             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6611                         cur_params.min_discovery_timeout) ||
6612             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6613                         cur_params.dot11MeshHWMPactivePathTimeout) ||
6614             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6615                         cur_params.dot11MeshHWMPpreqMinInterval) ||
6616             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6617                         cur_params.dot11MeshHWMPperrMinInterval) ||
6618             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6619                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
6620             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
6621                        cur_params.dot11MeshHWMPRootMode) ||
6622             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6623                         cur_params.dot11MeshHWMPRannInterval) ||
6624             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6625                        cur_params.dot11MeshGateAnnouncementProtocol) ||
6626             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
6627                        cur_params.dot11MeshForwarding) ||
6628             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
6629                         cur_params.rssi_threshold) ||
6630             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
6631                         cur_params.ht_opmode) ||
6632             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6633                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
6634             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6635                         cur_params.dot11MeshHWMProotInterval) ||
6636             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6637                         cur_params.dot11MeshHWMPconfirmationInterval) ||
6638             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
6639                         cur_params.power_mode) ||
6640             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
6641                         cur_params.dot11MeshAwakeWindowDuration) ||
6642             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
6643                         cur_params.plink_timeout) ||
6644             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
6645                        cur_params.dot11MeshConnectedToMeshGate))
6646                 goto nla_put_failure;
6647         nla_nest_end(msg, pinfoattr);
6648         genlmsg_end(msg, hdr);
6649         return genlmsg_reply(msg, info);
6650
6651  nla_put_failure:
6652  out:
6653         nlmsg_free(msg);
6654         return -ENOBUFS;
6655 }
6656
6657 static const struct nla_policy
6658 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
6659         [NL80211_MESHCONF_RETRY_TIMEOUT] =
6660                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6661         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
6662                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6663         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
6664                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6665         [NL80211_MESHCONF_MAX_PEER_LINKS] =
6666                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
6667         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
6668         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6669         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6670         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
6671         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
6672                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
6673         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
6674         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
6675         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
6676         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
6677         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
6678                 NLA_POLICY_MIN(NLA_U16, 1),
6679         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
6680                 NLA_POLICY_MIN(NLA_U16, 1),
6681         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
6682                 NLA_POLICY_MIN(NLA_U16, 1),
6683         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
6684         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
6685                 NLA_POLICY_MIN(NLA_U16, 1),
6686         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
6687         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
6688         [NL80211_MESHCONF_RSSI_THRESHOLD] =
6689                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
6690         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
6691         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
6692         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
6693                 NLA_POLICY_MIN(NLA_U16, 1),
6694         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
6695                 NLA_POLICY_MIN(NLA_U16, 1),
6696         [NL80211_MESHCONF_POWER_MODE] =
6697                 NLA_POLICY_RANGE(NLA_U32,
6698                                  NL80211_MESH_POWER_ACTIVE,
6699                                  NL80211_MESH_POWER_MAX),
6700         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
6701         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
6702         [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
6703 };
6704
6705 static const struct nla_policy
6706         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
6707         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
6708         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
6709         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
6710         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
6711         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
6712         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
6713         [NL80211_MESH_SETUP_IE] =
6714                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
6715                                        IEEE80211_MAX_DATA_LEN),
6716         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
6717 };
6718
6719 static int nl80211_parse_mesh_config(struct genl_info *info,
6720                                      struct mesh_config *cfg,
6721                                      u32 *mask_out)
6722 {
6723         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
6724         u32 mask = 0;
6725         u16 ht_opmode;
6726
6727 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
6728 do {                                                                    \
6729         if (tb[attr]) {                                                 \
6730                 cfg->param = fn(tb[attr]);                              \
6731                 mask |= BIT((attr) - 1);                                \
6732         }                                                               \
6733 } while (0)
6734
6735         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
6736                 return -EINVAL;
6737         if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
6738                 return -EINVAL;
6739
6740         /* This makes sure that there aren't more than 32 mesh config
6741          * parameters (otherwise our bitfield scheme would not work.) */
6742         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
6743
6744         /* Fill in the params struct */
6745         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
6746                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
6747         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
6748                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
6749                                   nla_get_u16);
6750         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
6751                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
6752                                   nla_get_u16);
6753         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
6754                                   NL80211_MESHCONF_MAX_PEER_LINKS,
6755                                   nla_get_u16);
6756         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
6757                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
6758         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
6759                                   NL80211_MESHCONF_TTL, nla_get_u8);
6760         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
6761                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
6762         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
6763                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6764                                   nla_get_u8);
6765         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
6766                                   mask,
6767                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6768                                   nla_get_u32);
6769         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
6770                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6771                                   nla_get_u8);
6772         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
6773                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
6774                                   nla_get_u32);
6775         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
6776             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
6777                 return -EINVAL;
6778         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
6779                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6780                                   nla_get_u16);
6781         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
6782                                   mask,
6783                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6784                                   nla_get_u32);
6785         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
6786             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
6787              cfg->dot11MeshHWMPactivePathTimeout > 65535))
6788                 return -EINVAL;
6789         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
6790                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6791                                   nla_get_u16);
6792         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
6793                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6794                                   nla_get_u16);
6795         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6796                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
6797                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6798                                   nla_get_u16);
6799         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
6800                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
6801         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
6802                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6803                                   nla_get_u16);
6804         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
6805                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6806                                   nla_get_u8);
6807         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
6808                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
6809         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
6810                                   NL80211_MESHCONF_RSSI_THRESHOLD,
6811                                   nla_get_s32);
6812         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
6813                                   NL80211_MESHCONF_CONNECTED_TO_GATE,
6814                                   nla_get_u8);
6815         /*
6816          * Check HT operation mode based on
6817          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
6818          */
6819         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
6820                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
6821
6822                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
6823                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
6824                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6825                         return -EINVAL;
6826
6827                 /* NON_HT_STA bit is reserved, but some programs set it */
6828                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
6829
6830                 cfg->ht_opmode = ht_opmode;
6831                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
6832         }
6833         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6834                                   dot11MeshHWMPactivePathToRootTimeout, mask,
6835                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6836                                   nla_get_u32);
6837         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
6838             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
6839              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
6840                 return -EINVAL;
6841         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
6842                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6843                                   nla_get_u16);
6844         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
6845                                   mask,
6846                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6847                                   nla_get_u16);
6848         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
6849                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
6850         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
6851                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
6852         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
6853                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
6854         if (mask_out)
6855                 *mask_out = mask;
6856
6857         return 0;
6858
6859 #undef FILL_IN_MESH_PARAM_IF_SET
6860 }
6861
6862 static int nl80211_parse_mesh_setup(struct genl_info *info,
6863                                      struct mesh_setup *setup)
6864 {
6865         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6866         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6867
6868         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6869                 return -EINVAL;
6870         if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
6871                 return -EINVAL;
6872
6873         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6874                 setup->sync_method =
6875                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6876                  IEEE80211_SYNC_METHOD_VENDOR :
6877                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6878
6879         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6880                 setup->path_sel_proto =
6881                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6882                  IEEE80211_PATH_PROTOCOL_VENDOR :
6883                  IEEE80211_PATH_PROTOCOL_HWMP;
6884
6885         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6886                 setup->path_metric =
6887                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6888                  IEEE80211_PATH_METRIC_VENDOR :
6889                  IEEE80211_PATH_METRIC_AIRTIME;
6890
6891         if (tb[NL80211_MESH_SETUP_IE]) {
6892                 struct nlattr *ieattr =
6893                         tb[NL80211_MESH_SETUP_IE];
6894                 setup->ie = nla_data(ieattr);
6895                 setup->ie_len = nla_len(ieattr);
6896         }
6897         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6898             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6899                 return -EINVAL;
6900         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6901         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6902         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6903         if (setup->is_secure)
6904                 setup->user_mpm = true;
6905
6906         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6907                 if (!setup->user_mpm)
6908                         return -EINVAL;
6909                 setup->auth_id =
6910                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6911         }
6912
6913         return 0;
6914 }
6915
6916 static int nl80211_update_mesh_config(struct sk_buff *skb,
6917                                       struct genl_info *info)
6918 {
6919         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6920         struct net_device *dev = info->user_ptr[1];
6921         struct wireless_dev *wdev = dev->ieee80211_ptr;
6922         struct mesh_config cfg;
6923         u32 mask;
6924         int err;
6925
6926         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6927                 return -EOPNOTSUPP;
6928
6929         if (!rdev->ops->update_mesh_config)
6930                 return -EOPNOTSUPP;
6931
6932         err = nl80211_parse_mesh_config(info, &cfg, &mask);
6933         if (err)
6934                 return err;
6935
6936         wdev_lock(wdev);
6937         if (!wdev->mesh_id_len)
6938                 err = -ENOLINK;
6939
6940         if (!err)
6941                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6942
6943         wdev_unlock(wdev);
6944
6945         return err;
6946 }
6947
6948 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6949                               struct sk_buff *msg)
6950 {
6951         struct nlattr *nl_reg_rules;
6952         unsigned int i;
6953
6954         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6955             (regdom->dfs_region &&
6956              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6957                 goto nla_put_failure;
6958
6959         nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
6960         if (!nl_reg_rules)
6961                 goto nla_put_failure;
6962
6963         for (i = 0; i < regdom->n_reg_rules; i++) {
6964                 struct nlattr *nl_reg_rule;
6965                 const struct ieee80211_reg_rule *reg_rule;
6966                 const struct ieee80211_freq_range *freq_range;
6967                 const struct ieee80211_power_rule *power_rule;
6968                 unsigned int max_bandwidth_khz;
6969
6970                 reg_rule = &regdom->reg_rules[i];
6971                 freq_range = &reg_rule->freq_range;
6972                 power_rule = &reg_rule->power_rule;
6973
6974                 nl_reg_rule = nla_nest_start_noflag(msg, i);
6975                 if (!nl_reg_rule)
6976                         goto nla_put_failure;
6977
6978                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6979                 if (!max_bandwidth_khz)
6980                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6981                                                                   reg_rule);
6982
6983                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6984                                 reg_rule->flags) ||
6985                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6986                                 freq_range->start_freq_khz) ||
6987                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6988                                 freq_range->end_freq_khz) ||
6989                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6990                                 max_bandwidth_khz) ||
6991                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6992                                 power_rule->max_antenna_gain) ||
6993                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6994                                 power_rule->max_eirp) ||
6995                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6996                                 reg_rule->dfs_cac_ms))
6997                         goto nla_put_failure;
6998
6999                 nla_nest_end(msg, nl_reg_rule);
7000         }
7001
7002         nla_nest_end(msg, nl_reg_rules);
7003         return 0;
7004
7005 nla_put_failure:
7006         return -EMSGSIZE;
7007 }
7008
7009 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
7010 {
7011         const struct ieee80211_regdomain *regdom = NULL;
7012         struct cfg80211_registered_device *rdev;
7013         struct wiphy *wiphy = NULL;
7014         struct sk_buff *msg;
7015         void *hdr;
7016
7017         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7018         if (!msg)
7019                 return -ENOBUFS;
7020
7021         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7022                              NL80211_CMD_GET_REG);
7023         if (!hdr)
7024                 goto put_failure;
7025
7026         if (info->attrs[NL80211_ATTR_WIPHY]) {
7027                 bool self_managed;
7028
7029                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
7030                 if (IS_ERR(rdev)) {
7031                         nlmsg_free(msg);
7032                         return PTR_ERR(rdev);
7033                 }
7034
7035                 wiphy = &rdev->wiphy;
7036                 self_managed = wiphy->regulatory_flags &
7037                                REGULATORY_WIPHY_SELF_MANAGED;
7038                 regdom = get_wiphy_regdom(wiphy);
7039
7040                 /* a self-managed-reg device must have a private regdom */
7041                 if (WARN_ON(!regdom && self_managed)) {
7042                         nlmsg_free(msg);
7043                         return -EINVAL;
7044                 }
7045
7046                 if (regdom &&
7047                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
7048                         goto nla_put_failure;
7049         }
7050
7051         if (!wiphy && reg_last_request_cell_base() &&
7052             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
7053                         NL80211_USER_REG_HINT_CELL_BASE))
7054                 goto nla_put_failure;
7055
7056         rcu_read_lock();
7057
7058         if (!regdom)
7059                 regdom = rcu_dereference(cfg80211_regdomain);
7060
7061         if (nl80211_put_regdom(regdom, msg))
7062                 goto nla_put_failure_rcu;
7063
7064         rcu_read_unlock();
7065
7066         genlmsg_end(msg, hdr);
7067         return genlmsg_reply(msg, info);
7068
7069 nla_put_failure_rcu:
7070         rcu_read_unlock();
7071 nla_put_failure:
7072 put_failure:
7073         nlmsg_free(msg);
7074         return -EMSGSIZE;
7075 }
7076
7077 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
7078                                u32 seq, int flags, struct wiphy *wiphy,
7079                                const struct ieee80211_regdomain *regdom)
7080 {
7081         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7082                                    NL80211_CMD_GET_REG);
7083
7084         if (!hdr)
7085                 return -1;
7086
7087         genl_dump_check_consistent(cb, hdr);
7088
7089         if (nl80211_put_regdom(regdom, msg))
7090                 goto nla_put_failure;
7091
7092         if (!wiphy && reg_last_request_cell_base() &&
7093             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
7094                         NL80211_USER_REG_HINT_CELL_BASE))
7095                 goto nla_put_failure;
7096
7097         if (wiphy &&
7098             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
7099                 goto nla_put_failure;
7100
7101         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
7102             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
7103                 goto nla_put_failure;
7104
7105         genlmsg_end(msg, hdr);
7106         return 0;
7107
7108 nla_put_failure:
7109         genlmsg_cancel(msg, hdr);
7110         return -EMSGSIZE;
7111 }
7112
7113 static int nl80211_get_reg_dump(struct sk_buff *skb,
7114                                 struct netlink_callback *cb)
7115 {
7116         const struct ieee80211_regdomain *regdom = NULL;
7117         struct cfg80211_registered_device *rdev;
7118         int err, reg_idx, start = cb->args[2];
7119
7120         rtnl_lock();
7121
7122         if (cfg80211_regdomain && start == 0) {
7123                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
7124                                           NLM_F_MULTI, NULL,
7125                                           rtnl_dereference(cfg80211_regdomain));
7126                 if (err < 0)
7127                         goto out_err;
7128         }
7129
7130         /* the global regdom is idx 0 */
7131         reg_idx = 1;
7132         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
7133                 regdom = get_wiphy_regdom(&rdev->wiphy);
7134                 if (!regdom)
7135                         continue;
7136
7137                 if (++reg_idx <= start)
7138                         continue;
7139
7140                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
7141                                           NLM_F_MULTI, &rdev->wiphy, regdom);
7142                 if (err < 0) {
7143                         reg_idx--;
7144                         break;
7145                 }
7146         }
7147
7148         cb->args[2] = reg_idx;
7149         err = skb->len;
7150 out_err:
7151         rtnl_unlock();
7152         return err;
7153 }
7154
7155 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
7156 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
7157         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
7158         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
7159         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
7160         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
7161         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
7162         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
7163         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
7164 };
7165
7166 static int parse_reg_rule(struct nlattr *tb[],
7167         struct ieee80211_reg_rule *reg_rule)
7168 {
7169         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
7170         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
7171
7172         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
7173                 return -EINVAL;
7174         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
7175                 return -EINVAL;
7176         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
7177                 return -EINVAL;
7178         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
7179                 return -EINVAL;
7180         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
7181                 return -EINVAL;
7182
7183         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
7184
7185         freq_range->start_freq_khz =
7186                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
7187         freq_range->end_freq_khz =
7188                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
7189         freq_range->max_bandwidth_khz =
7190                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
7191
7192         power_rule->max_eirp =
7193                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
7194
7195         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
7196                 power_rule->max_antenna_gain =
7197                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
7198
7199         if (tb[NL80211_ATTR_DFS_CAC_TIME])
7200                 reg_rule->dfs_cac_ms =
7201                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
7202
7203         return 0;
7204 }
7205
7206 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
7207 {
7208         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
7209         struct nlattr *nl_reg_rule;
7210         char *alpha2;
7211         int rem_reg_rules, r;
7212         u32 num_rules = 0, rule_idx = 0;
7213         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
7214         struct ieee80211_regdomain *rd;
7215
7216         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
7217                 return -EINVAL;
7218
7219         if (!info->attrs[NL80211_ATTR_REG_RULES])
7220                 return -EINVAL;
7221
7222         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
7223
7224         if (info->attrs[NL80211_ATTR_DFS_REGION])
7225                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
7226
7227         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7228                             rem_reg_rules) {
7229                 num_rules++;
7230                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
7231                         return -EINVAL;
7232         }
7233
7234         if (!reg_is_valid_request(alpha2))
7235                 return -EINVAL;
7236
7237         rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
7238         if (!rd)
7239                 return -ENOMEM;
7240
7241         rd->n_reg_rules = num_rules;
7242         rd->alpha2[0] = alpha2[0];
7243         rd->alpha2[1] = alpha2[1];
7244
7245         /*
7246          * Disable DFS master mode if the DFS region was
7247          * not supported or known on this kernel.
7248          */
7249         if (reg_supported_dfs_region(dfs_region))
7250                 rd->dfs_region = dfs_region;
7251
7252         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7253                             rem_reg_rules) {
7254                 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
7255                                                 nl_reg_rule, reg_rule_policy,
7256                                                 info->extack);
7257                 if (r)
7258                         goto bad_reg;
7259                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
7260                 if (r)
7261                         goto bad_reg;
7262
7263                 rule_idx++;
7264
7265                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
7266                         r = -EINVAL;
7267                         goto bad_reg;
7268                 }
7269         }
7270
7271         /* set_regdom takes ownership of rd */
7272         return set_regdom(rd, REGD_SOURCE_CRDA);
7273  bad_reg:
7274         kfree(rd);
7275         return r;
7276 }
7277 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
7278
7279 static int validate_scan_freqs(struct nlattr *freqs)
7280 {
7281         struct nlattr *attr1, *attr2;
7282         int n_channels = 0, tmp1, tmp2;
7283
7284         nla_for_each_nested(attr1, freqs, tmp1)
7285                 if (nla_len(attr1) != sizeof(u32))
7286                         return 0;
7287
7288         nla_for_each_nested(attr1, freqs, tmp1) {
7289                 n_channels++;
7290                 /*
7291                  * Some hardware has a limited channel list for
7292                  * scanning, and it is pretty much nonsensical
7293                  * to scan for a channel twice, so disallow that
7294                  * and don't require drivers to check that the
7295                  * channel list they get isn't longer than what
7296                  * they can scan, as long as they can scan all
7297                  * the channels they registered at once.
7298                  */
7299                 nla_for_each_nested(attr2, freqs, tmp2)
7300                         if (attr1 != attr2 &&
7301                             nla_get_u32(attr1) == nla_get_u32(attr2))
7302                                 return 0;
7303         }
7304
7305         return n_channels;
7306 }
7307
7308 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
7309 {
7310         return b < NUM_NL80211_BANDS && wiphy->bands[b];
7311 }
7312
7313 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
7314                             struct cfg80211_bss_selection *bss_select)
7315 {
7316         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
7317         struct nlattr *nest;
7318         int err;
7319         bool found = false;
7320         int i;
7321
7322         /* only process one nested attribute */
7323         nest = nla_data(nla);
7324         if (!nla_ok(nest, nla_len(nest)))
7325                 return -EINVAL;
7326
7327         err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
7328                                           nest, nl80211_bss_select_policy,
7329                                           NULL);
7330         if (err)
7331                 return err;
7332
7333         /* only one attribute may be given */
7334         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
7335                 if (attr[i]) {
7336                         if (found)
7337                                 return -EINVAL;
7338                         found = true;
7339                 }
7340         }
7341
7342         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
7343
7344         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
7345                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
7346
7347         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
7348                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
7349                 bss_select->param.band_pref =
7350                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
7351                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
7352                         return -EINVAL;
7353         }
7354
7355         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
7356                 struct nl80211_bss_select_rssi_adjust *adj_param;
7357
7358                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
7359                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
7360                 bss_select->param.adjust.band = adj_param->band;
7361                 bss_select->param.adjust.delta = adj_param->delta;
7362                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
7363                         return -EINVAL;
7364         }
7365
7366         /* user-space did not provide behaviour attribute */
7367         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
7368                 return -EINVAL;
7369
7370         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
7371                 return -EINVAL;
7372
7373         return 0;
7374 }
7375
7376 int nl80211_parse_random_mac(struct nlattr **attrs,
7377                              u8 *mac_addr, u8 *mac_addr_mask)
7378 {
7379         int i;
7380
7381         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
7382                 eth_zero_addr(mac_addr);
7383                 eth_zero_addr(mac_addr_mask);
7384                 mac_addr[0] = 0x2;
7385                 mac_addr_mask[0] = 0x3;
7386
7387                 return 0;
7388         }
7389
7390         /* need both or none */
7391         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
7392                 return -EINVAL;
7393
7394         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
7395         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
7396
7397         /* don't allow or configure an mcast address */
7398         if (!is_multicast_ether_addr(mac_addr_mask) ||
7399             is_multicast_ether_addr(mac_addr))
7400                 return -EINVAL;
7401
7402         /*
7403          * allow users to pass a MAC address that has bits set outside
7404          * of the mask, but don't bother drivers with having to deal
7405          * with such bits
7406          */
7407         for (i = 0; i < ETH_ALEN; i++)
7408                 mac_addr[i] &= mac_addr_mask[i];
7409
7410         return 0;
7411 }
7412
7413 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
7414 {
7415         ASSERT_WDEV_LOCK(wdev);
7416
7417         if (!cfg80211_beaconing_iface_active(wdev))
7418                 return true;
7419
7420         if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
7421                 return true;
7422
7423         return regulatory_pre_cac_allowed(wdev->wiphy);
7424 }
7425
7426 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
7427                                     enum nl80211_ext_feature_index feat)
7428 {
7429         if (!(flags & flag))
7430                 return true;
7431         if (wiphy_ext_feature_isset(wiphy, feat))
7432                 return true;
7433         return false;
7434 }
7435
7436 static int
7437 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
7438                          void *request, struct nlattr **attrs,
7439                          bool is_sched_scan)
7440 {
7441         u8 *mac_addr, *mac_addr_mask;
7442         u32 *flags;
7443         enum nl80211_feature_flags randomness_flag;
7444
7445         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
7446                 return 0;
7447
7448         if (is_sched_scan) {
7449                 struct cfg80211_sched_scan_request *req = request;
7450
7451                 randomness_flag = wdev ?
7452                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
7453                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7454                 flags = &req->flags;
7455                 mac_addr = req->mac_addr;
7456                 mac_addr_mask = req->mac_addr_mask;
7457         } else {
7458                 struct cfg80211_scan_request *req = request;
7459
7460                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
7461                 flags = &req->flags;
7462                 mac_addr = req->mac_addr;
7463                 mac_addr_mask = req->mac_addr_mask;
7464         }
7465
7466         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
7467
7468         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
7469              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
7470             !nl80211_check_scan_feat(wiphy, *flags,
7471                                      NL80211_SCAN_FLAG_LOW_SPAN,
7472                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
7473             !nl80211_check_scan_feat(wiphy, *flags,
7474                                      NL80211_SCAN_FLAG_LOW_POWER,
7475                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
7476             !nl80211_check_scan_feat(wiphy, *flags,
7477                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
7478                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
7479             !nl80211_check_scan_feat(wiphy, *flags,
7480                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
7481                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
7482             !nl80211_check_scan_feat(wiphy, *flags,
7483                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
7484                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
7485             !nl80211_check_scan_feat(wiphy, *flags,
7486                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
7487                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
7488             !nl80211_check_scan_feat(wiphy, *flags,
7489                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
7490                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
7491             !nl80211_check_scan_feat(wiphy, *flags,
7492                                      NL80211_SCAN_FLAG_RANDOM_SN,
7493                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
7494             !nl80211_check_scan_feat(wiphy, *flags,
7495                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
7496                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
7497                 return -EOPNOTSUPP;
7498
7499         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
7500                 int err;
7501
7502                 if (!(wiphy->features & randomness_flag) ||
7503                     (wdev && wdev->current_bss))
7504                         return -EOPNOTSUPP;
7505
7506                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
7507                 if (err)
7508                         return err;
7509         }
7510
7511         return 0;
7512 }
7513
7514 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
7515 {
7516         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7517         struct wireless_dev *wdev = info->user_ptr[1];
7518         struct cfg80211_scan_request *request;
7519         struct nlattr *attr;
7520         struct wiphy *wiphy;
7521         int err, tmp, n_ssids = 0, n_channels, i;
7522         size_t ie_len;
7523
7524         wiphy = &rdev->wiphy;
7525
7526         if (wdev->iftype == NL80211_IFTYPE_NAN)
7527                 return -EOPNOTSUPP;
7528
7529         if (!rdev->ops->scan)
7530                 return -EOPNOTSUPP;
7531
7532         if (rdev->scan_req || rdev->scan_msg) {
7533                 err = -EBUSY;
7534                 goto unlock;
7535         }
7536
7537         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7538                 n_channels = validate_scan_freqs(
7539                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7540                 if (!n_channels) {
7541                         err = -EINVAL;
7542                         goto unlock;
7543                 }
7544         } else {
7545                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7546         }
7547
7548         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
7549                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
7550                         n_ssids++;
7551
7552         if (n_ssids > wiphy->max_scan_ssids) {
7553                 err = -EINVAL;
7554                 goto unlock;
7555         }
7556
7557         if (info->attrs[NL80211_ATTR_IE])
7558                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7559         else
7560                 ie_len = 0;
7561
7562         if (ie_len > wiphy->max_scan_ie_len) {
7563                 err = -EINVAL;
7564                 goto unlock;
7565         }
7566
7567         request = kzalloc(sizeof(*request)
7568                         + sizeof(*request->ssids) * n_ssids
7569                         + sizeof(*request->channels) * n_channels
7570                         + ie_len, GFP_KERNEL);
7571         if (!request) {
7572                 err = -ENOMEM;
7573                 goto unlock;
7574         }
7575
7576         if (n_ssids)
7577                 request->ssids = (void *)&request->channels[n_channels];
7578         request->n_ssids = n_ssids;
7579         if (ie_len) {
7580                 if (n_ssids)
7581                         request->ie = (void *)(request->ssids + n_ssids);
7582                 else
7583                         request->ie = (void *)(request->channels + n_channels);
7584         }
7585
7586         i = 0;
7587         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7588                 /* user specified, bail out if channel not found */
7589                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
7590                         struct ieee80211_channel *chan;
7591
7592                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7593
7594                         if (!chan) {
7595                                 err = -EINVAL;
7596                                 goto out_free;
7597                         }
7598
7599                         /* ignore disabled channels */
7600                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7601                                 continue;
7602
7603                         request->channels[i] = chan;
7604                         i++;
7605                 }
7606         } else {
7607                 enum nl80211_band band;
7608
7609                 /* all channels */
7610                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7611                         int j;
7612
7613                         if (!wiphy->bands[band])
7614                                 continue;
7615                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7616                                 struct ieee80211_channel *chan;
7617
7618                                 chan = &wiphy->bands[band]->channels[j];
7619
7620                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7621                                         continue;
7622
7623                                 request->channels[i] = chan;
7624                                 i++;
7625                         }
7626                 }
7627         }
7628
7629         if (!i) {
7630                 err = -EINVAL;
7631                 goto out_free;
7632         }
7633
7634         request->n_channels = i;
7635
7636         wdev_lock(wdev);
7637         if (!cfg80211_off_channel_oper_allowed(wdev)) {
7638                 struct ieee80211_channel *chan;
7639
7640                 if (request->n_channels != 1) {
7641                         wdev_unlock(wdev);
7642                         err = -EBUSY;
7643                         goto out_free;
7644                 }
7645
7646                 chan = request->channels[0];
7647                 if (chan->center_freq != wdev->chandef.chan->center_freq) {
7648                         wdev_unlock(wdev);
7649                         err = -EBUSY;
7650                         goto out_free;
7651                 }
7652         }
7653         wdev_unlock(wdev);
7654
7655         i = 0;
7656         if (n_ssids) {
7657                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
7658                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7659                                 err = -EINVAL;
7660                                 goto out_free;
7661                         }
7662                         request->ssids[i].ssid_len = nla_len(attr);
7663                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
7664                         i++;
7665                 }
7666         }
7667
7668         if (info->attrs[NL80211_ATTR_IE]) {
7669                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7670                 memcpy((void *)request->ie,
7671                        nla_data(info->attrs[NL80211_ATTR_IE]),
7672                        request->ie_len);
7673         }
7674
7675         for (i = 0; i < NUM_NL80211_BANDS; i++)
7676                 if (wiphy->bands[i])
7677                         request->rates[i] =
7678                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
7679
7680         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
7681                 nla_for_each_nested(attr,
7682                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
7683                                     tmp) {
7684                         enum nl80211_band band = nla_type(attr);
7685
7686                         if (band < 0 || band >= NUM_NL80211_BANDS) {
7687                                 err = -EINVAL;
7688                                 goto out_free;
7689                         }
7690
7691                         if (!wiphy->bands[band])
7692                                 continue;
7693
7694                         err = ieee80211_get_ratemask(wiphy->bands[band],
7695                                                      nla_data(attr),
7696                                                      nla_len(attr),
7697                                                      &request->rates[band]);
7698                         if (err)
7699                                 goto out_free;
7700                 }
7701         }
7702
7703         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
7704                 if (!wiphy_ext_feature_isset(wiphy,
7705                                         NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
7706                         err = -EOPNOTSUPP;
7707                         goto out_free;
7708                 }
7709
7710                 request->duration =
7711                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
7712                 request->duration_mandatory =
7713                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
7714         }
7715
7716         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
7717                                        false);
7718         if (err)
7719                 goto out_free;
7720
7721         request->no_cck =
7722                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7723
7724         /* Initial implementation used NL80211_ATTR_MAC to set the specific
7725          * BSSID to scan for. This was problematic because that same attribute
7726          * was already used for another purpose (local random MAC address). The
7727          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
7728          * compatibility with older userspace components, also use the
7729          * NL80211_ATTR_MAC value here if it can be determined to be used for
7730          * the specific BSSID use case instead of the random MAC address
7731          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
7732          */
7733         if (info->attrs[NL80211_ATTR_BSSID])
7734                 memcpy(request->bssid,
7735                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
7736         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
7737                  info->attrs[NL80211_ATTR_MAC])
7738                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
7739                        ETH_ALEN);
7740         else
7741                 eth_broadcast_addr(request->bssid);
7742
7743         request->wdev = wdev;
7744         request->wiphy = &rdev->wiphy;
7745         request->scan_start = jiffies;
7746
7747         rdev->scan_req = request;
7748         err = rdev_scan(rdev, request);
7749
7750         if (!err) {
7751                 nl80211_send_scan_start(rdev, wdev);
7752                 if (wdev->netdev)
7753                         dev_hold(wdev->netdev);
7754         } else {
7755  out_free:
7756                 rdev->scan_req = NULL;
7757                 kfree(request);
7758         }
7759
7760  unlock:
7761         return err;
7762 }
7763
7764 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
7765 {
7766         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7767         struct wireless_dev *wdev = info->user_ptr[1];
7768
7769         if (!rdev->ops->abort_scan)
7770                 return -EOPNOTSUPP;
7771
7772         if (rdev->scan_msg)
7773                 return 0;
7774
7775         if (!rdev->scan_req)
7776                 return -ENOENT;
7777
7778         rdev_abort_scan(rdev, wdev);
7779         return 0;
7780 }
7781
7782 static int
7783 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
7784                                struct cfg80211_sched_scan_request *request,
7785                                struct nlattr **attrs)
7786 {
7787         int tmp, err, i = 0;
7788         struct nlattr *attr;
7789
7790         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7791                 u32 interval;
7792
7793                 /*
7794                  * If scan plans are not specified,
7795                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
7796                  * case one scan plan will be set with the specified scan
7797                  * interval and infinite number of iterations.
7798                  */
7799                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
7800                 if (!interval)
7801                         return -EINVAL;
7802
7803                 request->scan_plans[0].interval =
7804                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
7805                 if (!request->scan_plans[0].interval)
7806                         return -EINVAL;
7807
7808                 if (request->scan_plans[0].interval >
7809                     wiphy->max_sched_scan_plan_interval)
7810                         request->scan_plans[0].interval =
7811                                 wiphy->max_sched_scan_plan_interval;
7812
7813                 return 0;
7814         }
7815
7816         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
7817                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
7818
7819                 if (WARN_ON(i >= n_plans))
7820                         return -EINVAL;
7821
7822                 err = nla_parse_nested_deprecated(plan,
7823                                                   NL80211_SCHED_SCAN_PLAN_MAX,
7824                                                   attr, nl80211_plan_policy,
7825                                                   NULL);
7826                 if (err)
7827                         return err;
7828
7829                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
7830                         return -EINVAL;
7831
7832                 request->scan_plans[i].interval =
7833                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
7834                 if (!request->scan_plans[i].interval ||
7835                     request->scan_plans[i].interval >
7836                     wiphy->max_sched_scan_plan_interval)
7837                         return -EINVAL;
7838
7839                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
7840                         request->scan_plans[i].iterations =
7841                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
7842                         if (!request->scan_plans[i].iterations ||
7843                             (request->scan_plans[i].iterations >
7844                              wiphy->max_sched_scan_plan_iterations))
7845                                 return -EINVAL;
7846                 } else if (i < n_plans - 1) {
7847                         /*
7848                          * All scan plans but the last one must specify
7849                          * a finite number of iterations
7850                          */
7851                         return -EINVAL;
7852                 }
7853
7854                 i++;
7855         }
7856
7857         /*
7858          * The last scan plan must not specify the number of
7859          * iterations, it is supposed to run infinitely
7860          */
7861         if (request->scan_plans[n_plans - 1].iterations)
7862                 return  -EINVAL;
7863
7864         return 0;
7865 }
7866
7867 static int
7868 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
7869                                        struct cfg80211_match_set *match_sets,
7870                                        struct nlattr *tb_band_rssi,
7871                                        s32 rssi_thold)
7872 {
7873         struct nlattr *attr;
7874         int i, tmp, ret = 0;
7875
7876         if (!wiphy_ext_feature_isset(wiphy,
7877                     NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
7878                 if (tb_band_rssi)
7879                         ret = -EOPNOTSUPP;
7880                 else
7881                         for (i = 0; i < NUM_NL80211_BANDS; i++)
7882                                 match_sets->per_band_rssi_thold[i] =
7883                                         NL80211_SCAN_RSSI_THOLD_OFF;
7884                 return ret;
7885         }
7886
7887         for (i = 0; i < NUM_NL80211_BANDS; i++)
7888                 match_sets->per_band_rssi_thold[i] = rssi_thold;
7889
7890         nla_for_each_nested(attr, tb_band_rssi, tmp) {
7891                 enum nl80211_band band = nla_type(attr);
7892
7893                 if (band < 0 || band >= NUM_NL80211_BANDS)
7894                         return -EINVAL;
7895
7896                 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr);
7897         }
7898
7899         return 0;
7900 }
7901
7902 static struct cfg80211_sched_scan_request *
7903 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
7904                          struct nlattr **attrs, int max_match_sets)
7905 {
7906         struct cfg80211_sched_scan_request *request;
7907         struct nlattr *attr;
7908         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
7909         enum nl80211_band band;
7910         size_t ie_len;
7911         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
7912         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
7913
7914         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7915                 n_channels = validate_scan_freqs(
7916                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7917                 if (!n_channels)
7918                         return ERR_PTR(-EINVAL);
7919         } else {
7920                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7921         }
7922
7923         if (attrs[NL80211_ATTR_SCAN_SSIDS])
7924                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7925                                     tmp)
7926                         n_ssids++;
7927
7928         if (n_ssids > wiphy->max_sched_scan_ssids)
7929                 return ERR_PTR(-EINVAL);
7930
7931         /*
7932          * First, count the number of 'real' matchsets. Due to an issue with
7933          * the old implementation, matchsets containing only the RSSI attribute
7934          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
7935          * RSSI for all matchsets, rather than their own matchset for reporting
7936          * all APs with a strong RSSI. This is needed to be compatible with
7937          * older userspace that treated a matchset with only the RSSI as the
7938          * global RSSI for all other matchsets - if there are other matchsets.
7939          */
7940         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7941                 nla_for_each_nested(attr,
7942                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7943                                     tmp) {
7944                         struct nlattr *rssi;
7945
7946                         err = nla_parse_nested_deprecated(tb,
7947                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7948                                                           attr,
7949                                                           nl80211_match_policy,
7950                                                           NULL);
7951                         if (err)
7952                                 return ERR_PTR(err);
7953
7954                         /* SSID and BSSID are mutually exclusive */
7955                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
7956                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
7957                                 return ERR_PTR(-EINVAL);
7958
7959                         /* add other standalone attributes here */
7960                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
7961                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
7962                                 n_match_sets++;
7963                                 continue;
7964                         }
7965                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7966                         if (rssi)
7967                                 default_match_rssi = nla_get_s32(rssi);
7968                 }
7969         }
7970
7971         /* However, if there's no other matchset, add the RSSI one */
7972         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
7973                 n_match_sets = 1;
7974
7975         if (n_match_sets > max_match_sets)
7976                 return ERR_PTR(-EINVAL);
7977
7978         if (attrs[NL80211_ATTR_IE])
7979                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
7980         else
7981                 ie_len = 0;
7982
7983         if (ie_len > wiphy->max_sched_scan_ie_len)
7984                 return ERR_PTR(-EINVAL);
7985
7986         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7987                 /*
7988                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
7989                  * each scan plan already specifies its own interval
7990                  */
7991                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7992                         return ERR_PTR(-EINVAL);
7993
7994                 nla_for_each_nested(attr,
7995                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7996                         n_plans++;
7997         } else {
7998                 /*
7999                  * The scan interval attribute is kept for backward
8000                  * compatibility. If no scan plans are specified and sched scan
8001                  * interval is specified, one scan plan will be set with this
8002                  * scan interval and infinite number of iterations.
8003                  */
8004                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
8005                         return ERR_PTR(-EINVAL);
8006
8007                 n_plans = 1;
8008         }
8009
8010         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
8011                 return ERR_PTR(-EINVAL);
8012
8013         if (!wiphy_ext_feature_isset(
8014                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
8015             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
8016              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
8017                 return ERR_PTR(-EINVAL);
8018
8019         request = kzalloc(sizeof(*request)
8020                         + sizeof(*request->ssids) * n_ssids
8021                         + sizeof(*request->match_sets) * n_match_sets
8022                         + sizeof(*request->scan_plans) * n_plans
8023                         + sizeof(*request->channels) * n_channels
8024                         + ie_len, GFP_KERNEL);
8025         if (!request)
8026                 return ERR_PTR(-ENOMEM);
8027
8028         if (n_ssids)
8029                 request->ssids = (void *)&request->channels[n_channels];
8030         request->n_ssids = n_ssids;
8031         if (ie_len) {
8032                 if (n_ssids)
8033                         request->ie = (void *)(request->ssids + n_ssids);
8034                 else
8035                         request->ie = (void *)(request->channels + n_channels);
8036         }
8037
8038         if (n_match_sets) {
8039                 if (request->ie)
8040                         request->match_sets = (void *)(request->ie + ie_len);
8041                 else if (n_ssids)
8042                         request->match_sets =
8043                                 (void *)(request->ssids + n_ssids);
8044                 else
8045                         request->match_sets =
8046                                 (void *)(request->channels + n_channels);
8047         }
8048         request->n_match_sets = n_match_sets;
8049
8050         if (n_match_sets)
8051                 request->scan_plans = (void *)(request->match_sets +
8052                                                n_match_sets);
8053         else if (request->ie)
8054                 request->scan_plans = (void *)(request->ie + ie_len);
8055         else if (n_ssids)
8056                 request->scan_plans = (void *)(request->ssids + n_ssids);
8057         else
8058                 request->scan_plans = (void *)(request->channels + n_channels);
8059
8060         request->n_scan_plans = n_plans;
8061
8062         i = 0;
8063         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
8064                 /* user specified, bail out if channel not found */
8065                 nla_for_each_nested(attr,
8066                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
8067                                     tmp) {
8068                         struct ieee80211_channel *chan;
8069
8070                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
8071
8072                         if (!chan) {
8073                                 err = -EINVAL;
8074                                 goto out_free;
8075                         }
8076
8077                         /* ignore disabled channels */
8078                         if (chan->flags & IEEE80211_CHAN_DISABLED)
8079                                 continue;
8080
8081                         request->channels[i] = chan;
8082                         i++;
8083                 }
8084         } else {
8085                 /* all channels */
8086                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
8087                         int j;
8088
8089                         if (!wiphy->bands[band])
8090                                 continue;
8091                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
8092                                 struct ieee80211_channel *chan;
8093
8094                                 chan = &wiphy->bands[band]->channels[j];
8095
8096                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
8097                                         continue;
8098
8099                                 request->channels[i] = chan;
8100                                 i++;
8101                         }
8102                 }
8103         }
8104
8105         if (!i) {
8106                 err = -EINVAL;
8107                 goto out_free;
8108         }
8109
8110         request->n_channels = i;
8111
8112         i = 0;
8113         if (n_ssids) {
8114                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
8115                                     tmp) {
8116                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
8117                                 err = -EINVAL;
8118                                 goto out_free;
8119                         }
8120                         request->ssids[i].ssid_len = nla_len(attr);
8121                         memcpy(request->ssids[i].ssid, nla_data(attr),
8122                                nla_len(attr));
8123                         i++;
8124                 }
8125         }
8126
8127         i = 0;
8128         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
8129                 nla_for_each_nested(attr,
8130                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
8131                                     tmp) {
8132                         struct nlattr *ssid, *bssid, *rssi;
8133
8134                         err = nla_parse_nested_deprecated(tb,
8135                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
8136                                                           attr,
8137                                                           nl80211_match_policy,
8138                                                           NULL);
8139                         if (err)
8140                                 goto out_free;
8141                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
8142                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
8143
8144                         if (!ssid && !bssid) {
8145                                 i++;
8146                                 continue;
8147                         }
8148
8149                         if (WARN_ON(i >= n_match_sets)) {
8150                                 /* this indicates a programming error,
8151                                  * the loop above should have verified
8152                                  * things properly
8153                                  */
8154                                 err = -EINVAL;
8155                                 goto out_free;
8156                         }
8157
8158                         if (ssid) {
8159                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
8160                                         err = -EINVAL;
8161                                         goto out_free;
8162                                 }
8163                                 memcpy(request->match_sets[i].ssid.ssid,
8164                                        nla_data(ssid), nla_len(ssid));
8165                                 request->match_sets[i].ssid.ssid_len =
8166                                         nla_len(ssid);
8167                         }
8168                         if (bssid) {
8169                                 if (nla_len(bssid) != ETH_ALEN) {
8170                                         err = -EINVAL;
8171                                         goto out_free;
8172                                 }
8173                                 memcpy(request->match_sets[i].bssid,
8174                                        nla_data(bssid), ETH_ALEN);
8175                         }
8176
8177                         /* special attribute - old implementation w/a */
8178                         request->match_sets[i].rssi_thold = default_match_rssi;
8179                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
8180                         if (rssi)
8181                                 request->match_sets[i].rssi_thold =
8182                                         nla_get_s32(rssi);
8183
8184                         /* Parse per band RSSI attribute */
8185                         err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
8186                                 &request->match_sets[i],
8187                                 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
8188                                 request->match_sets[i].rssi_thold);
8189                         if (err)
8190                                 goto out_free;
8191
8192                         i++;
8193                 }
8194
8195                 /* there was no other matchset, so the RSSI one is alone */
8196                 if (i == 0 && n_match_sets)
8197                         request->match_sets[0].rssi_thold = default_match_rssi;
8198
8199                 request->min_rssi_thold = INT_MAX;
8200                 for (i = 0; i < n_match_sets; i++)
8201                         request->min_rssi_thold =
8202                                 min(request->match_sets[i].rssi_thold,
8203                                     request->min_rssi_thold);
8204         } else {
8205                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
8206         }
8207
8208         if (ie_len) {
8209                 request->ie_len = ie_len;
8210                 memcpy((void *)request->ie,
8211                        nla_data(attrs[NL80211_ATTR_IE]),
8212                        request->ie_len);
8213         }
8214
8215         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
8216         if (err)
8217                 goto out_free;
8218
8219         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
8220                 request->delay =
8221                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
8222
8223         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
8224                 request->relative_rssi = nla_get_s8(
8225                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
8226                 request->relative_rssi_set = true;
8227         }
8228
8229         if (request->relative_rssi_set &&
8230             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
8231                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
8232
8233                 rssi_adjust = nla_data(
8234                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
8235                 request->rssi_adjust.band = rssi_adjust->band;
8236                 request->rssi_adjust.delta = rssi_adjust->delta;
8237                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
8238                         err = -EINVAL;
8239                         goto out_free;
8240                 }
8241         }
8242
8243         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
8244         if (err)
8245                 goto out_free;
8246
8247         request->scan_start = jiffies;
8248
8249         return request;
8250
8251 out_free:
8252         kfree(request);
8253         return ERR_PTR(err);
8254 }
8255
8256 static int nl80211_start_sched_scan(struct sk_buff *skb,
8257                                     struct genl_info *info)
8258 {
8259         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8260         struct net_device *dev = info->user_ptr[1];
8261         struct wireless_dev *wdev = dev->ieee80211_ptr;
8262         struct cfg80211_sched_scan_request *sched_scan_req;
8263         bool want_multi;
8264         int err;
8265
8266         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
8267                 return -EOPNOTSUPP;
8268
8269         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
8270         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
8271         if (err)
8272                 return err;
8273
8274         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
8275                                                   info->attrs,
8276                                                   rdev->wiphy.max_match_sets);
8277
8278         err = PTR_ERR_OR_ZERO(sched_scan_req);
8279         if (err)
8280                 goto out_err;
8281
8282         /* leave request id zero for legacy request
8283          * or if driver does not support multi-scheduled scan
8284          */
8285         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
8286                 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
8287
8288         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
8289         if (err)
8290                 goto out_free;
8291
8292         sched_scan_req->dev = dev;
8293         sched_scan_req->wiphy = &rdev->wiphy;
8294
8295         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
8296                 sched_scan_req->owner_nlportid = info->snd_portid;
8297
8298         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
8299
8300         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
8301         return 0;
8302
8303 out_free:
8304         kfree(sched_scan_req);
8305 out_err:
8306         return err;
8307 }
8308
8309 static int nl80211_stop_sched_scan(struct sk_buff *skb,
8310                                    struct genl_info *info)
8311 {
8312         struct cfg80211_sched_scan_request *req;
8313         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8314         u64 cookie;
8315
8316         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
8317                 return -EOPNOTSUPP;
8318
8319         if (info->attrs[NL80211_ATTR_COOKIE]) {
8320                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8321                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
8322         }
8323
8324         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
8325                                      struct cfg80211_sched_scan_request,
8326                                      list);
8327         if (!req || req->reqid ||
8328             (req->owner_nlportid &&
8329              req->owner_nlportid != info->snd_portid))
8330                 return -ENOENT;
8331
8332         return cfg80211_stop_sched_scan_req(rdev, req, false);
8333 }
8334
8335 static int nl80211_start_radar_detection(struct sk_buff *skb,
8336                                          struct genl_info *info)
8337 {
8338         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8339         struct net_device *dev = info->user_ptr[1];
8340         struct wireless_dev *wdev = dev->ieee80211_ptr;
8341         struct wiphy *wiphy = wdev->wiphy;
8342         struct cfg80211_chan_def chandef;
8343         enum nl80211_dfs_regions dfs_region;
8344         unsigned int cac_time_ms;
8345         int err;
8346
8347         dfs_region = reg_get_dfs_region(wiphy);
8348         if (dfs_region == NL80211_DFS_UNSET)
8349                 return -EINVAL;
8350
8351         err = nl80211_parse_chandef(rdev, info, &chandef);
8352         if (err)
8353                 return err;
8354
8355         if (netif_carrier_ok(dev))
8356                 return -EBUSY;
8357
8358         if (wdev->cac_started)
8359                 return -EBUSY;
8360
8361         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
8362         if (err < 0)
8363                 return err;
8364
8365         if (err == 0)
8366                 return -EINVAL;
8367
8368         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
8369                 return -EINVAL;
8370
8371         /* CAC start is offloaded to HW and can't be started manually */
8372         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
8373                 return -EOPNOTSUPP;
8374
8375         if (!rdev->ops->start_radar_detection)
8376                 return -EOPNOTSUPP;
8377
8378         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
8379         if (WARN_ON(!cac_time_ms))
8380                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
8381
8382         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
8383         if (!err) {
8384                 wdev->chandef = chandef;
8385                 wdev->cac_started = true;
8386                 wdev->cac_start_time = jiffies;
8387                 wdev->cac_time_ms = cac_time_ms;
8388         }
8389         return err;
8390 }
8391
8392 static int nl80211_notify_radar_detection(struct sk_buff *skb,
8393                                           struct genl_info *info)
8394 {
8395         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8396         struct net_device *dev = info->user_ptr[1];
8397         struct wireless_dev *wdev = dev->ieee80211_ptr;
8398         struct wiphy *wiphy = wdev->wiphy;
8399         struct cfg80211_chan_def chandef;
8400         enum nl80211_dfs_regions dfs_region;
8401         int err;
8402
8403         dfs_region = reg_get_dfs_region(wiphy);
8404         if (dfs_region == NL80211_DFS_UNSET) {
8405                 GENL_SET_ERR_MSG(info,
8406                                  "DFS Region is not set. Unexpected Radar indication");
8407                 return -EINVAL;
8408         }
8409
8410         err = nl80211_parse_chandef(rdev, info, &chandef);
8411         if (err) {
8412                 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
8413                 return err;
8414         }
8415
8416         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
8417         if (err < 0) {
8418                 GENL_SET_ERR_MSG(info, "chandef is invalid");
8419                 return err;
8420         }
8421
8422         if (err == 0) {
8423                 GENL_SET_ERR_MSG(info,
8424                                  "Unexpected Radar indication for chandef/iftype");
8425                 return -EINVAL;
8426         }
8427
8428         /* Do not process this notification if radar is already detected
8429          * by kernel on this channel, and return success.
8430          */
8431         if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
8432                 return 0;
8433
8434         cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
8435
8436         cfg80211_sched_dfs_chan_update(rdev);
8437
8438         rdev->radar_chandef = chandef;
8439
8440         /* Propagate this notification to other radios as well */
8441         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
8442
8443         return 0;
8444 }
8445
8446 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
8447 {
8448         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8449         struct net_device *dev = info->user_ptr[1];
8450         struct wireless_dev *wdev = dev->ieee80211_ptr;
8451         struct cfg80211_csa_settings params;
8452         /* csa_attrs is defined static to avoid waste of stack size - this
8453          * function is called under RTNL lock, so this should not be a problem.
8454          */
8455         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
8456         int err;
8457         bool need_new_beacon = false;
8458         bool need_handle_dfs_flag = true;
8459         int len, i;
8460         u32 cs_count;
8461
8462         if (!rdev->ops->channel_switch ||
8463             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
8464                 return -EOPNOTSUPP;
8465
8466         switch (dev->ieee80211_ptr->iftype) {
8467         case NL80211_IFTYPE_AP:
8468         case NL80211_IFTYPE_P2P_GO:
8469                 need_new_beacon = true;
8470                 /* For all modes except AP the handle_dfs flag needs to be
8471                  * supplied to tell the kernel that userspace will handle radar
8472                  * events when they happen. Otherwise a switch to a channel
8473                  * requiring DFS will be rejected.
8474                  */
8475                 need_handle_dfs_flag = false;
8476
8477                 /* useless if AP is not running */
8478                 if (!wdev->beacon_interval)
8479                         return -ENOTCONN;
8480                 break;
8481         case NL80211_IFTYPE_ADHOC:
8482                 if (!wdev->ssid_len)
8483                         return -ENOTCONN;
8484                 break;
8485         case NL80211_IFTYPE_MESH_POINT:
8486                 if (!wdev->mesh_id_len)
8487                         return -ENOTCONN;
8488                 break;
8489         default:
8490                 return -EOPNOTSUPP;
8491         }
8492
8493         memset(&params, 0, sizeof(params));
8494         params.beacon_csa.ftm_responder = -1;
8495
8496         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
8497             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
8498                 return -EINVAL;
8499
8500         /* only important for AP, IBSS and mesh create IEs internally */
8501         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
8502                 return -EINVAL;
8503
8504         /* Even though the attribute is u32, the specification says
8505          * u8, so let's make sure we don't overflow.
8506          */
8507         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
8508         if (cs_count > 255)
8509                 return -EINVAL;
8510
8511         params.count = cs_count;
8512
8513         if (!need_new_beacon)
8514                 goto skip_beacons;
8515
8516         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after);
8517         if (err)
8518                 return err;
8519
8520         err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
8521                                           info->attrs[NL80211_ATTR_CSA_IES],
8522                                           nl80211_policy, info->extack);
8523         if (err)
8524                 return err;
8525
8526         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa);
8527         if (err)
8528                 return err;
8529
8530         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
8531                 return -EINVAL;
8532
8533         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
8534         if (!len || (len % sizeof(u16)))
8535                 return -EINVAL;
8536
8537         params.n_counter_offsets_beacon = len / sizeof(u16);
8538         if (rdev->wiphy.max_num_csa_counters &&
8539             (params.n_counter_offsets_beacon >
8540              rdev->wiphy.max_num_csa_counters))
8541                 return -EINVAL;
8542
8543         params.counter_offsets_beacon =
8544                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
8545
8546         /* sanity checks - counters should fit and be the same */
8547         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
8548                 u16 offset = params.counter_offsets_beacon[i];
8549
8550                 if (offset >= params.beacon_csa.tail_len)
8551                         return -EINVAL;
8552
8553                 if (params.beacon_csa.tail[offset] != params.count)
8554                         return -EINVAL;
8555         }
8556
8557         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
8558                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
8559                 if (!len || (len % sizeof(u16)))
8560                         return -EINVAL;
8561
8562                 params.n_counter_offsets_presp = len / sizeof(u16);
8563                 if (rdev->wiphy.max_num_csa_counters &&
8564                     (params.n_counter_offsets_presp >
8565                      rdev->wiphy.max_num_csa_counters))
8566                         return -EINVAL;
8567
8568                 params.counter_offsets_presp =
8569                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
8570
8571                 /* sanity checks - counters should fit and be the same */
8572                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
8573                         u16 offset = params.counter_offsets_presp[i];
8574
8575                         if (offset >= params.beacon_csa.probe_resp_len)
8576                                 return -EINVAL;
8577
8578                         if (params.beacon_csa.probe_resp[offset] !=
8579                             params.count)
8580                                 return -EINVAL;
8581                 }
8582         }
8583
8584 skip_beacons:
8585         err = nl80211_parse_chandef(rdev, info, &params.chandef);
8586         if (err)
8587                 return err;
8588
8589         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
8590                                            wdev->iftype))
8591                 return -EINVAL;
8592
8593         err = cfg80211_chandef_dfs_required(wdev->wiphy,
8594                                             &params.chandef,
8595                                             wdev->iftype);
8596         if (err < 0)
8597                 return err;
8598
8599         if (err > 0) {
8600                 params.radar_required = true;
8601                 if (need_handle_dfs_flag &&
8602                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
8603                         return -EINVAL;
8604                 }
8605         }
8606
8607         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
8608                 params.block_tx = true;
8609
8610         wdev_lock(wdev);
8611         err = rdev_channel_switch(rdev, dev, &params);
8612         wdev_unlock(wdev);
8613
8614         return err;
8615 }
8616
8617 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
8618                             u32 seq, int flags,
8619                             struct cfg80211_registered_device *rdev,
8620                             struct wireless_dev *wdev,
8621                             struct cfg80211_internal_bss *intbss)
8622 {
8623         struct cfg80211_bss *res = &intbss->pub;
8624         const struct cfg80211_bss_ies *ies;
8625         void *hdr;
8626         struct nlattr *bss;
8627
8628         ASSERT_WDEV_LOCK(wdev);
8629
8630         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8631                              NL80211_CMD_NEW_SCAN_RESULTS);
8632         if (!hdr)
8633                 return -1;
8634
8635         genl_dump_check_consistent(cb, hdr);
8636
8637         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
8638                 goto nla_put_failure;
8639         if (wdev->netdev &&
8640             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
8641                 goto nla_put_failure;
8642         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
8643                               NL80211_ATTR_PAD))
8644                 goto nla_put_failure;
8645
8646         bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
8647         if (!bss)
8648                 goto nla_put_failure;
8649         if ((!is_zero_ether_addr(res->bssid) &&
8650              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
8651                 goto nla_put_failure;
8652
8653         rcu_read_lock();
8654         /* indicate whether we have probe response data or not */
8655         if (rcu_access_pointer(res->proberesp_ies) &&
8656             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
8657                 goto fail_unlock_rcu;
8658
8659         /* this pointer prefers to be pointed to probe response data
8660          * but is always valid
8661          */
8662         ies = rcu_dereference(res->ies);
8663         if (ies) {
8664                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
8665                                       NL80211_BSS_PAD))
8666                         goto fail_unlock_rcu;
8667                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
8668                                         ies->len, ies->data))
8669                         goto fail_unlock_rcu;
8670         }
8671
8672         /* and this pointer is always (unless driver didn't know) beacon data */
8673         ies = rcu_dereference(res->beacon_ies);
8674         if (ies && ies->from_beacon) {
8675                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
8676                                       NL80211_BSS_PAD))
8677                         goto fail_unlock_rcu;
8678                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
8679                                         ies->len, ies->data))
8680                         goto fail_unlock_rcu;
8681         }
8682         rcu_read_unlock();
8683
8684         if (res->beacon_interval &&
8685             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
8686                 goto nla_put_failure;
8687         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
8688             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
8689             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
8690             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
8691                         jiffies_to_msecs(jiffies - intbss->ts)))
8692                 goto nla_put_failure;
8693
8694         if (intbss->parent_tsf &&
8695             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
8696                                intbss->parent_tsf, NL80211_BSS_PAD) ||
8697              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
8698                      intbss->parent_bssid)))
8699                 goto nla_put_failure;
8700
8701         if (intbss->ts_boottime &&
8702             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
8703                               intbss->ts_boottime, NL80211_BSS_PAD))
8704                 goto nla_put_failure;
8705
8706         if (!nl80211_put_signal(msg, intbss->pub.chains,
8707                                 intbss->pub.chain_signal,
8708                                 NL80211_BSS_CHAIN_SIGNAL))
8709                 goto nla_put_failure;
8710
8711         switch (rdev->wiphy.signal_type) {
8712         case CFG80211_SIGNAL_TYPE_MBM:
8713                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
8714                         goto nla_put_failure;
8715                 break;
8716         case CFG80211_SIGNAL_TYPE_UNSPEC:
8717                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
8718                         goto nla_put_failure;
8719                 break;
8720         default:
8721                 break;
8722         }
8723
8724         switch (wdev->iftype) {
8725         case NL80211_IFTYPE_P2P_CLIENT:
8726         case NL80211_IFTYPE_STATION:
8727                 if (intbss == wdev->current_bss &&
8728                     nla_put_u32(msg, NL80211_BSS_STATUS,
8729                                 NL80211_BSS_STATUS_ASSOCIATED))
8730                         goto nla_put_failure;
8731                 break;
8732         case NL80211_IFTYPE_ADHOC:
8733                 if (intbss == wdev->current_bss &&
8734                     nla_put_u32(msg, NL80211_BSS_STATUS,
8735                                 NL80211_BSS_STATUS_IBSS_JOINED))
8736                         goto nla_put_failure;
8737                 break;
8738         default:
8739                 break;
8740         }
8741
8742         nla_nest_end(msg, bss);
8743
8744         genlmsg_end(msg, hdr);
8745         return 0;
8746
8747  fail_unlock_rcu:
8748         rcu_read_unlock();
8749  nla_put_failure:
8750         genlmsg_cancel(msg, hdr);
8751         return -EMSGSIZE;
8752 }
8753
8754 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
8755 {
8756         struct cfg80211_registered_device *rdev;
8757         struct cfg80211_internal_bss *scan;
8758         struct wireless_dev *wdev;
8759         int start = cb->args[2], idx = 0;
8760         int err;
8761
8762         rtnl_lock();
8763         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
8764         if (err) {
8765                 rtnl_unlock();
8766                 return err;
8767         }
8768
8769         wdev_lock(wdev);
8770         spin_lock_bh(&rdev->bss_lock);
8771
8772         /*
8773          * dump_scan will be called multiple times to break up the scan results
8774          * into multiple messages.  It is unlikely that any more bss-es will be
8775          * expired after the first call, so only call only call this on the
8776          * first dump_scan invocation.
8777          */
8778         if (start == 0)
8779                 cfg80211_bss_expire(rdev);
8780
8781         cb->seq = rdev->bss_generation;
8782
8783         list_for_each_entry(scan, &rdev->bss_list, list) {
8784                 if (++idx <= start)
8785                         continue;
8786                 if (nl80211_send_bss(skb, cb,
8787                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8788                                 rdev, wdev, scan) < 0) {
8789                         idx--;
8790                         break;
8791                 }
8792         }
8793
8794         spin_unlock_bh(&rdev->bss_lock);
8795         wdev_unlock(wdev);
8796
8797         cb->args[2] = idx;
8798         rtnl_unlock();
8799
8800         return skb->len;
8801 }
8802
8803 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
8804                                int flags, struct net_device *dev,
8805                                bool allow_radio_stats,
8806                                struct survey_info *survey)
8807 {
8808         void *hdr;
8809         struct nlattr *infoattr;
8810
8811         /* skip radio stats if userspace didn't request them */
8812         if (!survey->channel && !allow_radio_stats)
8813                 return 0;
8814
8815         hdr = nl80211hdr_put(msg, portid, seq, flags,
8816                              NL80211_CMD_NEW_SURVEY_RESULTS);
8817         if (!hdr)
8818                 return -ENOMEM;
8819
8820         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
8821                 goto nla_put_failure;
8822
8823         infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
8824         if (!infoattr)
8825                 goto nla_put_failure;
8826
8827         if (survey->channel &&
8828             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
8829                         survey->channel->center_freq))
8830                 goto nla_put_failure;
8831
8832         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
8833             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
8834                 goto nla_put_failure;
8835         if ((survey->filled & SURVEY_INFO_IN_USE) &&
8836             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
8837                 goto nla_put_failure;
8838         if ((survey->filled & SURVEY_INFO_TIME) &&
8839             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
8840                         survey->time, NL80211_SURVEY_INFO_PAD))
8841                 goto nla_put_failure;
8842         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
8843             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
8844                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
8845                 goto nla_put_failure;
8846         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
8847             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
8848                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
8849                 goto nla_put_failure;
8850         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
8851             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
8852                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
8853                 goto nla_put_failure;
8854         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
8855             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
8856                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
8857                 goto nla_put_failure;
8858         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
8859             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
8860                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
8861                 goto nla_put_failure;
8862         if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
8863             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
8864                               survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
8865                 goto nla_put_failure;
8866
8867         nla_nest_end(msg, infoattr);
8868
8869         genlmsg_end(msg, hdr);
8870         return 0;
8871
8872  nla_put_failure:
8873         genlmsg_cancel(msg, hdr);
8874         return -EMSGSIZE;
8875 }
8876
8877 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
8878 {
8879         struct nlattr **attrbuf;
8880         struct survey_info survey;
8881         struct cfg80211_registered_device *rdev;
8882         struct wireless_dev *wdev;
8883         int survey_idx = cb->args[2];
8884         int res;
8885         bool radio_stats;
8886
8887         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
8888         if (!attrbuf)
8889                 return -ENOMEM;
8890
8891         rtnl_lock();
8892         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
8893         if (res)
8894                 goto out_err;
8895
8896         /* prepare_wdev_dump parsed the attributes */
8897         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
8898
8899         if (!wdev->netdev) {
8900                 res = -EINVAL;
8901                 goto out_err;
8902         }
8903
8904         if (!rdev->ops->dump_survey) {
8905                 res = -EOPNOTSUPP;
8906                 goto out_err;
8907         }
8908
8909         while (1) {
8910                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
8911                 if (res == -ENOENT)
8912                         break;
8913                 if (res)
8914                         goto out_err;
8915
8916                 /* don't send disabled channels, but do send non-channel data */
8917                 if (survey.channel &&
8918                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
8919                         survey_idx++;
8920                         continue;
8921                 }
8922
8923                 if (nl80211_send_survey(skb,
8924                                 NETLINK_CB(cb->skb).portid,
8925                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8926                                 wdev->netdev, radio_stats, &survey) < 0)
8927                         goto out;
8928                 survey_idx++;
8929         }
8930
8931  out:
8932         cb->args[2] = survey_idx;
8933         res = skb->len;
8934  out_err:
8935         kfree(attrbuf);
8936         rtnl_unlock();
8937         return res;
8938 }
8939
8940 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
8941 {
8942         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
8943                                   NL80211_WPA_VERSION_2 |
8944                                   NL80211_WPA_VERSION_3));
8945 }
8946
8947 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
8948 {
8949         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8950         struct net_device *dev = info->user_ptr[1];
8951         struct ieee80211_channel *chan;
8952         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
8953         int err, ssid_len, ie_len = 0, auth_data_len = 0;
8954         enum nl80211_auth_type auth_type;
8955         struct key_parse key;
8956         bool local_state_change;
8957
8958         if (!info->attrs[NL80211_ATTR_MAC])
8959                 return -EINVAL;
8960
8961         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
8962                 return -EINVAL;
8963
8964         if (!info->attrs[NL80211_ATTR_SSID])
8965                 return -EINVAL;
8966
8967         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8968                 return -EINVAL;
8969
8970         err = nl80211_parse_key(info, &key);
8971         if (err)
8972                 return err;
8973
8974         if (key.idx >= 0) {
8975                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
8976                         return -EINVAL;
8977                 if (!key.p.key || !key.p.key_len)
8978                         return -EINVAL;
8979                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
8980                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
8981                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
8982                      key.p.key_len != WLAN_KEY_LEN_WEP104))
8983                         return -EINVAL;
8984                 if (key.idx > 3)
8985                         return -EINVAL;
8986         } else {
8987                 key.p.key_len = 0;
8988                 key.p.key = NULL;
8989         }
8990
8991         if (key.idx >= 0) {
8992                 int i;
8993                 bool ok = false;
8994
8995                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
8996                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
8997                                 ok = true;
8998                                 break;
8999                         }
9000                 }
9001                 if (!ok)
9002                         return -EINVAL;
9003         }
9004
9005         if (!rdev->ops->auth)
9006                 return -EOPNOTSUPP;
9007
9008         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9009             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9010                 return -EOPNOTSUPP;
9011
9012         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9013         chan = nl80211_get_valid_chan(&rdev->wiphy,
9014                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9015         if (!chan)
9016                 return -EINVAL;
9017
9018         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9019         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9020
9021         if (info->attrs[NL80211_ATTR_IE]) {
9022                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9023                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9024         }
9025
9026         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9027         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
9028                 return -EINVAL;
9029
9030         if ((auth_type == NL80211_AUTHTYPE_SAE ||
9031              auth_type == NL80211_AUTHTYPE_FILS_SK ||
9032              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
9033              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
9034             !info->attrs[NL80211_ATTR_AUTH_DATA])
9035                 return -EINVAL;
9036
9037         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
9038                 if (auth_type != NL80211_AUTHTYPE_SAE &&
9039                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
9040                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
9041                     auth_type != NL80211_AUTHTYPE_FILS_PK)
9042                         return -EINVAL;
9043                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
9044                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
9045                 /* need to include at least Auth Transaction and Status Code */
9046                 if (auth_data_len < 4)
9047                         return -EINVAL;
9048         }
9049
9050         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9051
9052         /*
9053          * Since we no longer track auth state, ignore
9054          * requests to only change local state.
9055          */
9056         if (local_state_change)
9057                 return 0;
9058
9059         wdev_lock(dev->ieee80211_ptr);
9060         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
9061                                  ssid, ssid_len, ie, ie_len,
9062                                  key.p.key, key.p.key_len, key.idx,
9063                                  auth_data, auth_data_len);
9064         wdev_unlock(dev->ieee80211_ptr);
9065         return err;
9066 }
9067
9068 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
9069                                      struct genl_info *info)
9070 {
9071         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9072                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
9073                 return -EINVAL;
9074         }
9075
9076         if (!rdev->ops->tx_control_port ||
9077             !wiphy_ext_feature_isset(&rdev->wiphy,
9078                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
9079                 return -EOPNOTSUPP;
9080
9081         return 0;
9082 }
9083
9084 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
9085                                    struct genl_info *info,
9086                                    struct cfg80211_crypto_settings *settings,
9087                                    int cipher_limit)
9088 {
9089         memset(settings, 0, sizeof(*settings));
9090
9091         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
9092
9093         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
9094                 u16 proto;
9095
9096                 proto = nla_get_u16(
9097                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
9098                 settings->control_port_ethertype = cpu_to_be16(proto);
9099                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
9100                     proto != ETH_P_PAE)
9101                         return -EINVAL;
9102                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
9103                         settings->control_port_no_encrypt = true;
9104         } else
9105                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
9106
9107         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
9108                 int r = validate_pae_over_nl80211(rdev, info);
9109
9110                 if (r < 0)
9111                         return r;
9112
9113                 settings->control_port_over_nl80211 = true;
9114         }
9115
9116         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
9117                 void *data;
9118                 int len, i;
9119
9120                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
9121                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
9122                 settings->n_ciphers_pairwise = len / sizeof(u32);
9123
9124                 if (len % sizeof(u32))
9125                         return -EINVAL;
9126
9127                 if (settings->n_ciphers_pairwise > cipher_limit)
9128                         return -EINVAL;
9129
9130                 memcpy(settings->ciphers_pairwise, data, len);
9131
9132                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
9133                         if (!cfg80211_supported_cipher_suite(
9134                                         &rdev->wiphy,
9135                                         settings->ciphers_pairwise[i]))
9136                                 return -EINVAL;
9137         }
9138
9139         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
9140                 settings->cipher_group =
9141                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
9142                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
9143                                                      settings->cipher_group))
9144                         return -EINVAL;
9145         }
9146
9147         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
9148                 settings->wpa_versions =
9149                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
9150                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
9151                         return -EINVAL;
9152         }
9153
9154         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
9155                 void *data;
9156                 int len;
9157
9158                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
9159                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
9160                 settings->n_akm_suites = len / sizeof(u32);
9161
9162                 if (len % sizeof(u32))
9163                         return -EINVAL;
9164
9165                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
9166                         return -EINVAL;
9167
9168                 memcpy(settings->akm_suites, data, len);
9169         }
9170
9171         if (info->attrs[NL80211_ATTR_PMK]) {
9172                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
9173                         return -EINVAL;
9174                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9175                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
9176                         return -EINVAL;
9177                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9178         }
9179
9180         if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
9181                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9182                                              NL80211_EXT_FEATURE_SAE_OFFLOAD))
9183                         return -EINVAL;
9184                 settings->sae_pwd =
9185                         nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
9186                 settings->sae_pwd_len =
9187                         nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
9188         }
9189
9190         return 0;
9191 }
9192
9193 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
9194 {
9195         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9196         struct net_device *dev = info->user_ptr[1];
9197         struct ieee80211_channel *chan;
9198         struct cfg80211_assoc_request req = {};
9199         const u8 *bssid, *ssid;
9200         int err, ssid_len = 0;
9201
9202         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9203             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9204                 return -EPERM;
9205
9206         if (!info->attrs[NL80211_ATTR_MAC] ||
9207             !info->attrs[NL80211_ATTR_SSID] ||
9208             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
9209                 return -EINVAL;
9210
9211         if (!rdev->ops->assoc)
9212                 return -EOPNOTSUPP;
9213
9214         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9215             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9216                 return -EOPNOTSUPP;
9217
9218         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9219
9220         chan = nl80211_get_valid_chan(&rdev->wiphy,
9221                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9222         if (!chan)
9223                 return -EINVAL;
9224
9225         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9226         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9227
9228         if (info->attrs[NL80211_ATTR_IE]) {
9229                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9230                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9231         }
9232
9233         if (info->attrs[NL80211_ATTR_USE_MFP]) {
9234                 enum nl80211_mfp mfp =
9235                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9236                 if (mfp == NL80211_MFP_REQUIRED)
9237                         req.use_mfp = true;
9238                 else if (mfp != NL80211_MFP_NO)
9239                         return -EINVAL;
9240         }
9241
9242         if (info->attrs[NL80211_ATTR_PREV_BSSID])
9243                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9244
9245         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9246                 req.flags |= ASSOC_REQ_DISABLE_HT;
9247
9248         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9249                 memcpy(&req.ht_capa_mask,
9250                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9251                        sizeof(req.ht_capa_mask));
9252
9253         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9254                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9255                         return -EINVAL;
9256                 memcpy(&req.ht_capa,
9257                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9258                        sizeof(req.ht_capa));
9259         }
9260
9261         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9262                 req.flags |= ASSOC_REQ_DISABLE_VHT;
9263
9264         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9265                 memcpy(&req.vht_capa_mask,
9266                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9267                        sizeof(req.vht_capa_mask));
9268
9269         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9270                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9271                         return -EINVAL;
9272                 memcpy(&req.vht_capa,
9273                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9274                        sizeof(req.vht_capa));
9275         }
9276
9277         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9278                 if (!((rdev->wiphy.features &
9279                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9280                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9281                     !wiphy_ext_feature_isset(&rdev->wiphy,
9282                                              NL80211_EXT_FEATURE_RRM))
9283                         return -EINVAL;
9284                 req.flags |= ASSOC_REQ_USE_RRM;
9285         }
9286
9287         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
9288                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
9289                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
9290                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
9291                         return -EINVAL;
9292                 req.fils_nonces =
9293                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
9294         }
9295
9296         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
9297         if (!err) {
9298                 wdev_lock(dev->ieee80211_ptr);
9299
9300                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
9301                                           ssid, ssid_len, &req);
9302
9303                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9304                         dev->ieee80211_ptr->conn_owner_nlportid =
9305                                 info->snd_portid;
9306                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
9307                                bssid, ETH_ALEN);
9308                 }
9309
9310                 wdev_unlock(dev->ieee80211_ptr);
9311         }
9312
9313         return err;
9314 }
9315
9316 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
9317 {
9318         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9319         struct net_device *dev = info->user_ptr[1];
9320         const u8 *ie = NULL, *bssid;
9321         int ie_len = 0, err;
9322         u16 reason_code;
9323         bool local_state_change;
9324
9325         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9326             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9327                 return -EPERM;
9328
9329         if (!info->attrs[NL80211_ATTR_MAC])
9330                 return -EINVAL;
9331
9332         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9333                 return -EINVAL;
9334
9335         if (!rdev->ops->deauth)
9336                 return -EOPNOTSUPP;
9337
9338         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9339             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9340                 return -EOPNOTSUPP;
9341
9342         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9343
9344         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9345         if (reason_code == 0) {
9346                 /* Reason Code 0 is reserved */
9347                 return -EINVAL;
9348         }
9349
9350         if (info->attrs[NL80211_ATTR_IE]) {
9351                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9352                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9353         }
9354
9355         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9356
9357         wdev_lock(dev->ieee80211_ptr);
9358         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
9359                                    local_state_change);
9360         wdev_unlock(dev->ieee80211_ptr);
9361         return err;
9362 }
9363
9364 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
9365 {
9366         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9367         struct net_device *dev = info->user_ptr[1];
9368         const u8 *ie = NULL, *bssid;
9369         int ie_len = 0, err;
9370         u16 reason_code;
9371         bool local_state_change;
9372
9373         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9374             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9375                 return -EPERM;
9376
9377         if (!info->attrs[NL80211_ATTR_MAC])
9378                 return -EINVAL;
9379
9380         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9381                 return -EINVAL;
9382
9383         if (!rdev->ops->disassoc)
9384                 return -EOPNOTSUPP;
9385
9386         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9387             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9388                 return -EOPNOTSUPP;
9389
9390         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9391
9392         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9393         if (reason_code == 0) {
9394                 /* Reason Code 0 is reserved */
9395                 return -EINVAL;
9396         }
9397
9398         if (info->attrs[NL80211_ATTR_IE]) {
9399                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9400                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9401         }
9402
9403         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9404
9405         wdev_lock(dev->ieee80211_ptr);
9406         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
9407                                      local_state_change);
9408         wdev_unlock(dev->ieee80211_ptr);
9409         return err;
9410 }
9411
9412 static bool
9413 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
9414                          int mcast_rate[NUM_NL80211_BANDS],
9415                          int rateval)
9416 {
9417         struct wiphy *wiphy = &rdev->wiphy;
9418         bool found = false;
9419         int band, i;
9420
9421         for (band = 0; band < NUM_NL80211_BANDS; band++) {
9422                 struct ieee80211_supported_band *sband;
9423
9424                 sband = wiphy->bands[band];
9425                 if (!sband)
9426                         continue;
9427
9428                 for (i = 0; i < sband->n_bitrates; i++) {
9429                         if (sband->bitrates[i].bitrate == rateval) {
9430                                 mcast_rate[band] = i + 1;
9431                                 found = true;
9432                                 break;
9433                         }
9434                 }
9435         }
9436
9437         return found;
9438 }
9439
9440 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
9441 {
9442         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9443         struct net_device *dev = info->user_ptr[1];
9444         struct cfg80211_ibss_params ibss;
9445         struct wiphy *wiphy;
9446         struct cfg80211_cached_keys *connkeys = NULL;
9447         int err;
9448
9449         memset(&ibss, 0, sizeof(ibss));
9450
9451         if (!info->attrs[NL80211_ATTR_SSID] ||
9452             !nla_len(info->attrs[NL80211_ATTR_SSID]))
9453                 return -EINVAL;
9454
9455         ibss.beacon_interval = 100;
9456
9457         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
9458                 ibss.beacon_interval =
9459                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9460
9461         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
9462                                            ibss.beacon_interval);
9463         if (err)
9464                 return err;
9465
9466         if (!rdev->ops->join_ibss)
9467                 return -EOPNOTSUPP;
9468
9469         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9470                 return -EOPNOTSUPP;
9471
9472         wiphy = &rdev->wiphy;
9473
9474         if (info->attrs[NL80211_ATTR_MAC]) {
9475                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9476
9477                 if (!is_valid_ether_addr(ibss.bssid))
9478                         return -EINVAL;
9479         }
9480         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9481         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9482
9483         if (info->attrs[NL80211_ATTR_IE]) {
9484                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9485                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9486         }
9487
9488         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
9489         if (err)
9490                 return err;
9491
9492         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
9493                                      NL80211_IFTYPE_ADHOC))
9494                 return -EINVAL;
9495
9496         switch (ibss.chandef.width) {
9497         case NL80211_CHAN_WIDTH_5:
9498         case NL80211_CHAN_WIDTH_10:
9499         case NL80211_CHAN_WIDTH_20_NOHT:
9500                 break;
9501         case NL80211_CHAN_WIDTH_20:
9502         case NL80211_CHAN_WIDTH_40:
9503                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
9504                         return -EINVAL;
9505                 break;
9506         case NL80211_CHAN_WIDTH_80:
9507         case NL80211_CHAN_WIDTH_80P80:
9508         case NL80211_CHAN_WIDTH_160:
9509                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
9510                         return -EINVAL;
9511                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9512                                              NL80211_EXT_FEATURE_VHT_IBSS))
9513                         return -EINVAL;
9514                 break;
9515         default:
9516                 return -EINVAL;
9517         }
9518
9519         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
9520         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
9521
9522         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9523                 u8 *rates =
9524                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9525                 int n_rates =
9526                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9527                 struct ieee80211_supported_band *sband =
9528                         wiphy->bands[ibss.chandef.chan->band];
9529
9530                 err = ieee80211_get_ratemask(sband, rates, n_rates,
9531                                              &ibss.basic_rates);
9532                 if (err)
9533                         return err;
9534         }
9535
9536         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9537                 memcpy(&ibss.ht_capa_mask,
9538                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9539                        sizeof(ibss.ht_capa_mask));
9540
9541         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9542                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9543                         return -EINVAL;
9544                 memcpy(&ibss.ht_capa,
9545                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9546                        sizeof(ibss.ht_capa));
9547         }
9548
9549         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9550             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
9551                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9552                 return -EINVAL;
9553
9554         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9555                 bool no_ht = false;
9556
9557                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
9558                 if (IS_ERR(connkeys))
9559                         return PTR_ERR(connkeys);
9560
9561                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
9562                     no_ht) {
9563                         kzfree(connkeys);
9564                         return -EINVAL;
9565                 }
9566         }
9567
9568         ibss.control_port =
9569                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
9570
9571         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
9572                 int r = validate_pae_over_nl80211(rdev, info);
9573
9574                 if (r < 0) {
9575                         kzfree(connkeys);
9576                         return r;
9577                 }
9578
9579                 ibss.control_port_over_nl80211 = true;
9580         }
9581
9582         ibss.userspace_handles_dfs =
9583                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
9584
9585         wdev_lock(dev->ieee80211_ptr);
9586         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
9587         if (err)
9588                 kzfree(connkeys);
9589         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9590                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9591         wdev_unlock(dev->ieee80211_ptr);
9592
9593         return err;
9594 }
9595
9596 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
9597 {
9598         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9599         struct net_device *dev = info->user_ptr[1];
9600
9601         if (!rdev->ops->leave_ibss)
9602                 return -EOPNOTSUPP;
9603
9604         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9605                 return -EOPNOTSUPP;
9606
9607         return cfg80211_leave_ibss(rdev, dev, false);
9608 }
9609
9610 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
9611 {
9612         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9613         struct net_device *dev = info->user_ptr[1];
9614         int mcast_rate[NUM_NL80211_BANDS];
9615         u32 nla_rate;
9616         int err;
9617
9618         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
9619             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
9620             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
9621                 return -EOPNOTSUPP;
9622
9623         if (!rdev->ops->set_mcast_rate)
9624                 return -EOPNOTSUPP;
9625
9626         memset(mcast_rate, 0, sizeof(mcast_rate));
9627
9628         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
9629                 return -EINVAL;
9630
9631         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
9632         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
9633                 return -EINVAL;
9634
9635         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
9636
9637         return err;
9638 }
9639
9640 static struct sk_buff *
9641 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
9642                             struct wireless_dev *wdev, int approxlen,
9643                             u32 portid, u32 seq, enum nl80211_commands cmd,
9644                             enum nl80211_attrs attr,
9645                             const struct nl80211_vendor_cmd_info *info,
9646                             gfp_t gfp)
9647 {
9648         struct sk_buff *skb;
9649         void *hdr;
9650         struct nlattr *data;
9651
9652         skb = nlmsg_new(approxlen + 100, gfp);
9653         if (!skb)
9654                 return NULL;
9655
9656         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
9657         if (!hdr) {
9658                 kfree_skb(skb);
9659                 return NULL;
9660         }
9661
9662         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9663                 goto nla_put_failure;
9664
9665         if (info) {
9666                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
9667                                 info->vendor_id))
9668                         goto nla_put_failure;
9669                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
9670                                 info->subcmd))
9671                         goto nla_put_failure;
9672         }
9673
9674         if (wdev) {
9675                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
9676                                       wdev_id(wdev), NL80211_ATTR_PAD))
9677                         goto nla_put_failure;
9678                 if (wdev->netdev &&
9679                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
9680                                 wdev->netdev->ifindex))
9681                         goto nla_put_failure;
9682         }
9683
9684         data = nla_nest_start_noflag(skb, attr);
9685         if (!data)
9686                 goto nla_put_failure;
9687
9688         ((void **)skb->cb)[0] = rdev;
9689         ((void **)skb->cb)[1] = hdr;
9690         ((void **)skb->cb)[2] = data;
9691
9692         return skb;
9693
9694  nla_put_failure:
9695         kfree_skb(skb);
9696         return NULL;
9697 }
9698
9699 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
9700                                            struct wireless_dev *wdev,
9701                                            enum nl80211_commands cmd,
9702                                            enum nl80211_attrs attr,
9703                                            unsigned int portid,
9704                                            int vendor_event_idx,
9705                                            int approxlen, gfp_t gfp)
9706 {
9707         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9708         const struct nl80211_vendor_cmd_info *info;
9709
9710         switch (cmd) {
9711         case NL80211_CMD_TESTMODE:
9712                 if (WARN_ON(vendor_event_idx != -1))
9713                         return NULL;
9714                 info = NULL;
9715                 break;
9716         case NL80211_CMD_VENDOR:
9717                 if (WARN_ON(vendor_event_idx < 0 ||
9718                             vendor_event_idx >= wiphy->n_vendor_events))
9719                         return NULL;
9720                 info = &wiphy->vendor_events[vendor_event_idx];
9721                 break;
9722         default:
9723                 WARN_ON(1);
9724                 return NULL;
9725         }
9726
9727         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
9728                                            cmd, attr, info, gfp);
9729 }
9730 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
9731
9732 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
9733 {
9734         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9735         void *hdr = ((void **)skb->cb)[1];
9736         struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
9737         struct nlattr *data = ((void **)skb->cb)[2];
9738         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
9739
9740         /* clear CB data for netlink core to own from now on */
9741         memset(skb->cb, 0, sizeof(skb->cb));
9742
9743         nla_nest_end(skb, data);
9744         genlmsg_end(skb, hdr);
9745
9746         if (nlhdr->nlmsg_pid) {
9747                 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
9748                                 nlhdr->nlmsg_pid);
9749         } else {
9750                 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
9751                         mcgrp = NL80211_MCGRP_VENDOR;
9752
9753                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
9754                                         skb, 0, mcgrp, gfp);
9755         }
9756 }
9757 EXPORT_SYMBOL(__cfg80211_send_event_skb);
9758
9759 #ifdef CONFIG_NL80211_TESTMODE
9760 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
9761 {
9762         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9763         struct wireless_dev *wdev =
9764                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9765         int err;
9766
9767         if (!rdev->ops->testmode_cmd)
9768                 return -EOPNOTSUPP;
9769
9770         if (IS_ERR(wdev)) {
9771                 err = PTR_ERR(wdev);
9772                 if (err != -EINVAL)
9773                         return err;
9774                 wdev = NULL;
9775         } else if (wdev->wiphy != &rdev->wiphy) {
9776                 return -EINVAL;
9777         }
9778
9779         if (!info->attrs[NL80211_ATTR_TESTDATA])
9780                 return -EINVAL;
9781
9782         rdev->cur_cmd_info = info;
9783         err = rdev_testmode_cmd(rdev, wdev,
9784                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
9785                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
9786         rdev->cur_cmd_info = NULL;
9787
9788         return err;
9789 }
9790
9791 static int nl80211_testmode_dump(struct sk_buff *skb,
9792                                  struct netlink_callback *cb)
9793 {
9794         struct cfg80211_registered_device *rdev;
9795         struct nlattr **attrbuf = NULL;
9796         int err;
9797         long phy_idx;
9798         void *data = NULL;
9799         int data_len = 0;
9800
9801         rtnl_lock();
9802
9803         if (cb->args[0]) {
9804                 /*
9805                  * 0 is a valid index, but not valid for args[0],
9806                  * so we need to offset by 1.
9807                  */
9808                 phy_idx = cb->args[0] - 1;
9809
9810                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
9811                 if (!rdev) {
9812                         err = -ENOENT;
9813                         goto out_err;
9814                 }
9815         } else {
9816                 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
9817                                   GFP_KERNEL);
9818                 if (!attrbuf) {
9819                         err = -ENOMEM;
9820                         goto out_err;
9821                 }
9822
9823                 err = nlmsg_parse_deprecated(cb->nlh,
9824                                              GENL_HDRLEN + nl80211_fam.hdrsize,
9825                                              attrbuf, nl80211_fam.maxattr,
9826                                              nl80211_policy, NULL);
9827                 if (err)
9828                         goto out_err;
9829
9830                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
9831                 if (IS_ERR(rdev)) {
9832                         err = PTR_ERR(rdev);
9833                         goto out_err;
9834                 }
9835                 phy_idx = rdev->wiphy_idx;
9836
9837                 if (attrbuf[NL80211_ATTR_TESTDATA])
9838                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
9839         }
9840
9841         if (cb->args[1]) {
9842                 data = nla_data((void *)cb->args[1]);
9843                 data_len = nla_len((void *)cb->args[1]);
9844         }
9845
9846         if (!rdev->ops->testmode_dump) {
9847                 err = -EOPNOTSUPP;
9848                 goto out_err;
9849         }
9850
9851         while (1) {
9852                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
9853                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
9854                                            NL80211_CMD_TESTMODE);
9855                 struct nlattr *tmdata;
9856
9857                 if (!hdr)
9858                         break;
9859
9860                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
9861                         genlmsg_cancel(skb, hdr);
9862                         break;
9863                 }
9864
9865                 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
9866                 if (!tmdata) {
9867                         genlmsg_cancel(skb, hdr);
9868                         break;
9869                 }
9870                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
9871                 nla_nest_end(skb, tmdata);
9872
9873                 if (err == -ENOBUFS || err == -ENOENT) {
9874                         genlmsg_cancel(skb, hdr);
9875                         break;
9876                 } else if (err) {
9877                         genlmsg_cancel(skb, hdr);
9878                         goto out_err;
9879                 }
9880
9881                 genlmsg_end(skb, hdr);
9882         }
9883
9884         err = skb->len;
9885         /* see above */
9886         cb->args[0] = phy_idx + 1;
9887  out_err:
9888         kfree(attrbuf);
9889         rtnl_unlock();
9890         return err;
9891 }
9892 #endif
9893
9894 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
9895 {
9896         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9897         struct net_device *dev = info->user_ptr[1];
9898         struct cfg80211_connect_params connect;
9899         struct wiphy *wiphy;
9900         struct cfg80211_cached_keys *connkeys = NULL;
9901         int err;
9902
9903         memset(&connect, 0, sizeof(connect));
9904
9905         if (!info->attrs[NL80211_ATTR_SSID] ||
9906             !nla_len(info->attrs[NL80211_ATTR_SSID]))
9907                 return -EINVAL;
9908
9909         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9910                 connect.auth_type =
9911                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9912                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
9913                                              NL80211_CMD_CONNECT))
9914                         return -EINVAL;
9915         } else
9916                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
9917
9918         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
9919
9920         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
9921             !wiphy_ext_feature_isset(&rdev->wiphy,
9922                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
9923                 return -EINVAL;
9924         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
9925
9926         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
9927                                       NL80211_MAX_NR_CIPHER_SUITES);
9928         if (err)
9929                 return err;
9930
9931         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9932             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9933                 return -EOPNOTSUPP;
9934
9935         wiphy = &rdev->wiphy;
9936
9937         connect.bg_scan_period = -1;
9938         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
9939                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
9940                 connect.bg_scan_period =
9941                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
9942         }
9943
9944         if (info->attrs[NL80211_ATTR_MAC])
9945                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9946         else if (info->attrs[NL80211_ATTR_MAC_HINT])
9947                 connect.bssid_hint =
9948                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
9949         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9950         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9951
9952         if (info->attrs[NL80211_ATTR_IE]) {
9953                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9954                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9955         }
9956
9957         if (info->attrs[NL80211_ATTR_USE_MFP]) {
9958                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9959                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
9960                     !wiphy_ext_feature_isset(&rdev->wiphy,
9961                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
9962                         return -EOPNOTSUPP;
9963         } else {
9964                 connect.mfp = NL80211_MFP_NO;
9965         }
9966
9967         if (info->attrs[NL80211_ATTR_PREV_BSSID])
9968                 connect.prev_bssid =
9969                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9970
9971         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9972                 connect.channel = nl80211_get_valid_chan(
9973                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9974                 if (!connect.channel)
9975                         return -EINVAL;
9976         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
9977                 connect.channel_hint = nl80211_get_valid_chan(
9978                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
9979                 if (!connect.channel_hint)
9980                         return -EINVAL;
9981         }
9982
9983         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
9984                 connect.edmg.channels =
9985                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
9986
9987                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
9988                         connect.edmg.bw_config =
9989                                 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
9990         }
9991
9992         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9993                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
9994                 if (IS_ERR(connkeys))
9995                         return PTR_ERR(connkeys);
9996         }
9997
9998         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9999                 connect.flags |= ASSOC_REQ_DISABLE_HT;
10000
10001         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10002                 memcpy(&connect.ht_capa_mask,
10003                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10004                        sizeof(connect.ht_capa_mask));
10005
10006         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10007                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
10008                         kzfree(connkeys);
10009                         return -EINVAL;
10010                 }
10011                 memcpy(&connect.ht_capa,
10012                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10013                        sizeof(connect.ht_capa));
10014         }
10015
10016         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
10017                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
10018
10019         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10020                 memcpy(&connect.vht_capa_mask,
10021                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
10022                        sizeof(connect.vht_capa_mask));
10023
10024         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
10025                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
10026                         kzfree(connkeys);
10027                         return -EINVAL;
10028                 }
10029                 memcpy(&connect.vht_capa,
10030                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
10031                        sizeof(connect.vht_capa));
10032         }
10033
10034         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
10035                 if (!((rdev->wiphy.features &
10036                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
10037                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
10038                     !wiphy_ext_feature_isset(&rdev->wiphy,
10039                                              NL80211_EXT_FEATURE_RRM)) {
10040                         kzfree(connkeys);
10041                         return -EINVAL;
10042                 }
10043                 connect.flags |= ASSOC_REQ_USE_RRM;
10044         }
10045
10046         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
10047         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
10048                 kzfree(connkeys);
10049                 return -EOPNOTSUPP;
10050         }
10051
10052         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
10053                 /* bss selection makes no sense if bssid is set */
10054                 if (connect.bssid) {
10055                         kzfree(connkeys);
10056                         return -EINVAL;
10057                 }
10058
10059                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
10060                                        wiphy, &connect.bss_select);
10061                 if (err) {
10062                         kzfree(connkeys);
10063                         return err;
10064                 }
10065         }
10066
10067         if (wiphy_ext_feature_isset(&rdev->wiphy,
10068                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
10069             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
10070             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
10071             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
10072             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10073                 connect.fils_erp_username =
10074                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10075                 connect.fils_erp_username_len =
10076                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10077                 connect.fils_erp_realm =
10078                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10079                 connect.fils_erp_realm_len =
10080                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10081                 connect.fils_erp_next_seq_num =
10082                         nla_get_u16(
10083                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
10084                 connect.fils_erp_rrk =
10085                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10086                 connect.fils_erp_rrk_len =
10087                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10088         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
10089                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
10090                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
10091                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10092                 kzfree(connkeys);
10093                 return -EINVAL;
10094         }
10095
10096         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
10097                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10098                         kzfree(connkeys);
10099                         GENL_SET_ERR_MSG(info,
10100                                          "external auth requires connection ownership");
10101                         return -EINVAL;
10102                 }
10103                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
10104         }
10105
10106         wdev_lock(dev->ieee80211_ptr);
10107
10108         err = cfg80211_connect(rdev, dev, &connect, connkeys,
10109                                connect.prev_bssid);
10110         if (err)
10111                 kzfree(connkeys);
10112
10113         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10114                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10115                 if (connect.bssid)
10116                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
10117                                connect.bssid, ETH_ALEN);
10118                 else
10119                         memset(dev->ieee80211_ptr->disconnect_bssid,
10120                                0, ETH_ALEN);
10121         }
10122
10123         wdev_unlock(dev->ieee80211_ptr);
10124
10125         return err;
10126 }
10127
10128 static int nl80211_update_connect_params(struct sk_buff *skb,
10129                                          struct genl_info *info)
10130 {
10131         struct cfg80211_connect_params connect = {};
10132         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10133         struct net_device *dev = info->user_ptr[1];
10134         struct wireless_dev *wdev = dev->ieee80211_ptr;
10135         bool fils_sk_offload;
10136         u32 auth_type;
10137         u32 changed = 0;
10138         int ret;
10139
10140         if (!rdev->ops->update_connect_params)
10141                 return -EOPNOTSUPP;
10142
10143         if (info->attrs[NL80211_ATTR_IE]) {
10144                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10145                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10146                 changed |= UPDATE_ASSOC_IES;
10147         }
10148
10149         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
10150                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
10151
10152         /*
10153          * when driver supports fils-sk offload all attributes must be
10154          * provided. So the else covers "fils-sk-not-all" and
10155          * "no-fils-sk-any".
10156          */
10157         if (fils_sk_offload &&
10158             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
10159             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
10160             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
10161             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10162                 connect.fils_erp_username =
10163                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10164                 connect.fils_erp_username_len =
10165                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10166                 connect.fils_erp_realm =
10167                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10168                 connect.fils_erp_realm_len =
10169                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10170                 connect.fils_erp_next_seq_num =
10171                         nla_get_u16(
10172                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
10173                 connect.fils_erp_rrk =
10174                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10175                 connect.fils_erp_rrk_len =
10176                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10177                 changed |= UPDATE_FILS_ERP_INFO;
10178         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
10179                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
10180                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
10181                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10182                 return -EINVAL;
10183         }
10184
10185         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
10186                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10187                 if (!nl80211_valid_auth_type(rdev, auth_type,
10188                                              NL80211_CMD_CONNECT))
10189                         return -EINVAL;
10190
10191                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
10192                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
10193                         return -EINVAL;
10194
10195                 connect.auth_type = auth_type;
10196                 changed |= UPDATE_AUTH_TYPE;
10197         }
10198
10199         wdev_lock(dev->ieee80211_ptr);
10200         if (!wdev->current_bss)
10201                 ret = -ENOLINK;
10202         else
10203                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
10204         wdev_unlock(dev->ieee80211_ptr);
10205
10206         return ret;
10207 }
10208
10209 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
10210 {
10211         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10212         struct net_device *dev = info->user_ptr[1];
10213         u16 reason;
10214         int ret;
10215
10216         if (dev->ieee80211_ptr->conn_owner_nlportid &&
10217             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10218                 return -EPERM;
10219
10220         if (!info->attrs[NL80211_ATTR_REASON_CODE])
10221                 reason = WLAN_REASON_DEAUTH_LEAVING;
10222         else
10223                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
10224
10225         if (reason == 0)
10226                 return -EINVAL;
10227
10228         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10229             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10230                 return -EOPNOTSUPP;
10231
10232         wdev_lock(dev->ieee80211_ptr);
10233         ret = cfg80211_disconnect(rdev, dev, reason, true);
10234         wdev_unlock(dev->ieee80211_ptr);
10235         return ret;
10236 }
10237
10238 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
10239 {
10240         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10241         struct net *net;
10242         int err;
10243
10244         if (info->attrs[NL80211_ATTR_PID]) {
10245                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
10246
10247                 net = get_net_ns_by_pid(pid);
10248         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
10249                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
10250
10251                 net = get_net_ns_by_fd(fd);
10252         } else {
10253                 return -EINVAL;
10254         }
10255
10256         if (IS_ERR(net))
10257                 return PTR_ERR(net);
10258
10259         err = 0;
10260
10261         /* check if anything to do */
10262         if (!net_eq(wiphy_net(&rdev->wiphy), net))
10263                 err = cfg80211_switch_netns(rdev, net);
10264
10265         put_net(net);
10266         return err;
10267 }
10268
10269 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
10270 {
10271         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10272         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
10273                         struct cfg80211_pmksa *pmksa) = NULL;
10274         struct net_device *dev = info->user_ptr[1];
10275         struct cfg80211_pmksa pmksa;
10276
10277         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
10278
10279         if (!info->attrs[NL80211_ATTR_PMKID])
10280                 return -EINVAL;
10281
10282         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
10283
10284         if (info->attrs[NL80211_ATTR_MAC]) {
10285                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10286         } else if (info->attrs[NL80211_ATTR_SSID] &&
10287                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
10288                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
10289                     info->attrs[NL80211_ATTR_PMK])) {
10290                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10291                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10292                 pmksa.cache_id =
10293                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
10294         } else {
10295                 return -EINVAL;
10296         }
10297         if (info->attrs[NL80211_ATTR_PMK]) {
10298                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
10299                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
10300         }
10301
10302         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10303             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
10304             !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
10305               wiphy_ext_feature_isset(&rdev->wiphy,
10306                                       NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
10307                 return -EOPNOTSUPP;
10308
10309         switch (info->genlhdr->cmd) {
10310         case NL80211_CMD_SET_PMKSA:
10311                 rdev_ops = rdev->ops->set_pmksa;
10312                 break;
10313         case NL80211_CMD_DEL_PMKSA:
10314                 rdev_ops = rdev->ops->del_pmksa;
10315                 break;
10316         default:
10317                 WARN_ON(1);
10318                 break;
10319         }
10320
10321         if (!rdev_ops)
10322                 return -EOPNOTSUPP;
10323
10324         return rdev_ops(&rdev->wiphy, dev, &pmksa);
10325 }
10326
10327 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
10328 {
10329         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10330         struct net_device *dev = info->user_ptr[1];
10331
10332         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10333             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10334                 return -EOPNOTSUPP;
10335
10336         if (!rdev->ops->flush_pmksa)
10337                 return -EOPNOTSUPP;
10338
10339         return rdev_flush_pmksa(rdev, dev);
10340 }
10341
10342 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
10343 {
10344         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10345         struct net_device *dev = info->user_ptr[1];
10346         u8 action_code, dialog_token;
10347         u32 peer_capability = 0;
10348         u16 status_code;
10349         u8 *peer;
10350         bool initiator;
10351
10352         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
10353             !rdev->ops->tdls_mgmt)
10354                 return -EOPNOTSUPP;
10355
10356         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
10357             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
10358             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
10359             !info->attrs[NL80211_ATTR_IE] ||
10360             !info->attrs[NL80211_ATTR_MAC])
10361                 return -EINVAL;
10362
10363         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10364         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
10365         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
10366         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
10367         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
10368         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
10369                 peer_capability =
10370                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
10371
10372         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
10373                               dialog_token, status_code, peer_capability,
10374                               initiator,
10375                               nla_data(info->attrs[NL80211_ATTR_IE]),
10376                               nla_len(info->attrs[NL80211_ATTR_IE]));
10377 }
10378
10379 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
10380 {
10381         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10382         struct net_device *dev = info->user_ptr[1];
10383         enum nl80211_tdls_operation operation;
10384         u8 *peer;
10385
10386         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
10387             !rdev->ops->tdls_oper)
10388                 return -EOPNOTSUPP;
10389
10390         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
10391             !info->attrs[NL80211_ATTR_MAC])
10392                 return -EINVAL;
10393
10394         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
10395         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10396
10397         return rdev_tdls_oper(rdev, dev, peer, operation);
10398 }
10399
10400 static int nl80211_remain_on_channel(struct sk_buff *skb,
10401                                      struct genl_info *info)
10402 {
10403         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10404         struct wireless_dev *wdev = info->user_ptr[1];
10405         struct cfg80211_chan_def chandef;
10406         const struct cfg80211_chan_def *compat_chandef;
10407         struct sk_buff *msg;
10408         void *hdr;
10409         u64 cookie;
10410         u32 duration;
10411         int err;
10412
10413         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10414             !info->attrs[NL80211_ATTR_DURATION])
10415                 return -EINVAL;
10416
10417         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
10418
10419         if (!rdev->ops->remain_on_channel ||
10420             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
10421                 return -EOPNOTSUPP;
10422
10423         /*
10424          * We should be on that channel for at least a minimum amount of
10425          * time (10ms) but no longer than the driver supports.
10426          */
10427         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10428             duration > rdev->wiphy.max_remain_on_channel_duration)
10429                 return -EINVAL;
10430
10431         err = nl80211_parse_chandef(rdev, info, &chandef);
10432         if (err)
10433                 return err;
10434
10435         wdev_lock(wdev);
10436         if (!cfg80211_off_channel_oper_allowed(wdev) &&
10437             !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
10438                 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
10439                                                              &chandef);
10440                 if (compat_chandef != &chandef) {
10441                         wdev_unlock(wdev);
10442                         return -EBUSY;
10443                 }
10444         }
10445         wdev_unlock(wdev);
10446
10447         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10448         if (!msg)
10449                 return -ENOMEM;
10450
10451         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10452                              NL80211_CMD_REMAIN_ON_CHANNEL);
10453         if (!hdr) {
10454                 err = -ENOBUFS;
10455                 goto free_msg;
10456         }
10457
10458         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
10459                                      duration, &cookie);
10460
10461         if (err)
10462                 goto free_msg;
10463
10464         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10465                               NL80211_ATTR_PAD))
10466                 goto nla_put_failure;
10467
10468         genlmsg_end(msg, hdr);
10469
10470         return genlmsg_reply(msg, info);
10471
10472  nla_put_failure:
10473         err = -ENOBUFS;
10474  free_msg:
10475         nlmsg_free(msg);
10476         return err;
10477 }
10478
10479 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
10480                                             struct genl_info *info)
10481 {
10482         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10483         struct wireless_dev *wdev = info->user_ptr[1];
10484         u64 cookie;
10485
10486         if (!info->attrs[NL80211_ATTR_COOKIE])
10487                 return -EINVAL;
10488
10489         if (!rdev->ops->cancel_remain_on_channel)
10490                 return -EOPNOTSUPP;
10491
10492         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10493
10494         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
10495 }
10496
10497 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
10498                                        struct genl_info *info)
10499 {
10500         struct cfg80211_bitrate_mask mask;
10501         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10502         struct net_device *dev = info->user_ptr[1];
10503         int err;
10504
10505         if (!rdev->ops->set_bitrate_mask)
10506                 return -EOPNOTSUPP;
10507
10508         err = nl80211_parse_tx_bitrate_mask(info, &mask);
10509         if (err)
10510                 return err;
10511
10512         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
10513 }
10514
10515 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
10516 {
10517         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10518         struct wireless_dev *wdev = info->user_ptr[1];
10519         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
10520
10521         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
10522                 return -EINVAL;
10523
10524         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
10525                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
10526
10527         switch (wdev->iftype) {
10528         case NL80211_IFTYPE_STATION:
10529         case NL80211_IFTYPE_ADHOC:
10530         case NL80211_IFTYPE_P2P_CLIENT:
10531         case NL80211_IFTYPE_AP:
10532         case NL80211_IFTYPE_AP_VLAN:
10533         case NL80211_IFTYPE_MESH_POINT:
10534         case NL80211_IFTYPE_P2P_GO:
10535         case NL80211_IFTYPE_P2P_DEVICE:
10536                 break;
10537         case NL80211_IFTYPE_NAN:
10538         default:
10539                 return -EOPNOTSUPP;
10540         }
10541
10542         /* not much point in registering if we can't reply */
10543         if (!rdev->ops->mgmt_tx)
10544                 return -EOPNOTSUPP;
10545
10546         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
10547                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
10548                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
10549 }
10550
10551 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
10552 {
10553         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10554         struct wireless_dev *wdev = info->user_ptr[1];
10555         struct cfg80211_chan_def chandef;
10556         int err;
10557         void *hdr = NULL;
10558         u64 cookie;
10559         struct sk_buff *msg = NULL;
10560         struct cfg80211_mgmt_tx_params params = {
10561                 .dont_wait_for_ack =
10562                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
10563         };
10564
10565         if (!info->attrs[NL80211_ATTR_FRAME])
10566                 return -EINVAL;
10567
10568         if (!rdev->ops->mgmt_tx)
10569                 return -EOPNOTSUPP;
10570
10571         switch (wdev->iftype) {
10572         case NL80211_IFTYPE_P2P_DEVICE:
10573                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10574                         return -EINVAL;
10575         case NL80211_IFTYPE_STATION:
10576         case NL80211_IFTYPE_ADHOC:
10577         case NL80211_IFTYPE_P2P_CLIENT:
10578         case NL80211_IFTYPE_AP:
10579         case NL80211_IFTYPE_AP_VLAN:
10580         case NL80211_IFTYPE_MESH_POINT:
10581         case NL80211_IFTYPE_P2P_GO:
10582                 break;
10583         case NL80211_IFTYPE_NAN:
10584         default:
10585                 return -EOPNOTSUPP;
10586         }
10587
10588         if (info->attrs[NL80211_ATTR_DURATION]) {
10589                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10590                         return -EINVAL;
10591                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
10592
10593                 /*
10594                  * We should wait on the channel for at least a minimum amount
10595                  * of time (10ms) but no longer than the driver supports.
10596                  */
10597                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10598                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
10599                         return -EINVAL;
10600         }
10601
10602         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
10603
10604         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10605                 return -EINVAL;
10606
10607         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
10608
10609         /* get the channel if any has been specified, otherwise pass NULL to
10610          * the driver. The latter will use the current one
10611          */
10612         chandef.chan = NULL;
10613         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10614                 err = nl80211_parse_chandef(rdev, info, &chandef);
10615                 if (err)
10616                         return err;
10617         }
10618
10619         if (!chandef.chan && params.offchan)
10620                 return -EINVAL;
10621
10622         wdev_lock(wdev);
10623         if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
10624                 wdev_unlock(wdev);
10625                 return -EBUSY;
10626         }
10627         wdev_unlock(wdev);
10628
10629         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
10630         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
10631
10632         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
10633                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10634                 int i;
10635
10636                 if (len % sizeof(u16))
10637                         return -EINVAL;
10638
10639                 params.n_csa_offsets = len / sizeof(u16);
10640                 params.csa_offsets =
10641                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10642
10643                 /* check that all the offsets fit the frame */
10644                 for (i = 0; i < params.n_csa_offsets; i++) {
10645                         if (params.csa_offsets[i] >= params.len)
10646                                 return -EINVAL;
10647                 }
10648         }
10649
10650         if (!params.dont_wait_for_ack) {
10651                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10652                 if (!msg)
10653                         return -ENOMEM;
10654
10655                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10656                                      NL80211_CMD_FRAME);
10657                 if (!hdr) {
10658                         err = -ENOBUFS;
10659                         goto free_msg;
10660                 }
10661         }
10662
10663         params.chan = chandef.chan;
10664         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
10665         if (err)
10666                 goto free_msg;
10667
10668         if (msg) {
10669                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10670                                       NL80211_ATTR_PAD))
10671                         goto nla_put_failure;
10672
10673                 genlmsg_end(msg, hdr);
10674                 return genlmsg_reply(msg, info);
10675         }
10676
10677         return 0;
10678
10679  nla_put_failure:
10680         err = -ENOBUFS;
10681  free_msg:
10682         nlmsg_free(msg);
10683         return err;
10684 }
10685
10686 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
10687 {
10688         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10689         struct wireless_dev *wdev = info->user_ptr[1];
10690         u64 cookie;
10691
10692         if (!info->attrs[NL80211_ATTR_COOKIE])
10693                 return -EINVAL;
10694
10695         if (!rdev->ops->mgmt_tx_cancel_wait)
10696                 return -EOPNOTSUPP;
10697
10698         switch (wdev->iftype) {
10699         case NL80211_IFTYPE_STATION:
10700         case NL80211_IFTYPE_ADHOC:
10701         case NL80211_IFTYPE_P2P_CLIENT:
10702         case NL80211_IFTYPE_AP:
10703         case NL80211_IFTYPE_AP_VLAN:
10704         case NL80211_IFTYPE_P2P_GO:
10705         case NL80211_IFTYPE_P2P_DEVICE:
10706                 break;
10707         case NL80211_IFTYPE_NAN:
10708         default:
10709                 return -EOPNOTSUPP;
10710         }
10711
10712         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10713
10714         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
10715 }
10716
10717 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
10718 {
10719         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10720         struct wireless_dev *wdev;
10721         struct net_device *dev = info->user_ptr[1];
10722         u8 ps_state;
10723         bool state;
10724         int err;
10725
10726         if (!info->attrs[NL80211_ATTR_PS_STATE])
10727                 return -EINVAL;
10728
10729         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
10730
10731         wdev = dev->ieee80211_ptr;
10732
10733         if (!rdev->ops->set_power_mgmt)
10734                 return -EOPNOTSUPP;
10735
10736         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
10737
10738         if (state == wdev->ps)
10739                 return 0;
10740
10741         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
10742         if (!err)
10743                 wdev->ps = state;
10744         return err;
10745 }
10746
10747 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
10748 {
10749         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10750         enum nl80211_ps_state ps_state;
10751         struct wireless_dev *wdev;
10752         struct net_device *dev = info->user_ptr[1];
10753         struct sk_buff *msg;
10754         void *hdr;
10755         int err;
10756
10757         wdev = dev->ieee80211_ptr;
10758
10759         if (!rdev->ops->set_power_mgmt)
10760                 return -EOPNOTSUPP;
10761
10762         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10763         if (!msg)
10764                 return -ENOMEM;
10765
10766         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10767                              NL80211_CMD_GET_POWER_SAVE);
10768         if (!hdr) {
10769                 err = -ENOBUFS;
10770                 goto free_msg;
10771         }
10772
10773         if (wdev->ps)
10774                 ps_state = NL80211_PS_ENABLED;
10775         else
10776                 ps_state = NL80211_PS_DISABLED;
10777
10778         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
10779                 goto nla_put_failure;
10780
10781         genlmsg_end(msg, hdr);
10782         return genlmsg_reply(msg, info);
10783
10784  nla_put_failure:
10785         err = -ENOBUFS;
10786  free_msg:
10787         nlmsg_free(msg);
10788         return err;
10789 }
10790
10791 static const struct nla_policy
10792 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
10793         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
10794         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
10795         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
10796         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
10797         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
10798         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
10799         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
10800 };
10801
10802 static int nl80211_set_cqm_txe(struct genl_info *info,
10803                                u32 rate, u32 pkts, u32 intvl)
10804 {
10805         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10806         struct net_device *dev = info->user_ptr[1];
10807         struct wireless_dev *wdev = dev->ieee80211_ptr;
10808
10809         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
10810                 return -EINVAL;
10811
10812         if (!rdev->ops->set_cqm_txe_config)
10813                 return -EOPNOTSUPP;
10814
10815         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10816             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10817                 return -EOPNOTSUPP;
10818
10819         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
10820 }
10821
10822 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
10823                                     struct net_device *dev)
10824 {
10825         struct wireless_dev *wdev = dev->ieee80211_ptr;
10826         s32 last, low, high;
10827         u32 hyst;
10828         int i, n, low_index;
10829         int err;
10830
10831         /* RSSI reporting disabled? */
10832         if (!wdev->cqm_config)
10833                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
10834
10835         /*
10836          * Obtain current RSSI value if possible, if not and no RSSI threshold
10837          * event has been received yet, we should receive an event after a
10838          * connection is established and enough beacons received to calculate
10839          * the average.
10840          */
10841         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
10842             rdev->ops->get_station) {
10843                 struct station_info sinfo = {};
10844                 u8 *mac_addr;
10845
10846                 mac_addr = wdev->current_bss->pub.bssid;
10847
10848                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
10849                 if (err)
10850                         return err;
10851
10852                 cfg80211_sinfo_release_content(&sinfo);
10853                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
10854                         wdev->cqm_config->last_rssi_event_value =
10855                                 (s8) sinfo.rx_beacon_signal_avg;
10856         }
10857
10858         last = wdev->cqm_config->last_rssi_event_value;
10859         hyst = wdev->cqm_config->rssi_hyst;
10860         n = wdev->cqm_config->n_rssi_thresholds;
10861
10862         for (i = 0; i < n; i++) {
10863                 i = array_index_nospec(i, n);
10864                 if (last < wdev->cqm_config->rssi_thresholds[i])
10865                         break;
10866         }
10867
10868         low_index = i - 1;
10869         if (low_index >= 0) {
10870                 low_index = array_index_nospec(low_index, n);
10871                 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
10872         } else {
10873                 low = S32_MIN;
10874         }
10875         if (i < n) {
10876                 i = array_index_nospec(i, n);
10877                 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
10878         } else {
10879                 high = S32_MAX;
10880         }
10881
10882         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
10883 }
10884
10885 static int nl80211_set_cqm_rssi(struct genl_info *info,
10886                                 const s32 *thresholds, int n_thresholds,
10887                                 u32 hysteresis)
10888 {
10889         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10890         struct net_device *dev = info->user_ptr[1];
10891         struct wireless_dev *wdev = dev->ieee80211_ptr;
10892         int i, err;
10893         s32 prev = S32_MIN;
10894
10895         /* Check all values negative and sorted */
10896         for (i = 0; i < n_thresholds; i++) {
10897                 if (thresholds[i] > 0 || thresholds[i] <= prev)
10898                         return -EINVAL;
10899
10900                 prev = thresholds[i];
10901         }
10902
10903         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10904             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10905                 return -EOPNOTSUPP;
10906
10907         wdev_lock(wdev);
10908         cfg80211_cqm_config_free(wdev);
10909         wdev_unlock(wdev);
10910
10911         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
10912                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
10913                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
10914
10915                 return rdev_set_cqm_rssi_config(rdev, dev,
10916                                                 thresholds[0], hysteresis);
10917         }
10918
10919         if (!wiphy_ext_feature_isset(&rdev->wiphy,
10920                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
10921                 return -EOPNOTSUPP;
10922
10923         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
10924                 n_thresholds = 0;
10925
10926         wdev_lock(wdev);
10927         if (n_thresholds) {
10928                 struct cfg80211_cqm_config *cqm_config;
10929
10930                 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
10931                                      n_thresholds * sizeof(s32), GFP_KERNEL);
10932                 if (!cqm_config) {
10933                         err = -ENOMEM;
10934                         goto unlock;
10935                 }
10936
10937                 cqm_config->rssi_hyst = hysteresis;
10938                 cqm_config->n_rssi_thresholds = n_thresholds;
10939                 memcpy(cqm_config->rssi_thresholds, thresholds,
10940                        n_thresholds * sizeof(s32));
10941
10942                 wdev->cqm_config = cqm_config;
10943         }
10944
10945         err = cfg80211_cqm_rssi_update(rdev, dev);
10946
10947 unlock:
10948         wdev_unlock(wdev);
10949
10950         return err;
10951 }
10952
10953 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
10954 {
10955         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
10956         struct nlattr *cqm;
10957         int err;
10958
10959         cqm = info->attrs[NL80211_ATTR_CQM];
10960         if (!cqm)
10961                 return -EINVAL;
10962
10963         err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
10964                                           nl80211_attr_cqm_policy,
10965                                           info->extack);
10966         if (err)
10967                 return err;
10968
10969         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
10970             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
10971                 const s32 *thresholds =
10972                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10973                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10974                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
10975
10976                 if (len % 4)
10977                         return -EINVAL;
10978
10979                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
10980                                             hysteresis);
10981         }
10982
10983         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
10984             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
10985             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
10986                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
10987                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
10988                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
10989
10990                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
10991         }
10992
10993         return -EINVAL;
10994 }
10995
10996 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
10997 {
10998         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10999         struct net_device *dev = info->user_ptr[1];
11000         struct ocb_setup setup = {};
11001         int err;
11002
11003         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
11004         if (err)
11005                 return err;
11006
11007         return cfg80211_join_ocb(rdev, dev, &setup);
11008 }
11009
11010 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
11011 {
11012         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11013         struct net_device *dev = info->user_ptr[1];
11014
11015         return cfg80211_leave_ocb(rdev, dev);
11016 }
11017
11018 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
11019 {
11020         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11021         struct net_device *dev = info->user_ptr[1];
11022         struct mesh_config cfg;
11023         struct mesh_setup setup;
11024         int err;
11025
11026         /* start with default */
11027         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
11028         memcpy(&setup, &default_mesh_setup, sizeof(setup));
11029
11030         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
11031                 /* and parse parameters if given */
11032                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
11033                 if (err)
11034                         return err;
11035         }
11036
11037         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
11038             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
11039                 return -EINVAL;
11040
11041         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
11042         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
11043
11044         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11045             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
11046                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11047                         return -EINVAL;
11048
11049         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
11050                 setup.beacon_interval =
11051                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11052
11053                 err = cfg80211_validate_beacon_int(rdev,
11054                                                    NL80211_IFTYPE_MESH_POINT,
11055                                                    setup.beacon_interval);
11056                 if (err)
11057                         return err;
11058         }
11059
11060         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
11061                 setup.dtim_period =
11062                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
11063                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
11064                         return -EINVAL;
11065         }
11066
11067         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
11068                 /* parse additional setup parameters if given */
11069                 err = nl80211_parse_mesh_setup(info, &setup);
11070                 if (err)
11071                         return err;
11072         }
11073
11074         if (setup.user_mpm)
11075                 cfg.auto_open_plinks = false;
11076
11077         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
11078                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
11079                 if (err)
11080                         return err;
11081         } else {
11082                 /* __cfg80211_join_mesh() will sort it out */
11083                 setup.chandef.chan = NULL;
11084         }
11085
11086         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11087                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11088                 int n_rates =
11089                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11090                 struct ieee80211_supported_band *sband;
11091
11092                 if (!setup.chandef.chan)
11093                         return -EINVAL;
11094
11095                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
11096
11097                 err = ieee80211_get_ratemask(sband, rates, n_rates,
11098                                              &setup.basic_rates);
11099                 if (err)
11100                         return err;
11101         }
11102
11103         if (info->attrs[NL80211_ATTR_TX_RATES]) {
11104                 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
11105                 if (err)
11106                         return err;
11107
11108                 if (!setup.chandef.chan)
11109                         return -EINVAL;
11110
11111                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
11112                                               &setup.beacon_rate);
11113                 if (err)
11114                         return err;
11115         }
11116
11117         setup.userspace_handles_dfs =
11118                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11119
11120         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11121                 int r = validate_pae_over_nl80211(rdev, info);
11122
11123                 if (r < 0)
11124                         return r;
11125
11126                 setup.control_port_over_nl80211 = true;
11127         }
11128
11129         wdev_lock(dev->ieee80211_ptr);
11130         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
11131         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
11132                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11133         wdev_unlock(dev->ieee80211_ptr);
11134
11135         return err;
11136 }
11137
11138 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
11139 {
11140         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11141         struct net_device *dev = info->user_ptr[1];
11142
11143         return cfg80211_leave_mesh(rdev, dev);
11144 }
11145
11146 #ifdef CONFIG_PM
11147 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
11148                                         struct cfg80211_registered_device *rdev)
11149 {
11150         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
11151         struct nlattr *nl_pats, *nl_pat;
11152         int i, pat_len;
11153
11154         if (!wowlan->n_patterns)
11155                 return 0;
11156
11157         nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
11158         if (!nl_pats)
11159                 return -ENOBUFS;
11160
11161         for (i = 0; i < wowlan->n_patterns; i++) {
11162                 nl_pat = nla_nest_start_noflag(msg, i + 1);
11163                 if (!nl_pat)
11164                         return -ENOBUFS;
11165                 pat_len = wowlan->patterns[i].pattern_len;
11166                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
11167                             wowlan->patterns[i].mask) ||
11168                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
11169                             wowlan->patterns[i].pattern) ||
11170                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
11171                                 wowlan->patterns[i].pkt_offset))
11172                         return -ENOBUFS;
11173                 nla_nest_end(msg, nl_pat);
11174         }
11175         nla_nest_end(msg, nl_pats);
11176
11177         return 0;
11178 }
11179
11180 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
11181                                    struct cfg80211_wowlan_tcp *tcp)
11182 {
11183         struct nlattr *nl_tcp;
11184
11185         if (!tcp)
11186                 return 0;
11187
11188         nl_tcp = nla_nest_start_noflag(msg,
11189                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
11190         if (!nl_tcp)
11191                 return -ENOBUFS;
11192
11193         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
11194             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
11195             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
11196             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
11197             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
11198             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
11199                     tcp->payload_len, tcp->payload) ||
11200             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
11201                         tcp->data_interval) ||
11202             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
11203                     tcp->wake_len, tcp->wake_data) ||
11204             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
11205                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
11206                 return -ENOBUFS;
11207
11208         if (tcp->payload_seq.len &&
11209             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
11210                     sizeof(tcp->payload_seq), &tcp->payload_seq))
11211                 return -ENOBUFS;
11212
11213         if (tcp->payload_tok.len &&
11214             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
11215                     sizeof(tcp->payload_tok) + tcp->tokens_size,
11216                     &tcp->payload_tok))
11217                 return -ENOBUFS;
11218
11219         nla_nest_end(msg, nl_tcp);
11220
11221         return 0;
11222 }
11223
11224 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
11225                                   struct cfg80211_sched_scan_request *req)
11226 {
11227         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
11228         int i;
11229
11230         if (!req)
11231                 return 0;
11232
11233         nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
11234         if (!nd)
11235                 return -ENOBUFS;
11236
11237         if (req->n_scan_plans == 1 &&
11238             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
11239                         req->scan_plans[0].interval * 1000))
11240                 return -ENOBUFS;
11241
11242         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
11243                 return -ENOBUFS;
11244
11245         if (req->relative_rssi_set) {
11246                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
11247
11248                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
11249                                req->relative_rssi))
11250                         return -ENOBUFS;
11251
11252                 rssi_adjust.band = req->rssi_adjust.band;
11253                 rssi_adjust.delta = req->rssi_adjust.delta;
11254                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
11255                             sizeof(rssi_adjust), &rssi_adjust))
11256                         return -ENOBUFS;
11257         }
11258
11259         freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
11260         if (!freqs)
11261                 return -ENOBUFS;
11262
11263         for (i = 0; i < req->n_channels; i++) {
11264                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
11265                         return -ENOBUFS;
11266         }
11267
11268         nla_nest_end(msg, freqs);
11269
11270         if (req->n_match_sets) {
11271                 matches = nla_nest_start_noflag(msg,
11272                                                 NL80211_ATTR_SCHED_SCAN_MATCH);
11273                 if (!matches)
11274                         return -ENOBUFS;
11275
11276                 for (i = 0; i < req->n_match_sets; i++) {
11277                         match = nla_nest_start_noflag(msg, i);
11278                         if (!match)
11279                                 return -ENOBUFS;
11280
11281                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
11282                                     req->match_sets[i].ssid.ssid_len,
11283                                     req->match_sets[i].ssid.ssid))
11284                                 return -ENOBUFS;
11285                         nla_nest_end(msg, match);
11286                 }
11287                 nla_nest_end(msg, matches);
11288         }
11289
11290         scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
11291         if (!scan_plans)
11292                 return -ENOBUFS;
11293
11294         for (i = 0; i < req->n_scan_plans; i++) {
11295                 scan_plan = nla_nest_start_noflag(msg, i + 1);
11296                 if (!scan_plan)
11297                         return -ENOBUFS;
11298
11299                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
11300                                 req->scan_plans[i].interval) ||
11301                     (req->scan_plans[i].iterations &&
11302                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
11303                                  req->scan_plans[i].iterations)))
11304                         return -ENOBUFS;
11305                 nla_nest_end(msg, scan_plan);
11306         }
11307         nla_nest_end(msg, scan_plans);
11308
11309         nla_nest_end(msg, nd);
11310
11311         return 0;
11312 }
11313
11314 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
11315 {
11316         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11317         struct sk_buff *msg;
11318         void *hdr;
11319         u32 size = NLMSG_DEFAULT_SIZE;
11320
11321         if (!rdev->wiphy.wowlan)
11322                 return -EOPNOTSUPP;
11323
11324         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
11325                 /* adjust size to have room for all the data */
11326                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
11327                         rdev->wiphy.wowlan_config->tcp->payload_len +
11328                         rdev->wiphy.wowlan_config->tcp->wake_len +
11329                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
11330         }
11331
11332         msg = nlmsg_new(size, GFP_KERNEL);
11333         if (!msg)
11334                 return -ENOMEM;
11335
11336         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11337                              NL80211_CMD_GET_WOWLAN);
11338         if (!hdr)
11339                 goto nla_put_failure;
11340
11341         if (rdev->wiphy.wowlan_config) {
11342                 struct nlattr *nl_wowlan;
11343
11344                 nl_wowlan = nla_nest_start_noflag(msg,
11345                                                   NL80211_ATTR_WOWLAN_TRIGGERS);
11346                 if (!nl_wowlan)
11347                         goto nla_put_failure;
11348
11349                 if ((rdev->wiphy.wowlan_config->any &&
11350                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
11351                     (rdev->wiphy.wowlan_config->disconnect &&
11352                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
11353                     (rdev->wiphy.wowlan_config->magic_pkt &&
11354                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
11355                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
11356                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
11357                     (rdev->wiphy.wowlan_config->eap_identity_req &&
11358                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
11359                     (rdev->wiphy.wowlan_config->four_way_handshake &&
11360                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
11361                     (rdev->wiphy.wowlan_config->rfkill_release &&
11362                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
11363                         goto nla_put_failure;
11364
11365                 if (nl80211_send_wowlan_patterns(msg, rdev))
11366                         goto nla_put_failure;
11367
11368                 if (nl80211_send_wowlan_tcp(msg,
11369                                             rdev->wiphy.wowlan_config->tcp))
11370                         goto nla_put_failure;
11371
11372                 if (nl80211_send_wowlan_nd(
11373                             msg,
11374                             rdev->wiphy.wowlan_config->nd_config))
11375                         goto nla_put_failure;
11376
11377                 nla_nest_end(msg, nl_wowlan);
11378         }
11379
11380         genlmsg_end(msg, hdr);
11381         return genlmsg_reply(msg, info);
11382
11383 nla_put_failure:
11384         nlmsg_free(msg);
11385         return -ENOBUFS;
11386 }
11387
11388 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
11389                                     struct nlattr *attr,
11390                                     struct cfg80211_wowlan *trig)
11391 {
11392         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
11393         struct cfg80211_wowlan_tcp *cfg;
11394         struct nl80211_wowlan_tcp_data_token *tok = NULL;
11395         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
11396         u32 size;
11397         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
11398         int err, port;
11399
11400         if (!rdev->wiphy.wowlan->tcp)
11401                 return -EINVAL;
11402
11403         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
11404                                           nl80211_wowlan_tcp_policy, NULL);
11405         if (err)
11406                 return err;
11407
11408         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
11409             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
11410             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
11411             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
11412             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
11413             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
11414             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
11415             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
11416                 return -EINVAL;
11417
11418         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
11419         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
11420                 return -EINVAL;
11421
11422         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
11423                         rdev->wiphy.wowlan->tcp->data_interval_max ||
11424             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
11425                 return -EINVAL;
11426
11427         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
11428         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
11429                 return -EINVAL;
11430
11431         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
11432         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
11433                 return -EINVAL;
11434
11435         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
11436                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
11437
11438                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
11439                 tokens_size = tokln - sizeof(*tok);
11440
11441                 if (!tok->len || tokens_size % tok->len)
11442                         return -EINVAL;
11443                 if (!rdev->wiphy.wowlan->tcp->tok)
11444                         return -EINVAL;
11445                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
11446                         return -EINVAL;
11447                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
11448                         return -EINVAL;
11449                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
11450                         return -EINVAL;
11451                 if (tok->offset + tok->len > data_size)
11452                         return -EINVAL;
11453         }
11454
11455         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
11456                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
11457                 if (!rdev->wiphy.wowlan->tcp->seq)
11458                         return -EINVAL;
11459                 if (seq->len == 0 || seq->len > 4)
11460                         return -EINVAL;
11461                 if (seq->len + seq->offset > data_size)
11462                         return -EINVAL;
11463         }
11464
11465         size = sizeof(*cfg);
11466         size += data_size;
11467         size += wake_size + wake_mask_size;
11468         size += tokens_size;
11469
11470         cfg = kzalloc(size, GFP_KERNEL);
11471         if (!cfg)
11472                 return -ENOMEM;
11473         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
11474         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
11475         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
11476                ETH_ALEN);
11477         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
11478                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
11479         else
11480                 port = 0;
11481 #ifdef CONFIG_INET
11482         /* allocate a socket and port for it and use it */
11483         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
11484                             IPPROTO_TCP, &cfg->sock, 1);
11485         if (err) {
11486                 kfree(cfg);
11487                 return err;
11488         }
11489         if (inet_csk_get_port(cfg->sock->sk, port)) {
11490                 sock_release(cfg->sock);
11491                 kfree(cfg);
11492                 return -EADDRINUSE;
11493         }
11494         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
11495 #else
11496         if (!port) {
11497                 kfree(cfg);
11498                 return -EINVAL;
11499         }
11500         cfg->src_port = port;
11501 #endif
11502
11503         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
11504         cfg->payload_len = data_size;
11505         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
11506         memcpy((void *)cfg->payload,
11507                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
11508                data_size);
11509         if (seq)
11510                 cfg->payload_seq = *seq;
11511         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
11512         cfg->wake_len = wake_size;
11513         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
11514         memcpy((void *)cfg->wake_data,
11515                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
11516                wake_size);
11517         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
11518                          data_size + wake_size;
11519         memcpy((void *)cfg->wake_mask,
11520                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
11521                wake_mask_size);
11522         if (tok) {
11523                 cfg->tokens_size = tokens_size;
11524                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
11525         }
11526
11527         trig->tcp = cfg;
11528
11529         return 0;
11530 }
11531
11532 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
11533                                    const struct wiphy_wowlan_support *wowlan,
11534                                    struct nlattr *attr,
11535                                    struct cfg80211_wowlan *trig)
11536 {
11537         struct nlattr **tb;
11538         int err;
11539
11540         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
11541         if (!tb)
11542                 return -ENOMEM;
11543
11544         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
11545                 err = -EOPNOTSUPP;
11546                 goto out;
11547         }
11548
11549         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
11550                                           nl80211_policy, NULL);
11551         if (err)
11552                 goto out;
11553
11554         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
11555                                                    wowlan->max_nd_match_sets);
11556         err = PTR_ERR_OR_ZERO(trig->nd_config);
11557         if (err)
11558                 trig->nd_config = NULL;
11559
11560 out:
11561         kfree(tb);
11562         return err;
11563 }
11564
11565 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
11566 {
11567         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11568         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
11569         struct cfg80211_wowlan new_triggers = {};
11570         struct cfg80211_wowlan *ntrig;
11571         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
11572         int err, i;
11573         bool prev_enabled = rdev->wiphy.wowlan_config;
11574         bool regular = false;
11575
11576         if (!wowlan)
11577                 return -EOPNOTSUPP;
11578
11579         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
11580                 cfg80211_rdev_free_wowlan(rdev);
11581                 rdev->wiphy.wowlan_config = NULL;
11582                 goto set_wakeup;
11583         }
11584
11585         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
11586                                           info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
11587                                           nl80211_wowlan_policy, info->extack);
11588         if (err)
11589                 return err;
11590
11591         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
11592                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
11593                         return -EINVAL;
11594                 new_triggers.any = true;
11595         }
11596
11597         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
11598                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
11599                         return -EINVAL;
11600                 new_triggers.disconnect = true;
11601                 regular = true;
11602         }
11603
11604         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
11605                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
11606                         return -EINVAL;
11607                 new_triggers.magic_pkt = true;
11608                 regular = true;
11609         }
11610
11611         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
11612                 return -EINVAL;
11613
11614         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
11615                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
11616                         return -EINVAL;
11617                 new_triggers.gtk_rekey_failure = true;
11618                 regular = true;
11619         }
11620
11621         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
11622                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
11623                         return -EINVAL;
11624                 new_triggers.eap_identity_req = true;
11625                 regular = true;
11626         }
11627
11628         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
11629                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
11630                         return -EINVAL;
11631                 new_triggers.four_way_handshake = true;
11632                 regular = true;
11633         }
11634
11635         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
11636                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
11637                         return -EINVAL;
11638                 new_triggers.rfkill_release = true;
11639                 regular = true;
11640         }
11641
11642         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
11643                 struct nlattr *pat;
11644                 int n_patterns = 0;
11645                 int rem, pat_len, mask_len, pkt_offset;
11646                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11647
11648                 regular = true;
11649
11650                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11651                                     rem)
11652                         n_patterns++;
11653                 if (n_patterns > wowlan->n_patterns)
11654                         return -EINVAL;
11655
11656                 new_triggers.patterns = kcalloc(n_patterns,
11657                                                 sizeof(new_triggers.patterns[0]),
11658                                                 GFP_KERNEL);
11659                 if (!new_triggers.patterns)
11660                         return -ENOMEM;
11661
11662                 new_triggers.n_patterns = n_patterns;
11663                 i = 0;
11664
11665                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11666                                     rem) {
11667                         u8 *mask_pat;
11668
11669                         err = nla_parse_nested_deprecated(pat_tb,
11670                                                           MAX_NL80211_PKTPAT,
11671                                                           pat,
11672                                                           nl80211_packet_pattern_policy,
11673                                                           info->extack);
11674                         if (err)
11675                                 goto error;
11676
11677                         err = -EINVAL;
11678                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
11679                             !pat_tb[NL80211_PKTPAT_PATTERN])
11680                                 goto error;
11681                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11682                         mask_len = DIV_ROUND_UP(pat_len, 8);
11683                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11684                                 goto error;
11685                         if (pat_len > wowlan->pattern_max_len ||
11686                             pat_len < wowlan->pattern_min_len)
11687                                 goto error;
11688
11689                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
11690                                 pkt_offset = 0;
11691                         else
11692                                 pkt_offset = nla_get_u32(
11693                                         pat_tb[NL80211_PKTPAT_OFFSET]);
11694                         if (pkt_offset > wowlan->max_pkt_offset)
11695                                 goto error;
11696                         new_triggers.patterns[i].pkt_offset = pkt_offset;
11697
11698                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11699                         if (!mask_pat) {
11700                                 err = -ENOMEM;
11701                                 goto error;
11702                         }
11703                         new_triggers.patterns[i].mask = mask_pat;
11704                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11705                                mask_len);
11706                         mask_pat += mask_len;
11707                         new_triggers.patterns[i].pattern = mask_pat;
11708                         new_triggers.patterns[i].pattern_len = pat_len;
11709                         memcpy(mask_pat,
11710                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11711                                pat_len);
11712                         i++;
11713                 }
11714         }
11715
11716         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
11717                 regular = true;
11718                 err = nl80211_parse_wowlan_tcp(
11719                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
11720                         &new_triggers);
11721                 if (err)
11722                         goto error;
11723         }
11724
11725         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
11726                 regular = true;
11727                 err = nl80211_parse_wowlan_nd(
11728                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
11729                         &new_triggers);
11730                 if (err)
11731                         goto error;
11732         }
11733
11734         /* The 'any' trigger means the device continues operating more or less
11735          * as in its normal operation mode and wakes up the host on most of the
11736          * normal interrupts (like packet RX, ...)
11737          * It therefore makes little sense to combine with the more constrained
11738          * wakeup trigger modes.
11739          */
11740         if (new_triggers.any && regular) {
11741                 err = -EINVAL;
11742                 goto error;
11743         }
11744
11745         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
11746         if (!ntrig) {
11747                 err = -ENOMEM;
11748                 goto error;
11749         }
11750         cfg80211_rdev_free_wowlan(rdev);
11751         rdev->wiphy.wowlan_config = ntrig;
11752
11753  set_wakeup:
11754         if (rdev->ops->set_wakeup &&
11755             prev_enabled != !!rdev->wiphy.wowlan_config)
11756                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
11757
11758         return 0;
11759  error:
11760         for (i = 0; i < new_triggers.n_patterns; i++)
11761                 kfree(new_triggers.patterns[i].mask);
11762         kfree(new_triggers.patterns);
11763         if (new_triggers.tcp && new_triggers.tcp->sock)
11764                 sock_release(new_triggers.tcp->sock);
11765         kfree(new_triggers.tcp);
11766         kfree(new_triggers.nd_config);
11767         return err;
11768 }
11769 #endif
11770
11771 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
11772                                        struct cfg80211_registered_device *rdev)
11773 {
11774         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
11775         int i, j, pat_len;
11776         struct cfg80211_coalesce_rules *rule;
11777
11778         if (!rdev->coalesce->n_rules)
11779                 return 0;
11780
11781         nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
11782         if (!nl_rules)
11783                 return -ENOBUFS;
11784
11785         for (i = 0; i < rdev->coalesce->n_rules; i++) {
11786                 nl_rule = nla_nest_start_noflag(msg, i + 1);
11787                 if (!nl_rule)
11788                         return -ENOBUFS;
11789
11790                 rule = &rdev->coalesce->rules[i];
11791                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
11792                                 rule->delay))
11793                         return -ENOBUFS;
11794
11795                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
11796                                 rule->condition))
11797                         return -ENOBUFS;
11798
11799                 nl_pats = nla_nest_start_noflag(msg,
11800                                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
11801                 if (!nl_pats)
11802                         return -ENOBUFS;
11803
11804                 for (j = 0; j < rule->n_patterns; j++) {
11805                         nl_pat = nla_nest_start_noflag(msg, j + 1);
11806                         if (!nl_pat)
11807                                 return -ENOBUFS;
11808                         pat_len = rule->patterns[j].pattern_len;
11809                         if (nla_put(msg, NL80211_PKTPAT_MASK,
11810                                     DIV_ROUND_UP(pat_len, 8),
11811                                     rule->patterns[j].mask) ||
11812                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
11813                                     rule->patterns[j].pattern) ||
11814                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
11815                                         rule->patterns[j].pkt_offset))
11816                                 return -ENOBUFS;
11817                         nla_nest_end(msg, nl_pat);
11818                 }
11819                 nla_nest_end(msg, nl_pats);
11820                 nla_nest_end(msg, nl_rule);
11821         }
11822         nla_nest_end(msg, nl_rules);
11823
11824         return 0;
11825 }
11826
11827 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
11828 {
11829         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11830         struct sk_buff *msg;
11831         void *hdr;
11832
11833         if (!rdev->wiphy.coalesce)
11834                 return -EOPNOTSUPP;
11835
11836         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11837         if (!msg)
11838                 return -ENOMEM;
11839
11840         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11841                              NL80211_CMD_GET_COALESCE);
11842         if (!hdr)
11843                 goto nla_put_failure;
11844
11845         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
11846                 goto nla_put_failure;
11847
11848         genlmsg_end(msg, hdr);
11849         return genlmsg_reply(msg, info);
11850
11851 nla_put_failure:
11852         nlmsg_free(msg);
11853         return -ENOBUFS;
11854 }
11855
11856 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
11857 {
11858         struct cfg80211_coalesce *coalesce = rdev->coalesce;
11859         int i, j;
11860         struct cfg80211_coalesce_rules *rule;
11861
11862         if (!coalesce)
11863                 return;
11864
11865         for (i = 0; i < coalesce->n_rules; i++) {
11866                 rule = &coalesce->rules[i];
11867                 for (j = 0; j < rule->n_patterns; j++)
11868                         kfree(rule->patterns[j].mask);
11869                 kfree(rule->patterns);
11870         }
11871         kfree(coalesce->rules);
11872         kfree(coalesce);
11873         rdev->coalesce = NULL;
11874 }
11875
11876 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
11877                                        struct nlattr *rule,
11878                                        struct cfg80211_coalesce_rules *new_rule)
11879 {
11880         int err, i;
11881         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11882         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
11883         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
11884         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11885
11886         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
11887                                           rule, nl80211_coalesce_policy, NULL);
11888         if (err)
11889                 return err;
11890
11891         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
11892                 new_rule->delay =
11893                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
11894         if (new_rule->delay > coalesce->max_delay)
11895                 return -EINVAL;
11896
11897         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
11898                 new_rule->condition =
11899                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
11900
11901         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
11902                 return -EINVAL;
11903
11904         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11905                             rem)
11906                 n_patterns++;
11907         if (n_patterns > coalesce->n_patterns)
11908                 return -EINVAL;
11909
11910         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
11911                                      GFP_KERNEL);
11912         if (!new_rule->patterns)
11913                 return -ENOMEM;
11914
11915         new_rule->n_patterns = n_patterns;
11916         i = 0;
11917
11918         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11919                             rem) {
11920                 u8 *mask_pat;
11921
11922                 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
11923                                                   pat,
11924                                                   nl80211_packet_pattern_policy,
11925                                                   NULL);
11926                 if (err)
11927                         return err;
11928
11929                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
11930                     !pat_tb[NL80211_PKTPAT_PATTERN])
11931                         return -EINVAL;
11932                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11933                 mask_len = DIV_ROUND_UP(pat_len, 8);
11934                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11935                         return -EINVAL;
11936                 if (pat_len > coalesce->pattern_max_len ||
11937                     pat_len < coalesce->pattern_min_len)
11938                         return -EINVAL;
11939
11940                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
11941                         pkt_offset = 0;
11942                 else
11943                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
11944                 if (pkt_offset > coalesce->max_pkt_offset)
11945                         return -EINVAL;
11946                 new_rule->patterns[i].pkt_offset = pkt_offset;
11947
11948                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11949                 if (!mask_pat)
11950                         return -ENOMEM;
11951
11952                 new_rule->patterns[i].mask = mask_pat;
11953                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11954                        mask_len);
11955
11956                 mask_pat += mask_len;
11957                 new_rule->patterns[i].pattern = mask_pat;
11958                 new_rule->patterns[i].pattern_len = pat_len;
11959                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11960                        pat_len);
11961                 i++;
11962         }
11963
11964         return 0;
11965 }
11966
11967 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
11968 {
11969         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11970         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11971         struct cfg80211_coalesce new_coalesce = {};
11972         struct cfg80211_coalesce *n_coalesce;
11973         int err, rem_rule, n_rules = 0, i, j;
11974         struct nlattr *rule;
11975         struct cfg80211_coalesce_rules *tmp_rule;
11976
11977         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
11978                 return -EOPNOTSUPP;
11979
11980         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
11981                 cfg80211_rdev_free_coalesce(rdev);
11982                 rdev_set_coalesce(rdev, NULL);
11983                 return 0;
11984         }
11985
11986         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11987                             rem_rule)
11988                 n_rules++;
11989         if (n_rules > coalesce->n_rules)
11990                 return -EINVAL;
11991
11992         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
11993                                      GFP_KERNEL);
11994         if (!new_coalesce.rules)
11995                 return -ENOMEM;
11996
11997         new_coalesce.n_rules = n_rules;
11998         i = 0;
11999
12000         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
12001                             rem_rule) {
12002                 err = nl80211_parse_coalesce_rule(rdev, rule,
12003                                                   &new_coalesce.rules[i]);
12004                 if (err)
12005                         goto error;
12006
12007                 i++;
12008         }
12009
12010         err = rdev_set_coalesce(rdev, &new_coalesce);
12011         if (err)
12012                 goto error;
12013
12014         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
12015         if (!n_coalesce) {
12016                 err = -ENOMEM;
12017                 goto error;
12018         }
12019         cfg80211_rdev_free_coalesce(rdev);
12020         rdev->coalesce = n_coalesce;
12021
12022         return 0;
12023 error:
12024         for (i = 0; i < new_coalesce.n_rules; i++) {
12025                 tmp_rule = &new_coalesce.rules[i];
12026                 for (j = 0; j < tmp_rule->n_patterns; j++)
12027                         kfree(tmp_rule->patterns[j].mask);
12028                 kfree(tmp_rule->patterns);
12029         }
12030         kfree(new_coalesce.rules);
12031
12032         return err;
12033 }
12034
12035 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
12036 {
12037         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12038         struct net_device *dev = info->user_ptr[1];
12039         struct wireless_dev *wdev = dev->ieee80211_ptr;
12040         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
12041         struct cfg80211_gtk_rekey_data rekey_data;
12042         int err;
12043
12044         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
12045                 return -EINVAL;
12046
12047         err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
12048                                           info->attrs[NL80211_ATTR_REKEY_DATA],
12049                                           nl80211_rekey_policy, info->extack);
12050         if (err)
12051                 return err;
12052
12053         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
12054             !tb[NL80211_REKEY_DATA_KCK])
12055                 return -EINVAL;
12056         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
12057                 return -ERANGE;
12058         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
12059                 return -ERANGE;
12060         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
12061                 return -ERANGE;
12062
12063         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
12064         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
12065         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
12066
12067         wdev_lock(wdev);
12068         if (!wdev->current_bss) {
12069                 err = -ENOTCONN;
12070                 goto out;
12071         }
12072
12073         if (!rdev->ops->set_rekey_data) {
12074                 err = -EOPNOTSUPP;
12075                 goto out;
12076         }
12077
12078         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
12079  out:
12080         wdev_unlock(wdev);
12081         return err;
12082 }
12083
12084 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
12085                                              struct genl_info *info)
12086 {
12087         struct net_device *dev = info->user_ptr[1];
12088         struct wireless_dev *wdev = dev->ieee80211_ptr;
12089
12090         if (wdev->iftype != NL80211_IFTYPE_AP &&
12091             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12092                 return -EINVAL;
12093
12094         if (wdev->ap_unexpected_nlportid)
12095                 return -EBUSY;
12096
12097         wdev->ap_unexpected_nlportid = info->snd_portid;
12098         return 0;
12099 }
12100
12101 static int nl80211_probe_client(struct sk_buff *skb,
12102                                 struct genl_info *info)
12103 {
12104         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12105         struct net_device *dev = info->user_ptr[1];
12106         struct wireless_dev *wdev = dev->ieee80211_ptr;
12107         struct sk_buff *msg;
12108         void *hdr;
12109         const u8 *addr;
12110         u64 cookie;
12111         int err;
12112
12113         if (wdev->iftype != NL80211_IFTYPE_AP &&
12114             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12115                 return -EOPNOTSUPP;
12116
12117         if (!info->attrs[NL80211_ATTR_MAC])
12118                 return -EINVAL;
12119
12120         if (!rdev->ops->probe_client)
12121                 return -EOPNOTSUPP;
12122
12123         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12124         if (!msg)
12125                 return -ENOMEM;
12126
12127         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12128                              NL80211_CMD_PROBE_CLIENT);
12129         if (!hdr) {
12130                 err = -ENOBUFS;
12131                 goto free_msg;
12132         }
12133
12134         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12135
12136         err = rdev_probe_client(rdev, dev, addr, &cookie);
12137         if (err)
12138                 goto free_msg;
12139
12140         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12141                               NL80211_ATTR_PAD))
12142                 goto nla_put_failure;
12143
12144         genlmsg_end(msg, hdr);
12145
12146         return genlmsg_reply(msg, info);
12147
12148  nla_put_failure:
12149         err = -ENOBUFS;
12150  free_msg:
12151         nlmsg_free(msg);
12152         return err;
12153 }
12154
12155 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
12156 {
12157         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12158         struct cfg80211_beacon_registration *reg, *nreg;
12159         int rv;
12160
12161         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
12162                 return -EOPNOTSUPP;
12163
12164         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
12165         if (!nreg)
12166                 return -ENOMEM;
12167
12168         /* First, check if already registered. */
12169         spin_lock_bh(&rdev->beacon_registrations_lock);
12170         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
12171                 if (reg->nlportid == info->snd_portid) {
12172                         rv = -EALREADY;
12173                         goto out_err;
12174                 }
12175         }
12176         /* Add it to the list */
12177         nreg->nlportid = info->snd_portid;
12178         list_add(&nreg->list, &rdev->beacon_registrations);
12179
12180         spin_unlock_bh(&rdev->beacon_registrations_lock);
12181
12182         return 0;
12183 out_err:
12184         spin_unlock_bh(&rdev->beacon_registrations_lock);
12185         kfree(nreg);
12186         return rv;
12187 }
12188
12189 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
12190 {
12191         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12192         struct wireless_dev *wdev = info->user_ptr[1];
12193         int err;
12194
12195         if (!rdev->ops->start_p2p_device)
12196                 return -EOPNOTSUPP;
12197
12198         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
12199                 return -EOPNOTSUPP;
12200
12201         if (wdev_running(wdev))
12202                 return 0;
12203
12204         if (rfkill_blocked(rdev->rfkill))
12205                 return -ERFKILL;
12206
12207         err = rdev_start_p2p_device(rdev, wdev);
12208         if (err)
12209                 return err;
12210
12211         wdev->is_running = true;
12212         rdev->opencount++;
12213
12214         return 0;
12215 }
12216
12217 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
12218 {
12219         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12220         struct wireless_dev *wdev = info->user_ptr[1];
12221
12222         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
12223                 return -EOPNOTSUPP;
12224
12225         if (!rdev->ops->stop_p2p_device)
12226                 return -EOPNOTSUPP;
12227
12228         cfg80211_stop_p2p_device(rdev, wdev);
12229
12230         return 0;
12231 }
12232
12233 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
12234 {
12235         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12236         struct wireless_dev *wdev = info->user_ptr[1];
12237         struct cfg80211_nan_conf conf = {};
12238         int err;
12239
12240         if (wdev->iftype != NL80211_IFTYPE_NAN)
12241                 return -EOPNOTSUPP;
12242
12243         if (wdev_running(wdev))
12244                 return -EEXIST;
12245
12246         if (rfkill_blocked(rdev->rfkill))
12247                 return -ERFKILL;
12248
12249         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
12250                 return -EINVAL;
12251
12252         conf.master_pref =
12253                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
12254
12255         if (info->attrs[NL80211_ATTR_BANDS]) {
12256                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
12257
12258                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
12259                         return -EOPNOTSUPP;
12260
12261                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
12262                         return -EINVAL;
12263
12264                 conf.bands = bands;
12265         }
12266
12267         err = rdev_start_nan(rdev, wdev, &conf);
12268         if (err)
12269                 return err;
12270
12271         wdev->is_running = true;
12272         rdev->opencount++;
12273
12274         return 0;
12275 }
12276
12277 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
12278 {
12279         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12280         struct wireless_dev *wdev = info->user_ptr[1];
12281
12282         if (wdev->iftype != NL80211_IFTYPE_NAN)
12283                 return -EOPNOTSUPP;
12284
12285         cfg80211_stop_nan(rdev, wdev);
12286
12287         return 0;
12288 }
12289
12290 static int validate_nan_filter(struct nlattr *filter_attr)
12291 {
12292         struct nlattr *attr;
12293         int len = 0, n_entries = 0, rem;
12294
12295         nla_for_each_nested(attr, filter_attr, rem) {
12296                 len += nla_len(attr);
12297                 n_entries++;
12298         }
12299
12300         if (len >= U8_MAX)
12301                 return -EINVAL;
12302
12303         return n_entries;
12304 }
12305
12306 static int handle_nan_filter(struct nlattr *attr_filter,
12307                              struct cfg80211_nan_func *func,
12308                              bool tx)
12309 {
12310         struct nlattr *attr;
12311         int n_entries, rem, i;
12312         struct cfg80211_nan_func_filter *filter;
12313
12314         n_entries = validate_nan_filter(attr_filter);
12315         if (n_entries < 0)
12316                 return n_entries;
12317
12318         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
12319
12320         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
12321         if (!filter)
12322                 return -ENOMEM;
12323
12324         i = 0;
12325         nla_for_each_nested(attr, attr_filter, rem) {
12326                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
12327                 filter[i].len = nla_len(attr);
12328                 i++;
12329         }
12330         if (tx) {
12331                 func->num_tx_filters = n_entries;
12332                 func->tx_filters = filter;
12333         } else {
12334                 func->num_rx_filters = n_entries;
12335                 func->rx_filters = filter;
12336         }
12337
12338         return 0;
12339 }
12340
12341 static int nl80211_nan_add_func(struct sk_buff *skb,
12342                                 struct genl_info *info)
12343 {
12344         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12345         struct wireless_dev *wdev = info->user_ptr[1];
12346         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
12347         struct cfg80211_nan_func *func;
12348         struct sk_buff *msg = NULL;
12349         void *hdr = NULL;
12350         int err = 0;
12351
12352         if (wdev->iftype != NL80211_IFTYPE_NAN)
12353                 return -EOPNOTSUPP;
12354
12355         if (!wdev_running(wdev))
12356                 return -ENOTCONN;
12357
12358         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
12359                 return -EINVAL;
12360
12361         err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
12362                                           info->attrs[NL80211_ATTR_NAN_FUNC],
12363                                           nl80211_nan_func_policy,
12364                                           info->extack);
12365         if (err)
12366                 return err;
12367
12368         func = kzalloc(sizeof(*func), GFP_KERNEL);
12369         if (!func)
12370                 return -ENOMEM;
12371
12372         func->cookie = cfg80211_assign_cookie(rdev);
12373
12374         if (!tb[NL80211_NAN_FUNC_TYPE] ||
12375             nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
12376                 err = -EINVAL;
12377                 goto out;
12378         }
12379
12380
12381         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
12382
12383         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
12384                 err = -EINVAL;
12385                 goto out;
12386         }
12387
12388         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
12389                sizeof(func->service_id));
12390
12391         func->close_range =
12392                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
12393
12394         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
12395                 func->serv_spec_info_len =
12396                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
12397                 func->serv_spec_info =
12398                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
12399                                 func->serv_spec_info_len,
12400                                 GFP_KERNEL);
12401                 if (!func->serv_spec_info) {
12402                         err = -ENOMEM;
12403                         goto out;
12404                 }
12405         }
12406
12407         if (tb[NL80211_NAN_FUNC_TTL])
12408                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
12409
12410         switch (func->type) {
12411         case NL80211_NAN_FUNC_PUBLISH:
12412                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
12413                         err = -EINVAL;
12414                         goto out;
12415                 }
12416
12417                 func->publish_type =
12418                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
12419                 func->publish_bcast =
12420                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
12421
12422                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
12423                         func->publish_bcast) {
12424                         err = -EINVAL;
12425                         goto out;
12426                 }
12427                 break;
12428         case NL80211_NAN_FUNC_SUBSCRIBE:
12429                 func->subscribe_active =
12430                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
12431                 break;
12432         case NL80211_NAN_FUNC_FOLLOW_UP:
12433                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
12434                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
12435                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
12436                         err = -EINVAL;
12437                         goto out;
12438                 }
12439
12440                 func->followup_id =
12441                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
12442                 func->followup_reqid =
12443                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
12444                 memcpy(func->followup_dest.addr,
12445                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
12446                        sizeof(func->followup_dest.addr));
12447                 if (func->ttl) {
12448                         err = -EINVAL;
12449                         goto out;
12450                 }
12451                 break;
12452         default:
12453                 err = -EINVAL;
12454                 goto out;
12455         }
12456
12457         if (tb[NL80211_NAN_FUNC_SRF]) {
12458                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
12459
12460                 err = nla_parse_nested_deprecated(srf_tb,
12461                                                   NL80211_NAN_SRF_ATTR_MAX,
12462                                                   tb[NL80211_NAN_FUNC_SRF],
12463                                                   nl80211_nan_srf_policy,
12464                                                   info->extack);
12465                 if (err)
12466                         goto out;
12467
12468                 func->srf_include =
12469                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
12470
12471                 if (srf_tb[NL80211_NAN_SRF_BF]) {
12472                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
12473                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
12474                                 err = -EINVAL;
12475                                 goto out;
12476                         }
12477
12478                         func->srf_bf_len =
12479                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
12480                         func->srf_bf =
12481                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
12482                                         func->srf_bf_len, GFP_KERNEL);
12483                         if (!func->srf_bf) {
12484                                 err = -ENOMEM;
12485                                 goto out;
12486                         }
12487
12488                         func->srf_bf_idx =
12489                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
12490                 } else {
12491                         struct nlattr *attr, *mac_attr =
12492                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
12493                         int n_entries, rem, i = 0;
12494
12495                         if (!mac_attr) {
12496                                 err = -EINVAL;
12497                                 goto out;
12498                         }
12499
12500                         n_entries = validate_acl_mac_addrs(mac_attr);
12501                         if (n_entries <= 0) {
12502                                 err = -EINVAL;
12503                                 goto out;
12504                         }
12505
12506                         func->srf_num_macs = n_entries;
12507                         func->srf_macs =
12508                                 kcalloc(n_entries, sizeof(*func->srf_macs),
12509                                         GFP_KERNEL);
12510                         if (!func->srf_macs) {
12511                                 err = -ENOMEM;
12512                                 goto out;
12513                         }
12514
12515                         nla_for_each_nested(attr, mac_attr, rem)
12516                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
12517                                        sizeof(*func->srf_macs));
12518                 }
12519         }
12520
12521         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
12522                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
12523                                         func, true);
12524                 if (err)
12525                         goto out;
12526         }
12527
12528         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
12529                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
12530                                         func, false);
12531                 if (err)
12532                         goto out;
12533         }
12534
12535         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12536         if (!msg) {
12537                 err = -ENOMEM;
12538                 goto out;
12539         }
12540
12541         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12542                              NL80211_CMD_ADD_NAN_FUNCTION);
12543         /* This can't really happen - we just allocated 4KB */
12544         if (WARN_ON(!hdr)) {
12545                 err = -ENOMEM;
12546                 goto out;
12547         }
12548
12549         err = rdev_add_nan_func(rdev, wdev, func);
12550 out:
12551         if (err < 0) {
12552                 cfg80211_free_nan_func(func);
12553                 nlmsg_free(msg);
12554                 return err;
12555         }
12556
12557         /* propagate the instance id and cookie to userspace  */
12558         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
12559                               NL80211_ATTR_PAD))
12560                 goto nla_put_failure;
12561
12562         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
12563         if (!func_attr)
12564                 goto nla_put_failure;
12565
12566         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
12567                        func->instance_id))
12568                 goto nla_put_failure;
12569
12570         nla_nest_end(msg, func_attr);
12571
12572         genlmsg_end(msg, hdr);
12573         return genlmsg_reply(msg, info);
12574
12575 nla_put_failure:
12576         nlmsg_free(msg);
12577         return -ENOBUFS;
12578 }
12579
12580 static int nl80211_nan_del_func(struct sk_buff *skb,
12581                                struct genl_info *info)
12582 {
12583         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12584         struct wireless_dev *wdev = info->user_ptr[1];
12585         u64 cookie;
12586
12587         if (wdev->iftype != NL80211_IFTYPE_NAN)
12588                 return -EOPNOTSUPP;
12589
12590         if (!wdev_running(wdev))
12591                 return -ENOTCONN;
12592
12593         if (!info->attrs[NL80211_ATTR_COOKIE])
12594                 return -EINVAL;
12595
12596         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12597
12598         rdev_del_nan_func(rdev, wdev, cookie);
12599
12600         return 0;
12601 }
12602
12603 static int nl80211_nan_change_config(struct sk_buff *skb,
12604                                      struct genl_info *info)
12605 {
12606         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12607         struct wireless_dev *wdev = info->user_ptr[1];
12608         struct cfg80211_nan_conf conf = {};
12609         u32 changed = 0;
12610
12611         if (wdev->iftype != NL80211_IFTYPE_NAN)
12612                 return -EOPNOTSUPP;
12613
12614         if (!wdev_running(wdev))
12615                 return -ENOTCONN;
12616
12617         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
12618                 conf.master_pref =
12619                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
12620                 if (conf.master_pref <= 1 || conf.master_pref == 255)
12621                         return -EINVAL;
12622
12623                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
12624         }
12625
12626         if (info->attrs[NL80211_ATTR_BANDS]) {
12627                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
12628
12629                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
12630                         return -EOPNOTSUPP;
12631
12632                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
12633                         return -EINVAL;
12634
12635                 conf.bands = bands;
12636                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
12637         }
12638
12639         if (!changed)
12640                 return -EINVAL;
12641
12642         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
12643 }
12644
12645 void cfg80211_nan_match(struct wireless_dev *wdev,
12646                         struct cfg80211_nan_match_params *match, gfp_t gfp)
12647 {
12648         struct wiphy *wiphy = wdev->wiphy;
12649         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12650         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
12651         struct sk_buff *msg;
12652         void *hdr;
12653
12654         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
12655                 return;
12656
12657         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12658         if (!msg)
12659                 return;
12660
12661         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
12662         if (!hdr) {
12663                 nlmsg_free(msg);
12664                 return;
12665         }
12666
12667         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12668             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12669                                          wdev->netdev->ifindex)) ||
12670             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12671                               NL80211_ATTR_PAD))
12672                 goto nla_put_failure;
12673
12674         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
12675                               NL80211_ATTR_PAD) ||
12676             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
12677                 goto nla_put_failure;
12678
12679         match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
12680         if (!match_attr)
12681                 goto nla_put_failure;
12682
12683         local_func_attr = nla_nest_start_noflag(msg,
12684                                                 NL80211_NAN_MATCH_FUNC_LOCAL);
12685         if (!local_func_attr)
12686                 goto nla_put_failure;
12687
12688         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
12689                 goto nla_put_failure;
12690
12691         nla_nest_end(msg, local_func_attr);
12692
12693         peer_func_attr = nla_nest_start_noflag(msg,
12694                                                NL80211_NAN_MATCH_FUNC_PEER);
12695         if (!peer_func_attr)
12696                 goto nla_put_failure;
12697
12698         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
12699             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
12700                 goto nla_put_failure;
12701
12702         if (match->info && match->info_len &&
12703             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
12704                     match->info))
12705                 goto nla_put_failure;
12706
12707         nla_nest_end(msg, peer_func_attr);
12708         nla_nest_end(msg, match_attr);
12709         genlmsg_end(msg, hdr);
12710
12711         if (!wdev->owner_nlportid)
12712                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12713                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12714         else
12715                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12716                                 wdev->owner_nlportid);
12717
12718         return;
12719
12720 nla_put_failure:
12721         nlmsg_free(msg);
12722 }
12723 EXPORT_SYMBOL(cfg80211_nan_match);
12724
12725 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
12726                                   u8 inst_id,
12727                                   enum nl80211_nan_func_term_reason reason,
12728                                   u64 cookie, gfp_t gfp)
12729 {
12730         struct wiphy *wiphy = wdev->wiphy;
12731         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12732         struct sk_buff *msg;
12733         struct nlattr *func_attr;
12734         void *hdr;
12735
12736         if (WARN_ON(!inst_id))
12737                 return;
12738
12739         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12740         if (!msg)
12741                 return;
12742
12743         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
12744         if (!hdr) {
12745                 nlmsg_free(msg);
12746                 return;
12747         }
12748
12749         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12750             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12751                                          wdev->netdev->ifindex)) ||
12752             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12753                               NL80211_ATTR_PAD))
12754                 goto nla_put_failure;
12755
12756         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12757                               NL80211_ATTR_PAD))
12758                 goto nla_put_failure;
12759
12760         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
12761         if (!func_attr)
12762                 goto nla_put_failure;
12763
12764         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
12765             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
12766                 goto nla_put_failure;
12767
12768         nla_nest_end(msg, func_attr);
12769         genlmsg_end(msg, hdr);
12770
12771         if (!wdev->owner_nlportid)
12772                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12773                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12774         else
12775                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12776                                 wdev->owner_nlportid);
12777
12778         return;
12779
12780 nla_put_failure:
12781         nlmsg_free(msg);
12782 }
12783 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
12784
12785 static int nl80211_get_protocol_features(struct sk_buff *skb,
12786                                          struct genl_info *info)
12787 {
12788         void *hdr;
12789         struct sk_buff *msg;
12790
12791         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12792         if (!msg)
12793                 return -ENOMEM;
12794
12795         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12796                              NL80211_CMD_GET_PROTOCOL_FEATURES);
12797         if (!hdr)
12798                 goto nla_put_failure;
12799
12800         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
12801                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
12802                 goto nla_put_failure;
12803
12804         genlmsg_end(msg, hdr);
12805         return genlmsg_reply(msg, info);
12806
12807  nla_put_failure:
12808         kfree_skb(msg);
12809         return -ENOBUFS;
12810 }
12811
12812 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
12813 {
12814         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12815         struct cfg80211_update_ft_ies_params ft_params;
12816         struct net_device *dev = info->user_ptr[1];
12817
12818         if (!rdev->ops->update_ft_ies)
12819                 return -EOPNOTSUPP;
12820
12821         if (!info->attrs[NL80211_ATTR_MDID] ||
12822             !info->attrs[NL80211_ATTR_IE])
12823                 return -EINVAL;
12824
12825         memset(&ft_params, 0, sizeof(ft_params));
12826         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
12827         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12828         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12829
12830         return rdev_update_ft_ies(rdev, dev, &ft_params);
12831 }
12832
12833 static int nl80211_crit_protocol_start(struct sk_buff *skb,
12834                                        struct genl_info *info)
12835 {
12836         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12837         struct wireless_dev *wdev = info->user_ptr[1];
12838         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
12839         u16 duration;
12840         int ret;
12841
12842         if (!rdev->ops->crit_proto_start)
12843                 return -EOPNOTSUPP;
12844
12845         if (WARN_ON(!rdev->ops->crit_proto_stop))
12846                 return -EINVAL;
12847
12848         if (rdev->crit_proto_nlportid)
12849                 return -EBUSY;
12850
12851         /* determine protocol if provided */
12852         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
12853                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
12854
12855         if (proto >= NUM_NL80211_CRIT_PROTO)
12856                 return -EINVAL;
12857
12858         /* timeout must be provided */
12859         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
12860                 return -EINVAL;
12861
12862         duration =
12863                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
12864
12865         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
12866                 return -ERANGE;
12867
12868         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
12869         if (!ret)
12870                 rdev->crit_proto_nlportid = info->snd_portid;
12871
12872         return ret;
12873 }
12874
12875 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
12876                                       struct genl_info *info)
12877 {
12878         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12879         struct wireless_dev *wdev = info->user_ptr[1];
12880
12881         if (!rdev->ops->crit_proto_stop)
12882                 return -EOPNOTSUPP;
12883
12884         if (rdev->crit_proto_nlportid) {
12885                 rdev->crit_proto_nlportid = 0;
12886                 rdev_crit_proto_stop(rdev, wdev);
12887         }
12888         return 0;
12889 }
12890
12891 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
12892                                        struct nlattr *attr,
12893                                        struct netlink_ext_ack *extack)
12894 {
12895         if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
12896                 if (attr->nla_type & NLA_F_NESTED) {
12897                         NL_SET_ERR_MSG_ATTR(extack, attr,
12898                                             "unexpected nested data");
12899                         return -EINVAL;
12900                 }
12901
12902                 return 0;
12903         }
12904
12905         if (!(attr->nla_type & NLA_F_NESTED)) {
12906                 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
12907                 return -EINVAL;
12908         }
12909
12910         return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
12911 }
12912
12913 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
12914 {
12915         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12916         struct wireless_dev *wdev =
12917                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
12918         int i, err;
12919         u32 vid, subcmd;
12920
12921         if (!rdev->wiphy.vendor_commands)
12922                 return -EOPNOTSUPP;
12923
12924         if (IS_ERR(wdev)) {
12925                 err = PTR_ERR(wdev);
12926                 if (err != -EINVAL)
12927                         return err;
12928                 wdev = NULL;
12929         } else if (wdev->wiphy != &rdev->wiphy) {
12930                 return -EINVAL;
12931         }
12932
12933         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
12934             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
12935                 return -EINVAL;
12936
12937         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
12938         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
12939         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
12940                 const struct wiphy_vendor_command *vcmd;
12941                 void *data = NULL;
12942                 int len = 0;
12943
12944                 vcmd = &rdev->wiphy.vendor_commands[i];
12945
12946                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12947                         continue;
12948
12949                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12950                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12951                         if (!wdev)
12952                                 return -EINVAL;
12953                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12954                             !wdev->netdev)
12955                                 return -EINVAL;
12956
12957                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12958                                 if (!wdev_running(wdev))
12959                                         return -ENETDOWN;
12960                         }
12961
12962                         if (!vcmd->doit)
12963                                 return -EOPNOTSUPP;
12964                 } else {
12965                         wdev = NULL;
12966                 }
12967
12968                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
12969                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12970                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12971
12972                         err = nl80211_vendor_check_policy(vcmd,
12973                                         info->attrs[NL80211_ATTR_VENDOR_DATA],
12974                                         info->extack);
12975                         if (err)
12976                                 return err;
12977                 }
12978
12979                 rdev->cur_cmd_info = info;
12980                 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
12981                 rdev->cur_cmd_info = NULL;
12982                 return err;
12983         }
12984
12985         return -EOPNOTSUPP;
12986 }
12987
12988 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
12989                                        struct netlink_callback *cb,
12990                                        struct cfg80211_registered_device **rdev,
12991                                        struct wireless_dev **wdev)
12992 {
12993         struct nlattr **attrbuf;
12994         u32 vid, subcmd;
12995         unsigned int i;
12996         int vcmd_idx = -1;
12997         int err;
12998         void *data = NULL;
12999         unsigned int data_len = 0;
13000
13001         if (cb->args[0]) {
13002                 /* subtract the 1 again here */
13003                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
13004                 struct wireless_dev *tmp;
13005
13006                 if (!wiphy)
13007                         return -ENODEV;
13008                 *rdev = wiphy_to_rdev(wiphy);
13009                 *wdev = NULL;
13010
13011                 if (cb->args[1]) {
13012                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
13013                                 if (tmp->identifier == cb->args[1] - 1) {
13014                                         *wdev = tmp;
13015                                         break;
13016                                 }
13017                         }
13018                 }
13019
13020                 /* keep rtnl locked in successful case */
13021                 return 0;
13022         }
13023
13024         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
13025         if (!attrbuf)
13026                 return -ENOMEM;
13027
13028         err = nlmsg_parse_deprecated(cb->nlh,
13029                                      GENL_HDRLEN + nl80211_fam.hdrsize,
13030                                      attrbuf, nl80211_fam.maxattr,
13031                                      nl80211_policy, NULL);
13032         if (err)
13033                 goto out;
13034
13035         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
13036             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
13037                 err = -EINVAL;
13038                 goto out;
13039         }
13040
13041         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
13042         if (IS_ERR(*wdev))
13043                 *wdev = NULL;
13044
13045         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
13046         if (IS_ERR(*rdev)) {
13047                 err = PTR_ERR(*rdev);
13048                 goto out;
13049         }
13050
13051         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
13052         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
13053
13054         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
13055                 const struct wiphy_vendor_command *vcmd;
13056
13057                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
13058
13059                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
13060                         continue;
13061
13062                 if (!vcmd->dumpit) {
13063                         err = -EOPNOTSUPP;
13064                         goto out;
13065                 }
13066
13067                 vcmd_idx = i;
13068                 break;
13069         }
13070
13071         if (vcmd_idx < 0) {
13072                 err = -EOPNOTSUPP;
13073                 goto out;
13074         }
13075
13076         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
13077                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
13078                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
13079
13080                 err = nl80211_vendor_check_policy(
13081                                 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
13082                                 attrbuf[NL80211_ATTR_VENDOR_DATA],
13083                                 cb->extack);
13084                 if (err)
13085                         goto out;
13086         }
13087
13088         /* 0 is the first index - add 1 to parse only once */
13089         cb->args[0] = (*rdev)->wiphy_idx + 1;
13090         /* add 1 to know if it was NULL */
13091         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
13092         cb->args[2] = vcmd_idx;
13093         cb->args[3] = (unsigned long)data;
13094         cb->args[4] = data_len;
13095
13096         /* keep rtnl locked in successful case */
13097         err = 0;
13098 out:
13099         kfree(attrbuf);
13100         return err;
13101 }
13102
13103 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
13104                                    struct netlink_callback *cb)
13105 {
13106         struct cfg80211_registered_device *rdev;
13107         struct wireless_dev *wdev;
13108         unsigned int vcmd_idx;
13109         const struct wiphy_vendor_command *vcmd;
13110         void *data;
13111         int data_len;
13112         int err;
13113         struct nlattr *vendor_data;
13114
13115         rtnl_lock();
13116         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
13117         if (err)
13118                 goto out;
13119
13120         vcmd_idx = cb->args[2];
13121         data = (void *)cb->args[3];
13122         data_len = cb->args[4];
13123         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
13124
13125         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
13126                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
13127                 if (!wdev) {
13128                         err = -EINVAL;
13129                         goto out;
13130                 }
13131                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
13132                     !wdev->netdev) {
13133                         err = -EINVAL;
13134                         goto out;
13135                 }
13136
13137                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
13138                         if (!wdev_running(wdev)) {
13139                                 err = -ENETDOWN;
13140                                 goto out;
13141                         }
13142                 }
13143         }
13144
13145         while (1) {
13146                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
13147                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
13148                                            NL80211_CMD_VENDOR);
13149                 if (!hdr)
13150                         break;
13151
13152                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13153                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
13154                                                wdev_id(wdev),
13155                                                NL80211_ATTR_PAD))) {
13156                         genlmsg_cancel(skb, hdr);
13157                         break;
13158                 }
13159
13160                 vendor_data = nla_nest_start_noflag(skb,
13161                                                     NL80211_ATTR_VENDOR_DATA);
13162                 if (!vendor_data) {
13163                         genlmsg_cancel(skb, hdr);
13164                         break;
13165                 }
13166
13167                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
13168                                    (unsigned long *)&cb->args[5]);
13169                 nla_nest_end(skb, vendor_data);
13170
13171                 if (err == -ENOBUFS || err == -ENOENT) {
13172                         genlmsg_cancel(skb, hdr);
13173                         break;
13174                 } else if (err) {
13175                         genlmsg_cancel(skb, hdr);
13176                         goto out;
13177                 }
13178
13179                 genlmsg_end(skb, hdr);
13180         }
13181
13182         err = skb->len;
13183  out:
13184         rtnl_unlock();
13185         return err;
13186 }
13187
13188 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
13189                                            enum nl80211_commands cmd,
13190                                            enum nl80211_attrs attr,
13191                                            int approxlen)
13192 {
13193         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13194
13195         if (WARN_ON(!rdev->cur_cmd_info))
13196                 return NULL;
13197
13198         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
13199                                            rdev->cur_cmd_info->snd_portid,
13200                                            rdev->cur_cmd_info->snd_seq,
13201                                            cmd, attr, NULL, GFP_KERNEL);
13202 }
13203 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
13204
13205 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
13206 {
13207         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
13208         void *hdr = ((void **)skb->cb)[1];
13209         struct nlattr *data = ((void **)skb->cb)[2];
13210
13211         /* clear CB data for netlink core to own from now on */
13212         memset(skb->cb, 0, sizeof(skb->cb));
13213
13214         if (WARN_ON(!rdev->cur_cmd_info)) {
13215                 kfree_skb(skb);
13216                 return -EINVAL;
13217         }
13218
13219         nla_nest_end(skb, data);
13220         genlmsg_end(skb, hdr);
13221         return genlmsg_reply(skb, rdev->cur_cmd_info);
13222 }
13223 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
13224
13225 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
13226 {
13227         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13228
13229         if (WARN_ON(!rdev->cur_cmd_info))
13230                 return 0;
13231
13232         return rdev->cur_cmd_info->snd_portid;
13233 }
13234 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
13235
13236 static int nl80211_set_qos_map(struct sk_buff *skb,
13237                                struct genl_info *info)
13238 {
13239         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13240         struct cfg80211_qos_map *qos_map = NULL;
13241         struct net_device *dev = info->user_ptr[1];
13242         u8 *pos, len, num_des, des_len, des;
13243         int ret;
13244
13245         if (!rdev->ops->set_qos_map)
13246                 return -EOPNOTSUPP;
13247
13248         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
13249                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
13250                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
13251
13252                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
13253                     len > IEEE80211_QOS_MAP_LEN_MAX)
13254                         return -EINVAL;
13255
13256                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
13257                 if (!qos_map)
13258                         return -ENOMEM;
13259
13260                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
13261                 if (num_des) {
13262                         des_len = num_des *
13263                                 sizeof(struct cfg80211_dscp_exception);
13264                         memcpy(qos_map->dscp_exception, pos, des_len);
13265                         qos_map->num_des = num_des;
13266                         for (des = 0; des < num_des; des++) {
13267                                 if (qos_map->dscp_exception[des].up > 7) {
13268                                         kfree(qos_map);
13269                                         return -EINVAL;
13270                                 }
13271                         }
13272                         pos += des_len;
13273                 }
13274                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
13275         }
13276
13277         wdev_lock(dev->ieee80211_ptr);
13278         ret = nl80211_key_allowed(dev->ieee80211_ptr);
13279         if (!ret)
13280                 ret = rdev_set_qos_map(rdev, dev, qos_map);
13281         wdev_unlock(dev->ieee80211_ptr);
13282
13283         kfree(qos_map);
13284         return ret;
13285 }
13286
13287 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
13288 {
13289         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13290         struct net_device *dev = info->user_ptr[1];
13291         struct wireless_dev *wdev = dev->ieee80211_ptr;
13292         const u8 *peer;
13293         u8 tsid, up;
13294         u16 admitted_time = 0;
13295         int err;
13296
13297         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
13298                 return -EOPNOTSUPP;
13299
13300         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
13301             !info->attrs[NL80211_ATTR_USER_PRIO])
13302                 return -EINVAL;
13303
13304         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
13305         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
13306
13307         /* WMM uses TIDs 0-7 even for TSPEC */
13308         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
13309                 /* TODO: handle 802.11 TSPEC/admission control
13310                  * need more attributes for that (e.g. BA session requirement);
13311                  * change the WMM adminssion test above to allow both then
13312                  */
13313                 return -EINVAL;
13314         }
13315
13316         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13317
13318         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
13319                 admitted_time =
13320                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
13321                 if (!admitted_time)
13322                         return -EINVAL;
13323         }
13324
13325         wdev_lock(wdev);
13326         switch (wdev->iftype) {
13327         case NL80211_IFTYPE_STATION:
13328         case NL80211_IFTYPE_P2P_CLIENT:
13329                 if (wdev->current_bss)
13330                         break;
13331                 err = -ENOTCONN;
13332                 goto out;
13333         default:
13334                 err = -EOPNOTSUPP;
13335                 goto out;
13336         }
13337
13338         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
13339
13340  out:
13341         wdev_unlock(wdev);
13342         return err;
13343 }
13344
13345 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
13346 {
13347         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13348         struct net_device *dev = info->user_ptr[1];
13349         struct wireless_dev *wdev = dev->ieee80211_ptr;
13350         const u8 *peer;
13351         u8 tsid;
13352         int err;
13353
13354         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
13355                 return -EINVAL;
13356
13357         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
13358         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13359
13360         wdev_lock(wdev);
13361         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
13362         wdev_unlock(wdev);
13363
13364         return err;
13365 }
13366
13367 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
13368                                        struct genl_info *info)
13369 {
13370         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13371         struct net_device *dev = info->user_ptr[1];
13372         struct wireless_dev *wdev = dev->ieee80211_ptr;
13373         struct cfg80211_chan_def chandef = {};
13374         const u8 *addr;
13375         u8 oper_class;
13376         int err;
13377
13378         if (!rdev->ops->tdls_channel_switch ||
13379             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
13380                 return -EOPNOTSUPP;
13381
13382         switch (dev->ieee80211_ptr->iftype) {
13383         case NL80211_IFTYPE_STATION:
13384         case NL80211_IFTYPE_P2P_CLIENT:
13385                 break;
13386         default:
13387                 return -EOPNOTSUPP;
13388         }
13389
13390         if (!info->attrs[NL80211_ATTR_MAC] ||
13391             !info->attrs[NL80211_ATTR_OPER_CLASS])
13392                 return -EINVAL;
13393
13394         err = nl80211_parse_chandef(rdev, info, &chandef);
13395         if (err)
13396                 return err;
13397
13398         /*
13399          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
13400          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
13401          * specification is not defined for them.
13402          */
13403         if (chandef.chan->band == NL80211_BAND_2GHZ &&
13404             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
13405             chandef.width != NL80211_CHAN_WIDTH_20)
13406                 return -EINVAL;
13407
13408         /* we will be active on the TDLS link */
13409         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
13410                                            wdev->iftype))
13411                 return -EINVAL;
13412
13413         /* don't allow switching to DFS channels */
13414         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
13415                 return -EINVAL;
13416
13417         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
13418         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
13419
13420         wdev_lock(wdev);
13421         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
13422         wdev_unlock(wdev);
13423
13424         return err;
13425 }
13426
13427 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
13428                                               struct genl_info *info)
13429 {
13430         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13431         struct net_device *dev = info->user_ptr[1];
13432         struct wireless_dev *wdev = dev->ieee80211_ptr;
13433         const u8 *addr;
13434
13435         if (!rdev->ops->tdls_channel_switch ||
13436             !rdev->ops->tdls_cancel_channel_switch ||
13437             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
13438                 return -EOPNOTSUPP;
13439
13440         switch (dev->ieee80211_ptr->iftype) {
13441         case NL80211_IFTYPE_STATION:
13442         case NL80211_IFTYPE_P2P_CLIENT:
13443                 break;
13444         default:
13445                 return -EOPNOTSUPP;
13446         }
13447
13448         if (!info->attrs[NL80211_ATTR_MAC])
13449                 return -EINVAL;
13450
13451         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
13452
13453         wdev_lock(wdev);
13454         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
13455         wdev_unlock(wdev);
13456
13457         return 0;
13458 }
13459
13460 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
13461                                             struct genl_info *info)
13462 {
13463         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13464         struct net_device *dev = info->user_ptr[1];
13465         struct wireless_dev *wdev = dev->ieee80211_ptr;
13466         const struct nlattr *nla;
13467         bool enabled;
13468
13469         if (!rdev->ops->set_multicast_to_unicast)
13470                 return -EOPNOTSUPP;
13471
13472         if (wdev->iftype != NL80211_IFTYPE_AP &&
13473             wdev->iftype != NL80211_IFTYPE_P2P_GO)
13474                 return -EOPNOTSUPP;
13475
13476         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
13477         enabled = nla_get_flag(nla);
13478
13479         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
13480 }
13481
13482 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
13483 {
13484         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13485         struct net_device *dev = info->user_ptr[1];
13486         struct wireless_dev *wdev = dev->ieee80211_ptr;
13487         struct cfg80211_pmk_conf pmk_conf = {};
13488         int ret;
13489
13490         if (wdev->iftype != NL80211_IFTYPE_STATION &&
13491             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13492                 return -EOPNOTSUPP;
13493
13494         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13495                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13496                 return -EOPNOTSUPP;
13497
13498         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
13499                 return -EINVAL;
13500
13501         wdev_lock(wdev);
13502         if (!wdev->current_bss) {
13503                 ret = -ENOTCONN;
13504                 goto out;
13505         }
13506
13507         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
13508         if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
13509                 ret = -EINVAL;
13510                 goto out;
13511         }
13512
13513         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
13514         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
13515         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
13516             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
13517                 ret = -EINVAL;
13518                 goto out;
13519         }
13520
13521         if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
13522                 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
13523
13524                 if (r0_name_len != WLAN_PMK_NAME_LEN) {
13525                         ret = -EINVAL;
13526                         goto out;
13527                 }
13528
13529                 pmk_conf.pmk_r0_name =
13530                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
13531         }
13532
13533         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
13534 out:
13535         wdev_unlock(wdev);
13536         return ret;
13537 }
13538
13539 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
13540 {
13541         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13542         struct net_device *dev = info->user_ptr[1];
13543         struct wireless_dev *wdev = dev->ieee80211_ptr;
13544         const u8 *aa;
13545         int ret;
13546
13547         if (wdev->iftype != NL80211_IFTYPE_STATION &&
13548             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13549                 return -EOPNOTSUPP;
13550
13551         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13552                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13553                 return -EOPNOTSUPP;
13554
13555         if (!info->attrs[NL80211_ATTR_MAC])
13556                 return -EINVAL;
13557
13558         wdev_lock(wdev);
13559         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
13560         ret = rdev_del_pmk(rdev, dev, aa);
13561         wdev_unlock(wdev);
13562
13563         return ret;
13564 }
13565
13566 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
13567 {
13568         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13569         struct net_device *dev = info->user_ptr[1];
13570         struct cfg80211_external_auth_params params;
13571
13572         if (!rdev->ops->external_auth)
13573                 return -EOPNOTSUPP;
13574
13575         if (!info->attrs[NL80211_ATTR_SSID] &&
13576             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
13577             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
13578                 return -EINVAL;
13579
13580         if (!info->attrs[NL80211_ATTR_BSSID])
13581                 return -EINVAL;
13582
13583         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
13584                 return -EINVAL;
13585
13586         memset(&params, 0, sizeof(params));
13587
13588         if (info->attrs[NL80211_ATTR_SSID]) {
13589                 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13590                 if (params.ssid.ssid_len == 0 ||
13591                     params.ssid.ssid_len > IEEE80211_MAX_SSID_LEN)
13592                         return -EINVAL;
13593                 memcpy(params.ssid.ssid,
13594                        nla_data(info->attrs[NL80211_ATTR_SSID]),
13595                        params.ssid.ssid_len);
13596         }
13597
13598         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
13599                ETH_ALEN);
13600
13601         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
13602
13603         if (info->attrs[NL80211_ATTR_PMKID])
13604                 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
13605
13606         return rdev_external_auth(rdev, dev, &params);
13607 }
13608
13609 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
13610 {
13611         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13612         struct net_device *dev = info->user_ptr[1];
13613         struct wireless_dev *wdev = dev->ieee80211_ptr;
13614         const u8 *buf;
13615         size_t len;
13616         u8 *dest;
13617         u16 proto;
13618         bool noencrypt;
13619         int err;
13620
13621         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13622                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
13623                 return -EOPNOTSUPP;
13624
13625         if (!rdev->ops->tx_control_port)
13626                 return -EOPNOTSUPP;
13627
13628         if (!info->attrs[NL80211_ATTR_FRAME] ||
13629             !info->attrs[NL80211_ATTR_MAC] ||
13630             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
13631                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
13632                 return -EINVAL;
13633         }
13634
13635         wdev_lock(wdev);
13636
13637         switch (wdev->iftype) {
13638         case NL80211_IFTYPE_AP:
13639         case NL80211_IFTYPE_P2P_GO:
13640         case NL80211_IFTYPE_MESH_POINT:
13641                 break;
13642         case NL80211_IFTYPE_ADHOC:
13643         case NL80211_IFTYPE_STATION:
13644         case NL80211_IFTYPE_P2P_CLIENT:
13645                 if (wdev->current_bss)
13646                         break;
13647                 err = -ENOTCONN;
13648                 goto out;
13649         default:
13650                 err = -EOPNOTSUPP;
13651                 goto out;
13652         }
13653
13654         wdev_unlock(wdev);
13655
13656         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
13657         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
13658         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
13659         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
13660         noencrypt =
13661                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
13662
13663         return rdev_tx_control_port(rdev, dev, buf, len,
13664                                     dest, cpu_to_be16(proto), noencrypt);
13665
13666  out:
13667         wdev_unlock(wdev);
13668         return err;
13669 }
13670
13671 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
13672                                            struct genl_info *info)
13673 {
13674         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13675         struct net_device *dev = info->user_ptr[1];
13676         struct wireless_dev *wdev = dev->ieee80211_ptr;
13677         struct cfg80211_ftm_responder_stats ftm_stats = {};
13678         struct sk_buff *msg;
13679         void *hdr;
13680         struct nlattr *ftm_stats_attr;
13681         int err;
13682
13683         if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval)
13684                 return -EOPNOTSUPP;
13685
13686         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
13687         if (err)
13688                 return err;
13689
13690         if (!ftm_stats.filled)
13691                 return -ENODATA;
13692
13693         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13694         if (!msg)
13695                 return -ENOMEM;
13696
13697         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13698                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
13699         if (!hdr)
13700                 goto nla_put_failure;
13701
13702         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
13703                 goto nla_put_failure;
13704
13705         ftm_stats_attr = nla_nest_start_noflag(msg,
13706                                                NL80211_ATTR_FTM_RESPONDER_STATS);
13707         if (!ftm_stats_attr)
13708                 goto nla_put_failure;
13709
13710 #define SET_FTM(field, name, type)                                       \
13711         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
13712             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
13713                              ftm_stats.field))                           \
13714                 goto nla_put_failure; } while (0)
13715 #define SET_FTM_U64(field, name)                                         \
13716         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
13717             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
13718                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
13719                 goto nla_put_failure; } while (0)
13720
13721         SET_FTM(success_num, SUCCESS_NUM, u32);
13722         SET_FTM(partial_num, PARTIAL_NUM, u32);
13723         SET_FTM(failed_num, FAILED_NUM, u32);
13724         SET_FTM(asap_num, ASAP_NUM, u32);
13725         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
13726         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
13727         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
13728         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
13729         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
13730 #undef SET_FTM
13731
13732         nla_nest_end(msg, ftm_stats_attr);
13733
13734         genlmsg_end(msg, hdr);
13735         return genlmsg_reply(msg, info);
13736
13737 nla_put_failure:
13738         nlmsg_free(msg);
13739         return -ENOBUFS;
13740 }
13741
13742 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
13743 {
13744         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13745         struct cfg80211_update_owe_info owe_info;
13746         struct net_device *dev = info->user_ptr[1];
13747
13748         if (!rdev->ops->update_owe_info)
13749                 return -EOPNOTSUPP;
13750
13751         if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
13752             !info->attrs[NL80211_ATTR_MAC])
13753                 return -EINVAL;
13754
13755         memset(&owe_info, 0, sizeof(owe_info));
13756         owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
13757         nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
13758
13759         if (info->attrs[NL80211_ATTR_IE]) {
13760                 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13761                 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13762         }
13763
13764         return rdev_update_owe_info(rdev, dev, &owe_info);
13765 }
13766
13767 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
13768 {
13769         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13770         struct net_device *dev = info->user_ptr[1];
13771         struct wireless_dev *wdev = dev->ieee80211_ptr;
13772         struct station_info sinfo = {};
13773         const u8 *buf;
13774         size_t len;
13775         u8 *dest;
13776         int err;
13777
13778         if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
13779                 return -EOPNOTSUPP;
13780
13781         if (!info->attrs[NL80211_ATTR_MAC] ||
13782             !info->attrs[NL80211_ATTR_FRAME]) {
13783                 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
13784                 return -EINVAL;
13785         }
13786
13787         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
13788                 return -EOPNOTSUPP;
13789
13790         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
13791         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
13792         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
13793
13794         if (len < sizeof(struct ethhdr))
13795                 return -EINVAL;
13796
13797         if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
13798             !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
13799                 return -EINVAL;
13800
13801         err = rdev_get_station(rdev, dev, dest, &sinfo);
13802         if (err)
13803                 return err;
13804
13805         cfg80211_sinfo_release_content(&sinfo);
13806
13807         return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
13808 }
13809
13810 #define NL80211_FLAG_NEED_WIPHY         0x01
13811 #define NL80211_FLAG_NEED_NETDEV        0x02
13812 #define NL80211_FLAG_NEED_RTNL          0x04
13813 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
13814 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
13815                                          NL80211_FLAG_CHECK_NETDEV_UP)
13816 #define NL80211_FLAG_NEED_WDEV          0x10
13817 /* If a netdev is associated, it must be UP, P2P must be started */
13818 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
13819                                          NL80211_FLAG_CHECK_NETDEV_UP)
13820 #define NL80211_FLAG_CLEAR_SKB          0x20
13821
13822 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
13823                             struct genl_info *info)
13824 {
13825         struct cfg80211_registered_device *rdev;
13826         struct wireless_dev *wdev;
13827         struct net_device *dev;
13828         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
13829
13830         if (rtnl)
13831                 rtnl_lock();
13832
13833         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
13834                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
13835                 if (IS_ERR(rdev)) {
13836                         if (rtnl)
13837                                 rtnl_unlock();
13838                         return PTR_ERR(rdev);
13839                 }
13840                 info->user_ptr[0] = rdev;
13841         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
13842                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13843                 ASSERT_RTNL();
13844
13845                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
13846                                                   info->attrs);
13847                 if (IS_ERR(wdev)) {
13848                         if (rtnl)
13849                                 rtnl_unlock();
13850                         return PTR_ERR(wdev);
13851                 }
13852
13853                 dev = wdev->netdev;
13854                 rdev = wiphy_to_rdev(wdev->wiphy);
13855
13856                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
13857                         if (!dev) {
13858                                 if (rtnl)
13859                                         rtnl_unlock();
13860                                 return -EINVAL;
13861                         }
13862
13863                         info->user_ptr[1] = dev;
13864                 } else {
13865                         info->user_ptr[1] = wdev;
13866                 }
13867
13868                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
13869                     !wdev_running(wdev)) {
13870                         if (rtnl)
13871                                 rtnl_unlock();
13872                         return -ENETDOWN;
13873                 }
13874
13875                 if (dev)
13876                         dev_hold(dev);
13877
13878                 info->user_ptr[0] = rdev;
13879         }
13880
13881         return 0;
13882 }
13883
13884 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
13885                               struct genl_info *info)
13886 {
13887         if (info->user_ptr[1]) {
13888                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13889                         struct wireless_dev *wdev = info->user_ptr[1];
13890
13891                         if (wdev->netdev)
13892                                 dev_put(wdev->netdev);
13893                 } else {
13894                         dev_put(info->user_ptr[1]);
13895                 }
13896         }
13897
13898         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
13899                 rtnl_unlock();
13900
13901         /* If needed, clear the netlink message payload from the SKB
13902          * as it might contain key data that shouldn't stick around on
13903          * the heap after the SKB is freed. The netlink message header
13904          * is still needed for further processing, so leave it intact.
13905          */
13906         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
13907                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
13908
13909                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
13910         }
13911 }
13912
13913 static const struct genl_ops nl80211_ops[] = {
13914         {
13915                 .cmd = NL80211_CMD_GET_WIPHY,
13916                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13917                 .doit = nl80211_get_wiphy,
13918                 .dumpit = nl80211_dump_wiphy,
13919                 .done = nl80211_dump_wiphy_done,
13920                 /* can be retrieved by unprivileged users */
13921                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13922                                   NL80211_FLAG_NEED_RTNL,
13923         },
13924         {
13925                 .cmd = NL80211_CMD_SET_WIPHY,
13926                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13927                 .doit = nl80211_set_wiphy,
13928                 .flags = GENL_UNS_ADMIN_PERM,
13929                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13930         },
13931         {
13932                 .cmd = NL80211_CMD_GET_INTERFACE,
13933                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13934                 .doit = nl80211_get_interface,
13935                 .dumpit = nl80211_dump_interface,
13936                 /* can be retrieved by unprivileged users */
13937                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13938                                   NL80211_FLAG_NEED_RTNL,
13939         },
13940         {
13941                 .cmd = NL80211_CMD_SET_INTERFACE,
13942                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13943                 .doit = nl80211_set_interface,
13944                 .flags = GENL_UNS_ADMIN_PERM,
13945                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13946                                   NL80211_FLAG_NEED_RTNL,
13947         },
13948         {
13949                 .cmd = NL80211_CMD_NEW_INTERFACE,
13950                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13951                 .doit = nl80211_new_interface,
13952                 .flags = GENL_UNS_ADMIN_PERM,
13953                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13954                                   NL80211_FLAG_NEED_RTNL,
13955         },
13956         {
13957                 .cmd = NL80211_CMD_DEL_INTERFACE,
13958                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13959                 .doit = nl80211_del_interface,
13960                 .flags = GENL_UNS_ADMIN_PERM,
13961                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13962                                   NL80211_FLAG_NEED_RTNL,
13963         },
13964         {
13965                 .cmd = NL80211_CMD_GET_KEY,
13966                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13967                 .doit = nl80211_get_key,
13968                 .flags = GENL_UNS_ADMIN_PERM,
13969                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13970                                   NL80211_FLAG_NEED_RTNL,
13971         },
13972         {
13973                 .cmd = NL80211_CMD_SET_KEY,
13974                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13975                 .doit = nl80211_set_key,
13976                 .flags = GENL_UNS_ADMIN_PERM,
13977                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13978                                   NL80211_FLAG_NEED_RTNL |
13979                                   NL80211_FLAG_CLEAR_SKB,
13980         },
13981         {
13982                 .cmd = NL80211_CMD_NEW_KEY,
13983                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13984                 .doit = nl80211_new_key,
13985                 .flags = GENL_UNS_ADMIN_PERM,
13986                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13987                                   NL80211_FLAG_NEED_RTNL |
13988                                   NL80211_FLAG_CLEAR_SKB,
13989         },
13990         {
13991                 .cmd = NL80211_CMD_DEL_KEY,
13992                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13993                 .doit = nl80211_del_key,
13994                 .flags = GENL_UNS_ADMIN_PERM,
13995                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13996                                   NL80211_FLAG_NEED_RTNL,
13997         },
13998         {
13999                 .cmd = NL80211_CMD_SET_BEACON,
14000                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14001                 .flags = GENL_UNS_ADMIN_PERM,
14002                 .doit = nl80211_set_beacon,
14003                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14004                                   NL80211_FLAG_NEED_RTNL,
14005         },
14006         {
14007                 .cmd = NL80211_CMD_START_AP,
14008                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14009                 .flags = GENL_UNS_ADMIN_PERM,
14010                 .doit = nl80211_start_ap,
14011                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14012                                   NL80211_FLAG_NEED_RTNL,
14013         },
14014         {
14015                 .cmd = NL80211_CMD_STOP_AP,
14016                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14017                 .flags = GENL_UNS_ADMIN_PERM,
14018                 .doit = nl80211_stop_ap,
14019                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14020                                   NL80211_FLAG_NEED_RTNL,
14021         },
14022         {
14023                 .cmd = NL80211_CMD_GET_STATION,
14024                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14025                 .doit = nl80211_get_station,
14026                 .dumpit = nl80211_dump_station,
14027                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14028                                   NL80211_FLAG_NEED_RTNL,
14029         },
14030         {
14031                 .cmd = NL80211_CMD_SET_STATION,
14032                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14033                 .doit = nl80211_set_station,
14034                 .flags = GENL_UNS_ADMIN_PERM,
14035                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14036                                   NL80211_FLAG_NEED_RTNL,
14037         },
14038         {
14039                 .cmd = NL80211_CMD_NEW_STATION,
14040                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14041                 .doit = nl80211_new_station,
14042                 .flags = GENL_UNS_ADMIN_PERM,
14043                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14044                                   NL80211_FLAG_NEED_RTNL,
14045         },
14046         {
14047                 .cmd = NL80211_CMD_DEL_STATION,
14048                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14049                 .doit = nl80211_del_station,
14050                 .flags = GENL_UNS_ADMIN_PERM,
14051                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14052                                   NL80211_FLAG_NEED_RTNL,
14053         },
14054         {
14055                 .cmd = NL80211_CMD_GET_MPATH,
14056                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14057                 .doit = nl80211_get_mpath,
14058                 .dumpit = nl80211_dump_mpath,
14059                 .flags = GENL_UNS_ADMIN_PERM,
14060                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14061                                   NL80211_FLAG_NEED_RTNL,
14062         },
14063         {
14064                 .cmd = NL80211_CMD_GET_MPP,
14065                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14066                 .doit = nl80211_get_mpp,
14067                 .dumpit = nl80211_dump_mpp,
14068                 .flags = GENL_UNS_ADMIN_PERM,
14069                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14070                                   NL80211_FLAG_NEED_RTNL,
14071         },
14072         {
14073                 .cmd = NL80211_CMD_SET_MPATH,
14074                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14075                 .doit = nl80211_set_mpath,
14076                 .flags = GENL_UNS_ADMIN_PERM,
14077                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14078                                   NL80211_FLAG_NEED_RTNL,
14079         },
14080         {
14081                 .cmd = NL80211_CMD_NEW_MPATH,
14082                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14083                 .doit = nl80211_new_mpath,
14084                 .flags = GENL_UNS_ADMIN_PERM,
14085                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14086                                   NL80211_FLAG_NEED_RTNL,
14087         },
14088         {
14089                 .cmd = NL80211_CMD_DEL_MPATH,
14090                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14091                 .doit = nl80211_del_mpath,
14092                 .flags = GENL_UNS_ADMIN_PERM,
14093                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14094                                   NL80211_FLAG_NEED_RTNL,
14095         },
14096         {
14097                 .cmd = NL80211_CMD_SET_BSS,
14098                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14099                 .doit = nl80211_set_bss,
14100                 .flags = GENL_UNS_ADMIN_PERM,
14101                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14102                                   NL80211_FLAG_NEED_RTNL,
14103         },
14104         {
14105                 .cmd = NL80211_CMD_GET_REG,
14106                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14107                 .doit = nl80211_get_reg_do,
14108                 .dumpit = nl80211_get_reg_dump,
14109                 .internal_flags = NL80211_FLAG_NEED_RTNL,
14110                 /* can be retrieved by unprivileged users */
14111         },
14112 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
14113         {
14114                 .cmd = NL80211_CMD_SET_REG,
14115                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14116                 .doit = nl80211_set_reg,
14117                 .flags = GENL_ADMIN_PERM,
14118                 .internal_flags = NL80211_FLAG_NEED_RTNL,
14119         },
14120 #endif
14121         {
14122                 .cmd = NL80211_CMD_REQ_SET_REG,
14123                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14124                 .doit = nl80211_req_set_reg,
14125                 .flags = GENL_ADMIN_PERM,
14126         },
14127         {
14128                 .cmd = NL80211_CMD_RELOAD_REGDB,
14129                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14130                 .doit = nl80211_reload_regdb,
14131                 .flags = GENL_ADMIN_PERM,
14132         },
14133         {
14134                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
14135                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14136                 .doit = nl80211_get_mesh_config,
14137                 /* can be retrieved by unprivileged users */
14138                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14139                                   NL80211_FLAG_NEED_RTNL,
14140         },
14141         {
14142                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
14143                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14144                 .doit = nl80211_update_mesh_config,
14145                 .flags = GENL_UNS_ADMIN_PERM,
14146                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14147                                   NL80211_FLAG_NEED_RTNL,
14148         },
14149         {
14150                 .cmd = NL80211_CMD_TRIGGER_SCAN,
14151                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14152                 .doit = nl80211_trigger_scan,
14153                 .flags = GENL_UNS_ADMIN_PERM,
14154                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14155                                   NL80211_FLAG_NEED_RTNL,
14156         },
14157         {
14158                 .cmd = NL80211_CMD_ABORT_SCAN,
14159                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14160                 .doit = nl80211_abort_scan,
14161                 .flags = GENL_UNS_ADMIN_PERM,
14162                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14163                                   NL80211_FLAG_NEED_RTNL,
14164         },
14165         {
14166                 .cmd = NL80211_CMD_GET_SCAN,
14167                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14168                 .dumpit = nl80211_dump_scan,
14169         },
14170         {
14171                 .cmd = NL80211_CMD_START_SCHED_SCAN,
14172                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14173                 .doit = nl80211_start_sched_scan,
14174                 .flags = GENL_UNS_ADMIN_PERM,
14175                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14176                                   NL80211_FLAG_NEED_RTNL,
14177         },
14178         {
14179                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
14180                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14181                 .doit = nl80211_stop_sched_scan,
14182                 .flags = GENL_UNS_ADMIN_PERM,
14183                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14184                                   NL80211_FLAG_NEED_RTNL,
14185         },
14186         {
14187                 .cmd = NL80211_CMD_AUTHENTICATE,
14188                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14189                 .doit = nl80211_authenticate,
14190                 .flags = GENL_UNS_ADMIN_PERM,
14191                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14192                                   NL80211_FLAG_NEED_RTNL |
14193                                   NL80211_FLAG_CLEAR_SKB,
14194         },
14195         {
14196                 .cmd = NL80211_CMD_ASSOCIATE,
14197                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14198                 .doit = nl80211_associate,
14199                 .flags = GENL_UNS_ADMIN_PERM,
14200                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14201                                   NL80211_FLAG_NEED_RTNL |
14202                                   NL80211_FLAG_CLEAR_SKB,
14203         },
14204         {
14205                 .cmd = NL80211_CMD_DEAUTHENTICATE,
14206                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14207                 .doit = nl80211_deauthenticate,
14208                 .flags = GENL_UNS_ADMIN_PERM,
14209                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14210                                   NL80211_FLAG_NEED_RTNL,
14211         },
14212         {
14213                 .cmd = NL80211_CMD_DISASSOCIATE,
14214                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14215                 .doit = nl80211_disassociate,
14216                 .flags = GENL_UNS_ADMIN_PERM,
14217                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14218                                   NL80211_FLAG_NEED_RTNL,
14219         },
14220         {
14221                 .cmd = NL80211_CMD_JOIN_IBSS,
14222                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14223                 .doit = nl80211_join_ibss,
14224                 .flags = GENL_UNS_ADMIN_PERM,
14225                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14226                                   NL80211_FLAG_NEED_RTNL,
14227         },
14228         {
14229                 .cmd = NL80211_CMD_LEAVE_IBSS,
14230                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14231                 .doit = nl80211_leave_ibss,
14232                 .flags = GENL_UNS_ADMIN_PERM,
14233                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14234                                   NL80211_FLAG_NEED_RTNL,
14235         },
14236 #ifdef CONFIG_NL80211_TESTMODE
14237         {
14238                 .cmd = NL80211_CMD_TESTMODE,
14239                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14240                 .doit = nl80211_testmode_do,
14241                 .dumpit = nl80211_testmode_dump,
14242                 .flags = GENL_UNS_ADMIN_PERM,
14243                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14244                                   NL80211_FLAG_NEED_RTNL,
14245         },
14246 #endif
14247         {
14248                 .cmd = NL80211_CMD_CONNECT,
14249                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14250                 .doit = nl80211_connect,
14251                 .flags = GENL_UNS_ADMIN_PERM,
14252                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14253                                   NL80211_FLAG_NEED_RTNL |
14254                                   NL80211_FLAG_CLEAR_SKB,
14255         },
14256         {
14257                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
14258                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14259                 .doit = nl80211_update_connect_params,
14260                 .flags = GENL_ADMIN_PERM,
14261                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14262                                   NL80211_FLAG_NEED_RTNL |
14263                                   NL80211_FLAG_CLEAR_SKB,
14264         },
14265         {
14266                 .cmd = NL80211_CMD_DISCONNECT,
14267                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14268                 .doit = nl80211_disconnect,
14269                 .flags = GENL_UNS_ADMIN_PERM,
14270                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14271                                   NL80211_FLAG_NEED_RTNL,
14272         },
14273         {
14274                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
14275                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14276                 .doit = nl80211_wiphy_netns,
14277                 .flags = GENL_UNS_ADMIN_PERM,
14278                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14279                                   NL80211_FLAG_NEED_RTNL,
14280         },
14281         {
14282                 .cmd = NL80211_CMD_GET_SURVEY,
14283                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14284                 .dumpit = nl80211_dump_survey,
14285         },
14286         {
14287                 .cmd = NL80211_CMD_SET_PMKSA,
14288                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14289                 .doit = nl80211_setdel_pmksa,
14290                 .flags = GENL_UNS_ADMIN_PERM,
14291                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14292                                   NL80211_FLAG_NEED_RTNL |
14293                                   NL80211_FLAG_CLEAR_SKB,
14294         },
14295         {
14296                 .cmd = NL80211_CMD_DEL_PMKSA,
14297                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14298                 .doit = nl80211_setdel_pmksa,
14299                 .flags = GENL_UNS_ADMIN_PERM,
14300                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14301                                   NL80211_FLAG_NEED_RTNL,
14302         },
14303         {
14304                 .cmd = NL80211_CMD_FLUSH_PMKSA,
14305                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14306                 .doit = nl80211_flush_pmksa,
14307                 .flags = GENL_UNS_ADMIN_PERM,
14308                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14309                                   NL80211_FLAG_NEED_RTNL,
14310         },
14311         {
14312                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
14313                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14314                 .doit = nl80211_remain_on_channel,
14315                 .flags = GENL_UNS_ADMIN_PERM,
14316                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14317                                   NL80211_FLAG_NEED_RTNL,
14318         },
14319         {
14320                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
14321                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14322                 .doit = nl80211_cancel_remain_on_channel,
14323                 .flags = GENL_UNS_ADMIN_PERM,
14324                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14325                                   NL80211_FLAG_NEED_RTNL,
14326         },
14327         {
14328                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
14329                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14330                 .doit = nl80211_set_tx_bitrate_mask,
14331                 .flags = GENL_UNS_ADMIN_PERM,
14332                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14333                                   NL80211_FLAG_NEED_RTNL,
14334         },
14335         {
14336                 .cmd = NL80211_CMD_REGISTER_FRAME,
14337                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14338                 .doit = nl80211_register_mgmt,
14339                 .flags = GENL_UNS_ADMIN_PERM,
14340                 .internal_flags = NL80211_FLAG_NEED_WDEV |
14341                                   NL80211_FLAG_NEED_RTNL,
14342         },
14343         {
14344                 .cmd = NL80211_CMD_FRAME,
14345                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14346                 .doit = nl80211_tx_mgmt,
14347                 .flags = GENL_UNS_ADMIN_PERM,
14348                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14349                                   NL80211_FLAG_NEED_RTNL,
14350         },
14351         {
14352                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
14353                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14354                 .doit = nl80211_tx_mgmt_cancel_wait,
14355                 .flags = GENL_UNS_ADMIN_PERM,
14356                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14357                                   NL80211_FLAG_NEED_RTNL,
14358         },
14359         {
14360                 .cmd = NL80211_CMD_SET_POWER_SAVE,
14361                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14362                 .doit = nl80211_set_power_save,
14363                 .flags = GENL_UNS_ADMIN_PERM,
14364                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14365                                   NL80211_FLAG_NEED_RTNL,
14366         },
14367         {
14368                 .cmd = NL80211_CMD_GET_POWER_SAVE,
14369                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14370                 .doit = nl80211_get_power_save,
14371                 /* can be retrieved by unprivileged users */
14372                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14373                                   NL80211_FLAG_NEED_RTNL,
14374         },
14375         {
14376                 .cmd = NL80211_CMD_SET_CQM,
14377                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14378                 .doit = nl80211_set_cqm,
14379                 .flags = GENL_UNS_ADMIN_PERM,
14380                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14381                                   NL80211_FLAG_NEED_RTNL,
14382         },
14383         {
14384                 .cmd = NL80211_CMD_SET_CHANNEL,
14385                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14386                 .doit = nl80211_set_channel,
14387                 .flags = GENL_UNS_ADMIN_PERM,
14388                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14389                                   NL80211_FLAG_NEED_RTNL,
14390         },
14391         {
14392                 .cmd = NL80211_CMD_SET_WDS_PEER,
14393                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14394                 .doit = nl80211_set_wds_peer,
14395                 .flags = GENL_UNS_ADMIN_PERM,
14396                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14397                                   NL80211_FLAG_NEED_RTNL,
14398         },
14399         {
14400                 .cmd = NL80211_CMD_JOIN_MESH,
14401                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14402                 .doit = nl80211_join_mesh,
14403                 .flags = GENL_UNS_ADMIN_PERM,
14404                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14405                                   NL80211_FLAG_NEED_RTNL,
14406         },
14407         {
14408                 .cmd = NL80211_CMD_LEAVE_MESH,
14409                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14410                 .doit = nl80211_leave_mesh,
14411                 .flags = GENL_UNS_ADMIN_PERM,
14412                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14413                                   NL80211_FLAG_NEED_RTNL,
14414         },
14415         {
14416                 .cmd = NL80211_CMD_JOIN_OCB,
14417                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14418                 .doit = nl80211_join_ocb,
14419                 .flags = GENL_UNS_ADMIN_PERM,
14420                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14421                                   NL80211_FLAG_NEED_RTNL,
14422         },
14423         {
14424                 .cmd = NL80211_CMD_LEAVE_OCB,
14425                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14426                 .doit = nl80211_leave_ocb,
14427                 .flags = GENL_UNS_ADMIN_PERM,
14428                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14429                                   NL80211_FLAG_NEED_RTNL,
14430         },
14431 #ifdef CONFIG_PM
14432         {
14433                 .cmd = NL80211_CMD_GET_WOWLAN,
14434                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14435                 .doit = nl80211_get_wowlan,
14436                 /* can be retrieved by unprivileged users */
14437                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14438                                   NL80211_FLAG_NEED_RTNL,
14439         },
14440         {
14441                 .cmd = NL80211_CMD_SET_WOWLAN,
14442                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14443                 .doit = nl80211_set_wowlan,
14444                 .flags = GENL_UNS_ADMIN_PERM,
14445                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14446                                   NL80211_FLAG_NEED_RTNL,
14447         },
14448 #endif
14449         {
14450                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
14451                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14452                 .doit = nl80211_set_rekey_data,
14453                 .flags = GENL_UNS_ADMIN_PERM,
14454                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14455                                   NL80211_FLAG_NEED_RTNL |
14456                                   NL80211_FLAG_CLEAR_SKB,
14457         },
14458         {
14459                 .cmd = NL80211_CMD_TDLS_MGMT,
14460                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14461                 .doit = nl80211_tdls_mgmt,
14462                 .flags = GENL_UNS_ADMIN_PERM,
14463                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14464                                   NL80211_FLAG_NEED_RTNL,
14465         },
14466         {
14467                 .cmd = NL80211_CMD_TDLS_OPER,
14468                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14469                 .doit = nl80211_tdls_oper,
14470                 .flags = GENL_UNS_ADMIN_PERM,
14471                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14472                                   NL80211_FLAG_NEED_RTNL,
14473         },
14474         {
14475                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
14476                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14477                 .doit = nl80211_register_unexpected_frame,
14478                 .flags = GENL_UNS_ADMIN_PERM,
14479                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14480                                   NL80211_FLAG_NEED_RTNL,
14481         },
14482         {
14483                 .cmd = NL80211_CMD_PROBE_CLIENT,
14484                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14485                 .doit = nl80211_probe_client,
14486                 .flags = GENL_UNS_ADMIN_PERM,
14487                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14488                                   NL80211_FLAG_NEED_RTNL,
14489         },
14490         {
14491                 .cmd = NL80211_CMD_REGISTER_BEACONS,
14492                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14493                 .doit = nl80211_register_beacons,
14494                 .flags = GENL_UNS_ADMIN_PERM,
14495                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14496                                   NL80211_FLAG_NEED_RTNL,
14497         },
14498         {
14499                 .cmd = NL80211_CMD_SET_NOACK_MAP,
14500                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14501                 .doit = nl80211_set_noack_map,
14502                 .flags = GENL_UNS_ADMIN_PERM,
14503                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14504                                   NL80211_FLAG_NEED_RTNL,
14505         },
14506         {
14507                 .cmd = NL80211_CMD_START_P2P_DEVICE,
14508                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14509                 .doit = nl80211_start_p2p_device,
14510                 .flags = GENL_UNS_ADMIN_PERM,
14511                 .internal_flags = NL80211_FLAG_NEED_WDEV |
14512                                   NL80211_FLAG_NEED_RTNL,
14513         },
14514         {
14515                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
14516                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14517                 .doit = nl80211_stop_p2p_device,
14518                 .flags = GENL_UNS_ADMIN_PERM,
14519                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14520                                   NL80211_FLAG_NEED_RTNL,
14521         },
14522         {
14523                 .cmd = NL80211_CMD_START_NAN,
14524                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14525                 .doit = nl80211_start_nan,
14526                 .flags = GENL_ADMIN_PERM,
14527                 .internal_flags = NL80211_FLAG_NEED_WDEV |
14528                                   NL80211_FLAG_NEED_RTNL,
14529         },
14530         {
14531                 .cmd = NL80211_CMD_STOP_NAN,
14532                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14533                 .doit = nl80211_stop_nan,
14534                 .flags = GENL_ADMIN_PERM,
14535                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14536                                   NL80211_FLAG_NEED_RTNL,
14537         },
14538         {
14539                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
14540                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14541                 .doit = nl80211_nan_add_func,
14542                 .flags = GENL_ADMIN_PERM,
14543                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14544                                   NL80211_FLAG_NEED_RTNL,
14545         },
14546         {
14547                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
14548                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14549                 .doit = nl80211_nan_del_func,
14550                 .flags = GENL_ADMIN_PERM,
14551                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14552                                   NL80211_FLAG_NEED_RTNL,
14553         },
14554         {
14555                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
14556                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14557                 .doit = nl80211_nan_change_config,
14558                 .flags = GENL_ADMIN_PERM,
14559                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14560                                   NL80211_FLAG_NEED_RTNL,
14561         },
14562         {
14563                 .cmd = NL80211_CMD_SET_MCAST_RATE,
14564                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14565                 .doit = nl80211_set_mcast_rate,
14566                 .flags = GENL_UNS_ADMIN_PERM,
14567                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14568                                   NL80211_FLAG_NEED_RTNL,
14569         },
14570         {
14571                 .cmd = NL80211_CMD_SET_MAC_ACL,
14572                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14573                 .doit = nl80211_set_mac_acl,
14574                 .flags = GENL_UNS_ADMIN_PERM,
14575                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14576                                   NL80211_FLAG_NEED_RTNL,
14577         },
14578         {
14579                 .cmd = NL80211_CMD_RADAR_DETECT,
14580                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14581                 .doit = nl80211_start_radar_detection,
14582                 .flags = GENL_UNS_ADMIN_PERM,
14583                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14584                                   NL80211_FLAG_NEED_RTNL,
14585         },
14586         {
14587                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
14588                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14589                 .doit = nl80211_get_protocol_features,
14590         },
14591         {
14592                 .cmd = NL80211_CMD_UPDATE_FT_IES,
14593                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14594                 .doit = nl80211_update_ft_ies,
14595                 .flags = GENL_UNS_ADMIN_PERM,
14596                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14597                                   NL80211_FLAG_NEED_RTNL,
14598         },
14599         {
14600                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
14601                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14602                 .doit = nl80211_crit_protocol_start,
14603                 .flags = GENL_UNS_ADMIN_PERM,
14604                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14605                                   NL80211_FLAG_NEED_RTNL,
14606         },
14607         {
14608                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
14609                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14610                 .doit = nl80211_crit_protocol_stop,
14611                 .flags = GENL_UNS_ADMIN_PERM,
14612                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14613                                   NL80211_FLAG_NEED_RTNL,
14614         },
14615         {
14616                 .cmd = NL80211_CMD_GET_COALESCE,
14617                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14618                 .doit = nl80211_get_coalesce,
14619                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14620                                   NL80211_FLAG_NEED_RTNL,
14621         },
14622         {
14623                 .cmd = NL80211_CMD_SET_COALESCE,
14624                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14625                 .doit = nl80211_set_coalesce,
14626                 .flags = GENL_UNS_ADMIN_PERM,
14627                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14628                                   NL80211_FLAG_NEED_RTNL,
14629         },
14630         {
14631                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
14632                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14633                 .doit = nl80211_channel_switch,
14634                 .flags = GENL_UNS_ADMIN_PERM,
14635                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14636                                   NL80211_FLAG_NEED_RTNL,
14637         },
14638         {
14639                 .cmd = NL80211_CMD_VENDOR,
14640                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14641                 .doit = nl80211_vendor_cmd,
14642                 .dumpit = nl80211_vendor_cmd_dump,
14643                 .flags = GENL_UNS_ADMIN_PERM,
14644                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14645                                   NL80211_FLAG_NEED_RTNL |
14646                                   NL80211_FLAG_CLEAR_SKB,
14647         },
14648         {
14649                 .cmd = NL80211_CMD_SET_QOS_MAP,
14650                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14651                 .doit = nl80211_set_qos_map,
14652                 .flags = GENL_UNS_ADMIN_PERM,
14653                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14654                                   NL80211_FLAG_NEED_RTNL,
14655         },
14656         {
14657                 .cmd = NL80211_CMD_ADD_TX_TS,
14658                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14659                 .doit = nl80211_add_tx_ts,
14660                 .flags = GENL_UNS_ADMIN_PERM,
14661                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14662                                   NL80211_FLAG_NEED_RTNL,
14663         },
14664         {
14665                 .cmd = NL80211_CMD_DEL_TX_TS,
14666                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14667                 .doit = nl80211_del_tx_ts,
14668                 .flags = GENL_UNS_ADMIN_PERM,
14669                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14670                                   NL80211_FLAG_NEED_RTNL,
14671         },
14672         {
14673                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
14674                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14675                 .doit = nl80211_tdls_channel_switch,
14676                 .flags = GENL_UNS_ADMIN_PERM,
14677                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14678                                   NL80211_FLAG_NEED_RTNL,
14679         },
14680         {
14681                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
14682                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14683                 .doit = nl80211_tdls_cancel_channel_switch,
14684                 .flags = GENL_UNS_ADMIN_PERM,
14685                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14686                                   NL80211_FLAG_NEED_RTNL,
14687         },
14688         {
14689                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
14690                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14691                 .doit = nl80211_set_multicast_to_unicast,
14692                 .flags = GENL_UNS_ADMIN_PERM,
14693                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14694                                   NL80211_FLAG_NEED_RTNL,
14695         },
14696         {
14697                 .cmd = NL80211_CMD_SET_PMK,
14698                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14699                 .doit = nl80211_set_pmk,
14700                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14701                                   NL80211_FLAG_NEED_RTNL |
14702                                   NL80211_FLAG_CLEAR_SKB,
14703         },
14704         {
14705                 .cmd = NL80211_CMD_DEL_PMK,
14706                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14707                 .doit = nl80211_del_pmk,
14708                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14709                                   NL80211_FLAG_NEED_RTNL,
14710         },
14711         {
14712                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
14713                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14714                 .doit = nl80211_external_auth,
14715                 .flags = GENL_ADMIN_PERM,
14716                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14717                                   NL80211_FLAG_NEED_RTNL,
14718         },
14719         {
14720                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
14721                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14722                 .doit = nl80211_tx_control_port,
14723                 .flags = GENL_UNS_ADMIN_PERM,
14724                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14725                                   NL80211_FLAG_NEED_RTNL,
14726         },
14727         {
14728                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
14729                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14730                 .doit = nl80211_get_ftm_responder_stats,
14731                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14732                                   NL80211_FLAG_NEED_RTNL,
14733         },
14734         {
14735                 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
14736                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14737                 .doit = nl80211_pmsr_start,
14738                 .flags = GENL_UNS_ADMIN_PERM,
14739                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14740                                   NL80211_FLAG_NEED_RTNL,
14741         },
14742         {
14743                 .cmd = NL80211_CMD_NOTIFY_RADAR,
14744                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14745                 .doit = nl80211_notify_radar_detection,
14746                 .flags = GENL_UNS_ADMIN_PERM,
14747                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14748                                   NL80211_FLAG_NEED_RTNL,
14749         },
14750         {
14751                 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
14752                 .doit = nl80211_update_owe_info,
14753                 .flags = GENL_ADMIN_PERM,
14754                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14755                                   NL80211_FLAG_NEED_RTNL,
14756         },
14757         {
14758                 .cmd = NL80211_CMD_PROBE_MESH_LINK,
14759                 .doit = nl80211_probe_mesh_link,
14760                 .flags = GENL_UNS_ADMIN_PERM,
14761                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14762                                   NL80211_FLAG_NEED_RTNL,
14763         },
14764 };
14765
14766 static struct genl_family nl80211_fam __ro_after_init = {
14767         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
14768         .hdrsize = 0,                   /* no private header */
14769         .version = 1,                   /* no particular meaning now */
14770         .maxattr = NL80211_ATTR_MAX,
14771         .policy = nl80211_policy,
14772         .netnsok = true,
14773         .pre_doit = nl80211_pre_doit,
14774         .post_doit = nl80211_post_doit,
14775         .module = THIS_MODULE,
14776         .ops = nl80211_ops,
14777         .n_ops = ARRAY_SIZE(nl80211_ops),
14778         .mcgrps = nl80211_mcgrps,
14779         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
14780         .parallel_ops = true,
14781 };
14782
14783 /* notification functions */
14784
14785 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
14786                           enum nl80211_commands cmd)
14787 {
14788         struct sk_buff *msg;
14789         struct nl80211_dump_wiphy_state state = {};
14790
14791         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
14792                 cmd != NL80211_CMD_DEL_WIPHY);
14793
14794         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14795         if (!msg)
14796                 return;
14797
14798         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
14799                 nlmsg_free(msg);
14800                 return;
14801         }
14802
14803         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14804                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
14805 }
14806
14807 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
14808                                 struct wireless_dev *wdev,
14809                                 enum nl80211_commands cmd)
14810 {
14811         struct sk_buff *msg;
14812
14813         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14814         if (!msg)
14815                 return;
14816
14817         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
14818                 nlmsg_free(msg);
14819                 return;
14820         }
14821
14822         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14823                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
14824 }
14825
14826 static int nl80211_add_scan_req(struct sk_buff *msg,
14827                                 struct cfg80211_registered_device *rdev)
14828 {
14829         struct cfg80211_scan_request *req = rdev->scan_req;
14830         struct nlattr *nest;
14831         int i;
14832
14833         if (WARN_ON(!req))
14834                 return 0;
14835
14836         nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
14837         if (!nest)
14838                 goto nla_put_failure;
14839         for (i = 0; i < req->n_ssids; i++) {
14840                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
14841                         goto nla_put_failure;
14842         }
14843         nla_nest_end(msg, nest);
14844
14845         nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
14846         if (!nest)
14847                 goto nla_put_failure;
14848         for (i = 0; i < req->n_channels; i++) {
14849                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
14850                         goto nla_put_failure;
14851         }
14852         nla_nest_end(msg, nest);
14853
14854         if (req->ie &&
14855             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
14856                 goto nla_put_failure;
14857
14858         if (req->flags &&
14859             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
14860                 goto nla_put_failure;
14861
14862         if (req->info.scan_start_tsf &&
14863             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
14864                                req->info.scan_start_tsf, NL80211_BSS_PAD) ||
14865              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
14866                      req->info.tsf_bssid)))
14867                 goto nla_put_failure;
14868
14869         return 0;
14870  nla_put_failure:
14871         return -ENOBUFS;
14872 }
14873
14874 static int nl80211_prep_scan_msg(struct sk_buff *msg,
14875                                  struct cfg80211_registered_device *rdev,
14876                                  struct wireless_dev *wdev,
14877                                  u32 portid, u32 seq, int flags,
14878                                  u32 cmd)
14879 {
14880         void *hdr;
14881
14882         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
14883         if (!hdr)
14884                 return -1;
14885
14886         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14887             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14888                                          wdev->netdev->ifindex)) ||
14889             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14890                               NL80211_ATTR_PAD))
14891                 goto nla_put_failure;
14892
14893         /* ignore errors and send incomplete event anyway */
14894         nl80211_add_scan_req(msg, rdev);
14895
14896         genlmsg_end(msg, hdr);
14897         return 0;
14898
14899  nla_put_failure:
14900         genlmsg_cancel(msg, hdr);
14901         return -EMSGSIZE;
14902 }
14903
14904 static int
14905 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
14906                             struct cfg80211_sched_scan_request *req, u32 cmd)
14907 {
14908         void *hdr;
14909
14910         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14911         if (!hdr)
14912                 return -1;
14913
14914         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
14915                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
14916             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
14917             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
14918                               NL80211_ATTR_PAD))
14919                 goto nla_put_failure;
14920
14921         genlmsg_end(msg, hdr);
14922         return 0;
14923
14924  nla_put_failure:
14925         genlmsg_cancel(msg, hdr);
14926         return -EMSGSIZE;
14927 }
14928
14929 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
14930                              struct wireless_dev *wdev)
14931 {
14932         struct sk_buff *msg;
14933
14934         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14935         if (!msg)
14936                 return;
14937
14938         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14939                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
14940                 nlmsg_free(msg);
14941                 return;
14942         }
14943
14944         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14945                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14946 }
14947
14948 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
14949                                        struct wireless_dev *wdev, bool aborted)
14950 {
14951         struct sk_buff *msg;
14952
14953         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14954         if (!msg)
14955                 return NULL;
14956
14957         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14958                                   aborted ? NL80211_CMD_SCAN_ABORTED :
14959                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
14960                 nlmsg_free(msg);
14961                 return NULL;
14962         }
14963
14964         return msg;
14965 }
14966
14967 /* send message created by nl80211_build_scan_msg() */
14968 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
14969                            struct sk_buff *msg)
14970 {
14971         if (!msg)
14972                 return;
14973
14974         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14975                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14976 }
14977
14978 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
14979 {
14980         struct sk_buff *msg;
14981
14982         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14983         if (!msg)
14984                 return;
14985
14986         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
14987                 nlmsg_free(msg);
14988                 return;
14989         }
14990
14991         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
14992                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14993 }
14994
14995 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
14996                                           struct regulatory_request *request)
14997 {
14998         /* Userspace can always count this one always being set */
14999         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
15000                 goto nla_put_failure;
15001
15002         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
15003                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
15004                                NL80211_REGDOM_TYPE_WORLD))
15005                         goto nla_put_failure;
15006         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
15007                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
15008                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
15009                         goto nla_put_failure;
15010         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
15011                    request->intersect) {
15012                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
15013                                NL80211_REGDOM_TYPE_INTERSECTION))
15014                         goto nla_put_failure;
15015         } else {
15016                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
15017                                NL80211_REGDOM_TYPE_COUNTRY) ||
15018                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
15019                                    request->alpha2))
15020                         goto nla_put_failure;
15021         }
15022
15023         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
15024                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
15025
15026                 if (wiphy &&
15027                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
15028                         goto nla_put_failure;
15029
15030                 if (wiphy &&
15031                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
15032                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
15033                         goto nla_put_failure;
15034         }
15035
15036         return true;
15037
15038 nla_put_failure:
15039         return false;
15040 }
15041
15042 /*
15043  * This can happen on global regulatory changes or device specific settings
15044  * based on custom regulatory domains.
15045  */
15046 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
15047                                      struct regulatory_request *request)
15048 {
15049         struct sk_buff *msg;
15050         void *hdr;
15051
15052         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15053         if (!msg)
15054                 return;
15055
15056         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
15057         if (!hdr)
15058                 goto nla_put_failure;
15059
15060         if (!nl80211_reg_change_event_fill(msg, request))
15061                 goto nla_put_failure;
15062
15063         genlmsg_end(msg, hdr);
15064
15065         rcu_read_lock();
15066         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
15067                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
15068         rcu_read_unlock();
15069
15070         return;
15071
15072 nla_put_failure:
15073         nlmsg_free(msg);
15074 }
15075
15076 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
15077                                     struct net_device *netdev,
15078                                     const u8 *buf, size_t len,
15079                                     enum nl80211_commands cmd, gfp_t gfp,
15080                                     int uapsd_queues, const u8 *req_ies,
15081                                     size_t req_ies_len)
15082 {
15083         struct sk_buff *msg;
15084         void *hdr;
15085
15086         msg = nlmsg_new(100 + len + req_ies_len, gfp);
15087         if (!msg)
15088                 return;
15089
15090         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15091         if (!hdr) {
15092                 nlmsg_free(msg);
15093                 return;
15094         }
15095
15096         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15097             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15098             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15099             (req_ies &&
15100              nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
15101                 goto nla_put_failure;
15102
15103         if (uapsd_queues >= 0) {
15104                 struct nlattr *nla_wmm =
15105                         nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
15106                 if (!nla_wmm)
15107                         goto nla_put_failure;
15108
15109                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
15110                                uapsd_queues))
15111                         goto nla_put_failure;
15112
15113                 nla_nest_end(msg, nla_wmm);
15114         }
15115
15116         genlmsg_end(msg, hdr);
15117
15118         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15119                                 NL80211_MCGRP_MLME, gfp);
15120         return;
15121
15122  nla_put_failure:
15123         nlmsg_free(msg);
15124 }
15125
15126 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
15127                           struct net_device *netdev, const u8 *buf,
15128                           size_t len, gfp_t gfp)
15129 {
15130         nl80211_send_mlme_event(rdev, netdev, buf, len,
15131                                 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0);
15132 }
15133
15134 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
15135                            struct net_device *netdev, const u8 *buf,
15136                            size_t len, gfp_t gfp, int uapsd_queues,
15137                            const u8 *req_ies, size_t req_ies_len)
15138 {
15139         nl80211_send_mlme_event(rdev, netdev, buf, len,
15140                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues,
15141                                 req_ies, req_ies_len);
15142 }
15143
15144 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
15145                          struct net_device *netdev, const u8 *buf,
15146                          size_t len, gfp_t gfp)
15147 {
15148         nl80211_send_mlme_event(rdev, netdev, buf, len,
15149                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0);
15150 }
15151
15152 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
15153                            struct net_device *netdev, const u8 *buf,
15154                            size_t len, gfp_t gfp)
15155 {
15156         nl80211_send_mlme_event(rdev, netdev, buf, len,
15157                                 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0);
15158 }
15159
15160 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
15161                                   size_t len)
15162 {
15163         struct wireless_dev *wdev = dev->ieee80211_ptr;
15164         struct wiphy *wiphy = wdev->wiphy;
15165         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15166         const struct ieee80211_mgmt *mgmt = (void *)buf;
15167         u32 cmd;
15168
15169         if (WARN_ON(len < 2))
15170                 return;
15171
15172         if (ieee80211_is_deauth(mgmt->frame_control))
15173                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
15174         else
15175                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
15176
15177         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
15178         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
15179                                 NULL, 0);
15180 }
15181 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
15182
15183 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
15184                                       struct net_device *netdev, int cmd,
15185                                       const u8 *addr, gfp_t gfp)
15186 {
15187         struct sk_buff *msg;
15188         void *hdr;
15189
15190         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15191         if (!msg)
15192                 return;
15193
15194         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15195         if (!hdr) {
15196                 nlmsg_free(msg);
15197                 return;
15198         }
15199
15200         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15201             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15202             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
15203             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
15204                 goto nla_put_failure;
15205
15206         genlmsg_end(msg, hdr);
15207
15208         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15209                                 NL80211_MCGRP_MLME, gfp);
15210         return;
15211
15212  nla_put_failure:
15213         nlmsg_free(msg);
15214 }
15215
15216 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
15217                                struct net_device *netdev, const u8 *addr,
15218                                gfp_t gfp)
15219 {
15220         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
15221                                   addr, gfp);
15222 }
15223
15224 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
15225                                 struct net_device *netdev, const u8 *addr,
15226                                 gfp_t gfp)
15227 {
15228         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
15229                                   addr, gfp);
15230 }
15231
15232 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
15233                                  struct net_device *netdev,
15234                                  struct cfg80211_connect_resp_params *cr,
15235                                  gfp_t gfp)
15236 {
15237         struct sk_buff *msg;
15238         void *hdr;
15239
15240         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
15241                         cr->fils.kek_len + cr->fils.pmk_len +
15242                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
15243         if (!msg)
15244                 return;
15245
15246         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
15247         if (!hdr) {
15248                 nlmsg_free(msg);
15249                 return;
15250         }
15251
15252         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15253             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15254             (cr->bssid &&
15255              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
15256             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
15257                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
15258                         cr->status) ||
15259             (cr->status < 0 &&
15260              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
15261               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
15262                           cr->timeout_reason))) ||
15263             (cr->req_ie &&
15264              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
15265             (cr->resp_ie &&
15266              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
15267                      cr->resp_ie)) ||
15268             (cr->fils.update_erp_next_seq_num &&
15269              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
15270                          cr->fils.erp_next_seq_num)) ||
15271             (cr->status == WLAN_STATUS_SUCCESS &&
15272              ((cr->fils.kek &&
15273                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
15274                        cr->fils.kek)) ||
15275               (cr->fils.pmk &&
15276                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
15277               (cr->fils.pmkid &&
15278                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
15279                 goto nla_put_failure;
15280
15281         genlmsg_end(msg, hdr);
15282
15283         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15284                                 NL80211_MCGRP_MLME, gfp);
15285         return;
15286
15287  nla_put_failure:
15288         nlmsg_free(msg);
15289 }
15290
15291 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
15292                          struct net_device *netdev,
15293                          struct cfg80211_roam_info *info, gfp_t gfp)
15294 {
15295         struct sk_buff *msg;
15296         void *hdr;
15297         const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
15298
15299         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
15300                         info->fils.kek_len + info->fils.pmk_len +
15301                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
15302         if (!msg)
15303                 return;
15304
15305         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
15306         if (!hdr) {
15307                 nlmsg_free(msg);
15308                 return;
15309         }
15310
15311         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15312             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15313             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
15314             (info->req_ie &&
15315              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
15316                      info->req_ie)) ||
15317             (info->resp_ie &&
15318              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
15319                      info->resp_ie)) ||
15320             (info->fils.update_erp_next_seq_num &&
15321              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
15322                          info->fils.erp_next_seq_num)) ||
15323             (info->fils.kek &&
15324              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
15325                      info->fils.kek)) ||
15326             (info->fils.pmk &&
15327              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
15328             (info->fils.pmkid &&
15329              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
15330                 goto nla_put_failure;
15331
15332         genlmsg_end(msg, hdr);
15333
15334         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15335                                 NL80211_MCGRP_MLME, gfp);
15336         return;
15337
15338  nla_put_failure:
15339         nlmsg_free(msg);
15340 }
15341
15342 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
15343                                   struct net_device *netdev, const u8 *bssid)
15344 {
15345         struct sk_buff *msg;
15346         void *hdr;
15347
15348         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15349         if (!msg)
15350                 return;
15351
15352         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
15353         if (!hdr) {
15354                 nlmsg_free(msg);
15355                 return;
15356         }
15357
15358         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15359             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15360             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15361                 goto nla_put_failure;
15362
15363         genlmsg_end(msg, hdr);
15364
15365         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15366                                 NL80211_MCGRP_MLME, GFP_KERNEL);
15367         return;
15368
15369  nla_put_failure:
15370         nlmsg_free(msg);
15371 }
15372
15373 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
15374                                struct net_device *netdev, u16 reason,
15375                                const u8 *ie, size_t ie_len, bool from_ap)
15376 {
15377         struct sk_buff *msg;
15378         void *hdr;
15379
15380         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
15381         if (!msg)
15382                 return;
15383
15384         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
15385         if (!hdr) {
15386                 nlmsg_free(msg);
15387                 return;
15388         }
15389
15390         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15391             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15392             (reason &&
15393              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
15394             (from_ap &&
15395              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
15396             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
15397                 goto nla_put_failure;
15398
15399         genlmsg_end(msg, hdr);
15400
15401         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15402                                 NL80211_MCGRP_MLME, GFP_KERNEL);
15403         return;
15404
15405  nla_put_failure:
15406         nlmsg_free(msg);
15407 }
15408
15409 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
15410                              struct net_device *netdev, const u8 *bssid,
15411                              gfp_t gfp)
15412 {
15413         struct sk_buff *msg;
15414         void *hdr;
15415
15416         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15417         if (!msg)
15418                 return;
15419
15420         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
15421         if (!hdr) {
15422                 nlmsg_free(msg);
15423                 return;
15424         }
15425
15426         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15427             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15428             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15429                 goto nla_put_failure;
15430
15431         genlmsg_end(msg, hdr);
15432
15433         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15434                                 NL80211_MCGRP_MLME, gfp);
15435         return;
15436
15437  nla_put_failure:
15438         nlmsg_free(msg);
15439 }
15440
15441 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
15442                                         const u8 *ie, u8 ie_len,
15443                                         int sig_dbm, gfp_t gfp)
15444 {
15445         struct wireless_dev *wdev = dev->ieee80211_ptr;
15446         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15447         struct sk_buff *msg;
15448         void *hdr;
15449
15450         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
15451                 return;
15452
15453         trace_cfg80211_notify_new_peer_candidate(dev, addr);
15454
15455         msg = nlmsg_new(100 + ie_len, gfp);
15456         if (!msg)
15457                 return;
15458
15459         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
15460         if (!hdr) {
15461                 nlmsg_free(msg);
15462                 return;
15463         }
15464
15465         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15466             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15467             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15468             (ie_len && ie &&
15469              nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
15470             (sig_dbm &&
15471              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
15472                 goto nla_put_failure;
15473
15474         genlmsg_end(msg, hdr);
15475
15476         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15477                                 NL80211_MCGRP_MLME, gfp);
15478         return;
15479
15480  nla_put_failure:
15481         nlmsg_free(msg);
15482 }
15483 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
15484
15485 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
15486                                  struct net_device *netdev, const u8 *addr,
15487                                  enum nl80211_key_type key_type, int key_id,
15488                                  const u8 *tsc, gfp_t gfp)
15489 {
15490         struct sk_buff *msg;
15491         void *hdr;
15492
15493         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15494         if (!msg)
15495                 return;
15496
15497         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
15498         if (!hdr) {
15499                 nlmsg_free(msg);
15500                 return;
15501         }
15502
15503         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15504             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15505             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
15506             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
15507             (key_id != -1 &&
15508              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
15509             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
15510                 goto nla_put_failure;
15511
15512         genlmsg_end(msg, hdr);
15513
15514         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15515                                 NL80211_MCGRP_MLME, gfp);
15516         return;
15517
15518  nla_put_failure:
15519         nlmsg_free(msg);
15520 }
15521
15522 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
15523                                     struct ieee80211_channel *channel_before,
15524                                     struct ieee80211_channel *channel_after)
15525 {
15526         struct sk_buff *msg;
15527         void *hdr;
15528         struct nlattr *nl_freq;
15529
15530         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
15531         if (!msg)
15532                 return;
15533
15534         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
15535         if (!hdr) {
15536                 nlmsg_free(msg);
15537                 return;
15538         }
15539
15540         /*
15541          * Since we are applying the beacon hint to a wiphy we know its
15542          * wiphy_idx is valid
15543          */
15544         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
15545                 goto nla_put_failure;
15546
15547         /* Before */
15548         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
15549         if (!nl_freq)
15550                 goto nla_put_failure;
15551
15552         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
15553                 goto nla_put_failure;
15554         nla_nest_end(msg, nl_freq);
15555
15556         /* After */
15557         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
15558         if (!nl_freq)
15559                 goto nla_put_failure;
15560
15561         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
15562                 goto nla_put_failure;
15563         nla_nest_end(msg, nl_freq);
15564
15565         genlmsg_end(msg, hdr);
15566
15567         rcu_read_lock();
15568         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
15569                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
15570         rcu_read_unlock();
15571
15572         return;
15573
15574 nla_put_failure:
15575         nlmsg_free(msg);
15576 }
15577
15578 static void nl80211_send_remain_on_chan_event(
15579         int cmd, struct cfg80211_registered_device *rdev,
15580         struct wireless_dev *wdev, u64 cookie,
15581         struct ieee80211_channel *chan,
15582         unsigned int duration, gfp_t gfp)
15583 {
15584         struct sk_buff *msg;
15585         void *hdr;
15586
15587         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15588         if (!msg)
15589                 return;
15590
15591         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15592         if (!hdr) {
15593                 nlmsg_free(msg);
15594                 return;
15595         }
15596
15597         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15598             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15599                                          wdev->netdev->ifindex)) ||
15600             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15601                               NL80211_ATTR_PAD) ||
15602             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
15603             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
15604                         NL80211_CHAN_NO_HT) ||
15605             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15606                               NL80211_ATTR_PAD))
15607                 goto nla_put_failure;
15608
15609         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
15610             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
15611                 goto nla_put_failure;
15612
15613         genlmsg_end(msg, hdr);
15614
15615         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15616                                 NL80211_MCGRP_MLME, gfp);
15617         return;
15618
15619  nla_put_failure:
15620         nlmsg_free(msg);
15621 }
15622
15623 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
15624                                struct ieee80211_channel *chan,
15625                                unsigned int duration, gfp_t gfp)
15626 {
15627         struct wiphy *wiphy = wdev->wiphy;
15628         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15629
15630         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
15631         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
15632                                           rdev, wdev, cookie, chan,
15633                                           duration, gfp);
15634 }
15635 EXPORT_SYMBOL(cfg80211_ready_on_channel);
15636
15637 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
15638                                         struct ieee80211_channel *chan,
15639                                         gfp_t gfp)
15640 {
15641         struct wiphy *wiphy = wdev->wiphy;
15642         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15643
15644         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
15645         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
15646                                           rdev, wdev, cookie, chan, 0, gfp);
15647 }
15648 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
15649
15650 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
15651                                         struct ieee80211_channel *chan,
15652                                         gfp_t gfp)
15653 {
15654         struct wiphy *wiphy = wdev->wiphy;
15655         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15656
15657         trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
15658         nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
15659                                           rdev, wdev, cookie, chan, 0, gfp);
15660 }
15661 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
15662
15663 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
15664                       struct station_info *sinfo, gfp_t gfp)
15665 {
15666         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
15667         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15668         struct sk_buff *msg;
15669
15670         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
15671
15672         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15673         if (!msg)
15674                 return;
15675
15676         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
15677                                  rdev, dev, mac_addr, sinfo) < 0) {
15678                 nlmsg_free(msg);
15679                 return;
15680         }
15681
15682         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15683                                 NL80211_MCGRP_MLME, gfp);
15684 }
15685 EXPORT_SYMBOL(cfg80211_new_sta);
15686
15687 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
15688                             struct station_info *sinfo, gfp_t gfp)
15689 {
15690         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
15691         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15692         struct sk_buff *msg;
15693         struct station_info empty_sinfo = {};
15694
15695         if (!sinfo)
15696                 sinfo = &empty_sinfo;
15697
15698         trace_cfg80211_del_sta(dev, mac_addr);
15699
15700         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15701         if (!msg) {
15702                 cfg80211_sinfo_release_content(sinfo);
15703                 return;
15704         }
15705
15706         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
15707                                  rdev, dev, mac_addr, sinfo) < 0) {
15708                 nlmsg_free(msg);
15709                 return;
15710         }
15711
15712         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15713                                 NL80211_MCGRP_MLME, gfp);
15714 }
15715 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
15716
15717 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
15718                           enum nl80211_connect_failed_reason reason,
15719                           gfp_t gfp)
15720 {
15721         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
15722         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15723         struct sk_buff *msg;
15724         void *hdr;
15725
15726         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
15727         if (!msg)
15728                 return;
15729
15730         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
15731         if (!hdr) {
15732                 nlmsg_free(msg);
15733                 return;
15734         }
15735
15736         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15737             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
15738             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
15739                 goto nla_put_failure;
15740
15741         genlmsg_end(msg, hdr);
15742
15743         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15744                                 NL80211_MCGRP_MLME, gfp);
15745         return;
15746
15747  nla_put_failure:
15748         nlmsg_free(msg);
15749 }
15750 EXPORT_SYMBOL(cfg80211_conn_failed);
15751
15752 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
15753                                        const u8 *addr, gfp_t gfp)
15754 {
15755         struct wireless_dev *wdev = dev->ieee80211_ptr;
15756         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15757         struct sk_buff *msg;
15758         void *hdr;
15759         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
15760
15761         if (!nlportid)
15762                 return false;
15763
15764         msg = nlmsg_new(100, gfp);
15765         if (!msg)
15766                 return true;
15767
15768         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15769         if (!hdr) {
15770                 nlmsg_free(msg);
15771                 return true;
15772         }
15773
15774         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15775             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15776             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
15777                 goto nla_put_failure;
15778
15779         genlmsg_end(msg, hdr);
15780         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15781         return true;
15782
15783  nla_put_failure:
15784         nlmsg_free(msg);
15785         return true;
15786 }
15787
15788 bool cfg80211_rx_spurious_frame(struct net_device *dev,
15789                                 const u8 *addr, gfp_t gfp)
15790 {
15791         struct wireless_dev *wdev = dev->ieee80211_ptr;
15792         bool ret;
15793
15794         trace_cfg80211_rx_spurious_frame(dev, addr);
15795
15796         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
15797                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
15798                 trace_cfg80211_return_bool(false);
15799                 return false;
15800         }
15801         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
15802                                          addr, gfp);
15803         trace_cfg80211_return_bool(ret);
15804         return ret;
15805 }
15806 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
15807
15808 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
15809                                         const u8 *addr, gfp_t gfp)
15810 {
15811         struct wireless_dev *wdev = dev->ieee80211_ptr;
15812         bool ret;
15813
15814         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
15815
15816         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
15817                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
15818                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
15819                 trace_cfg80211_return_bool(false);
15820                 return false;
15821         }
15822         ret = __nl80211_unexpected_frame(dev,
15823                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
15824                                          addr, gfp);
15825         trace_cfg80211_return_bool(ret);
15826         return ret;
15827 }
15828 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
15829
15830 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
15831                       struct wireless_dev *wdev, u32 nlportid,
15832                       int freq, int sig_dbm,
15833                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
15834 {
15835         struct net_device *netdev = wdev->netdev;
15836         struct sk_buff *msg;
15837         void *hdr;
15838
15839         msg = nlmsg_new(100 + len, gfp);
15840         if (!msg)
15841                 return -ENOMEM;
15842
15843         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
15844         if (!hdr) {
15845                 nlmsg_free(msg);
15846                 return -ENOMEM;
15847         }
15848
15849         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15850             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15851                                         netdev->ifindex)) ||
15852             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15853                               NL80211_ATTR_PAD) ||
15854             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
15855             (sig_dbm &&
15856              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
15857             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15858             (flags &&
15859              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
15860                 goto nla_put_failure;
15861
15862         genlmsg_end(msg, hdr);
15863
15864         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15865
15866  nla_put_failure:
15867         nlmsg_free(msg);
15868         return -ENOBUFS;
15869 }
15870
15871 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
15872                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
15873 {
15874         struct wiphy *wiphy = wdev->wiphy;
15875         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15876         struct net_device *netdev = wdev->netdev;
15877         struct sk_buff *msg;
15878         void *hdr;
15879
15880         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
15881
15882         msg = nlmsg_new(100 + len, gfp);
15883         if (!msg)
15884                 return;
15885
15886         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
15887         if (!hdr) {
15888                 nlmsg_free(msg);
15889                 return;
15890         }
15891
15892         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15893             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15894                                    netdev->ifindex)) ||
15895             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15896                               NL80211_ATTR_PAD) ||
15897             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15898             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15899                               NL80211_ATTR_PAD) ||
15900             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
15901                 goto nla_put_failure;
15902
15903         genlmsg_end(msg, hdr);
15904
15905         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15906                                 NL80211_MCGRP_MLME, gfp);
15907         return;
15908
15909  nla_put_failure:
15910         nlmsg_free(msg);
15911 }
15912 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
15913
15914 static int __nl80211_rx_control_port(struct net_device *dev,
15915                                      struct sk_buff *skb,
15916                                      bool unencrypted, gfp_t gfp)
15917 {
15918         struct wireless_dev *wdev = dev->ieee80211_ptr;
15919         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15920         struct ethhdr *ehdr = eth_hdr(skb);
15921         const u8 *addr = ehdr->h_source;
15922         u16 proto = be16_to_cpu(skb->protocol);
15923         struct sk_buff *msg;
15924         void *hdr;
15925         struct nlattr *frame;
15926
15927         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
15928
15929         if (!nlportid)
15930                 return -ENOENT;
15931
15932         msg = nlmsg_new(100 + skb->len, gfp);
15933         if (!msg)
15934                 return -ENOMEM;
15935
15936         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
15937         if (!hdr) {
15938                 nlmsg_free(msg);
15939                 return -ENOBUFS;
15940         }
15941
15942         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15943             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15944             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15945                               NL80211_ATTR_PAD) ||
15946             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15947             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
15948             (unencrypted && nla_put_flag(msg,
15949                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
15950                 goto nla_put_failure;
15951
15952         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
15953         if (!frame)
15954                 goto nla_put_failure;
15955
15956         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
15957         genlmsg_end(msg, hdr);
15958
15959         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15960
15961  nla_put_failure:
15962         nlmsg_free(msg);
15963         return -ENOBUFS;
15964 }
15965
15966 bool cfg80211_rx_control_port(struct net_device *dev,
15967                               struct sk_buff *skb, bool unencrypted)
15968 {
15969         int ret;
15970
15971         trace_cfg80211_rx_control_port(dev, skb, unencrypted);
15972         ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
15973         trace_cfg80211_return_bool(ret == 0);
15974         return ret == 0;
15975 }
15976 EXPORT_SYMBOL(cfg80211_rx_control_port);
15977
15978 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
15979                                             const char *mac, gfp_t gfp)
15980 {
15981         struct wireless_dev *wdev = dev->ieee80211_ptr;
15982         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15983         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15984         void **cb;
15985
15986         if (!msg)
15987                 return NULL;
15988
15989         cb = (void **)msg->cb;
15990
15991         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
15992         if (!cb[0]) {
15993                 nlmsg_free(msg);
15994                 return NULL;
15995         }
15996
15997         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15998             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15999                 goto nla_put_failure;
16000
16001         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
16002                 goto nla_put_failure;
16003
16004         cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
16005         if (!cb[1])
16006                 goto nla_put_failure;
16007
16008         cb[2] = rdev;
16009
16010         return msg;
16011  nla_put_failure:
16012         nlmsg_free(msg);
16013         return NULL;
16014 }
16015
16016 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
16017 {
16018         void **cb = (void **)msg->cb;
16019         struct cfg80211_registered_device *rdev = cb[2];
16020
16021         nla_nest_end(msg, cb[1]);
16022         genlmsg_end(msg, cb[0]);
16023
16024         memset(msg->cb, 0, sizeof(msg->cb));
16025
16026         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16027                                 NL80211_MCGRP_MLME, gfp);
16028 }
16029
16030 void cfg80211_cqm_rssi_notify(struct net_device *dev,
16031                               enum nl80211_cqm_rssi_threshold_event rssi_event,
16032                               s32 rssi_level, gfp_t gfp)
16033 {
16034         struct sk_buff *msg;
16035         struct wireless_dev *wdev = dev->ieee80211_ptr;
16036         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16037
16038         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
16039
16040         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
16041                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
16042                 return;
16043
16044         if (wdev->cqm_config) {
16045                 wdev->cqm_config->last_rssi_event_value = rssi_level;
16046
16047                 cfg80211_cqm_rssi_update(rdev, dev);
16048
16049                 if (rssi_level == 0)
16050                         rssi_level = wdev->cqm_config->last_rssi_event_value;
16051         }
16052
16053         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
16054         if (!msg)
16055                 return;
16056
16057         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
16058                         rssi_event))
16059                 goto nla_put_failure;
16060
16061         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
16062                                       rssi_level))
16063                 goto nla_put_failure;
16064
16065         cfg80211_send_cqm(msg, gfp);
16066
16067         return;
16068
16069  nla_put_failure:
16070         nlmsg_free(msg);
16071 }
16072 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
16073
16074 void cfg80211_cqm_txe_notify(struct net_device *dev,
16075                              const u8 *peer, u32 num_packets,
16076                              u32 rate, u32 intvl, gfp_t gfp)
16077 {
16078         struct sk_buff *msg;
16079
16080         msg = cfg80211_prepare_cqm(dev, peer, gfp);
16081         if (!msg)
16082                 return;
16083
16084         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
16085                 goto nla_put_failure;
16086
16087         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
16088                 goto nla_put_failure;
16089
16090         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
16091                 goto nla_put_failure;
16092
16093         cfg80211_send_cqm(msg, gfp);
16094         return;
16095
16096  nla_put_failure:
16097         nlmsg_free(msg);
16098 }
16099 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
16100
16101 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
16102                                  const u8 *peer, u32 num_packets, gfp_t gfp)
16103 {
16104         struct sk_buff *msg;
16105
16106         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
16107
16108         msg = cfg80211_prepare_cqm(dev, peer, gfp);
16109         if (!msg)
16110                 return;
16111
16112         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
16113                 goto nla_put_failure;
16114
16115         cfg80211_send_cqm(msg, gfp);
16116         return;
16117
16118  nla_put_failure:
16119         nlmsg_free(msg);
16120 }
16121 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
16122
16123 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
16124 {
16125         struct sk_buff *msg;
16126
16127         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
16128         if (!msg)
16129                 return;
16130
16131         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
16132                 goto nla_put_failure;
16133
16134         cfg80211_send_cqm(msg, gfp);
16135         return;
16136
16137  nla_put_failure:
16138         nlmsg_free(msg);
16139 }
16140 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
16141
16142 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
16143                                      struct net_device *netdev, const u8 *bssid,
16144                                      const u8 *replay_ctr, gfp_t gfp)
16145 {
16146         struct sk_buff *msg;
16147         struct nlattr *rekey_attr;
16148         void *hdr;
16149
16150         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16151         if (!msg)
16152                 return;
16153
16154         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
16155         if (!hdr) {
16156                 nlmsg_free(msg);
16157                 return;
16158         }
16159
16160         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16161             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16162             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
16163                 goto nla_put_failure;
16164
16165         rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
16166         if (!rekey_attr)
16167                 goto nla_put_failure;
16168
16169         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
16170                     NL80211_REPLAY_CTR_LEN, replay_ctr))
16171                 goto nla_put_failure;
16172
16173         nla_nest_end(msg, rekey_attr);
16174
16175         genlmsg_end(msg, hdr);
16176
16177         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16178                                 NL80211_MCGRP_MLME, gfp);
16179         return;
16180
16181  nla_put_failure:
16182         nlmsg_free(msg);
16183 }
16184
16185 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
16186                                const u8 *replay_ctr, gfp_t gfp)
16187 {
16188         struct wireless_dev *wdev = dev->ieee80211_ptr;
16189         struct wiphy *wiphy = wdev->wiphy;
16190         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16191
16192         trace_cfg80211_gtk_rekey_notify(dev, bssid);
16193         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
16194 }
16195 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
16196
16197 static void
16198 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
16199                                struct net_device *netdev, int index,
16200                                const u8 *bssid, bool preauth, gfp_t gfp)
16201 {
16202         struct sk_buff *msg;
16203         struct nlattr *attr;
16204         void *hdr;
16205
16206         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16207         if (!msg)
16208                 return;
16209
16210         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
16211         if (!hdr) {
16212                 nlmsg_free(msg);
16213                 return;
16214         }
16215
16216         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16217             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
16218                 goto nla_put_failure;
16219
16220         attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
16221         if (!attr)
16222                 goto nla_put_failure;
16223
16224         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
16225             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
16226             (preauth &&
16227              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
16228                 goto nla_put_failure;
16229
16230         nla_nest_end(msg, attr);
16231
16232         genlmsg_end(msg, hdr);
16233
16234         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16235                                 NL80211_MCGRP_MLME, gfp);
16236         return;
16237
16238  nla_put_failure:
16239         nlmsg_free(msg);
16240 }
16241
16242 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
16243                                      const u8 *bssid, bool preauth, gfp_t gfp)
16244 {
16245         struct wireless_dev *wdev = dev->ieee80211_ptr;
16246         struct wiphy *wiphy = wdev->wiphy;
16247         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16248
16249         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
16250         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
16251 }
16252 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
16253
16254 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
16255                                      struct net_device *netdev,
16256                                      struct cfg80211_chan_def *chandef,
16257                                      gfp_t gfp,
16258                                      enum nl80211_commands notif,
16259                                      u8 count)
16260 {
16261         struct sk_buff *msg;
16262         void *hdr;
16263
16264         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16265         if (!msg)
16266                 return;
16267
16268         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
16269         if (!hdr) {
16270                 nlmsg_free(msg);
16271                 return;
16272         }
16273
16274         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
16275                 goto nla_put_failure;
16276
16277         if (nl80211_send_chandef(msg, chandef))
16278                 goto nla_put_failure;
16279
16280         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
16281             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
16282                         goto nla_put_failure;
16283
16284         genlmsg_end(msg, hdr);
16285
16286         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16287                                 NL80211_MCGRP_MLME, gfp);
16288         return;
16289
16290  nla_put_failure:
16291         nlmsg_free(msg);
16292 }
16293
16294 void cfg80211_ch_switch_notify(struct net_device *dev,
16295                                struct cfg80211_chan_def *chandef)
16296 {
16297         struct wireless_dev *wdev = dev->ieee80211_ptr;
16298         struct wiphy *wiphy = wdev->wiphy;
16299         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16300
16301         ASSERT_WDEV_LOCK(wdev);
16302
16303         trace_cfg80211_ch_switch_notify(dev, chandef);
16304
16305         wdev->chandef = *chandef;
16306         wdev->preset_chandef = *chandef;
16307
16308         if (wdev->iftype == NL80211_IFTYPE_STATION &&
16309             !WARN_ON(!wdev->current_bss))
16310                 cfg80211_update_assoc_bss_entry(wdev, chandef->chan);
16311
16312         cfg80211_sched_dfs_chan_update(rdev);
16313
16314         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
16315                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
16316 }
16317 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
16318
16319 void cfg80211_ch_switch_started_notify(struct net_device *dev,
16320                                        struct cfg80211_chan_def *chandef,
16321                                        u8 count)
16322 {
16323         struct wireless_dev *wdev = dev->ieee80211_ptr;
16324         struct wiphy *wiphy = wdev->wiphy;
16325         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16326
16327         trace_cfg80211_ch_switch_started_notify(dev, chandef);
16328
16329         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
16330                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
16331 }
16332 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
16333
16334 void
16335 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
16336                      const struct cfg80211_chan_def *chandef,
16337                      enum nl80211_radar_event event,
16338                      struct net_device *netdev, gfp_t gfp)
16339 {
16340         struct sk_buff *msg;
16341         void *hdr;
16342
16343         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16344         if (!msg)
16345                 return;
16346
16347         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
16348         if (!hdr) {
16349                 nlmsg_free(msg);
16350                 return;
16351         }
16352
16353         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
16354                 goto nla_put_failure;
16355
16356         /* NOP and radar events don't need a netdev parameter */
16357         if (netdev) {
16358                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
16359
16360                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16361                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16362                                       NL80211_ATTR_PAD))
16363                         goto nla_put_failure;
16364         }
16365
16366         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
16367                 goto nla_put_failure;
16368
16369         if (nl80211_send_chandef(msg, chandef))
16370                 goto nla_put_failure;
16371
16372         genlmsg_end(msg, hdr);
16373
16374         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16375                                 NL80211_MCGRP_MLME, gfp);
16376         return;
16377
16378  nla_put_failure:
16379         nlmsg_free(msg);
16380 }
16381
16382 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
16383                                        struct sta_opmode_info *sta_opmode,
16384                                        gfp_t gfp)
16385 {
16386         struct sk_buff *msg;
16387         struct wireless_dev *wdev = dev->ieee80211_ptr;
16388         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16389         void *hdr;
16390
16391         if (WARN_ON(!mac))
16392                 return;
16393
16394         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16395         if (!msg)
16396                 return;
16397
16398         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
16399         if (!hdr) {
16400                 nlmsg_free(msg);
16401                 return;
16402         }
16403
16404         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
16405                 goto nla_put_failure;
16406
16407         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
16408                 goto nla_put_failure;
16409
16410         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
16411                 goto nla_put_failure;
16412
16413         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
16414             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
16415                 goto nla_put_failure;
16416
16417         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
16418             nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
16419                 goto nla_put_failure;
16420
16421         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
16422             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
16423                 goto nla_put_failure;
16424
16425         genlmsg_end(msg, hdr);
16426
16427         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16428                                 NL80211_MCGRP_MLME, gfp);
16429
16430         return;
16431
16432 nla_put_failure:
16433         nlmsg_free(msg);
16434 }
16435 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
16436
16437 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
16438                            u64 cookie, bool acked, s32 ack_signal,
16439                            bool is_valid_ack_signal, gfp_t gfp)
16440 {
16441         struct wireless_dev *wdev = dev->ieee80211_ptr;
16442         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16443         struct sk_buff *msg;
16444         void *hdr;
16445
16446         trace_cfg80211_probe_status(dev, addr, cookie, acked);
16447
16448         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16449
16450         if (!msg)
16451                 return;
16452
16453         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
16454         if (!hdr) {
16455                 nlmsg_free(msg);
16456                 return;
16457         }
16458
16459         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16460             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16461             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
16462             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16463                               NL80211_ATTR_PAD) ||
16464             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
16465             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
16466                                                 ack_signal)))
16467                 goto nla_put_failure;
16468
16469         genlmsg_end(msg, hdr);
16470
16471         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16472                                 NL80211_MCGRP_MLME, gfp);
16473         return;
16474
16475  nla_put_failure:
16476         nlmsg_free(msg);
16477 }
16478 EXPORT_SYMBOL(cfg80211_probe_status);
16479
16480 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
16481                                  const u8 *frame, size_t len,
16482                                  int freq, int sig_dbm)
16483 {
16484         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16485         struct sk_buff *msg;
16486         void *hdr;
16487         struct cfg80211_beacon_registration *reg;
16488
16489         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
16490
16491         spin_lock_bh(&rdev->beacon_registrations_lock);
16492         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
16493                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
16494                 if (!msg) {
16495                         spin_unlock_bh(&rdev->beacon_registrations_lock);
16496                         return;
16497                 }
16498
16499                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
16500                 if (!hdr)
16501                         goto nla_put_failure;
16502
16503                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16504                     (freq &&
16505                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
16506                     (sig_dbm &&
16507                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
16508                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
16509                         goto nla_put_failure;
16510
16511                 genlmsg_end(msg, hdr);
16512
16513                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
16514         }
16515         spin_unlock_bh(&rdev->beacon_registrations_lock);
16516         return;
16517
16518  nla_put_failure:
16519         spin_unlock_bh(&rdev->beacon_registrations_lock);
16520         nlmsg_free(msg);
16521 }
16522 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
16523
16524 #ifdef CONFIG_PM
16525 static int cfg80211_net_detect_results(struct sk_buff *msg,
16526                                        struct cfg80211_wowlan_wakeup *wakeup)
16527 {
16528         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
16529         struct nlattr *nl_results, *nl_match, *nl_freqs;
16530         int i, j;
16531
16532         nl_results = nla_nest_start_noflag(msg,
16533                                            NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
16534         if (!nl_results)
16535                 return -EMSGSIZE;
16536
16537         for (i = 0; i < nd->n_matches; i++) {
16538                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
16539
16540                 nl_match = nla_nest_start_noflag(msg, i);
16541                 if (!nl_match)
16542                         break;
16543
16544                 /* The SSID attribute is optional in nl80211, but for
16545                  * simplicity reasons it's always present in the
16546                  * cfg80211 structure.  If a driver can't pass the
16547                  * SSID, that needs to be changed.  A zero length SSID
16548                  * is still a valid SSID (wildcard), so it cannot be
16549                  * used for this purpose.
16550                  */
16551                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
16552                             match->ssid.ssid)) {
16553                         nla_nest_cancel(msg, nl_match);
16554                         goto out;
16555                 }
16556
16557                 if (match->n_channels) {
16558                         nl_freqs = nla_nest_start_noflag(msg,
16559                                                          NL80211_ATTR_SCAN_FREQUENCIES);
16560                         if (!nl_freqs) {
16561                                 nla_nest_cancel(msg, nl_match);
16562                                 goto out;
16563                         }
16564
16565                         for (j = 0; j < match->n_channels; j++) {
16566                                 if (nla_put_u32(msg, j, match->channels[j])) {
16567                                         nla_nest_cancel(msg, nl_freqs);
16568                                         nla_nest_cancel(msg, nl_match);
16569                                         goto out;
16570                                 }
16571                         }
16572
16573                         nla_nest_end(msg, nl_freqs);
16574                 }
16575
16576                 nla_nest_end(msg, nl_match);
16577         }
16578
16579 out:
16580         nla_nest_end(msg, nl_results);
16581         return 0;
16582 }
16583
16584 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
16585                                    struct cfg80211_wowlan_wakeup *wakeup,
16586                                    gfp_t gfp)
16587 {
16588         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16589         struct sk_buff *msg;
16590         void *hdr;
16591         int size = 200;
16592
16593         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
16594
16595         if (wakeup)
16596                 size += wakeup->packet_present_len;
16597
16598         msg = nlmsg_new(size, gfp);
16599         if (!msg)
16600                 return;
16601
16602         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
16603         if (!hdr)
16604                 goto free_msg;
16605
16606         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16607             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16608                               NL80211_ATTR_PAD))
16609                 goto free_msg;
16610
16611         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16612                                         wdev->netdev->ifindex))
16613                 goto free_msg;
16614
16615         if (wakeup) {
16616                 struct nlattr *reasons;
16617
16618                 reasons = nla_nest_start_noflag(msg,
16619                                                 NL80211_ATTR_WOWLAN_TRIGGERS);
16620                 if (!reasons)
16621                         goto free_msg;
16622
16623                 if (wakeup->disconnect &&
16624                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
16625                         goto free_msg;
16626                 if (wakeup->magic_pkt &&
16627                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
16628                         goto free_msg;
16629                 if (wakeup->gtk_rekey_failure &&
16630                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
16631                         goto free_msg;
16632                 if (wakeup->eap_identity_req &&
16633                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
16634                         goto free_msg;
16635                 if (wakeup->four_way_handshake &&
16636                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
16637                         goto free_msg;
16638                 if (wakeup->rfkill_release &&
16639                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
16640                         goto free_msg;
16641
16642                 if (wakeup->pattern_idx >= 0 &&
16643                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
16644                                 wakeup->pattern_idx))
16645                         goto free_msg;
16646
16647                 if (wakeup->tcp_match &&
16648                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
16649                         goto free_msg;
16650
16651                 if (wakeup->tcp_connlost &&
16652                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
16653                         goto free_msg;
16654
16655                 if (wakeup->tcp_nomoretokens &&
16656                     nla_put_flag(msg,
16657                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
16658                         goto free_msg;
16659
16660                 if (wakeup->packet) {
16661                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
16662                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
16663
16664                         if (!wakeup->packet_80211) {
16665                                 pkt_attr =
16666                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
16667                                 len_attr =
16668                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
16669                         }
16670
16671                         if (wakeup->packet_len &&
16672                             nla_put_u32(msg, len_attr, wakeup->packet_len))
16673                                 goto free_msg;
16674
16675                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
16676                                     wakeup->packet))
16677                                 goto free_msg;
16678                 }
16679
16680                 if (wakeup->net_detect &&
16681                     cfg80211_net_detect_results(msg, wakeup))
16682                                 goto free_msg;
16683
16684                 nla_nest_end(msg, reasons);
16685         }
16686
16687         genlmsg_end(msg, hdr);
16688
16689         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16690                                 NL80211_MCGRP_MLME, gfp);
16691         return;
16692
16693  free_msg:
16694         nlmsg_free(msg);
16695 }
16696 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
16697 #endif
16698
16699 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
16700                                 enum nl80211_tdls_operation oper,
16701                                 u16 reason_code, gfp_t gfp)
16702 {
16703         struct wireless_dev *wdev = dev->ieee80211_ptr;
16704         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16705         struct sk_buff *msg;
16706         void *hdr;
16707
16708         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
16709                                          reason_code);
16710
16711         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16712         if (!msg)
16713                 return;
16714
16715         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
16716         if (!hdr) {
16717                 nlmsg_free(msg);
16718                 return;
16719         }
16720
16721         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16722             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16723             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
16724             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
16725             (reason_code > 0 &&
16726              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
16727                 goto nla_put_failure;
16728
16729         genlmsg_end(msg, hdr);
16730
16731         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16732                                 NL80211_MCGRP_MLME, gfp);
16733         return;
16734
16735  nla_put_failure:
16736         nlmsg_free(msg);
16737 }
16738 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
16739
16740 static int nl80211_netlink_notify(struct notifier_block * nb,
16741                                   unsigned long state,
16742                                   void *_notify)
16743 {
16744         struct netlink_notify *notify = _notify;
16745         struct cfg80211_registered_device *rdev;
16746         struct wireless_dev *wdev;
16747         struct cfg80211_beacon_registration *reg, *tmp;
16748
16749         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
16750                 return NOTIFY_DONE;
16751
16752         rcu_read_lock();
16753
16754         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
16755                 struct cfg80211_sched_scan_request *sched_scan_req;
16756
16757                 list_for_each_entry_rcu(sched_scan_req,
16758                                         &rdev->sched_scan_req_list,
16759                                         list) {
16760                         if (sched_scan_req->owner_nlportid == notify->portid) {
16761                                 sched_scan_req->nl_owner_dead = true;
16762                                 schedule_work(&rdev->sched_scan_stop_wk);
16763                         }
16764                 }
16765
16766                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
16767                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
16768
16769                         if (wdev->owner_nlportid == notify->portid) {
16770                                 wdev->nl_owner_dead = true;
16771                                 schedule_work(&rdev->destroy_work);
16772                         } else if (wdev->conn_owner_nlportid == notify->portid) {
16773                                 schedule_work(&wdev->disconnect_wk);
16774                         }
16775
16776                         cfg80211_release_pmsr(wdev, notify->portid);
16777                 }
16778
16779                 spin_lock_bh(&rdev->beacon_registrations_lock);
16780                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
16781                                          list) {
16782                         if (reg->nlportid == notify->portid) {
16783                                 list_del(&reg->list);
16784                                 kfree(reg);
16785                                 break;
16786                         }
16787                 }
16788                 spin_unlock_bh(&rdev->beacon_registrations_lock);
16789         }
16790
16791         rcu_read_unlock();
16792
16793         /*
16794          * It is possible that the user space process that is controlling the
16795          * indoor setting disappeared, so notify the regulatory core.
16796          */
16797         regulatory_netlink_notify(notify->portid);
16798         return NOTIFY_OK;
16799 }
16800
16801 static struct notifier_block nl80211_netlink_notifier = {
16802         .notifier_call = nl80211_netlink_notify,
16803 };
16804
16805 void cfg80211_ft_event(struct net_device *netdev,
16806                        struct cfg80211_ft_event_params *ft_event)
16807 {
16808         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
16809         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16810         struct sk_buff *msg;
16811         void *hdr;
16812
16813         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
16814
16815         if (!ft_event->target_ap)
16816                 return;
16817
16818         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
16819                         GFP_KERNEL);
16820         if (!msg)
16821                 return;
16822
16823         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
16824         if (!hdr)
16825                 goto out;
16826
16827         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16828             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16829             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
16830                 goto out;
16831
16832         if (ft_event->ies &&
16833             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
16834                 goto out;
16835         if (ft_event->ric_ies &&
16836             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
16837                     ft_event->ric_ies))
16838                 goto out;
16839
16840         genlmsg_end(msg, hdr);
16841
16842         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16843                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16844         return;
16845  out:
16846         nlmsg_free(msg);
16847 }
16848 EXPORT_SYMBOL(cfg80211_ft_event);
16849
16850 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
16851 {
16852         struct cfg80211_registered_device *rdev;
16853         struct sk_buff *msg;
16854         void *hdr;
16855         u32 nlportid;
16856
16857         rdev = wiphy_to_rdev(wdev->wiphy);
16858         if (!rdev->crit_proto_nlportid)
16859                 return;
16860
16861         nlportid = rdev->crit_proto_nlportid;
16862         rdev->crit_proto_nlportid = 0;
16863
16864         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16865         if (!msg)
16866                 return;
16867
16868         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
16869         if (!hdr)
16870                 goto nla_put_failure;
16871
16872         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16873             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16874                               NL80211_ATTR_PAD))
16875                 goto nla_put_failure;
16876
16877         genlmsg_end(msg, hdr);
16878
16879         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16880         return;
16881
16882  nla_put_failure:
16883         nlmsg_free(msg);
16884 }
16885 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
16886
16887 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
16888 {
16889         struct wiphy *wiphy = wdev->wiphy;
16890         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16891         struct sk_buff *msg;
16892         void *hdr;
16893
16894         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16895         if (!msg)
16896                 return;
16897
16898         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
16899         if (!hdr)
16900                 goto out;
16901
16902         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16903             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
16904             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16905                               NL80211_ATTR_PAD))
16906                 goto out;
16907
16908         genlmsg_end(msg, hdr);
16909
16910         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
16911                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16912         return;
16913  out:
16914         nlmsg_free(msg);
16915 }
16916
16917 int cfg80211_external_auth_request(struct net_device *dev,
16918                                    struct cfg80211_external_auth_params *params,
16919                                    gfp_t gfp)
16920 {
16921         struct wireless_dev *wdev = dev->ieee80211_ptr;
16922         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16923         struct sk_buff *msg;
16924         void *hdr;
16925
16926         if (!wdev->conn_owner_nlportid)
16927                 return -EINVAL;
16928
16929         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16930         if (!msg)
16931                 return -ENOMEM;
16932
16933         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
16934         if (!hdr)
16935                 goto nla_put_failure;
16936
16937         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16938             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16939             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
16940             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
16941                         params->action) ||
16942             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
16943             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
16944                     params->ssid.ssid))
16945                 goto nla_put_failure;
16946
16947         genlmsg_end(msg, hdr);
16948         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16949                         wdev->conn_owner_nlportid);
16950         return 0;
16951
16952  nla_put_failure:
16953         nlmsg_free(msg);
16954         return -ENOBUFS;
16955 }
16956 EXPORT_SYMBOL(cfg80211_external_auth_request);
16957
16958 void cfg80211_update_owe_info_event(struct net_device *netdev,
16959                                     struct cfg80211_update_owe_info *owe_info,
16960                                     gfp_t gfp)
16961 {
16962         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
16963         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16964         struct sk_buff *msg;
16965         void *hdr;
16966
16967         trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
16968
16969         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16970         if (!msg)
16971                 return;
16972
16973         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
16974         if (!hdr)
16975                 goto nla_put_failure;
16976
16977         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16978             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16979             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
16980                 goto nla_put_failure;
16981
16982         if (!owe_info->ie_len ||
16983             nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
16984                 goto nla_put_failure;
16985
16986         genlmsg_end(msg, hdr);
16987
16988         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16989                                 NL80211_MCGRP_MLME, gfp);
16990         return;
16991
16992 nla_put_failure:
16993         genlmsg_cancel(msg, hdr);
16994         nlmsg_free(msg);
16995 }
16996 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
16997
16998 /* initialisation/exit functions */
16999
17000 int __init nl80211_init(void)
17001 {
17002         int err;
17003
17004         err = genl_register_family(&nl80211_fam);
17005         if (err)
17006                 return err;
17007
17008         err = netlink_register_notifier(&nl80211_netlink_notifier);
17009         if (err)
17010                 goto err_out;
17011
17012         return 0;
17013  err_out:
17014         genl_unregister_family(&nl80211_fam);
17015         return err;
17016 }
17017
17018 void nl80211_exit(void)
17019 {
17020         netlink_unregister_notifier(&nl80211_netlink_notifier);
17021         genl_unregister_family(&nl80211_fam);
17022 }