net/wireless/nl80211.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * This is the new netlink-based wireless configuration interface.
   4  *
   5  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright 2013-2014  Intel Mobile Communications GmbH
   7  * Copyright 2015-2017  Intel Deutschland GmbH
   8  * Copyright (C) 2018-2021 Intel Corporation
   9  */
  10
  11 #include <linux/if.h>
  12 #include <linux/module.h>
  13 #include <linux/err.h>
  14 #include <linux/slab.h>
  15 #include <linux/list.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/ieee80211.h>
  18 #include <linux/nl80211.h>
  19 #include <linux/rtnetlink.h>
  20 #include <linux/netlink.h>
  21 #include <linux/nospec.h>
  22 #include <linux/etherdevice.h>
  23 #include <linux/if_vlan.h>
  24 #include <net/net_namespace.h>
  25 #include <net/genetlink.h>
  26 #include <net/cfg80211.h>
  27 #include <net/sock.h>
  28 #include <net/inet_connection_sock.h>
  29 #include "core.h"
  30 #include "nl80211.h"
  31 #include "reg.h"
  32 #include "rdev-ops.h"
  33
  34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  35                                    struct genl_info *info,
  36                                    struct cfg80211_crypto_settings *settings,
  37                                    int cipher_limit);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam;
  41
  42 /* multicast groups */
  43 enum nl80211_multicast_groups {
  44         NL80211_MCGRP_CONFIG,
  45         NL80211_MCGRP_SCAN,
  46         NL80211_MCGRP_REGULATORY,
  47         NL80211_MCGRP_MLME,
  48         NL80211_MCGRP_VENDOR,
  49         NL80211_MCGRP_NAN,
  50         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  51 };
  52
  53 static const struct genl_multicast_group nl80211_mcgrps[] = {
  54         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  55         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  56         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  57         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  58         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  59         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  60 #ifdef CONFIG_NL80211_TESTMODE
  61         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  62 #endif
  63 };
  64
  65 /* returns ERR_PTR values */
  66 static struct wireless_dev *
  67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
  68                            struct net *netns, struct nlattr **attrs)
  69 {
  70         struct wireless_dev *result = NULL;
  71         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  72         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  73         u64 wdev_id = 0;
  74         int wiphy_idx = -1;
  75         int ifidx = -1;
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         if (rdev) {
  88                 struct wireless_dev *wdev;
  89
  90                 lockdep_assert_held(&rdev->wiphy.mtx);
  91
  92                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  93                         if (have_ifidx && wdev->netdev &&
  94                             wdev->netdev->ifindex == ifidx) {
  95                                 result = wdev;
  96                                 break;
  97                         }
  98                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                 }
 103
 104                 return result ?: ERR_PTR(-ENODEV);
 105         }
 106
 107         ASSERT_RTNL();
 108
 109         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 110                 struct wireless_dev *wdev;
 111
 112                 if (wiphy_net(&rdev->wiphy) != netns)
 113                         continue;
 114
 115                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 116                         continue;
 117
 118                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 119                         if (have_ifidx && wdev->netdev &&
 120                             wdev->netdev->ifindex == ifidx) {
 121                                 result = wdev;
 122                                 break;
 123                         }
 124                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 125                                 result = wdev;
 126                                 break;
 127                         }
 128                 }
 129
 130                 if (result)
 131                         break;
 132         }
 133
 134         if (result)
 135                 return result;
 136         return ERR_PTR(-ENODEV);
 137 }
 138
 139 static struct cfg80211_registered_device *
 140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 141 {
 142         struct cfg80211_registered_device *rdev = NULL, *tmp;
 143         struct net_device *netdev;
 144
 145         ASSERT_RTNL();
 146
 147         if (!attrs[NL80211_ATTR_WIPHY] &&
 148             !attrs[NL80211_ATTR_IFINDEX] &&
 149             !attrs[NL80211_ATTR_WDEV])
 150                 return ERR_PTR(-EINVAL);
 151
 152         if (attrs[NL80211_ATTR_WIPHY])
 153                 rdev = cfg80211_rdev_by_wiphy_idx(
 154                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 155
 156         if (attrs[NL80211_ATTR_WDEV]) {
 157                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 158                 struct wireless_dev *wdev;
 159                 bool found = false;
 160
 161                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 162                 if (tmp) {
 163                         /* make sure wdev exists */
 164                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 165                                 if (wdev->identifier != (u32)wdev_id)
 166                                         continue;
 167                                 found = true;
 168                                 break;
 169                         }
 170
 171                         if (!found)
 172                                 tmp = NULL;
 173
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176                         rdev = tmp;
 177                 }
 178         }
 179
 180         if (attrs[NL80211_ATTR_IFINDEX]) {
 181                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 182
 183                 netdev = __dev_get_by_index(netns, ifindex);
 184                 if (netdev) {
 185                         if (netdev->ieee80211_ptr)
 186                                 tmp = wiphy_to_rdev(
 187                                         netdev->ieee80211_ptr->wiphy);
 188                         else
 189                                 tmp = NULL;
 190
 191                         /* not wireless device -- return error */
 192                         if (!tmp)
 193                                 return ERR_PTR(-EINVAL);
 194
 195                         /* mismatch -- return error */
 196                         if (rdev && tmp != rdev)
 197                                 return ERR_PTR(-EINVAL);
 198
 199                         rdev = tmp;
 200                 }
 201         }
 202
 203         if (!rdev)
 204                 return ERR_PTR(-ENODEV);
 205
 206         if (netns != wiphy_net(&rdev->wiphy))
 207                 return ERR_PTR(-ENODEV);
 208
 209         return rdev;
 210 }
 211
 212 /*
 213  * This function returns a pointer to the driver
 214  * that the genl_info item that is passed refers to.
 215  *
 216  * The result of this can be a PTR_ERR and hence must
 217  * be checked with IS_ERR() for errors.
 218  */
 219 static struct cfg80211_registered_device *
 220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 221 {
 222         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 223 }
 224
 225 static int validate_beacon_head(const struct nlattr *attr,
 226                                 struct netlink_ext_ack *extack)
 227 {
 228         const u8 *data = nla_data(attr);
 229         unsigned int len = nla_len(attr);
 230         const struct element *elem;
 231         const struct ieee80211_mgmt *mgmt = (void *)data;
 232         unsigned int fixedlen, hdrlen;
 233         bool s1g_bcn;
 234
 235         if (len < offsetofend(typeof(*mgmt), frame_control))
 236                 goto err;
 237
 238         s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
 239         if (s1g_bcn) {
 240                 fixedlen = offsetof(struct ieee80211_ext,
 241                                     u.s1g_beacon.variable);
 242                 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
 243         } else {
 244                 fixedlen = offsetof(struct ieee80211_mgmt,
 245                                     u.beacon.variable);
 246                 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
 247         }
 248
 249         if (len < fixedlen)
 250                 goto err;
 251
 252         if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
 253                 goto err;
 254
 255         data += fixedlen;
 256         len -= fixedlen;
 257
 258         for_each_element(elem, data, len) {
 259                 /* nothing */
 260         }
 261
 262         if (for_each_element_completed(elem, data, len))
 263                 return 0;
 264
 265 err:
 266         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
 267         return -EINVAL;
 268 }
 269
 270 static int validate_ie_attr(const struct nlattr *attr,
 271                             struct netlink_ext_ack *extack)
 272 {
 273         const u8 *data = nla_data(attr);
 274         unsigned int len = nla_len(attr);
 275         const struct element *elem;
 276
 277         for_each_element(elem, data, len) {
 278                 /* nothing */
 279         }
 280
 281         if (for_each_element_completed(elem, data, len))
 282                 return 0;
 283
 284         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 285         return -EINVAL;
 286 }
 287
 288 /* policy for the attributes */
 289 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
 290
 291 static const struct nla_policy
 292 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 293         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 294         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 295                                         .len = U8_MAX },
 296         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 297                                              .len = U8_MAX },
 298 };
 299
 300 static const struct nla_policy
 301 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 302         [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
 303         [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
 304         [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
 305                 NLA_POLICY_MAX(NLA_U8, 15),
 306         [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
 307         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
 308                 NLA_POLICY_MAX(NLA_U8, 15),
 309         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
 310                 NLA_POLICY_MAX(NLA_U8, 31),
 311         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
 312         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
 313         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
 314         [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
 315         [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
 316 };
 317
 318 static const struct nla_policy
 319 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 320         [NL80211_PMSR_TYPE_FTM] =
 321                 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
 322 };
 323
 324 static const struct nla_policy
 325 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
 326         [NL80211_PMSR_REQ_ATTR_DATA] =
 327                 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
 328         [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
 329 };
 330
 331 static const struct nla_policy
 332 nl80211_psmr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 333         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
 334         [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
 335         [NL80211_PMSR_PEER_ATTR_REQ] =
 336                 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 337         [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
 338 };
 339
 340 static const struct nla_policy
 341 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 342         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 343         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 344         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 345         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 346         [NL80211_PMSR_ATTR_PEERS] =
 347                 NLA_POLICY_NESTED_ARRAY(nl80211_psmr_peer_attr_policy),
 348 };
 349
 350 static const struct nla_policy
 351 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
 352         [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
 353                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 354         [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
 355                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 356         [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
 357                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 358         [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
 359                 NLA_POLICY_EXACT_LEN(8),
 360         [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
 361                 NLA_POLICY_EXACT_LEN(8),
 362         [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
 363 };
 364
 365 static const struct nla_policy
 366 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
 367         [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
 368         [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
 369         [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
 370 };
 371
 372 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
 373         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
 374                                     .len = NL80211_MAX_SUPP_RATES },
 375         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
 376                                 .len = NL80211_MAX_SUPP_HT_RATES },
 377         [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
 378         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
 379         [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
 380         [NL80211_TXRATE_HE_GI] =  NLA_POLICY_RANGE(NLA_U8,
 381                                                    NL80211_RATE_INFO_HE_GI_0_8,
 382                                                    NL80211_RATE_INFO_HE_GI_3_2),
 383         [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
 384                                                    NL80211_RATE_INFO_HE_1XLTF,
 385                                                    NL80211_RATE_INFO_HE_4XLTF),
 386 };
 387
 388 static const struct nla_policy
 389 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
 390         [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
 391         [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
 392         [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
 393         [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
 394         [NL80211_TID_CONFIG_ATTR_NOACK] =
 395                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 396         [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 397         [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 398         [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
 399                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 400         [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
 401                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 402         [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
 403                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 404         [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
 405                         NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
 406         [NL80211_TID_CONFIG_ATTR_TX_RATE] =
 407                         NLA_POLICY_NESTED(nl80211_txattr_policy),
 408 };
 409
 410 static const struct nla_policy
 411 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
 412         [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
 413         [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
 414         NLA_POLICY_RANGE(NLA_BINARY,
 415                          NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
 416                          IEEE80211_MAX_DATA_LEN),
 417 };
 418
 419 static const struct nla_policy
 420 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
 421         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
 422         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
 423                                                        .len = IEEE80211_MAX_DATA_LEN }
 424 };
 425
 426 static const struct nla_policy
 427 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
 428         [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
 429         [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
 430 };
 431
 432 static const struct nla_policy
 433 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
 434         [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
 435         [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
 436 };
 437
 438 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 439         [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
 440         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 441         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 442                                       .len = 20-1 },
 443         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 444
 445         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 446         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 447         [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
 448                                                 NL80211_EDMG_CHANNELS_MIN,
 449                                                 NL80211_EDMG_CHANNELS_MAX),
 450         [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
 451                                                 NL80211_EDMG_BW_CONFIG_MIN,
 452                                                 NL80211_EDMG_BW_CONFIG_MAX),
 453
 454         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 455         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 456         [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 457         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 458
 459         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 460         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 461         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 462         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 463         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 464         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 465
 466         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 467         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 468         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 469
 470         [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 471         [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 472
 473         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 474         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 475                                     .len = WLAN_MAX_KEY_LEN },
 476         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
 477         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 478         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 479         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 480         [NL80211_ATTR_KEY_TYPE] =
 481                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 482
 483         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 484         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 485         [NL80211_ATTR_BEACON_HEAD] =
 486                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
 487                                        IEEE80211_MAX_DATA_LEN),
 488         [NL80211_ATTR_BEACON_TAIL] =
 489                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 490                                        IEEE80211_MAX_DATA_LEN),
 491         [NL80211_ATTR_STA_AID] =
 492                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 493         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 494         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 495         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 496                                                .len = NL80211_MAX_SUPP_RATES },
 497         [NL80211_ATTR_STA_PLINK_ACTION] =
 498                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 499         [NL80211_ATTR_STA_TX_POWER_SETTING] =
 500                 NLA_POLICY_RANGE(NLA_U8,
 501                                  NL80211_TX_POWER_AUTOMATIC,
 502                                  NL80211_TX_POWER_FIXED),
 503         [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
 504         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 505         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 506         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 507                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 508         [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
 509
 510         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 511         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 512
 513         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 514         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 515         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 516         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 517                                            .len = NL80211_MAX_SUPP_RATES },
 518         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 519
 520         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 521         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 522
 523         [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
 524
 525         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 526         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 527                                                    validate_ie_attr,
 528                                                    IEEE80211_MAX_DATA_LEN),
 529         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 530         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 531
 532         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 533                                 .len = IEEE80211_MAX_SSID_LEN },
 534         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 535         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 536         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 537         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 538         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 539                                                   NL80211_MFP_NO,
 540                                                   NL80211_MFP_OPTIONAL),
 541         [NL80211_ATTR_STA_FLAGS2] = {
 542                 .len = sizeof(struct nl80211_sta_flag_update),
 543         },
 544         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 545         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 546         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 547         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 548         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 549         [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
 550         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 551         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 552         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 553         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 554         [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
 555         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 556         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 557         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 558         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 559                                  .len = IEEE80211_MAX_DATA_LEN },
 560         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 561         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 562                                                    NL80211_PS_DISABLED,
 563                                                    NL80211_PS_ENABLED),
 564         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 565         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 566         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 567         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 568         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 569         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 570         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 571         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 572         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 573         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 574         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 575         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 576         [NL80211_ATTR_STA_PLINK_STATE] =
 577                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 578         [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
 579         [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
 580         [NL80211_ATTR_MESH_PEER_AID] =
 581                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 582         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 583         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 584         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 585         [NL80211_ATTR_HIDDEN_SSID] =
 586                 NLA_POLICY_RANGE(NLA_U32,
 587                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 588                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 589         [NL80211_ATTR_IE_PROBE_RESP] =
 590                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 591                                        IEEE80211_MAX_DATA_LEN),
 592         [NL80211_ATTR_IE_ASSOC_RESP] =
 593                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 594                                        IEEE80211_MAX_DATA_LEN),
 595         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 596         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 597         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 598         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 599         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 600         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 601         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 602         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 603         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 604         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 605         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 606                                       .len = IEEE80211_MAX_DATA_LEN },
 607         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 608         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 609         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 610                 .len = NL80211_HT_CAPABILITY_LEN
 611         },
 612         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 613         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 614         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 615         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 616         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 617
 618         /* need to include at least Auth Transaction and Status Code */
 619         [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
 620
 621         [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
 622         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 623         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 624         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 625         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 626                 NLA_POLICY_RANGE(NLA_U32,
 627                                  NL80211_MESH_POWER_UNKNOWN + 1,
 628                                  NL80211_MESH_POWER_MAX),
 629         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 630         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 631         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 632         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 633         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 634         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 635         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 636                 .len = NL80211_VHT_CAPABILITY_LEN,
 637         },
 638         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 639         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 640                                   .len = IEEE80211_MAX_DATA_LEN },
 641         [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
 642         [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
 643                 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
 644         [NL80211_ATTR_PEER_AID] =
 645                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 646         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 647         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 648         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 649         [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
 650         [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
 651         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
 652         /*
 653          * The value of the Length field of the Supported Operating
 654          * Classes element is between 2 and 253.
 655          */
 656         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
 657                 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
 658         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 659         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 660         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 661         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 662         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 663         [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
 664                                                   IEEE80211_QOS_MAP_LEN_MIN,
 665                                                   IEEE80211_QOS_MAP_LEN_MAX),
 666         [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 667         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 668         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 669         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 670         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 671         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 672         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 673         [NL80211_ATTR_USER_PRIO] =
 674                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 675         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 676         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 677         [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
 678         [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 679         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 680         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 681         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 682         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 683         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 684         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 685         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 686                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 687         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 688                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 689         },
 690         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 691         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 692         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 693         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 694         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 695                                     .len = FILS_MAX_KEK_LEN },
 696         [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
 697         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 698         [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 699         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 700         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 701                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 702         },
 703         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 704         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 705                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 706         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 707                                           .len = FILS_ERP_MAX_REALM_LEN },
 708         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 709         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 710                                         .len = FILS_ERP_MAX_RRK_LEN },
 711         [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
 712         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 713         [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
 714         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 715         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 716
 717         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 718         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 719         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 720         [NL80211_ATTR_HE_CAPABILITY] =
 721                 NLA_POLICY_RANGE(NLA_BINARY,
 722                                  NL80211_HE_MIN_CAPABILITY_LEN,
 723                                  NL80211_HE_MAX_CAPABILITY_LEN),
 724         [NL80211_ATTR_FTM_RESPONDER] =
 725                 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
 726         [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
 727         [NL80211_ATTR_PEER_MEASUREMENTS] =
 728                 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
 729         [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 730         [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
 731                                         .len = SAE_PASSWORD_MAX_LEN },
 732         [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
 733         [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
 734         [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
 735         [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
 736         [NL80211_ATTR_TID_CONFIG] =
 737                 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
 738         [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
 739         [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
 740         [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
 741         [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
 742         [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 743         [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
 744         [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
 745                 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
 746         [NL80211_ATTR_FILS_DISCOVERY] =
 747                 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
 748         [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
 749                 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
 750         [NL80211_ATTR_S1G_CAPABILITY] =
 751                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 752         [NL80211_ATTR_S1G_CAPABILITY_MASK] =
 753                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 754         [NL80211_ATTR_SAE_PWE] =
 755                 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
 756                                  NL80211_SAE_PWE_BOTH),
 757         [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
 758         [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
 759         [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
 760 };
 761
 762 /* policy for the key attributes */
 763 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 764         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 765         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 766         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 767         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 768         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 769         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 770         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 771         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 772         [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
 773 };
 774
 775 /* policy for the key default flags */
 776 static const struct nla_policy
 777 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 778         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 779         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 780 };
 781
 782 #ifdef CONFIG_PM
 783 /* policy for WoWLAN attributes */
 784 static const struct nla_policy
 785 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 786         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 787         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 788         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 789         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 790         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 791         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 792         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 793         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 794         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 795         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 796 };
 797
 798 static const struct nla_policy
 799 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 800         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 801         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 802         [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 803         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 804         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 805         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 806         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 807                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 808         },
 809         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 810                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 811         },
 812         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 813         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 814         [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
 815 };
 816 #endif /* CONFIG_PM */
 817
 818 /* policy for coalesce rule attributes */
 819 static const struct nla_policy
 820 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 821         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 822         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 823                 NLA_POLICY_RANGE(NLA_U32,
 824                                  NL80211_COALESCE_CONDITION_MATCH,
 825                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 826         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 827 };
 828
 829 /* policy for GTK rekey offload attributes */
 830 static const struct nla_policy
 831 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 832         [NL80211_REKEY_DATA_KEK] = {
 833                 .type = NLA_BINARY,
 834                 .len = NL80211_KEK_EXT_LEN
 835         },
 836         [NL80211_REKEY_DATA_KCK] = {
 837                 .type = NLA_BINARY,
 838                 .len = NL80211_KCK_EXT_LEN
 839         },
 840         [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
 841         [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
 842 };
 843
 844 static const struct nla_policy
 845 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
 846         [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
 847         [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
 848         [NL80211_BAND_6GHZ] = { .type = NLA_S32 },
 849         [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
 850 };
 851
 852 static const struct nla_policy
 853 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 854         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 855                                                  .len = IEEE80211_MAX_SSID_LEN },
 856         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 857         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 858         [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
 859                 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
 860 };
 861
 862 static const struct nla_policy
 863 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 864         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 865         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 866 };
 867
 868 static const struct nla_policy
 869 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 870         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 871         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 872         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 873                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 874         },
 875 };
 876
 877 /* policy for NAN function attributes */
 878 static const struct nla_policy
 879 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 880         [NL80211_NAN_FUNC_TYPE] =
 881                 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
 882         [NL80211_NAN_FUNC_SERVICE_ID] = {
 883                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 884         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 885         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 886         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 887         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 888         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 889         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 890         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 891         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 892         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 893                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 894         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 895         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 896         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 897         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 898         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 899 };
 900
 901 /* policy for Service Response Filter attributes */
 902 static const struct nla_policy
 903 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 904         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 905         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 906                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 907         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 908         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 909 };
 910
 911 /* policy for packet pattern attributes */
 912 static const struct nla_policy
 913 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 914         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 915         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 916         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 917 };
 918
 919 int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 920                               struct cfg80211_registered_device **rdev,
 921                               struct wireless_dev **wdev)
 922 {
 923         int err;
 924
 925         if (!cb->args[0]) {
 926                 struct nlattr **attrbuf;
 927
 928                 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
 929                                   GFP_KERNEL);
 930                 if (!attrbuf)
 931                         return -ENOMEM;
 932
 933                 err = nlmsg_parse_deprecated(cb->nlh,
 934                                              GENL_HDRLEN + nl80211_fam.hdrsize,
 935                                              attrbuf, nl80211_fam.maxattr,
 936                                              nl80211_policy, NULL);
 937                 if (err) {
 938                         kfree(attrbuf);
 939                         return err;
 940                 }
 941
 942                 rtnl_lock();
 943                 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
 944                                                    attrbuf);
 945                 kfree(attrbuf);
 946                 if (IS_ERR(*wdev)) {
 947                         rtnl_unlock();
 948                         return PTR_ERR(*wdev);
 949                 }
 950                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 951                 mutex_lock(&(*rdev)->wiphy.mtx);
 952                 rtnl_unlock();
 953                 /* 0 is the first index - add 1 to parse only once */
 954                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 955                 cb->args[1] = (*wdev)->identifier;
 956         } else {
 957                 /* subtract the 1 again here */
 958                 struct wiphy *wiphy;
 959                 struct wireless_dev *tmp;
 960
 961                 rtnl_lock();
 962                 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 963                 if (!wiphy) {
 964                         rtnl_unlock();
 965                         return -ENODEV;
 966                 }
 967                 *rdev = wiphy_to_rdev(wiphy);
 968                 *wdev = NULL;
 969
 970                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 971                         if (tmp->identifier == cb->args[1]) {
 972                                 *wdev = tmp;
 973                                 break;
 974                         }
 975                 }
 976
 977                 if (!*wdev) {
 978                         rtnl_unlock();
 979                         return -ENODEV;
 980                 }
 981                 mutex_lock(&(*rdev)->wiphy.mtx);
 982                 rtnl_unlock();
 983         }
 984
 985         return 0;
 986 }
 987
 988 /* message building helper */
 989 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 990                      int flags, u8 cmd)
 991 {
 992         /* since there is no private header just add the generic one */
 993         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 994 }
 995
 996 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
 997                                      const struct ieee80211_reg_rule *rule)
 998 {
 999         int j;
1000         struct nlattr *nl_wmm_rules =
1001                 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1002
1003         if (!nl_wmm_rules)
1004                 goto nla_put_failure;
1005
1006         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1007                 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1008
1009                 if (!nl_wmm_rule)
1010                         goto nla_put_failure;
1011
1012                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1013                                 rule->wmm_rule.client[j].cw_min) ||
1014                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1015                                 rule->wmm_rule.client[j].cw_max) ||
1016                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
1017                                rule->wmm_rule.client[j].aifsn) ||
1018                     nla_put_u16(msg, NL80211_WMMR_TXOP,
1019                                 rule->wmm_rule.client[j].cot))
1020                         goto nla_put_failure;
1021
1022                 nla_nest_end(msg, nl_wmm_rule);
1023         }
1024         nla_nest_end(msg, nl_wmm_rules);
1025
1026         return 0;
1027
1028 nla_put_failure:
1029         return -ENOBUFS;
1030 }
1031
1032 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1033                                    struct ieee80211_channel *chan,
1034                                    bool large)
1035 {
1036         /* Some channels must be completely excluded from the
1037          * list to protect old user-space tools from breaking
1038          */
1039         if (!large && chan->flags &
1040             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1041                 return 0;
1042         if (!large && chan->freq_offset)
1043                 return 0;
1044
1045         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1046                         chan->center_freq))
1047                 goto nla_put_failure;
1048
1049         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1050                 goto nla_put_failure;
1051
1052         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1053             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1054                 goto nla_put_failure;
1055         if (chan->flags & IEEE80211_CHAN_NO_IR) {
1056                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1057                         goto nla_put_failure;
1058                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1059                         goto nla_put_failure;
1060         }
1061         if (chan->flags & IEEE80211_CHAN_RADAR) {
1062                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1063                         goto nla_put_failure;
1064                 if (large) {
1065                         u32 time;
1066
1067                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1068
1069                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1070                                         chan->dfs_state))
1071                                 goto nla_put_failure;
1072                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1073                                         time))
1074                                 goto nla_put_failure;
1075                         if (nla_put_u32(msg,
1076                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1077                                         chan->dfs_cac_ms))
1078                                 goto nla_put_failure;
1079                 }
1080         }
1081
1082         if (large) {
1083                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1084                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1085                         goto nla_put_failure;
1086                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1087                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1088                         goto nla_put_failure;
1089                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1090                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1091                         goto nla_put_failure;
1092                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1093                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1094                         goto nla_put_failure;
1095                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1096                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1097                         goto nla_put_failure;
1098                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1099                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1100                         goto nla_put_failure;
1101                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1102                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1103                         goto nla_put_failure;
1104                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1105                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1106                         goto nla_put_failure;
1107                 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1108                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1109                         goto nla_put_failure;
1110                 if ((chan->flags & IEEE80211_CHAN_1MHZ) &&
1111                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ))
1112                         goto nla_put_failure;
1113                 if ((chan->flags & IEEE80211_CHAN_2MHZ) &&
1114                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ))
1115                         goto nla_put_failure;
1116                 if ((chan->flags & IEEE80211_CHAN_4MHZ) &&
1117                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ))
1118                         goto nla_put_failure;
1119                 if ((chan->flags & IEEE80211_CHAN_8MHZ) &&
1120                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ))
1121                         goto nla_put_failure;
1122                 if ((chan->flags & IEEE80211_CHAN_16MHZ) &&
1123                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ))
1124                         goto nla_put_failure;
1125         }
1126
1127         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1128                         DBM_TO_MBM(chan->max_power)))
1129                 goto nla_put_failure;
1130
1131         if (large) {
1132                 const struct ieee80211_reg_rule *rule =
1133                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1134
1135                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1136                         if (nl80211_msg_put_wmm_rules(msg, rule))
1137                                 goto nla_put_failure;
1138                 }
1139         }
1140
1141         return 0;
1142
1143  nla_put_failure:
1144         return -ENOBUFS;
1145 }
1146
1147 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1148                                   struct cfg80211_txq_stats *txqstats,
1149                                   int attrtype)
1150 {
1151         struct nlattr *txqattr;
1152
1153 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
1154         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
1155             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1156                 return false;                                             \
1157         } while (0)
1158
1159         txqattr = nla_nest_start_noflag(msg, attrtype);
1160         if (!txqattr)
1161                 return false;
1162
1163         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1164         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1165         PUT_TXQVAL_U32(FLOWS, flows);
1166         PUT_TXQVAL_U32(DROPS, drops);
1167         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1168         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1169         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1170         PUT_TXQVAL_U32(COLLISIONS, collisions);
1171         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1172         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1173         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1174         nla_nest_end(msg, txqattr);
1175
1176 #undef PUT_TXQVAL_U32
1177         return true;
1178 }
1179
1180 /* netlink command implementations */
1181
1182 struct key_parse {
1183         struct key_params p;
1184         int idx;
1185         int type;
1186         bool def, defmgmt, defbeacon;
1187         bool def_uni, def_multi;
1188 };
1189
1190 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1191                                  struct key_parse *k)
1192 {
1193         struct nlattr *tb[NL80211_KEY_MAX + 1];
1194         int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1195                                               nl80211_key_policy,
1196                                               info->extack);
1197         if (err)
1198                 return err;
1199
1200         k->def = !!tb[NL80211_KEY_DEFAULT];
1201         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1202         k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1203
1204         if (k->def) {
1205                 k->def_uni = true;
1206                 k->def_multi = true;
1207         }
1208         if (k->defmgmt || k->defbeacon)
1209                 k->def_multi = true;
1210
1211         if (tb[NL80211_KEY_IDX])
1212                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1213
1214         if (tb[NL80211_KEY_DATA]) {
1215                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1216                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1217         }
1218
1219         if (tb[NL80211_KEY_SEQ]) {
1220                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1221                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1222         }
1223
1224         if (tb[NL80211_KEY_CIPHER])
1225                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1226
1227         if (tb[NL80211_KEY_TYPE])
1228                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1229
1230         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1231                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1232
1233                 err = nla_parse_nested_deprecated(kdt,
1234                                                   NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1235                                                   tb[NL80211_KEY_DEFAULT_TYPES],
1236                                                   nl80211_key_default_policy,
1237                                                   info->extack);
1238                 if (err)
1239                         return err;
1240
1241                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1242                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1243         }
1244
1245         if (tb[NL80211_KEY_MODE])
1246                 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1247
1248         return 0;
1249 }
1250
1251 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1252 {
1253         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1254                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1255                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1256         }
1257
1258         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1259                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1260                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1261         }
1262
1263         if (info->attrs[NL80211_ATTR_KEY_IDX])
1264                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1265
1266         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1267                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1268
1269         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1270         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1271
1272         if (k->def) {
1273                 k->def_uni = true;
1274                 k->def_multi = true;
1275         }
1276         if (k->defmgmt)
1277                 k->def_multi = true;
1278
1279         if (info->attrs[NL80211_ATTR_KEY_TYPE])
1280                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1281
1282         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1283                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1284                 int err = nla_parse_nested_deprecated(kdt,
1285                                                       NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1286                                                       info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1287                                                       nl80211_key_default_policy,
1288                                                       info->extack);
1289                 if (err)
1290                         return err;
1291
1292                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1293                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1294         }
1295
1296         return 0;
1297 }
1298
1299 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1300 {
1301         int err;
1302
1303         memset(k, 0, sizeof(*k));
1304         k->idx = -1;
1305         k->type = -1;
1306
1307         if (info->attrs[NL80211_ATTR_KEY])
1308                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1309         else
1310                 err = nl80211_parse_key_old(info, k);
1311
1312         if (err)
1313                 return err;
1314
1315         if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1316             (k->defbeacon ? 1 : 0) > 1) {
1317                 GENL_SET_ERR_MSG(info,
1318                                  "key with multiple default flags is invalid");
1319                 return -EINVAL;
1320         }
1321
1322         if (k->defmgmt || k->defbeacon) {
1323                 if (k->def_uni || !k->def_multi) {
1324                         GENL_SET_ERR_MSG(info,
1325                                          "defmgmt/defbeacon key must be mcast");
1326                         return -EINVAL;
1327                 }
1328         }
1329
1330         if (k->idx != -1) {
1331                 if (k->defmgmt) {
1332                         if (k->idx < 4 || k->idx > 5) {
1333                                 GENL_SET_ERR_MSG(info,
1334                                                  "defmgmt key idx not 4 or 5");
1335                                 return -EINVAL;
1336                         }
1337                 } else if (k->defbeacon) {
1338                         if (k->idx < 6 || k->idx > 7) {
1339                                 GENL_SET_ERR_MSG(info,
1340                                                  "defbeacon key idx not 6 or 7");
1341                                 return -EINVAL;
1342                         }
1343                 } else if (k->def) {
1344                         if (k->idx < 0 || k->idx > 3) {
1345                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1346                                 return -EINVAL;
1347                         }
1348                 } else {
1349                         if (k->idx < 0 || k->idx > 7) {
1350                                 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1351                                 return -EINVAL;
1352                         }
1353                 }
1354         }
1355
1356         return 0;
1357 }
1358
1359 static struct cfg80211_cached_keys *
1360 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1361                        struct genl_info *info, bool *no_ht)
1362 {
1363         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1364         struct key_parse parse;
1365         struct nlattr *key;
1366         struct cfg80211_cached_keys *result;
1367         int rem, err, def = 0;
1368         bool have_key = false;
1369
1370         nla_for_each_nested(key, keys, rem) {
1371                 have_key = true;
1372                 break;
1373         }
1374
1375         if (!have_key)
1376                 return NULL;
1377
1378         result = kzalloc(sizeof(*result), GFP_KERNEL);
1379         if (!result)
1380                 return ERR_PTR(-ENOMEM);
1381
1382         result->def = -1;
1383
1384         nla_for_each_nested(key, keys, rem) {
1385                 memset(&parse, 0, sizeof(parse));
1386                 parse.idx = -1;
1387
1388                 err = nl80211_parse_key_new(info, key, &parse);
1389                 if (err)
1390                         goto error;
1391                 err = -EINVAL;
1392                 if (!parse.p.key)
1393                         goto error;
1394                 if (parse.idx < 0 || parse.idx > 3) {
1395                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1396                         goto error;
1397                 }
1398                 if (parse.def) {
1399                         if (def) {
1400                                 GENL_SET_ERR_MSG(info,
1401                                                  "only one key can be default");
1402                                 goto error;
1403                         }
1404                         def = 1;
1405                         result->def = parse.idx;
1406                         if (!parse.def_uni || !parse.def_multi)
1407                                 goto error;
1408                 } else if (parse.defmgmt)
1409                         goto error;
1410                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1411                                                      parse.idx, false, NULL);
1412                 if (err)
1413                         goto error;
1414                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1415                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1416                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1417                         err = -EINVAL;
1418                         goto error;
1419                 }
1420                 result->params[parse.idx].cipher = parse.p.cipher;
1421                 result->params[parse.idx].key_len = parse.p.key_len;
1422                 result->params[parse.idx].key = result->data[parse.idx];
1423                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1424
1425                 /* must be WEP key if we got here */
1426                 if (no_ht)
1427                         *no_ht = true;
1428         }
1429
1430         if (result->def < 0) {
1431                 err = -EINVAL;
1432                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1433                 goto error;
1434         }
1435
1436         return result;
1437  error:
1438         kfree(result);
1439         return ERR_PTR(err);
1440 }
1441
1442 static int nl80211_key_allowed(struct wireless_dev *wdev)
1443 {
1444         ASSERT_WDEV_LOCK(wdev);
1445
1446         switch (wdev->iftype) {
1447         case NL80211_IFTYPE_AP:
1448         case NL80211_IFTYPE_AP_VLAN:
1449         case NL80211_IFTYPE_P2P_GO:
1450         case NL80211_IFTYPE_MESH_POINT:
1451                 break;
1452         case NL80211_IFTYPE_ADHOC:
1453         case NL80211_IFTYPE_STATION:
1454         case NL80211_IFTYPE_P2P_CLIENT:
1455                 if (!wdev->current_bss)
1456                         return -ENOLINK;
1457                 break;
1458         case NL80211_IFTYPE_UNSPECIFIED:
1459         case NL80211_IFTYPE_OCB:
1460         case NL80211_IFTYPE_MONITOR:
1461         case NL80211_IFTYPE_NAN:
1462         case NL80211_IFTYPE_P2P_DEVICE:
1463         case NL80211_IFTYPE_WDS:
1464         case NUM_NL80211_IFTYPES:
1465                 return -EINVAL;
1466         }
1467
1468         return 0;
1469 }
1470
1471 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1472                                                         u32 freq)
1473 {
1474         struct ieee80211_channel *chan;
1475
1476         chan = ieee80211_get_channel_khz(wiphy, freq);
1477         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1478                 return NULL;
1479         return chan;
1480 }
1481
1482 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1483 {
1484         struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1485         int i;
1486
1487         if (!nl_modes)
1488                 goto nla_put_failure;
1489
1490         i = 0;
1491         while (ifmodes) {
1492                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1493                         goto nla_put_failure;
1494                 ifmodes >>= 1;
1495                 i++;
1496         }
1497
1498         nla_nest_end(msg, nl_modes);
1499         return 0;
1500
1501 nla_put_failure:
1502         return -ENOBUFS;
1503 }
1504
1505 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1506                                           struct sk_buff *msg,
1507                                           bool large)
1508 {
1509         struct nlattr *nl_combis;
1510         int i, j;
1511
1512         nl_combis = nla_nest_start_noflag(msg,
1513                                           NL80211_ATTR_INTERFACE_COMBINATIONS);
1514         if (!nl_combis)
1515                 goto nla_put_failure;
1516
1517         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1518                 const struct ieee80211_iface_combination *c;
1519                 struct nlattr *nl_combi, *nl_limits;
1520
1521                 c = &wiphy->iface_combinations[i];
1522
1523                 nl_combi = nla_nest_start_noflag(msg, i + 1);
1524                 if (!nl_combi)
1525                         goto nla_put_failure;
1526
1527                 nl_limits = nla_nest_start_noflag(msg,
1528                                                   NL80211_IFACE_COMB_LIMITS);
1529                 if (!nl_limits)
1530                         goto nla_put_failure;
1531
1532                 for (j = 0; j < c->n_limits; j++) {
1533                         struct nlattr *nl_limit;
1534
1535                         nl_limit = nla_nest_start_noflag(msg, j + 1);
1536                         if (!nl_limit)
1537                                 goto nla_put_failure;
1538                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1539                                         c->limits[j].max))
1540                                 goto nla_put_failure;
1541                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1542                                                 c->limits[j].types))
1543                                 goto nla_put_failure;
1544                         nla_nest_end(msg, nl_limit);
1545                 }
1546
1547                 nla_nest_end(msg, nl_limits);
1548
1549                 if (c->beacon_int_infra_match &&
1550                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1551                         goto nla_put_failure;
1552                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1553                                 c->num_different_channels) ||
1554                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1555                                 c->max_interfaces))
1556                         goto nla_put_failure;
1557                 if (large &&
1558                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1559                                 c->radar_detect_widths) ||
1560                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1561                                 c->radar_detect_regions)))
1562                         goto nla_put_failure;
1563                 if (c->beacon_int_min_gcd &&
1564                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1565                                 c->beacon_int_min_gcd))
1566                         goto nla_put_failure;
1567
1568                 nla_nest_end(msg, nl_combi);
1569         }
1570
1571         nla_nest_end(msg, nl_combis);
1572
1573         return 0;
1574 nla_put_failure:
1575         return -ENOBUFS;
1576 }
1577
1578 #ifdef CONFIG_PM
1579 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1580                                         struct sk_buff *msg)
1581 {
1582         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1583         struct nlattr *nl_tcp;
1584
1585         if (!tcp)
1586                 return 0;
1587
1588         nl_tcp = nla_nest_start_noflag(msg,
1589                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1590         if (!nl_tcp)
1591                 return -ENOBUFS;
1592
1593         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1594                         tcp->data_payload_max))
1595                 return -ENOBUFS;
1596
1597         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1598                         tcp->data_payload_max))
1599                 return -ENOBUFS;
1600
1601         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1602                 return -ENOBUFS;
1603
1604         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1605                                 sizeof(*tcp->tok), tcp->tok))
1606                 return -ENOBUFS;
1607
1608         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1609                         tcp->data_interval_max))
1610                 return -ENOBUFS;
1611
1612         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1613                         tcp->wake_payload_max))
1614                 return -ENOBUFS;
1615
1616         nla_nest_end(msg, nl_tcp);
1617         return 0;
1618 }
1619
1620 static int nl80211_send_wowlan(struct sk_buff *msg,
1621                                struct cfg80211_registered_device *rdev,
1622                                bool large)
1623 {
1624         struct nlattr *nl_wowlan;
1625
1626         if (!rdev->wiphy.wowlan)
1627                 return 0;
1628
1629         nl_wowlan = nla_nest_start_noflag(msg,
1630                                           NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1631         if (!nl_wowlan)
1632                 return -ENOBUFS;
1633
1634         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1635              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1636             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1637              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1638             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1639              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1640             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1641              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1642             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1643              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1644             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1645              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1646             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1647              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1648             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1649              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1650                 return -ENOBUFS;
1651
1652         if (rdev->wiphy.wowlan->n_patterns) {
1653                 struct nl80211_pattern_support pat = {
1654                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1655                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1656                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1657                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1658                 };
1659
1660                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1661                             sizeof(pat), &pat))
1662                         return -ENOBUFS;
1663         }
1664
1665         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1666             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1667                         rdev->wiphy.wowlan->max_nd_match_sets))
1668                 return -ENOBUFS;
1669
1670         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1671                 return -ENOBUFS;
1672
1673         nla_nest_end(msg, nl_wowlan);
1674
1675         return 0;
1676 }
1677 #endif
1678
1679 static int nl80211_send_coalesce(struct sk_buff *msg,
1680                                  struct cfg80211_registered_device *rdev)
1681 {
1682         struct nl80211_coalesce_rule_support rule;
1683
1684         if (!rdev->wiphy.coalesce)
1685                 return 0;
1686
1687         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1688         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1689         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1690         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1691         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1692         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1693
1694         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1695                 return -ENOBUFS;
1696
1697         return 0;
1698 }
1699
1700 static int
1701 nl80211_send_iftype_data(struct sk_buff *msg,
1702                          const struct ieee80211_supported_band *sband,
1703                          const struct ieee80211_sband_iftype_data *iftdata)
1704 {
1705         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1706
1707         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1708                                 iftdata->types_mask))
1709                 return -ENOBUFS;
1710
1711         if (he_cap->has_he) {
1712                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1713                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1714                             he_cap->he_cap_elem.mac_cap_info) ||
1715                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1716                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1717                             he_cap->he_cap_elem.phy_cap_info) ||
1718                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1719                             sizeof(he_cap->he_mcs_nss_supp),
1720                             &he_cap->he_mcs_nss_supp) ||
1721                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1722                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1723                         return -ENOBUFS;
1724         }
1725
1726         if (sband->band == NL80211_BAND_6GHZ &&
1727             nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
1728                     sizeof(iftdata->he_6ghz_capa),
1729                     &iftdata->he_6ghz_capa))
1730                 return -ENOBUFS;
1731
1732         return 0;
1733 }
1734
1735 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1736                                       struct ieee80211_supported_band *sband,
1737                                       bool large)
1738 {
1739         struct nlattr *nl_rates, *nl_rate;
1740         struct ieee80211_rate *rate;
1741         int i;
1742
1743         /* add HT info */
1744         if (sband->ht_cap.ht_supported &&
1745             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1746                      sizeof(sband->ht_cap.mcs),
1747                      &sband->ht_cap.mcs) ||
1748              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1749                          sband->ht_cap.cap) ||
1750              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1751                         sband->ht_cap.ampdu_factor) ||
1752              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1753                         sband->ht_cap.ampdu_density)))
1754                 return -ENOBUFS;
1755
1756         /* add VHT info */
1757         if (sband->vht_cap.vht_supported &&
1758             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1759                      sizeof(sband->vht_cap.vht_mcs),
1760                      &sband->vht_cap.vht_mcs) ||
1761              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1762                          sband->vht_cap.cap)))
1763                 return -ENOBUFS;
1764
1765         if (large && sband->n_iftype_data) {
1766                 struct nlattr *nl_iftype_data =
1767                         nla_nest_start_noflag(msg,
1768                                               NL80211_BAND_ATTR_IFTYPE_DATA);
1769                 int err;
1770
1771                 if (!nl_iftype_data)
1772                         return -ENOBUFS;
1773
1774                 for (i = 0; i < sband->n_iftype_data; i++) {
1775                         struct nlattr *iftdata;
1776
1777                         iftdata = nla_nest_start_noflag(msg, i + 1);
1778                         if (!iftdata)
1779                                 return -ENOBUFS;
1780
1781                         err = nl80211_send_iftype_data(msg, sband,
1782                                                        &sband->iftype_data[i]);
1783                         if (err)
1784                                 return err;
1785
1786                         nla_nest_end(msg, iftdata);
1787                 }
1788
1789                 nla_nest_end(msg, nl_iftype_data);
1790         }
1791
1792         /* add EDMG info */
1793         if (large && sband->edmg_cap.channels &&
1794             (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
1795                        sband->edmg_cap.channels) ||
1796             nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
1797                        sband->edmg_cap.bw_config)))
1798
1799                 return -ENOBUFS;
1800
1801         /* add bitrates */
1802         nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1803         if (!nl_rates)
1804                 return -ENOBUFS;
1805
1806         for (i = 0; i < sband->n_bitrates; i++) {
1807                 nl_rate = nla_nest_start_noflag(msg, i);
1808                 if (!nl_rate)
1809                         return -ENOBUFS;
1810
1811                 rate = &sband->bitrates[i];
1812                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1813                                 rate->bitrate))
1814                         return -ENOBUFS;
1815                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1816                     nla_put_flag(msg,
1817                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1818                         return -ENOBUFS;
1819
1820                 nla_nest_end(msg, nl_rate);
1821         }
1822
1823         nla_nest_end(msg, nl_rates);
1824
1825         return 0;
1826 }
1827
1828 static int
1829 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1830                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1831 {
1832         u16 stypes;
1833         struct nlattr *nl_ftypes, *nl_ifs;
1834         enum nl80211_iftype ift;
1835         int i;
1836
1837         if (!mgmt_stypes)
1838                 return 0;
1839
1840         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
1841         if (!nl_ifs)
1842                 return -ENOBUFS;
1843
1844         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1845                 nl_ftypes = nla_nest_start_noflag(msg, ift);
1846                 if (!nl_ftypes)
1847                         return -ENOBUFS;
1848                 i = 0;
1849                 stypes = mgmt_stypes[ift].tx;
1850                 while (stypes) {
1851                         if ((stypes & 1) &&
1852                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1853                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1854                                 return -ENOBUFS;
1855                         stypes >>= 1;
1856                         i++;
1857                 }
1858                 nla_nest_end(msg, nl_ftypes);
1859         }
1860
1861         nla_nest_end(msg, nl_ifs);
1862
1863         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
1864         if (!nl_ifs)
1865                 return -ENOBUFS;
1866
1867         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1868                 nl_ftypes = nla_nest_start_noflag(msg, ift);
1869                 if (!nl_ftypes)
1870                         return -ENOBUFS;
1871                 i = 0;
1872                 stypes = mgmt_stypes[ift].rx;
1873                 while (stypes) {
1874                         if ((stypes & 1) &&
1875                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1876                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1877                                 return -ENOBUFS;
1878                         stypes >>= 1;
1879                         i++;
1880                 }
1881                 nla_nest_end(msg, nl_ftypes);
1882         }
1883         nla_nest_end(msg, nl_ifs);
1884
1885         return 0;
1886 }
1887
1888 #define CMD(op, n)                                                      \
1889          do {                                                           \
1890                 if (rdev->ops->op) {                                    \
1891                         i++;                                            \
1892                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1893                                 goto nla_put_failure;                   \
1894                 }                                                       \
1895         } while (0)
1896
1897 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1898                                         struct sk_buff *msg)
1899 {
1900         int i = 0;
1901
1902         /*
1903          * do *NOT* add anything into this function, new things need to be
1904          * advertised only to new versions of userspace that can deal with
1905          * the split (and they can't possibly care about new features...
1906          */
1907         CMD(add_virtual_intf, NEW_INTERFACE);
1908         CMD(change_virtual_intf, SET_INTERFACE);
1909         CMD(add_key, NEW_KEY);
1910         CMD(start_ap, START_AP);
1911         CMD(add_station, NEW_STATION);
1912         CMD(add_mpath, NEW_MPATH);
1913         CMD(update_mesh_config, SET_MESH_CONFIG);
1914         CMD(change_bss, SET_BSS);
1915         CMD(auth, AUTHENTICATE);
1916         CMD(assoc, ASSOCIATE);
1917         CMD(deauth, DEAUTHENTICATE);
1918         CMD(disassoc, DISASSOCIATE);
1919         CMD(join_ibss, JOIN_IBSS);
1920         CMD(join_mesh, JOIN_MESH);
1921         CMD(set_pmksa, SET_PMKSA);
1922         CMD(del_pmksa, DEL_PMKSA);
1923         CMD(flush_pmksa, FLUSH_PMKSA);
1924         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1925                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1926         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1927         CMD(mgmt_tx, FRAME);
1928         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1929         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1930                 i++;
1931                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1932                         goto nla_put_failure;
1933         }
1934         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1935             rdev->ops->join_mesh) {
1936                 i++;
1937                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1938                         goto nla_put_failure;
1939         }
1940         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1941                 CMD(tdls_mgmt, TDLS_MGMT);
1942                 CMD(tdls_oper, TDLS_OPER);
1943         }
1944         if (rdev->wiphy.max_sched_scan_reqs)
1945                 CMD(sched_scan_start, START_SCHED_SCAN);
1946         CMD(probe_client, PROBE_CLIENT);
1947         CMD(set_noack_map, SET_NOACK_MAP);
1948         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1949                 i++;
1950                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1951                         goto nla_put_failure;
1952         }
1953         CMD(start_p2p_device, START_P2P_DEVICE);
1954         CMD(set_mcast_rate, SET_MCAST_RATE);
1955 #ifdef CONFIG_NL80211_TESTMODE
1956         CMD(testmode_cmd, TESTMODE);
1957 #endif
1958
1959         if (rdev->ops->connect || rdev->ops->auth) {
1960                 i++;
1961                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1962                         goto nla_put_failure;
1963         }
1964
1965         if (rdev->ops->disconnect || rdev->ops->deauth) {
1966                 i++;
1967                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1968                         goto nla_put_failure;
1969         }
1970
1971         return i;
1972  nla_put_failure:
1973         return -ENOBUFS;
1974 }
1975
1976 static int
1977 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
1978                            struct sk_buff *msg)
1979 {
1980         struct nlattr *ftm;
1981
1982         if (!cap->ftm.supported)
1983                 return 0;
1984
1985         ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
1986         if (!ftm)
1987                 return -ENOBUFS;
1988
1989         if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
1990                 return -ENOBUFS;
1991         if (cap->ftm.non_asap &&
1992             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
1993                 return -ENOBUFS;
1994         if (cap->ftm.request_lci &&
1995             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
1996                 return -ENOBUFS;
1997         if (cap->ftm.request_civicloc &&
1998             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
1999                 return -ENOBUFS;
2000         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2001                         cap->ftm.preambles))
2002                 return -ENOBUFS;
2003         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2004                         cap->ftm.bandwidths))
2005                 return -ENOBUFS;
2006         if (cap->ftm.max_bursts_exponent >= 0 &&
2007             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2008                         cap->ftm.max_bursts_exponent))
2009                 return -ENOBUFS;
2010         if (cap->ftm.max_ftms_per_burst &&
2011             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2012                         cap->ftm.max_ftms_per_burst))
2013                 return -ENOBUFS;
2014         if (cap->ftm.trigger_based &&
2015             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2016                 return -ENOBUFS;
2017         if (cap->ftm.non_trigger_based &&
2018             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2019                 return -ENOBUFS;
2020
2021         nla_nest_end(msg, ftm);
2022         return 0;
2023 }
2024
2025 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2026                                   struct sk_buff *msg)
2027 {
2028         const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2029         struct nlattr *pmsr, *caps;
2030
2031         if (!cap)
2032                 return 0;
2033
2034         /*
2035          * we don't need to clean up anything here since the caller
2036          * will genlmsg_cancel() if we fail
2037          */
2038
2039         pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2040         if (!pmsr)
2041                 return -ENOBUFS;
2042
2043         if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2044                 return -ENOBUFS;
2045
2046         if (cap->report_ap_tsf &&
2047             nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2048                 return -ENOBUFS;
2049
2050         if (cap->randomize_mac_addr &&
2051             nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2052                 return -ENOBUFS;
2053
2054         caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2055         if (!caps)
2056                 return -ENOBUFS;
2057
2058         if (nl80211_send_pmsr_ftm_capa(cap, msg))
2059                 return -ENOBUFS;
2060
2061         nla_nest_end(msg, caps);
2062         nla_nest_end(msg, pmsr);
2063
2064         return 0;
2065 }
2066
2067 static int
2068 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2069                               struct sk_buff *msg)
2070 {
2071         int i;
2072         struct nlattr *nested, *nested_akms;
2073         const struct wiphy_iftype_akm_suites *iftype_akms;
2074
2075         if (!rdev->wiphy.num_iftype_akm_suites ||
2076             !rdev->wiphy.iftype_akm_suites)
2077                 return 0;
2078
2079         nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2080         if (!nested)
2081                 return -ENOBUFS;
2082
2083         for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2084                 nested_akms = nla_nest_start(msg, i + 1);
2085                 if (!nested_akms)
2086                         return -ENOBUFS;
2087
2088                 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2089
2090                 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2091                                         iftype_akms->iftypes_mask))
2092                         return -ENOBUFS;
2093
2094                 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2095                             sizeof(u32) * iftype_akms->n_akm_suites,
2096                             iftype_akms->akm_suites)) {
2097                         return -ENOBUFS;
2098                 }
2099                 nla_nest_end(msg, nested_akms);
2100         }
2101
2102         nla_nest_end(msg, nested);
2103
2104         return 0;
2105 }
2106
2107 static int
2108 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2109                                struct sk_buff *msg)
2110 {
2111         struct nlattr *supp;
2112
2113         if (!rdev->wiphy.tid_config_support.vif &&
2114             !rdev->wiphy.tid_config_support.peer)
2115                 return 0;
2116
2117         supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2118         if (!supp)
2119                 return -ENOSPC;
2120
2121         if (rdev->wiphy.tid_config_support.vif &&
2122             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2123                               rdev->wiphy.tid_config_support.vif,
2124                               NL80211_TID_CONFIG_ATTR_PAD))
2125                 goto fail;
2126
2127         if (rdev->wiphy.tid_config_support.peer &&
2128             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2129                               rdev->wiphy.tid_config_support.peer,
2130                               NL80211_TID_CONFIG_ATTR_PAD))
2131                 goto fail;
2132
2133         /* for now we just use the same value ... makes more sense */
2134         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2135                        rdev->wiphy.tid_config_support.max_retry))
2136                 goto fail;
2137         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2138                        rdev->wiphy.tid_config_support.max_retry))
2139                 goto fail;
2140
2141         nla_nest_end(msg, supp);
2142
2143         return 0;
2144 fail:
2145         nla_nest_cancel(msg, supp);
2146         return -ENOBUFS;
2147 }
2148
2149 static int
2150 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2151                       struct sk_buff *msg)
2152 {
2153         struct nlattr *sar_capa, *specs, *sub_freq_range;
2154         u8 num_freq_ranges;
2155         int i;
2156
2157         if (!rdev->wiphy.sar_capa)
2158                 return 0;
2159
2160         num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2161
2162         sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2163         if (!sar_capa)
2164                 return -ENOSPC;
2165
2166         if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2167                 goto fail;
2168
2169         specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2170         if (!specs)
2171                 goto fail;
2172
2173         /* report supported freq_ranges */
2174         for (i = 0; i < num_freq_ranges; i++) {
2175                 sub_freq_range = nla_nest_start(msg, i + 1);
2176                 if (!sub_freq_range)
2177                         goto fail;
2178
2179                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2180                                 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2181                         goto fail;
2182
2183                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2184                                 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2185                         goto fail;
2186
2187                 nla_nest_end(msg, sub_freq_range);
2188         }
2189
2190         nla_nest_end(msg, specs);
2191         nla_nest_end(msg, sar_capa);
2192
2193         return 0;
2194 fail:
2195         nla_nest_cancel(msg, sar_capa);
2196         return -ENOBUFS;
2197 }
2198
2199 struct nl80211_dump_wiphy_state {
2200         s64 filter_wiphy;
2201         long start;
2202         long split_start, band_start, chan_start, capa_start;
2203         bool split;
2204 };
2205
2206 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2207                               enum nl80211_commands cmd,
2208                               struct sk_buff *msg, u32 portid, u32 seq,
2209                               int flags, struct nl80211_dump_wiphy_state *state)
2210 {
2211         void *hdr;
2212         struct nlattr *nl_bands, *nl_band;
2213         struct nlattr *nl_freqs, *nl_freq;
2214         struct nlattr *nl_cmds;
2215         enum nl80211_band band;
2216         struct ieee80211_channel *chan;
2217         int i;
2218         const struct ieee80211_txrx_stypes *mgmt_stypes =
2219                                 rdev->wiphy.mgmt_stypes;
2220         u32 features;
2221
2222         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2223         if (!hdr)
2224                 return -ENOBUFS;
2225
2226         if (WARN_ON(!state))
2227                 return -EINVAL;
2228
2229         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2230             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2231                            wiphy_name(&rdev->wiphy)) ||
2232             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2233                         cfg80211_rdev_list_generation))
2234                 goto nla_put_failure;
2235
2236         if (cmd != NL80211_CMD_NEW_WIPHY)
2237                 goto finish;
2238
2239         switch (state->split_start) {
2240         case 0:
2241                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2242                                rdev->wiphy.retry_short) ||
2243                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2244                                rdev->wiphy.retry_long) ||
2245                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2246                                 rdev->wiphy.frag_threshold) ||
2247                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2248                                 rdev->wiphy.rts_threshold) ||
2249                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2250                                rdev->wiphy.coverage_class) ||
2251                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2252                                rdev->wiphy.max_scan_ssids) ||
2253                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2254                                rdev->wiphy.max_sched_scan_ssids) ||
2255                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2256                                 rdev->wiphy.max_scan_ie_len) ||
2257                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2258                                 rdev->wiphy.max_sched_scan_ie_len) ||
2259                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2260                                rdev->wiphy.max_match_sets))
2261                         goto nla_put_failure;
2262
2263                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2264                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2265                         goto nla_put_failure;
2266                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2267                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2268                         goto nla_put_failure;
2269                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2270                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2271                         goto nla_put_failure;
2272                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2273                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2274                         goto nla_put_failure;
2275                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2276                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2277                         goto nla_put_failure;
2278                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2279                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2280                         goto nla_put_failure;
2281                 state->split_start++;
2282                 if (state->split)
2283                         break;
2284                 fallthrough;
2285         case 1:
2286                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2287                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
2288                             rdev->wiphy.cipher_suites))
2289                         goto nla_put_failure;
2290
2291                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2292                                rdev->wiphy.max_num_pmkids))
2293                         goto nla_put_failure;
2294
2295                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2296                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2297                         goto nla_put_failure;
2298
2299                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2300                                 rdev->wiphy.available_antennas_tx) ||
2301                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2302                                 rdev->wiphy.available_antennas_rx))
2303                         goto nla_put_failure;
2304
2305                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2306                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2307                                 rdev->wiphy.probe_resp_offload))
2308                         goto nla_put_failure;
2309
2310                 if ((rdev->wiphy.available_antennas_tx ||
2311                      rdev->wiphy.available_antennas_rx) &&
2312                     rdev->ops->get_antenna) {
2313                         u32 tx_ant = 0, rx_ant = 0;
2314                         int res;
2315
2316                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2317                         if (!res) {
2318                                 if (nla_put_u32(msg,
2319                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
2320                                                 tx_ant) ||
2321                                     nla_put_u32(msg,
2322                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
2323                                                 rx_ant))
2324                                         goto nla_put_failure;
2325                         }
2326                 }
2327
2328                 state->split_start++;
2329                 if (state->split)
2330                         break;
2331                 fallthrough;
2332         case 2:
2333                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2334                                         rdev->wiphy.interface_modes))
2335                                 goto nla_put_failure;
2336                 state->split_start++;
2337                 if (state->split)
2338                         break;
2339                 fallthrough;
2340         case 3:
2341                 nl_bands = nla_nest_start_noflag(msg,
2342                                                  NL80211_ATTR_WIPHY_BANDS);
2343                 if (!nl_bands)
2344                         goto nla_put_failure;
2345
2346                 for (band = state->band_start;
2347                      band < NUM_NL80211_BANDS; band++) {
2348                         struct ieee80211_supported_band *sband;
2349
2350                         /* omit higher bands for ancient software */
2351                         if (band > NL80211_BAND_5GHZ && !state->split)
2352                                 break;
2353
2354                         sband = rdev->wiphy.bands[band];
2355
2356                         if (!sband)
2357                                 continue;
2358
2359                         nl_band = nla_nest_start_noflag(msg, band);
2360                         if (!nl_band)
2361                                 goto nla_put_failure;
2362
2363                         switch (state->chan_start) {
2364                         case 0:
2365                                 if (nl80211_send_band_rateinfo(msg, sband,
2366                                                                state->split))
2367                                         goto nla_put_failure;
2368                                 state->chan_start++;
2369                                 if (state->split)
2370                                         break;
2371                                 fallthrough;
2372                         default:
2373                                 /* add frequencies */
2374                                 nl_freqs = nla_nest_start_noflag(msg,
2375                                                                  NL80211_BAND_ATTR_FREQS);
2376                                 if (!nl_freqs)
2377                                         goto nla_put_failure;
2378
2379                                 for (i = state->chan_start - 1;
2380                                      i < sband->n_channels;
2381                                      i++) {
2382                                         nl_freq = nla_nest_start_noflag(msg,
2383                                                                         i);
2384                                         if (!nl_freq)
2385                                                 goto nla_put_failure;
2386
2387                                         chan = &sband->channels[i];
2388
2389                                         if (nl80211_msg_put_channel(
2390                                                         msg, &rdev->wiphy, chan,
2391                                                         state->split))
2392                                                 goto nla_put_failure;
2393
2394                                         nla_nest_end(msg, nl_freq);
2395                                         if (state->split)
2396                                                 break;
2397                                 }
2398                                 if (i < sband->n_channels)
2399                                         state->chan_start = i + 2;
2400                                 else
2401                                         state->chan_start = 0;
2402                                 nla_nest_end(msg, nl_freqs);
2403                         }
2404
2405                         nla_nest_end(msg, nl_band);
2406
2407                         if (state->split) {
2408                                 /* start again here */
2409                                 if (state->chan_start)
2410                                         band--;
2411                                 break;
2412                         }
2413                 }
2414                 nla_nest_end(msg, nl_bands);
2415
2416                 if (band < NUM_NL80211_BANDS)
2417                         state->band_start = band + 1;
2418                 else
2419                         state->band_start = 0;
2420
2421                 /* if bands & channels are done, continue outside */
2422                 if (state->band_start == 0 && state->chan_start == 0)
2423                         state->split_start++;
2424                 if (state->split)
2425                         break;
2426                 fallthrough;
2427         case 4:
2428                 nl_cmds = nla_nest_start_noflag(msg,
2429                                                 NL80211_ATTR_SUPPORTED_COMMANDS);
2430                 if (!nl_cmds)
2431                         goto nla_put_failure;
2432
2433                 i = nl80211_add_commands_unsplit(rdev, msg);
2434                 if (i < 0)
2435                         goto nla_put_failure;
2436                 if (state->split) {
2437                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
2438                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2439                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2440                                 CMD(channel_switch, CHANNEL_SWITCH);
2441                         CMD(set_qos_map, SET_QOS_MAP);
2442                         if (rdev->wiphy.features &
2443                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2444                                 CMD(add_tx_ts, ADD_TX_TS);
2445                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2446                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2447                         CMD(update_ft_ies, UPDATE_FT_IES);
2448                         if (rdev->wiphy.sar_capa)
2449                                 CMD(set_sar_specs, SET_SAR_SPECS);
2450                 }
2451 #undef CMD
2452
2453                 nla_nest_end(msg, nl_cmds);
2454                 state->split_start++;
2455                 if (state->split)
2456                         break;
2457                 fallthrough;
2458         case 5:
2459                 if (rdev->ops->remain_on_channel &&
2460                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2461                     nla_put_u32(msg,
2462                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2463                                 rdev->wiphy.max_remain_on_channel_duration))
2464                         goto nla_put_failure;
2465
2466                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2467                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2468                         goto nla_put_failure;
2469
2470                 state->split_start++;
2471                 if (state->split)
2472                         break;
2473                 fallthrough;
2474         case 6:
2475 #ifdef CONFIG_PM
2476                 if (nl80211_send_wowlan(msg, rdev, state->split))
2477                         goto nla_put_failure;
2478                 state->split_start++;
2479                 if (state->split)
2480                         break;
2481 #else
2482                 state->split_start++;
2483 #endif
2484                 fallthrough;
2485         case 7:
2486                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2487                                         rdev->wiphy.software_iftypes))
2488                         goto nla_put_failure;
2489
2490                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2491                                                    state->split))
2492                         goto nla_put_failure;
2493
2494                 state->split_start++;
2495                 if (state->split)
2496                         break;
2497                 fallthrough;
2498         case 8:
2499                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2500                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2501                                 rdev->wiphy.ap_sme_capa))
2502                         goto nla_put_failure;
2503
2504                 features = rdev->wiphy.features;
2505                 /*
2506                  * We can only add the per-channel limit information if the
2507                  * dump is split, otherwise it makes it too big. Therefore
2508                  * only advertise it in that case.
2509                  */
2510                 if (state->split)
2511                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2512                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2513                         goto nla_put_failure;
2514
2515                 if (rdev->wiphy.ht_capa_mod_mask &&
2516                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2517                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
2518                             rdev->wiphy.ht_capa_mod_mask))
2519                         goto nla_put_failure;
2520
2521                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2522                     rdev->wiphy.max_acl_mac_addrs &&
2523                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2524                                 rdev->wiphy.max_acl_mac_addrs))
2525                         goto nla_put_failure;
2526
2527                 /*
2528                  * Any information below this point is only available to
2529                  * applications that can deal with it being split. This
2530                  * helps ensure that newly added capabilities don't break
2531                  * older tools by overrunning their buffers.
2532                  *
2533                  * We still increment split_start so that in the split
2534                  * case we'll continue with more data in the next round,
2535                  * but break unconditionally so unsplit data stops here.
2536                  */
2537                 if (state->split)
2538                         state->split_start++;
2539                 else
2540                         state->split_start = 0;
2541                 break;
2542         case 9:
2543                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2544                         goto nla_put_failure;
2545
2546                 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2547                                 rdev->wiphy.max_sched_scan_plans) ||
2548                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2549                                 rdev->wiphy.max_sched_scan_plan_interval) ||
2550                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2551                                 rdev->wiphy.max_sched_scan_plan_iterations))
2552                         goto nla_put_failure;
2553
2554                 if (rdev->wiphy.extended_capabilities &&
2555                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2556                              rdev->wiphy.extended_capabilities_len,
2557                              rdev->wiphy.extended_capabilities) ||
2558                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2559                              rdev->wiphy.extended_capabilities_len,
2560                              rdev->wiphy.extended_capabilities_mask)))
2561                         goto nla_put_failure;
2562
2563                 if (rdev->wiphy.vht_capa_mod_mask &&
2564                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2565                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
2566                             rdev->wiphy.vht_capa_mod_mask))
2567                         goto nla_put_failure;
2568
2569                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2570                             rdev->wiphy.perm_addr))
2571                         goto nla_put_failure;
2572
2573                 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2574                     nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2575                             rdev->wiphy.addr_mask))
2576                         goto nla_put_failure;
2577
2578                 if (rdev->wiphy.n_addresses > 1) {
2579                         void *attr;
2580
2581                         attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2582                         if (!attr)
2583                                 goto nla_put_failure;
2584
2585                         for (i = 0; i < rdev->wiphy.n_addresses; i++)
2586                                 if (nla_put(msg, i + 1, ETH_ALEN,
2587                                             rdev->wiphy.addresses[i].addr))
2588                                         goto nla_put_failure;
2589
2590                         nla_nest_end(msg, attr);
2591                 }
2592
2593                 state->split_start++;
2594                 break;
2595         case 10:
2596                 if (nl80211_send_coalesce(msg, rdev))
2597                         goto nla_put_failure;
2598
2599                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2600                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2601                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2602                         goto nla_put_failure;
2603
2604                 if (rdev->wiphy.max_ap_assoc_sta &&
2605                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2606                                 rdev->wiphy.max_ap_assoc_sta))
2607                         goto nla_put_failure;
2608
2609                 state->split_start++;
2610                 break;
2611         case 11:
2612                 if (rdev->wiphy.n_vendor_commands) {
2613                         const struct nl80211_vendor_cmd_info *info;
2614                         struct nlattr *nested;
2615
2616                         nested = nla_nest_start_noflag(msg,
2617                                                        NL80211_ATTR_VENDOR_DATA);
2618                         if (!nested)
2619                                 goto nla_put_failure;
2620
2621                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2622                                 info = &rdev->wiphy.vendor_commands[i].info;
2623                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2624                                         goto nla_put_failure;
2625                         }
2626                         nla_nest_end(msg, nested);
2627                 }
2628
2629                 if (rdev->wiphy.n_vendor_events) {
2630                         const struct nl80211_vendor_cmd_info *info;
2631                         struct nlattr *nested;
2632
2633                         nested = nla_nest_start_noflag(msg,
2634                                                        NL80211_ATTR_VENDOR_EVENTS);
2635                         if (!nested)
2636                                 goto nla_put_failure;
2637
2638                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2639                                 info = &rdev->wiphy.vendor_events[i];
2640                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2641                                         goto nla_put_failure;
2642                         }
2643                         nla_nest_end(msg, nested);
2644                 }
2645                 state->split_start++;
2646                 break;
2647         case 12:
2648                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2649                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2650                                rdev->wiphy.max_num_csa_counters))
2651                         goto nla_put_failure;
2652
2653                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2654                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2655                         goto nla_put_failure;
2656
2657                 if (rdev->wiphy.max_sched_scan_reqs &&
2658                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2659                                 rdev->wiphy.max_sched_scan_reqs))
2660                         goto nla_put_failure;
2661
2662                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2663                             sizeof(rdev->wiphy.ext_features),
2664                             rdev->wiphy.ext_features))
2665                         goto nla_put_failure;
2666
2667                 if (rdev->wiphy.bss_select_support) {
2668                         struct nlattr *nested;
2669                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2670
2671                         nested = nla_nest_start_noflag(msg,
2672                                                        NL80211_ATTR_BSS_SELECT);
2673                         if (!nested)
2674                                 goto nla_put_failure;
2675
2676                         i = 0;
2677                         while (bss_select_support) {
2678                                 if ((bss_select_support & 1) &&
2679                                     nla_put_flag(msg, i))
2680                                         goto nla_put_failure;
2681                                 i++;
2682                                 bss_select_support >>= 1;
2683                         }
2684                         nla_nest_end(msg, nested);
2685                 }
2686
2687                 state->split_start++;
2688                 break;
2689         case 13:
2690                 if (rdev->wiphy.num_iftype_ext_capab &&
2691                     rdev->wiphy.iftype_ext_capab) {
2692                         struct nlattr *nested_ext_capab, *nested;
2693
2694                         nested = nla_nest_start_noflag(msg,
2695                                                        NL80211_ATTR_IFTYPE_EXT_CAPA);
2696                         if (!nested)
2697                                 goto nla_put_failure;
2698
2699                         for (i = state->capa_start;
2700                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2701                                 const struct wiphy_iftype_ext_capab *capab;
2702
2703                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2704
2705                                 nested_ext_capab = nla_nest_start_noflag(msg,
2706                                                                          i);
2707                                 if (!nested_ext_capab ||
2708                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2709                                                 capab->iftype) ||
2710                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2711                                             capab->extended_capabilities_len,
2712                                             capab->extended_capabilities) ||
2713                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2714                                             capab->extended_capabilities_len,
2715                                             capab->extended_capabilities_mask))
2716                                         goto nla_put_failure;
2717
2718                                 nla_nest_end(msg, nested_ext_capab);
2719                                 if (state->split)
2720                                         break;
2721                         }
2722                         nla_nest_end(msg, nested);
2723                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2724                                 state->capa_start = i + 1;
2725                                 break;
2726                         }
2727                 }
2728
2729                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2730                                 rdev->wiphy.nan_supported_bands))
2731                         goto nla_put_failure;
2732
2733                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2734                                             NL80211_EXT_FEATURE_TXQS)) {
2735                         struct cfg80211_txq_stats txqstats = {};
2736                         int res;
2737
2738                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2739                         if (!res &&
2740                             !nl80211_put_txq_stats(msg, &txqstats,
2741                                                    NL80211_ATTR_TXQ_STATS))
2742                                 goto nla_put_failure;
2743
2744                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2745                                         rdev->wiphy.txq_limit))
2746                                 goto nla_put_failure;
2747                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2748                                         rdev->wiphy.txq_memory_limit))
2749                                 goto nla_put_failure;
2750                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2751                                         rdev->wiphy.txq_quantum))
2752                                 goto nla_put_failure;
2753                 }
2754
2755                 state->split_start++;
2756                 break;
2757         case 14:
2758                 if (nl80211_send_pmsr_capa(rdev, msg))
2759                         goto nla_put_failure;
2760
2761                 state->split_start++;
2762                 break;
2763         case 15:
2764                 if (rdev->wiphy.akm_suites &&
2765                     nla_put(msg, NL80211_ATTR_AKM_SUITES,
2766                             sizeof(u32) * rdev->wiphy.n_akm_suites,
2767                             rdev->wiphy.akm_suites))
2768                         goto nla_put_failure;
2769
2770                 if (nl80211_put_iftype_akm_suites(rdev, msg))
2771                         goto nla_put_failure;
2772
2773                 if (nl80211_put_tid_config_support(rdev, msg))
2774                         goto nla_put_failure;
2775                 state->split_start++;
2776                 break;
2777         case 16:
2778                 if (nl80211_put_sar_specs(rdev, msg))
2779                         goto nla_put_failure;
2780
2781                 /* done */
2782                 state->split_start = 0;
2783                 break;
2784         }
2785  finish:
2786         genlmsg_end(msg, hdr);
2787         return 0;
2788
2789  nla_put_failure:
2790         genlmsg_cancel(msg, hdr);
2791         return -EMSGSIZE;
2792 }
2793
2794 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2795                                     struct netlink_callback *cb,
2796                                     struct nl80211_dump_wiphy_state *state)
2797 {
2798         struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
2799         int ret;
2800
2801         if (!tb)
2802                 return -ENOMEM;
2803
2804         ret = nlmsg_parse_deprecated(cb->nlh,
2805                                      GENL_HDRLEN + nl80211_fam.hdrsize,
2806                                      tb, nl80211_fam.maxattr,
2807                                      nl80211_policy, NULL);
2808         /* ignore parse errors for backward compatibility */
2809         if (ret) {
2810                 ret = 0;
2811                 goto out;
2812         }
2813
2814         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2815         if (tb[NL80211_ATTR_WIPHY])
2816                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2817         if (tb[NL80211_ATTR_WDEV])
2818                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2819         if (tb[NL80211_ATTR_IFINDEX]) {
2820                 struct net_device *netdev;
2821                 struct cfg80211_registered_device *rdev;
2822                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2823
2824                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2825                 if (!netdev) {
2826                         ret = -ENODEV;
2827                         goto out;
2828                 }
2829                 if (netdev->ieee80211_ptr) {
2830                         rdev = wiphy_to_rdev(
2831                                 netdev->ieee80211_ptr->wiphy);
2832                         state->filter_wiphy = rdev->wiphy_idx;
2833                 }
2834         }
2835
2836         ret = 0;
2837 out:
2838         kfree(tb);
2839         return ret;
2840 }
2841
2842 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2843 {
2844         int idx = 0, ret;
2845         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2846         struct cfg80211_registered_device *rdev;
2847
2848         rtnl_lock();
2849         if (!state) {
2850                 state = kzalloc(sizeof(*state), GFP_KERNEL);
2851                 if (!state) {
2852                         rtnl_unlock();
2853                         return -ENOMEM;
2854                 }
2855                 state->filter_wiphy = -1;
2856                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2857                 if (ret) {
2858                         kfree(state);
2859                         rtnl_unlock();
2860                         return ret;
2861                 }
2862                 cb->args[0] = (long)state;
2863         }
2864
2865         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2866                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2867                         continue;
2868                 if (++idx <= state->start)
2869                         continue;
2870                 if (state->filter_wiphy != -1 &&
2871                     state->filter_wiphy != rdev->wiphy_idx)
2872                         continue;
2873                 /* attempt to fit multiple wiphy data chunks into the skb */
2874                 do {
2875                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2876                                                  skb,
2877                                                  NETLINK_CB(cb->skb).portid,
2878                                                  cb->nlh->nlmsg_seq,
2879                                                  NLM_F_MULTI, state);
2880                         if (ret < 0) {
2881                                 /*
2882                                  * If sending the wiphy data didn't fit (ENOBUFS
2883                                  * or EMSGSIZE returned), this SKB is still
2884                                  * empty (so it's not too big because another
2885                                  * wiphy dataset is already in the skb) and
2886                                  * we've not tried to adjust the dump allocation
2887                                  * yet ... then adjust the alloc size to be
2888                                  * bigger, and return 1 but with the empty skb.
2889                                  * This results in an empty message being RX'ed
2890                                  * in userspace, but that is ignored.
2891                                  *
2892                                  * We can then retry with the larger buffer.
2893                                  */
2894                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2895                                     !skb->len && !state->split &&
2896                                     cb->min_dump_alloc < 4096) {
2897                                         cb->min_dump_alloc = 4096;
2898                                         state->split_start = 0;
2899                                         rtnl_unlock();
2900                                         return 1;
2901                                 }
2902                                 idx--;
2903                                 break;
2904                         }
2905                 } while (state->split_start > 0);
2906                 break;
2907         }
2908         rtnl_unlock();
2909
2910         state->start = idx;
2911
2912         return skb->len;
2913 }
2914
2915 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2916 {
2917         kfree((void *)cb->args[0]);
2918         return 0;
2919 }
2920
2921 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2922 {
2923         struct sk_buff *msg;
2924         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2925         struct nl80211_dump_wiphy_state state = {};
2926
2927         msg = nlmsg_new(4096, GFP_KERNEL);
2928         if (!msg)
2929                 return -ENOMEM;
2930
2931         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2932                                info->snd_portid, info->snd_seq, 0,
2933                                &state) < 0) {
2934                 nlmsg_free(msg);
2935                 return -ENOBUFS;
2936         }
2937
2938         return genlmsg_reply(msg, info);
2939 }
2940
2941 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2942         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2943         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2944         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2945         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2946         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2947 };
2948
2949 static int parse_txq_params(struct nlattr *tb[],
2950                             struct ieee80211_txq_params *txq_params)
2951 {
2952         u8 ac;
2953
2954         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2955             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2956             !tb[NL80211_TXQ_ATTR_AIFS])
2957                 return -EINVAL;
2958
2959         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2960         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2961         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2962         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2963         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2964
2965         if (ac >= NL80211_NUM_ACS)
2966                 return -EINVAL;
2967         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2968         return 0;
2969 }
2970
2971 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2972 {
2973         /*
2974          * You can only set the channel explicitly for some interfaces,
2975          * most have their channel managed via their respective
2976          * "establish a connection" command (connect, join, ...)
2977          *
2978          * For AP/GO and mesh mode, the channel can be set with the
2979          * channel userspace API, but is only stored and passed to the
2980          * low-level driver when the AP starts or the mesh is joined.
2981          * This is for backward compatibility, userspace can also give
2982          * the channel in the start-ap or join-mesh commands instead.
2983          *
2984          * Monitors are special as they are normally slaved to
2985          * whatever else is going on, so they have their own special
2986          * operation to set the monitor channel if possible.
2987          */
2988         return !wdev ||
2989                 wdev->iftype == NL80211_IFTYPE_AP ||
2990                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2991                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2992                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2993 }
2994
2995 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2996                           struct genl_info *info,
2997                           struct cfg80211_chan_def *chandef)
2998 {
2999         struct netlink_ext_ack *extack = info->extack;
3000         struct nlattr **attrs = info->attrs;
3001         u32 control_freq;
3002
3003         if (!attrs[NL80211_ATTR_WIPHY_FREQ])
3004                 return -EINVAL;
3005
3006         control_freq = MHZ_TO_KHZ(
3007                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3008         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3009                 control_freq +=
3010                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3011
3012         memset(chandef, 0, sizeof(*chandef));
3013         chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3014         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3015         chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3016         chandef->freq1_offset = control_freq % 1000;
3017         chandef->center_freq2 = 0;
3018
3019         /* Primary channel not allowed */
3020         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
3021                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3022                                     "Channel is disabled");
3023                 return -EINVAL;
3024         }
3025
3026         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3027                 enum nl80211_channel_type chantype;
3028
3029                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3030
3031                 switch (chantype) {
3032                 case NL80211_CHAN_NO_HT:
3033                 case NL80211_CHAN_HT20:
3034                 case NL80211_CHAN_HT40PLUS:
3035                 case NL80211_CHAN_HT40MINUS:
3036                         cfg80211_chandef_create(chandef, chandef->chan,
3037                                                 chantype);
3038                         /* user input for center_freq is incorrect */
3039                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3040                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3041                                 NL_SET_ERR_MSG_ATTR(extack,
3042                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
3043                                                     "bad center frequency 1");
3044                                 return -EINVAL;
3045                         }
3046                         /* center_freq2 must be zero */
3047                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3048                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3049                                 NL_SET_ERR_MSG_ATTR(extack,
3050                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
3051                                                     "center frequency 2 can't be used");
3052                                 return -EINVAL;
3053                         }
3054                         break;
3055                 default:
3056                         NL_SET_ERR_MSG_ATTR(extack,
3057                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3058                                             "invalid channel type");
3059                         return -EINVAL;
3060                 }
3061         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3062                 chandef->width =
3063                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3064                 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3065                         chandef->center_freq1 =
3066                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3067                         if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET])
3068                                 chandef->freq1_offset = nla_get_u32(
3069                                       attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]);
3070                         else
3071                                 chandef->freq1_offset = 0;
3072                 }
3073                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3074                         chandef->center_freq2 =
3075                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3076         }
3077
3078         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3079                 chandef->edmg.channels =
3080                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3081
3082                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3083                         chandef->edmg.bw_config =
3084                      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3085         } else {
3086                 chandef->edmg.bw_config = 0;
3087                 chandef->edmg.channels = 0;
3088         }
3089
3090         if (!cfg80211_chandef_valid(chandef)) {
3091                 NL_SET_ERR_MSG(extack, "invalid channel definition");
3092                 return -EINVAL;
3093         }
3094
3095         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
3096                                      IEEE80211_CHAN_DISABLED)) {
3097                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3098                 return -EINVAL;
3099         }
3100
3101         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3102              chandef->width == NL80211_CHAN_WIDTH_10) &&
3103             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3104                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3105                 return -EINVAL;
3106         }
3107
3108         return 0;
3109 }
3110
3111 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3112                                  struct net_device *dev,
3113                                  struct genl_info *info)
3114 {
3115         struct cfg80211_chan_def chandef;
3116         int result;
3117         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3118         struct wireless_dev *wdev = NULL;
3119
3120         if (dev)
3121                 wdev = dev->ieee80211_ptr;
3122         if (!nl80211_can_set_dev_channel(wdev))
3123                 return -EOPNOTSUPP;
3124         if (wdev)
3125                 iftype = wdev->iftype;
3126
3127         result = nl80211_parse_chandef(rdev, info, &chandef);
3128         if (result)
3129                 return result;
3130
3131         switch (iftype) {
3132         case NL80211_IFTYPE_AP:
3133         case NL80211_IFTYPE_P2P_GO:
3134                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3135                                                    iftype)) {
3136                         result = -EINVAL;
3137                         break;
3138                 }
3139                 if (wdev->beacon_interval) {
3140                         if (!dev || !rdev->ops->set_ap_chanwidth ||
3141                             !(rdev->wiphy.features &
3142                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
3143                                 result = -EBUSY;
3144                                 break;
3145                         }
3146
3147                         /* Only allow dynamic channel width changes */
3148                         if (chandef.chan != wdev->preset_chandef.chan) {
3149                                 result = -EBUSY;
3150                                 break;
3151                         }
3152                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
3153                         if (result)
3154                                 break;
3155                 }
3156                 wdev->preset_chandef = chandef;
3157                 result = 0;
3158                 break;
3159         case NL80211_IFTYPE_MESH_POINT:
3160                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3161                 break;
3162         case NL80211_IFTYPE_MONITOR:
3163                 result = cfg80211_set_monitor_channel(rdev, &chandef);
3164                 break;
3165         default:
3166                 result = -EINVAL;
3167         }
3168
3169         return result;
3170 }
3171
3172 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3173 {
3174         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3175         struct net_device *netdev = info->user_ptr[1];
3176
3177         return __nl80211_set_channel(rdev, netdev, info);
3178 }
3179
3180 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3181 {
3182         struct cfg80211_registered_device *rdev = NULL;
3183         struct net_device *netdev = NULL;
3184         struct wireless_dev *wdev;
3185         int result = 0, rem_txq_params = 0;
3186         struct nlattr *nl_txq_params;
3187         u32 changed;
3188         u8 retry_short = 0, retry_long = 0;
3189         u32 frag_threshold = 0, rts_threshold = 0;
3190         u8 coverage_class = 0;
3191         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3192
3193         rtnl_lock();
3194         /*
3195          * Try to find the wiphy and netdev. Normally this
3196          * function shouldn't need the netdev, but this is
3197          * done for backward compatibility -- previously
3198          * setting the channel was done per wiphy, but now
3199          * it is per netdev. Previous userland like hostapd
3200          * also passed a netdev to set_wiphy, so that it is
3201          * possible to let that go to the right netdev!
3202          */
3203
3204         if (info->attrs[NL80211_ATTR_IFINDEX]) {
3205                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3206
3207                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3208                 if (netdev && netdev->ieee80211_ptr)
3209                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3210                 else
3211                         netdev = NULL;
3212         }
3213
3214         if (!netdev) {
3215                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3216                                                   info->attrs);
3217                 if (IS_ERR(rdev)) {
3218                         rtnl_unlock();
3219                         return PTR_ERR(rdev);
3220                 }
3221                 wdev = NULL;
3222                 netdev = NULL;
3223                 result = 0;
3224         } else
3225                 wdev = netdev->ieee80211_ptr;
3226
3227         wiphy_lock(&rdev->wiphy);
3228
3229         /*
3230          * end workaround code, by now the rdev is available
3231          * and locked, and wdev may or may not be NULL.
3232          */
3233
3234         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3235                 result = cfg80211_dev_rename(
3236                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3237         rtnl_unlock();
3238
3239         if (result)
3240                 goto out;
3241
3242         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3243                 struct ieee80211_txq_params txq_params;
3244                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3245
3246                 if (!rdev->ops->set_txq_params) {
3247                         result = -EOPNOTSUPP;
3248                         goto out;
3249                 }
3250
3251                 if (!netdev) {
3252                         result = -EINVAL;
3253                         goto out;
3254                 }
3255
3256                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3257                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3258                         result = -EINVAL;
3259                         goto out;
3260                 }
3261
3262                 if (!netif_running(netdev)) {
3263                         result = -ENETDOWN;
3264                         goto out;
3265                 }
3266
3267                 nla_for_each_nested(nl_txq_params,
3268                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3269                                     rem_txq_params) {
3270                         result = nla_parse_nested_deprecated(tb,
3271                                                              NL80211_TXQ_ATTR_MAX,
3272                                                              nl_txq_params,
3273                                                              txq_params_policy,
3274                                                              info->extack);
3275                         if (result)
3276                                 goto out;
3277                         result = parse_txq_params(tb, &txq_params);
3278                         if (result)
3279                                 goto out;
3280
3281                         result = rdev_set_txq_params(rdev, netdev,
3282                                                      &txq_params);
3283                         if (result)
3284                                 goto out;
3285                 }
3286         }
3287
3288         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3289                 result = __nl80211_set_channel(
3290                         rdev,
3291                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3292                         info);
3293                 if (result)
3294                         goto out;
3295         }
3296
3297         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3298                 struct wireless_dev *txp_wdev = wdev;
3299                 enum nl80211_tx_power_setting type;
3300                 int idx, mbm = 0;
3301
3302                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3303                         txp_wdev = NULL;
3304
3305                 if (!rdev->ops->set_tx_power) {
3306                         result = -EOPNOTSUPP;
3307                         goto out;
3308                 }
3309
3310                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3311                 type = nla_get_u32(info->attrs[idx]);
3312
3313                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3314                     (type != NL80211_TX_POWER_AUTOMATIC)) {
3315                         result = -EINVAL;
3316                         goto out;
3317                 }
3318
3319                 if (type != NL80211_TX_POWER_AUTOMATIC) {
3320                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3321                         mbm = nla_get_u32(info->attrs[idx]);
3322                 }
3323
3324                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3325                 if (result)
3326                         goto out;
3327         }
3328
3329         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3330             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3331                 u32 tx_ant, rx_ant;
3332
3333                 if ((!rdev->wiphy.available_antennas_tx &&
3334                      !rdev->wiphy.available_antennas_rx) ||
3335                     !rdev->ops->set_antenna) {
3336                         result = -EOPNOTSUPP;
3337                         goto out;
3338                 }
3339
3340                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3341                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3342
3343                 /* reject antenna configurations which don't match the
3344                  * available antenna masks, except for the "all" mask */
3345                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3346                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
3347                         result = -EINVAL;
3348                         goto out;
3349                 }
3350
3351                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3352                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3353
3354                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3355                 if (result)
3356                         goto out;
3357         }
3358
3359         changed = 0;
3360
3361         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3362                 retry_short = nla_get_u8(
3363                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3364
3365                 changed |= WIPHY_PARAM_RETRY_SHORT;
3366         }
3367
3368         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3369                 retry_long = nla_get_u8(
3370                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3371
3372                 changed |= WIPHY_PARAM_RETRY_LONG;
3373         }
3374
3375         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3376                 frag_threshold = nla_get_u32(
3377                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3378                 if (frag_threshold < 256) {
3379                         result = -EINVAL;
3380                         goto out;
3381                 }
3382
3383                 if (frag_threshold != (u32) -1) {
3384                         /*
3385                          * Fragments (apart from the last one) are required to
3386                          * have even length. Make the fragmentation code
3387                          * simpler by stripping LSB should someone try to use
3388                          * odd threshold value.
3389                          */
3390                         frag_threshold &= ~0x1;
3391                 }
3392                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3393         }
3394
3395         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3396                 rts_threshold = nla_get_u32(
3397                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3398                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3399         }
3400
3401         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3402                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3403                         result = -EINVAL;
3404                         goto out;
3405                 }
3406
3407                 coverage_class = nla_get_u8(
3408                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3409                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
3410         }
3411
3412         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3413                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) {
3414                         result = -EOPNOTSUPP;
3415                         goto out;
3416                 }
3417
3418                 changed |= WIPHY_PARAM_DYN_ACK;
3419         }
3420
3421         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3422                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3423                                              NL80211_EXT_FEATURE_TXQS)) {
3424                         result = -EOPNOTSUPP;
3425                         goto out;
3426                 }
3427                 txq_limit = nla_get_u32(
3428                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3429                 changed |= WIPHY_PARAM_TXQ_LIMIT;
3430         }
3431
3432         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3433                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3434                                              NL80211_EXT_FEATURE_TXQS)) {
3435                         result = -EOPNOTSUPP;
3436                         goto out;
3437                 }
3438                 txq_memory_limit = nla_get_u32(
3439                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3440                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3441         }
3442
3443         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3444                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3445                                              NL80211_EXT_FEATURE_TXQS)) {
3446                         result = -EOPNOTSUPP;
3447                         goto out;
3448                 }
3449                 txq_quantum = nla_get_u32(
3450                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3451                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3452         }
3453
3454         if (changed) {
3455                 u8 old_retry_short, old_retry_long;
3456                 u32 old_frag_threshold, old_rts_threshold;
3457                 u8 old_coverage_class;
3458                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3459
3460                 if (!rdev->ops->set_wiphy_params) {
3461                         result = -EOPNOTSUPP;
3462                         goto out;
3463                 }
3464
3465                 old_retry_short = rdev->wiphy.retry_short;
3466                 old_retry_long = rdev->wiphy.retry_long;
3467                 old_frag_threshold = rdev->wiphy.frag_threshold;
3468                 old_rts_threshold = rdev->wiphy.rts_threshold;
3469                 old_coverage_class = rdev->wiphy.coverage_class;
3470                 old_txq_limit = rdev->wiphy.txq_limit;
3471                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3472                 old_txq_quantum = rdev->wiphy.txq_quantum;
3473
3474                 if (changed & WIPHY_PARAM_RETRY_SHORT)
3475                         rdev->wiphy.retry_short = retry_short;
3476                 if (changed & WIPHY_PARAM_RETRY_LONG)
3477                         rdev->wiphy.retry_long = retry_long;
3478                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3479                         rdev->wiphy.frag_threshold = frag_threshold;
3480                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3481                         rdev->wiphy.rts_threshold = rts_threshold;
3482                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3483                         rdev->wiphy.coverage_class = coverage_class;
3484                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3485                         rdev->wiphy.txq_limit = txq_limit;
3486                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3487                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
3488                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3489                         rdev->wiphy.txq_quantum = txq_quantum;
3490
3491                 result = rdev_set_wiphy_params(rdev, changed);
3492                 if (result) {
3493                         rdev->wiphy.retry_short = old_retry_short;
3494                         rdev->wiphy.retry_long = old_retry_long;
3495                         rdev->wiphy.frag_threshold = old_frag_threshold;
3496                         rdev->wiphy.rts_threshold = old_rts_threshold;
3497                         rdev->wiphy.coverage_class = old_coverage_class;
3498                         rdev->wiphy.txq_limit = old_txq_limit;
3499                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3500                         rdev->wiphy.txq_quantum = old_txq_quantum;
3501                         goto out;
3502                 }
3503         }
3504
3505         result = 0;
3506
3507 out:
3508         wiphy_unlock(&rdev->wiphy);
3509         return result;
3510 }
3511
3512 static int nl80211_send_chandef(struct sk_buff *msg,
3513                                 const struct cfg80211_chan_def *chandef)
3514 {
3515         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3516                 return -EINVAL;
3517
3518         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3519                         chandef->chan->center_freq))
3520                 return -ENOBUFS;
3521         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
3522                         chandef->chan->freq_offset))
3523                 return -ENOBUFS;
3524         switch (chandef->width) {
3525         case NL80211_CHAN_WIDTH_20_NOHT:
3526         case NL80211_CHAN_WIDTH_20:
3527         case NL80211_CHAN_WIDTH_40:
3528                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3529                                 cfg80211_get_chandef_type(chandef)))
3530                         return -ENOBUFS;
3531                 break;
3532         default:
3533                 break;
3534         }
3535         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3536                 return -ENOBUFS;
3537         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3538                 return -ENOBUFS;
3539         if (chandef->center_freq2 &&
3540             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3541                 return -ENOBUFS;
3542         return 0;
3543 }
3544
3545 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3546                               struct cfg80211_registered_device *rdev,
3547                               struct wireless_dev *wdev,
3548                               enum nl80211_commands cmd)
3549 {
3550         struct net_device *dev = wdev->netdev;
3551         void *hdr;
3552
3553         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3554                 cmd != NL80211_CMD_DEL_INTERFACE &&
3555                 cmd != NL80211_CMD_SET_INTERFACE);
3556
3557         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3558         if (!hdr)
3559                 return -1;
3560
3561         if (dev &&
3562             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3563              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3564                 goto nla_put_failure;
3565
3566         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3567             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3568             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3569                               NL80211_ATTR_PAD) ||
3570             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3571             nla_put_u32(msg, NL80211_ATTR_GENERATION,
3572                         rdev->devlist_generation ^
3573                         (cfg80211_rdev_list_generation << 2)) ||
3574             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3575                 goto nla_put_failure;
3576
3577         if (rdev->ops->get_channel) {
3578                 int ret;
3579                 struct cfg80211_chan_def chandef = {};
3580
3581                 ret = rdev_get_channel(rdev, wdev, &chandef);
3582                 if (ret == 0) {
3583                         if (nl80211_send_chandef(msg, &chandef))
3584                                 goto nla_put_failure;
3585                 }
3586         }
3587
3588         if (rdev->ops->get_tx_power) {
3589                 int dbm, ret;
3590
3591                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3592                 if (ret == 0 &&
3593                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3594                                 DBM_TO_MBM(dbm)))
3595                         goto nla_put_failure;
3596         }
3597
3598         wdev_lock(wdev);
3599         switch (wdev->iftype) {
3600         case NL80211_IFTYPE_AP:
3601                 if (wdev->ssid_len &&
3602                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
3603                         goto nla_put_failure_locked;
3604                 break;
3605         case NL80211_IFTYPE_STATION:
3606         case NL80211_IFTYPE_P2P_CLIENT:
3607         case NL80211_IFTYPE_ADHOC: {
3608                 const u8 *ssid_ie;
3609                 if (!wdev->current_bss)
3610                         break;
3611                 rcu_read_lock();
3612                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
3613                                                WLAN_EID_SSID);
3614                 if (ssid_ie &&
3615                     nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
3616                         goto nla_put_failure_rcu_locked;
3617                 rcu_read_unlock();
3618                 break;
3619                 }
3620         default:
3621                 /* nothing */
3622                 break;
3623         }
3624         wdev_unlock(wdev);
3625
3626         if (rdev->ops->get_txq_stats) {
3627                 struct cfg80211_txq_stats txqstats = {};
3628                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3629
3630                 if (ret == 0 &&
3631                     !nl80211_put_txq_stats(msg, &txqstats,
3632                                            NL80211_ATTR_TXQ_STATS))
3633                         goto nla_put_failure;
3634         }
3635
3636         genlmsg_end(msg, hdr);
3637         return 0;
3638
3639  nla_put_failure_rcu_locked:
3640         rcu_read_unlock();
3641  nla_put_failure_locked:
3642         wdev_unlock(wdev);
3643  nla_put_failure:
3644         genlmsg_cancel(msg, hdr);
3645         return -EMSGSIZE;
3646 }
3647
3648 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3649 {
3650         int wp_idx = 0;
3651         int if_idx = 0;
3652         int wp_start = cb->args[0];
3653         int if_start = cb->args[1];
3654         int filter_wiphy = -1;
3655         struct cfg80211_registered_device *rdev;
3656         struct wireless_dev *wdev;
3657         int ret;
3658
3659         rtnl_lock();
3660         if (!cb->args[2]) {
3661                 struct nl80211_dump_wiphy_state state = {
3662                         .filter_wiphy = -1,
3663                 };
3664
3665                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3666                 if (ret)
3667                         goto out_unlock;
3668
3669                 filter_wiphy = state.filter_wiphy;
3670
3671                 /*
3672                  * if filtering, set cb->args[2] to +1 since 0 is the default
3673                  * value needed to determine that parsing is necessary.
3674                  */
3675                 if (filter_wiphy >= 0)
3676                         cb->args[2] = filter_wiphy + 1;
3677                 else
3678                         cb->args[2] = -1;
3679         } else if (cb->args[2] > 0) {
3680                 filter_wiphy = cb->args[2] - 1;
3681         }
3682
3683         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3684                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3685                         continue;
3686                 if (wp_idx < wp_start) {
3687                         wp_idx++;
3688                         continue;
3689                 }
3690
3691                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3692                         continue;
3693
3694                 if_idx = 0;
3695
3696                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3697                         if (if_idx < if_start) {
3698                                 if_idx++;
3699                                 continue;
3700                         }
3701                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
3702                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
3703                                                rdev, wdev,
3704                                                NL80211_CMD_NEW_INTERFACE) < 0) {
3705                                 goto out;
3706                         }
3707                         if_idx++;
3708                 }
3709
3710                 wp_idx++;
3711         }
3712  out:
3713         cb->args[0] = wp_idx;
3714         cb->args[1] = if_idx;
3715
3716         ret = skb->len;
3717  out_unlock:
3718         rtnl_unlock();
3719
3720         return ret;
3721 }
3722
3723 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3724 {
3725         struct sk_buff *msg;
3726         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3727         struct wireless_dev *wdev = info->user_ptr[1];
3728
3729         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3730         if (!msg)
3731                 return -ENOMEM;
3732
3733         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3734                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3735                 nlmsg_free(msg);
3736                 return -ENOBUFS;
3737         }
3738
3739         return genlmsg_reply(msg, info);
3740 }
3741
3742 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3743         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3744         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3745         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
3746         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
3747         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
3748         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
3749 };
3750
3751 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
3752 {
3753         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
3754         int flag;
3755
3756         *mntrflags = 0;
3757
3758         if (!nla)
3759                 return -EINVAL;
3760
3761         if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
3762                 return -EINVAL;
3763
3764         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3765                 if (flags[flag])
3766                         *mntrflags |= (1<<flag);
3767
3768         *mntrflags |= MONITOR_FLAG_CHANGED;
3769
3770         return 0;
3771 }
3772
3773 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3774                                      enum nl80211_iftype type,
3775                                      struct genl_info *info,
3776                                      struct vif_params *params)
3777 {
3778         bool change = false;
3779         int err;
3780
3781         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3782                 if (type != NL80211_IFTYPE_MONITOR)
3783                         return -EINVAL;
3784
3785                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3786                                           &params->flags);
3787                 if (err)
3788                         return err;
3789
3790                 change = true;
3791         }
3792
3793         if (params->flags & MONITOR_FLAG_ACTIVE &&
3794             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3795                 return -EOPNOTSUPP;
3796
3797         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3798                 const u8 *mumimo_groups;
3799                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3800
3801                 if (type != NL80211_IFTYPE_MONITOR)
3802                         return -EINVAL;
3803
3804                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3805                         return -EOPNOTSUPP;
3806
3807                 mumimo_groups =
3808                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3809
3810                 /* bits 0 and 63 are reserved and must be zero */
3811                 if ((mumimo_groups[0] & BIT(0)) ||
3812                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3813                         return -EINVAL;
3814
3815                 params->vht_mumimo_groups = mumimo_groups;
3816                 change = true;
3817         }
3818
3819         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3820                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3821
3822                 if (type != NL80211_IFTYPE_MONITOR)
3823                         return -EINVAL;
3824
3825                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3826                         return -EOPNOTSUPP;
3827
3828                 params->vht_mumimo_follow_addr =
3829                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3830                 change = true;
3831         }
3832
3833         return change ? 1 : 0;
3834 }
3835
3836 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3837                                struct net_device *netdev, u8 use_4addr,
3838                                enum nl80211_iftype iftype)
3839 {
3840         if (!use_4addr) {
3841                 if (netdev && netif_is_bridge_port(netdev))
3842                         return -EBUSY;
3843                 return 0;
3844         }
3845
3846         switch (iftype) {
3847         case NL80211_IFTYPE_AP_VLAN:
3848                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3849                         return 0;
3850                 break;
3851         case NL80211_IFTYPE_STATION:
3852                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3853                         return 0;
3854                 break;
3855         default:
3856                 break;
3857         }
3858
3859         return -EOPNOTSUPP;
3860 }
3861
3862 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3863 {
3864         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3865         struct vif_params params;
3866         int err;
3867         enum nl80211_iftype otype, ntype;
3868         struct net_device *dev = info->user_ptr[1];
3869         bool change = false;
3870
3871         memset(&params, 0, sizeof(params));
3872
3873         otype = ntype = dev->ieee80211_ptr->iftype;
3874
3875         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3876                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3877                 if (otype != ntype)
3878                         change = true;
3879         }
3880
3881         if (info->attrs[NL80211_ATTR_MESH_ID]) {
3882                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3883
3884                 if (ntype != NL80211_IFTYPE_MESH_POINT)
3885                         return -EINVAL;
3886                 if (netif_running(dev))
3887                         return -EBUSY;
3888
3889                 wdev_lock(wdev);
3890                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3891                              IEEE80211_MAX_MESH_ID_LEN);
3892                 wdev->mesh_id_up_len =
3893                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3894                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3895                        wdev->mesh_id_up_len);
3896                 wdev_unlock(wdev);
3897         }
3898
3899         if (info->attrs[NL80211_ATTR_4ADDR]) {
3900                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3901                 change = true;
3902                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3903                 if (err)
3904                         return err;
3905         } else {
3906                 params.use_4addr = -1;
3907         }
3908
3909         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
3910         if (err < 0)
3911                 return err;
3912         if (err > 0)
3913                 change = true;
3914
3915         if (change)
3916                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
3917         else
3918                 err = 0;
3919
3920         if (!err && params.use_4addr != -1)
3921                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3922
3923         if (change && !err) {
3924                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3925
3926                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
3927         }
3928
3929         return err;
3930 }
3931
3932 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3933 {
3934         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3935         struct vif_params params;
3936         struct wireless_dev *wdev;
3937         struct sk_buff *msg;
3938         int err;
3939         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3940
3941         /* to avoid failing a new interface creation due to pending removal */
3942         cfg80211_destroy_ifaces(rdev);
3943
3944         memset(&params, 0, sizeof(params));
3945
3946         if (!info->attrs[NL80211_ATTR_IFNAME])
3947                 return -EINVAL;
3948
3949         if (info->attrs[NL80211_ATTR_IFTYPE])
3950                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3951
3952         if (!rdev->ops->add_virtual_intf)
3953                 return -EOPNOTSUPP;
3954
3955         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3956              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3957             info->attrs[NL80211_ATTR_MAC]) {
3958                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3959                            ETH_ALEN);
3960                 if (!is_valid_ether_addr(params.macaddr))
3961                         return -EADDRNOTAVAIL;
3962         }
3963
3964         if (info->attrs[NL80211_ATTR_4ADDR]) {
3965                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3966                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3967                 if (err)
3968                         return err;
3969         }
3970
3971         if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
3972                 return -EOPNOTSUPP;
3973
3974         err = nl80211_parse_mon_options(rdev, type, info, &params);
3975         if (err < 0)
3976                 return err;
3977
3978         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3979         if (!msg)
3980                 return -ENOMEM;
3981
3982         wdev = rdev_add_virtual_intf(rdev,
3983                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3984                                 NET_NAME_USER, type, &params);
3985         if (WARN_ON(!wdev)) {
3986                 nlmsg_free(msg);
3987                 return -EPROTO;
3988         } else if (IS_ERR(wdev)) {
3989                 nlmsg_free(msg);
3990                 return PTR_ERR(wdev);
3991         }
3992
3993         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3994                 wdev->owner_nlportid = info->snd_portid;
3995
3996         switch (type) {
3997         case NL80211_IFTYPE_MESH_POINT:
3998                 if (!info->attrs[NL80211_ATTR_MESH_ID])
3999                         break;
4000                 wdev_lock(wdev);
4001                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4002                              IEEE80211_MAX_MESH_ID_LEN);
4003                 wdev->mesh_id_up_len =
4004                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4005                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4006                        wdev->mesh_id_up_len);
4007                 wdev_unlock(wdev);
4008                 break;
4009         case NL80211_IFTYPE_NAN:
4010         case NL80211_IFTYPE_P2P_DEVICE:
4011                 /*
4012                  * P2P Device and NAN do not have a netdev, so don't go
4013                  * through the netdev notifier and must be added here
4014                  */
4015                 cfg80211_init_wdev(wdev);
4016                 cfg80211_register_wdev(rdev, wdev);
4017                 break;
4018         default:
4019                 break;
4020         }
4021
4022         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4023                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4024                 nlmsg_free(msg);
4025                 return -ENOBUFS;
4026         }
4027
4028         return genlmsg_reply(msg, info);
4029 }
4030
4031 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4032 {
4033         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4034         struct wireless_dev *wdev = info->user_ptr[1];
4035
4036         if (!rdev->ops->del_virtual_intf)
4037                 return -EOPNOTSUPP;
4038
4039         /*
4040          * We hold RTNL, so this is safe, without RTNL opencount cannot
4041          * reach 0, and thus the rdev cannot be deleted.
4042          *
4043          * We need to do it for the dev_close(), since that will call
4044          * the netdev notifiers, and we need to acquire the mutex there
4045          * but don't know if we get there from here or from some other
4046          * place (e.g. "ip link set ... down").
4047          */
4048         mutex_unlock(&rdev->wiphy.mtx);
4049
4050         /*
4051          * If we remove a wireless device without a netdev then clear
4052          * user_ptr[1] so that nl80211_post_doit won't dereference it
4053          * to check if it needs to do dev_put(). Otherwise it crashes
4054          * since the wdev has been freed, unlike with a netdev where
4055          * we need the dev_put() for the netdev to really be freed.
4056          */
4057         if (!wdev->netdev)
4058                 info->user_ptr[1] = NULL;
4059         else
4060                 dev_close(wdev->netdev);
4061
4062         mutex_lock(&rdev->wiphy.mtx);
4063
4064         return rdev_del_virtual_intf(rdev, wdev);
4065 }
4066
4067 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4068 {
4069         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4070         struct net_device *dev = info->user_ptr[1];
4071         u16 noack_map;
4072
4073         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4074                 return -EINVAL;
4075
4076         if (!rdev->ops->set_noack_map)
4077                 return -EOPNOTSUPP;
4078
4079         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4080
4081         return rdev_set_noack_map(rdev, dev, noack_map);
4082 }
4083
4084 struct get_key_cookie {
4085         struct sk_buff *msg;
4086         int error;
4087         int idx;
4088 };
4089
4090 static void get_key_callback(void *c, struct key_params *params)
4091 {
4092         struct nlattr *key;
4093         struct get_key_cookie *cookie = c;
4094
4095         if ((params->key &&
4096              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
4097                      params->key_len, params->key)) ||
4098             (params->seq &&
4099              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4100                      params->seq_len, params->seq)) ||
4101             (params->cipher &&
4102              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4103                          params->cipher)))
4104                 goto nla_put_failure;
4105
4106         key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4107         if (!key)
4108                 goto nla_put_failure;
4109
4110         if ((params->key &&
4111              nla_put(cookie->msg, NL80211_KEY_DATA,
4112                      params->key_len, params->key)) ||
4113             (params->seq &&
4114              nla_put(cookie->msg, NL80211_KEY_SEQ,
4115                      params->seq_len, params->seq)) ||
4116             (params->cipher &&
4117              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4118                          params->cipher)))
4119                 goto nla_put_failure;
4120
4121         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4122                 goto nla_put_failure;
4123
4124         nla_nest_end(cookie->msg, key);
4125
4126         return;
4127  nla_put_failure:
4128         cookie->error = 1;
4129 }
4130
4131 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4132 {
4133         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4134         int err;
4135         struct net_device *dev = info->user_ptr[1];
4136         u8 key_idx = 0;
4137         const u8 *mac_addr = NULL;
4138         bool pairwise;
4139         struct get_key_cookie cookie = {
4140                 .error = 0,
4141         };
4142         void *hdr;
4143         struct sk_buff *msg;
4144         bool bigtk_support = false;
4145
4146         if (wiphy_ext_feature_isset(&rdev->wiphy,
4147                                     NL80211_EXT_FEATURE_BEACON_PROTECTION))
4148                 bigtk_support = true;
4149
4150         if ((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION ||
4151              dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4152             wiphy_ext_feature_isset(&rdev->wiphy,
4153                                     NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4154                 bigtk_support = true;
4155
4156         if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4157                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4158
4159                 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4160                         GENL_SET_ERR_MSG(info, "BIGTK not supported");
4161                         return -EINVAL;
4162                 }
4163         }
4164
4165         if (info->attrs[NL80211_ATTR_MAC])
4166                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4167
4168         pairwise = !!mac_addr;
4169         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4170                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4171
4172                 if (kt != NL80211_KEYTYPE_GROUP &&
4173                     kt != NL80211_KEYTYPE_PAIRWISE)
4174                         return -EINVAL;
4175                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4176         }
4177
4178         if (!rdev->ops->get_key)
4179                 return -EOPNOTSUPP;
4180
4181         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4182                 return -ENOENT;
4183
4184         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4185         if (!msg)
4186                 return -ENOMEM;
4187
4188         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4189                              NL80211_CMD_NEW_KEY);
4190         if (!hdr)
4191                 goto nla_put_failure;
4192
4193         cookie.msg = msg;
4194         cookie.idx = key_idx;
4195
4196         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4197             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4198                 goto nla_put_failure;
4199         if (mac_addr &&
4200             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4201                 goto nla_put_failure;
4202
4203         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
4204                            get_key_callback);
4205
4206         if (err)
4207                 goto free_msg;
4208
4209         if (cookie.error)
4210                 goto nla_put_failure;
4211
4212         genlmsg_end(msg, hdr);
4213         return genlmsg_reply(msg, info);
4214
4215  nla_put_failure:
4216         err = -ENOBUFS;
4217  free_msg:
4218         nlmsg_free(msg);
4219         return err;
4220 }
4221
4222 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4223 {
4224         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4225         struct key_parse key;
4226         int err;
4227         struct net_device *dev = info->user_ptr[1];
4228
4229         err = nl80211_parse_key(info, &key);
4230         if (err)
4231                 return err;
4232
4233         if (key.idx < 0)
4234                 return -EINVAL;
4235
4236         /* Only support setting default key and
4237          * Extended Key ID action NL80211_KEY_SET_TX.
4238          */
4239         if (!key.def && !key.defmgmt && !key.defbeacon &&
4240             !(key.p.mode == NL80211_KEY_SET_TX))
4241                 return -EINVAL;
4242
4243         wdev_lock(dev->ieee80211_ptr);
4244
4245         if (key.def) {
4246                 if (!rdev->ops->set_default_key) {
4247                         err = -EOPNOTSUPP;
4248                         goto out;
4249                 }
4250
4251                 err = nl80211_key_allowed(dev->ieee80211_ptr);
4252                 if (err)
4253                         goto out;
4254
4255                 err = rdev_set_default_key(rdev, dev, key.idx,
4256                                                  key.def_uni, key.def_multi);
4257
4258                 if (err)
4259                         goto out;
4260
4261 #ifdef CONFIG_CFG80211_WEXT
4262                 dev->ieee80211_ptr->wext.default_key = key.idx;
4263 #endif
4264         } else if (key.defmgmt) {
4265                 if (key.def_uni || !key.def_multi) {
4266                         err = -EINVAL;
4267                         goto out;
4268                 }
4269
4270                 if (!rdev->ops->set_default_mgmt_key) {
4271                         err = -EOPNOTSUPP;
4272                         goto out;
4273                 }
4274
4275                 err = nl80211_key_allowed(dev->ieee80211_ptr);
4276                 if (err)
4277                         goto out;
4278
4279                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
4280                 if (err)
4281                         goto out;
4282
4283 #ifdef CONFIG_CFG80211_WEXT
4284                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
4285 #endif
4286         } else if (key.defbeacon) {
4287                 if (key.def_uni || !key.def_multi) {
4288                         err = -EINVAL;
4289                         goto out;
4290                 }
4291
4292                 if (!rdev->ops->set_default_beacon_key) {
4293                         err = -EOPNOTSUPP;
4294                         goto out;
4295                 }
4296
4297                 err = nl80211_key_allowed(dev->ieee80211_ptr);
4298                 if (err)
4299                         goto out;
4300
4301                 err = rdev_set_default_beacon_key(rdev, dev, key.idx);
4302                 if (err)
4303                         goto out;
4304         } else if (key.p.mode == NL80211_KEY_SET_TX &&
4305                    wiphy_ext_feature_isset(&rdev->wiphy,
4306                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4307                 u8 *mac_addr = NULL;
4308
4309                 if (info->attrs[NL80211_ATTR_MAC])
4310                         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4311
4312                 if (!mac_addr || key.idx < 0 || key.idx > 1) {
4313                         err = -EINVAL;
4314                         goto out;
4315                 }
4316
4317                 err = rdev_add_key(rdev, dev, key.idx,
4318                                    NL80211_KEYTYPE_PAIRWISE,
4319                                    mac_addr, &key.p);
4320         } else {
4321                 err = -EINVAL;
4322         }
4323  out:
4324         wdev_unlock(dev->ieee80211_ptr);
4325
4326         return err;
4327 }
4328
4329 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4330 {
4331         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4332         int err;
4333         struct net_device *dev = info->user_ptr[1];
4334         struct key_parse key;
4335         const u8 *mac_addr = NULL;
4336
4337         err = nl80211_parse_key(info, &key);
4338         if (err)
4339                 return err;
4340
4341         if (!key.p.key) {
4342                 GENL_SET_ERR_MSG(info, "no key");
4343                 return -EINVAL;
4344         }
4345
4346         if (info->attrs[NL80211_ATTR_MAC])
4347                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4348
4349         if (key.type == -1) {
4350                 if (mac_addr)
4351                         key.type = NL80211_KEYTYPE_PAIRWISE;
4352                 else
4353                         key.type = NL80211_KEYTYPE_GROUP;
4354         }
4355
4356         /* for now */
4357         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4358             key.type != NL80211_KEYTYPE_GROUP) {
4359                 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4360                 return -EINVAL;
4361         }
4362
4363         if (key.type == NL80211_KEYTYPE_GROUP &&
4364             info->attrs[NL80211_ATTR_VLAN_ID])
4365                 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4366
4367         if (!rdev->ops->add_key)
4368                 return -EOPNOTSUPP;
4369
4370         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4371                                            key.type == NL80211_KEYTYPE_PAIRWISE,
4372                                            mac_addr)) {
4373                 GENL_SET_ERR_MSG(info, "key setting validation failed");
4374                 return -EINVAL;
4375         }
4376
4377         wdev_lock(dev->ieee80211_ptr);
4378         err = nl80211_key_allowed(dev->ieee80211_ptr);
4379         if (err)
4380                 GENL_SET_ERR_MSG(info, "key not allowed");
4381         if (!err) {
4382                 err = rdev_add_key(rdev, dev, key.idx,
4383                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4384                                     mac_addr, &key.p);
4385                 if (err)
4386                         GENL_SET_ERR_MSG(info, "key addition failed");
4387         }
4388         wdev_unlock(dev->ieee80211_ptr);
4389
4390         return err;
4391 }
4392
4393 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4394 {
4395         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4396         int err;
4397         struct net_device *dev = info->user_ptr[1];
4398         u8 *mac_addr = NULL;
4399         struct key_parse key;
4400
4401         err = nl80211_parse_key(info, &key);
4402         if (err)
4403                 return err;
4404
4405         if (info->attrs[NL80211_ATTR_MAC])
4406                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4407
4408         if (key.type == -1) {
4409                 if (mac_addr)
4410                         key.type = NL80211_KEYTYPE_PAIRWISE;
4411                 else
4412                         key.type = NL80211_KEYTYPE_GROUP;
4413         }
4414
4415         /* for now */
4416         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4417             key.type != NL80211_KEYTYPE_GROUP)
4418                 return -EINVAL;
4419
4420         if (!cfg80211_valid_key_idx(rdev, key.idx,
4421                                     key.type == NL80211_KEYTYPE_PAIRWISE))
4422                 return -EINVAL;
4423
4424         if (!rdev->ops->del_key)
4425                 return -EOPNOTSUPP;
4426
4427         wdev_lock(dev->ieee80211_ptr);
4428         err = nl80211_key_allowed(dev->ieee80211_ptr);
4429
4430         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4431             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4432                 err = -ENOENT;
4433
4434         if (!err)
4435                 err = rdev_del_key(rdev, dev, key.idx,
4436                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4437                                    mac_addr);
4438
4439 #ifdef CONFIG_CFG80211_WEXT
4440         if (!err) {
4441                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
4442                         dev->ieee80211_ptr->wext.default_key = -1;
4443                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
4444                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
4445         }
4446 #endif
4447         wdev_unlock(dev->ieee80211_ptr);
4448
4449         return err;
4450 }
4451
4452 /* This function returns an error or the number of nested attributes */
4453 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
4454 {
4455         struct nlattr *attr;
4456         int n_entries = 0, tmp;
4457
4458         nla_for_each_nested(attr, nl_attr, tmp) {
4459                 if (nla_len(attr) != ETH_ALEN)
4460                         return -EINVAL;
4461
4462                 n_entries++;
4463         }
4464
4465         return n_entries;
4466 }
4467
4468 /*
4469  * This function parses ACL information and allocates memory for ACL data.
4470  * On successful return, the calling function is responsible to free the
4471  * ACL buffer returned by this function.
4472  */
4473 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
4474                                                 struct genl_info *info)
4475 {
4476         enum nl80211_acl_policy acl_policy;
4477         struct nlattr *attr;
4478         struct cfg80211_acl_data *acl;
4479         int i = 0, n_entries, tmp;
4480
4481         if (!wiphy->max_acl_mac_addrs)
4482                 return ERR_PTR(-EOPNOTSUPP);
4483
4484         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
4485                 return ERR_PTR(-EINVAL);
4486
4487         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
4488         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
4489             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
4490                 return ERR_PTR(-EINVAL);
4491
4492         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
4493                 return ERR_PTR(-EINVAL);
4494
4495         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
4496         if (n_entries < 0)
4497                 return ERR_PTR(n_entries);
4498
4499         if (n_entries > wiphy->max_acl_mac_addrs)
4500                 return ERR_PTR(-ENOTSUPP);
4501
4502         acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
4503         if (!acl)
4504                 return ERR_PTR(-ENOMEM);
4505
4506         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
4507                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
4508                 i++;
4509         }
4510
4511         acl->n_acl_entries = n_entries;
4512         acl->acl_policy = acl_policy;
4513
4514         return acl;
4515 }
4516
4517 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
4518 {
4519         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4520         struct net_device *dev = info->user_ptr[1];
4521         struct cfg80211_acl_data *acl;
4522         int err;
4523
4524         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4525             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4526                 return -EOPNOTSUPP;
4527
4528         if (!dev->ieee80211_ptr->beacon_interval)
4529                 return -EINVAL;
4530
4531         acl = parse_acl_data(&rdev->wiphy, info);
4532         if (IS_ERR(acl))
4533                 return PTR_ERR(acl);
4534
4535         err = rdev_set_mac_acl(rdev, dev, acl);
4536
4537         kfree(acl);
4538
4539         return err;
4540 }
4541
4542 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4543                            u8 *rates, u8 rates_len)
4544 {
4545         u8 i;
4546         u32 mask = 0;
4547
4548         for (i = 0; i < rates_len; i++) {
4549                 int rate = (rates[i] & 0x7f) * 5;
4550                 int ridx;
4551
4552                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4553                         struct ieee80211_rate *srate =
4554                                 &sband->bitrates[ridx];
4555                         if (rate == srate->bitrate) {
4556                                 mask |= 1 << ridx;
4557                                 break;
4558                         }
4559                 }
4560                 if (ridx == sband->n_bitrates)
4561                         return 0; /* rate not found */
4562         }
4563
4564         return mask;
4565 }
4566
4567 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4568                                u8 *rates, u8 rates_len,
4569                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4570 {
4571         u8 i;
4572
4573         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4574
4575         for (i = 0; i < rates_len; i++) {
4576                 int ridx, rbit;
4577
4578                 ridx = rates[i] / 8;
4579                 rbit = BIT(rates[i] % 8);
4580
4581                 /* check validity */
4582                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4583                         return false;
4584
4585                 /* check availability */
4586                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4587                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4588                         mcs[ridx] |= rbit;
4589                 else
4590                         return false;
4591         }
4592
4593         return true;
4594 }
4595
4596 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4597 {
4598         u16 mcs_mask = 0;
4599
4600         switch (vht_mcs_map) {
4601         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4602                 break;
4603         case IEEE80211_VHT_MCS_SUPPORT_0_7:
4604                 mcs_mask = 0x00FF;
4605                 break;
4606         case IEEE80211_VHT_MCS_SUPPORT_0_8:
4607                 mcs_mask = 0x01FF;
4608                 break;
4609         case IEEE80211_VHT_MCS_SUPPORT_0_9:
4610                 mcs_mask = 0x03FF;
4611                 break;
4612         default:
4613                 break;
4614         }
4615
4616         return mcs_mask;
4617 }
4618
4619 static void vht_build_mcs_mask(u16 vht_mcs_map,
4620                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
4621 {
4622         u8 nss;
4623
4624         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
4625                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
4626                 vht_mcs_map >>= 2;
4627         }
4628 }
4629
4630 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
4631                              struct nl80211_txrate_vht *txrate,
4632                              u16 mcs[NL80211_VHT_NSS_MAX])
4633 {
4634         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4635         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
4636         u8 i;
4637
4638         if (!sband->vht_cap.vht_supported)
4639                 return false;
4640
4641         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
4642
4643         /* Build vht_mcs_mask from VHT capabilities */
4644         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4645
4646         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4647                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4648                         mcs[i] = txrate->mcs[i];
4649                 else
4650                         return false;
4651         }
4652
4653         return true;
4654 }
4655
4656 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
4657 {
4658         switch (he_mcs_map) {
4659         case IEEE80211_HE_MCS_NOT_SUPPORTED:
4660                 return 0;
4661         case IEEE80211_HE_MCS_SUPPORT_0_7:
4662                 return 0x00FF;
4663         case IEEE80211_HE_MCS_SUPPORT_0_9:
4664                 return 0x03FF;
4665         case IEEE80211_HE_MCS_SUPPORT_0_11:
4666                 return 0xFFF;
4667         default:
4668                 break;
4669         }
4670         return 0;
4671 }
4672
4673 static void he_build_mcs_mask(u16 he_mcs_map,
4674                               u16 he_mcs_mask[NL80211_HE_NSS_MAX])
4675 {
4676         u8 nss;
4677
4678         for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
4679                 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
4680                 he_mcs_map >>= 2;
4681         }
4682 }
4683
4684 static u16 he_get_txmcsmap(struct genl_info *info,
4685                            const struct ieee80211_sta_he_cap *he_cap)
4686 {
4687         struct net_device *dev = info->user_ptr[1];
4688         struct wireless_dev *wdev = dev->ieee80211_ptr;
4689         __le16  tx_mcs;
4690
4691         switch (wdev->chandef.width) {
4692         case NL80211_CHAN_WIDTH_80P80:
4693                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
4694                 break;
4695         case NL80211_CHAN_WIDTH_160:
4696                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
4697                 break;
4698         default:
4699                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
4700                 break;
4701         }
4702         return le16_to_cpu(tx_mcs);
4703 }
4704
4705 static bool he_set_mcs_mask(struct genl_info *info,
4706                             struct wireless_dev *wdev,
4707                             struct ieee80211_supported_band *sband,
4708                             struct nl80211_txrate_he *txrate,
4709                             u16 mcs[NL80211_HE_NSS_MAX])
4710 {
4711         const struct ieee80211_sta_he_cap *he_cap;
4712         u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
4713         u16 tx_mcs_map = 0;
4714         u8 i;
4715
4716         he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
4717         if (!he_cap)
4718                 return false;
4719
4720         memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
4721
4722         tx_mcs_map = he_get_txmcsmap(info, he_cap);
4723
4724         /* Build he_mcs_mask from HE capabilities */
4725         he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4726
4727         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
4728                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4729                         mcs[i] = txrate->mcs[i];
4730                 else
4731                         return false;
4732         }
4733
4734         return true;
4735 }
4736
4737 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
4738                                          struct nlattr *attrs[],
4739                                          enum nl80211_attrs attr,
4740                                          struct cfg80211_bitrate_mask *mask,
4741                                          struct net_device *dev,
4742                                          bool default_all_enabled)
4743 {
4744         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4745         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4746         struct wireless_dev *wdev = dev->ieee80211_ptr;
4747         int rem, i;
4748         struct nlattr *tx_rates;
4749         struct ieee80211_supported_band *sband;
4750         u16 vht_tx_mcs_map, he_tx_mcs_map;
4751
4752         memset(mask, 0, sizeof(*mask));
4753         /* Default to all rates enabled */
4754         for (i = 0; i < NUM_NL80211_BANDS; i++) {
4755                 const struct ieee80211_sta_he_cap *he_cap;
4756
4757                 if (!default_all_enabled)
4758                         break;
4759
4760                 sband = rdev->wiphy.bands[i];
4761
4762                 if (!sband)
4763                         continue;
4764
4765                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
4766                 memcpy(mask->control[i].ht_mcs,
4767                        sband->ht_cap.mcs.rx_mask,
4768                        sizeof(mask->control[i].ht_mcs));
4769
4770                 if (!sband->vht_cap.vht_supported)
4771                         continue;
4772
4773                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4774                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
4775
4776                 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
4777                 if (!he_cap)
4778                         continue;
4779
4780                 he_tx_mcs_map = he_get_txmcsmap(info, he_cap);
4781                 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
4782
4783                 mask->control[i].he_gi = 0xFF;
4784                 mask->control[i].he_ltf = 0xFF;
4785         }
4786
4787         /* if no rates are given set it back to the defaults */
4788         if (!attrs[attr])
4789                 goto out;
4790
4791         /* The nested attribute uses enum nl80211_band as the index. This maps
4792          * directly to the enum nl80211_band values used in cfg80211.
4793          */
4794         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
4795         nla_for_each_nested(tx_rates, attrs[attr], rem) {
4796                 enum nl80211_band band = nla_type(tx_rates);
4797                 int err;
4798
4799                 if (band < 0 || band >= NUM_NL80211_BANDS)
4800                         return -EINVAL;
4801                 sband = rdev->wiphy.bands[band];
4802                 if (sband == NULL)
4803                         return -EINVAL;
4804                 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
4805                                                   tx_rates,
4806                                                   nl80211_txattr_policy,
4807                                                   info->extack);
4808                 if (err)
4809                         return err;
4810                 if (tb[NL80211_TXRATE_LEGACY]) {
4811                         mask->control[band].legacy = rateset_to_mask(
4812                                 sband,
4813                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4814                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4815                         if ((mask->control[band].legacy == 0) &&
4816                             nla_len(tb[NL80211_TXRATE_LEGACY]))
4817                                 return -EINVAL;
4818                 }
4819                 if (tb[NL80211_TXRATE_HT]) {
4820                         if (!ht_rateset_to_mask(
4821                                         sband,
4822                                         nla_data(tb[NL80211_TXRATE_HT]),
4823                                         nla_len(tb[NL80211_TXRATE_HT]),
4824                                         mask->control[band].ht_mcs))
4825                                 return -EINVAL;
4826                 }
4827
4828                 if (tb[NL80211_TXRATE_VHT]) {
4829                         if (!vht_set_mcs_mask(
4830                                         sband,
4831                                         nla_data(tb[NL80211_TXRATE_VHT]),
4832                                         mask->control[band].vht_mcs))
4833                                 return -EINVAL;
4834                 }
4835
4836                 if (tb[NL80211_TXRATE_GI]) {
4837                         mask->control[band].gi =
4838                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
4839                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
4840                                 return -EINVAL;
4841                 }
4842                 if (tb[NL80211_TXRATE_HE] &&
4843                     !he_set_mcs_mask(info, wdev, sband,
4844                                      nla_data(tb[NL80211_TXRATE_HE]),
4845                                      mask->control[band].he_mcs))
4846                         return -EINVAL;
4847
4848                 if (tb[NL80211_TXRATE_HE_GI])
4849                         mask->control[band].he_gi =
4850                                 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
4851                 if (tb[NL80211_TXRATE_HE_LTF])
4852                         mask->control[band].he_ltf =
4853                                 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
4854
4855                 if (mask->control[band].legacy == 0) {
4856                         /* don't allow empty legacy rates if HT, VHT or HE
4857                          * are not even supported.
4858                          */
4859                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
4860                               rdev->wiphy.bands[band]->vht_cap.vht_supported ||
4861                               ieee80211_get_he_iftype_cap(sband, wdev->iftype)))
4862                                 return -EINVAL;
4863
4864                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
4865                                 if (mask->control[band].ht_mcs[i])
4866                                         goto out;
4867
4868                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
4869                                 if (mask->control[band].vht_mcs[i])
4870                                         goto out;
4871
4872                         for (i = 0; i < NL80211_HE_NSS_MAX; i++)
4873                                 if (mask->control[band].he_mcs[i])
4874                                         goto out;
4875
4876                         /* legacy and mcs rates may not be both empty */
4877                         return -EINVAL;
4878                 }
4879         }
4880
4881 out:
4882         return 0;
4883 }
4884
4885 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
4886                                    enum nl80211_band band,
4887                                    struct cfg80211_bitrate_mask *beacon_rate)
4888 {
4889         u32 count_ht, count_vht, count_he, i;
4890         u32 rate = beacon_rate->control[band].legacy;
4891
4892         /* Allow only one rate */
4893         if (hweight32(rate) > 1)
4894                 return -EINVAL;
4895
4896         count_ht = 0;
4897         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
4898                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
4899                         return -EINVAL;
4900                 } else if (beacon_rate->control[band].ht_mcs[i]) {
4901                         count_ht++;
4902                         if (count_ht > 1)
4903                                 return -EINVAL;
4904                 }
4905                 if (count_ht && rate)
4906                         return -EINVAL;
4907         }
4908
4909         count_vht = 0;
4910         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4911                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
4912                         return -EINVAL;
4913                 } else if (beacon_rate->control[band].vht_mcs[i]) {
4914                         count_vht++;
4915                         if (count_vht > 1)
4916                                 return -EINVAL;
4917                 }
4918                 if (count_vht && rate)
4919                         return -EINVAL;
4920         }
4921
4922         count_he = 0;
4923         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
4924                 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
4925                         return -EINVAL;
4926                 } else if (beacon_rate->control[band].he_mcs[i]) {
4927                         count_he++;
4928                         if (count_he > 1)
4929                                 return -EINVAL;
4930                 }
4931                 if (count_he && rate)
4932                         return -EINVAL;
4933         }
4934
4935         if ((count_ht && count_vht && count_he) ||
4936             (!rate && !count_ht && !count_vht && !count_he))
4937                 return -EINVAL;
4938
4939         if (rate &&
4940             !wiphy_ext_feature_isset(&rdev->wiphy,
4941                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
4942                 return -EINVAL;
4943         if (count_ht &&
4944             !wiphy_ext_feature_isset(&rdev->wiphy,
4945                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
4946                 return -EINVAL;
4947         if (count_vht &&
4948             !wiphy_ext_feature_isset(&rdev->wiphy,
4949                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
4950                 return -EINVAL;
4951         if (count_he &&
4952             !wiphy_ext_feature_isset(&rdev->wiphy,
4953                                      NL80211_EXT_FEATURE_BEACON_RATE_HE))
4954                 return -EINVAL;
4955
4956         return 0;
4957 }
4958
4959 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
4960                                 struct nlattr *attrs[],
4961                                 struct cfg80211_beacon_data *bcn)
4962 {
4963         bool haveinfo = false;
4964         int err;
4965
4966         memset(bcn, 0, sizeof(*bcn));
4967
4968         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4969                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4970                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4971                 if (!bcn->head_len)
4972                         return -EINVAL;
4973                 haveinfo = true;
4974         }
4975
4976         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4977                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4978                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4979                 haveinfo = true;
4980         }
4981
4982         if (!haveinfo)
4983                 return -EINVAL;
4984
4985         if (attrs[NL80211_ATTR_IE]) {
4986                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
4987                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
4988         }
4989
4990         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
4991                 bcn->proberesp_ies =
4992                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4993                 bcn->proberesp_ies_len =
4994                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4995         }
4996
4997         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
4998                 bcn->assocresp_ies =
4999                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5000                 bcn->assocresp_ies_len =
5001                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5002         }
5003
5004         if (attrs[NL80211_ATTR_PROBE_RESP]) {
5005                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
5006                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
5007         }
5008
5009         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
5010                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
5011
5012                 err = nla_parse_nested_deprecated(tb,
5013                                                   NL80211_FTM_RESP_ATTR_MAX,
5014                                                   attrs[NL80211_ATTR_FTM_RESPONDER],
5015                                                   NULL, NULL);
5016                 if (err)
5017                         return err;
5018
5019                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
5020                     wiphy_ext_feature_isset(&rdev->wiphy,
5021                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
5022                         bcn->ftm_responder = 1;
5023                 else
5024                         return -EOPNOTSUPP;
5025
5026                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
5027                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
5028                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
5029                 }
5030
5031                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
5032                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5033                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5034                 }
5035         } else {
5036                 bcn->ftm_responder = -1;
5037         }
5038
5039         return 0;
5040 }
5041
5042 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
5043                                     struct ieee80211_he_obss_pd *he_obss_pd)
5044 {
5045         struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
5046         int err;
5047
5048         err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
5049                                he_obss_pd_policy, NULL);
5050         if (err)
5051                 return err;
5052
5053         if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
5054                 return -EINVAL;
5055
5056         he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
5057
5058         if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
5059                 he_obss_pd->min_offset =
5060                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
5061         if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
5062                 he_obss_pd->max_offset =
5063                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
5064         if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
5065                 he_obss_pd->non_srg_max_offset =
5066                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
5067
5068         if (he_obss_pd->min_offset > he_obss_pd->max_offset)
5069                 return -EINVAL;
5070
5071         if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
5072                 memcpy(he_obss_pd->bss_color_bitmap,
5073                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
5074                        sizeof(he_obss_pd->bss_color_bitmap));
5075
5076         if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
5077                 memcpy(he_obss_pd->partial_bssid_bitmap,
5078                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
5079                        sizeof(he_obss_pd->partial_bssid_bitmap));
5080
5081         he_obss_pd->enable = true;
5082
5083         return 0;
5084 }
5085
5086 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
5087                                       struct cfg80211_he_bss_color *he_bss_color)
5088 {
5089         struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
5090         int err;
5091
5092         err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
5093                                he_bss_color_policy, NULL);
5094         if (err)
5095                 return err;
5096
5097         if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
5098                 return -EINVAL;
5099
5100         he_bss_color->color =
5101                 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
5102         he_bss_color->enabled =
5103                 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
5104         he_bss_color->partial =
5105                 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
5106
5107         return 0;
5108 }
5109
5110 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
5111                                         struct nlattr *attrs,
5112                                         struct cfg80211_ap_settings *params)
5113 {
5114         struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
5115         int ret;
5116         struct cfg80211_fils_discovery *fd = &params->fils_discovery;
5117
5118         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5119                                      NL80211_EXT_FEATURE_FILS_DISCOVERY))
5120                 return -EINVAL;
5121
5122         ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
5123                                NULL, NULL);
5124         if (ret)
5125                 return ret;
5126
5127         if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
5128             !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
5129             !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
5130                 return -EINVAL;
5131
5132         fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5133         fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5134         fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
5135         fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
5136
5137         return 0;
5138 }
5139
5140 static int
5141 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
5142                                      struct nlattr *attrs,
5143                                      struct cfg80211_ap_settings *params)
5144 {
5145         struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
5146         int ret;
5147         struct cfg80211_unsol_bcast_probe_resp *presp =
5148                                         &params->unsol_bcast_probe_resp;
5149
5150         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5151                                      NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
5152                 return -EINVAL;
5153
5154         ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
5155                                attrs, NULL, NULL);
5156         if (ret)
5157                 return ret;
5158
5159         if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
5160             !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
5161                 return -EINVAL;
5162
5163         presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5164         presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5165         presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
5166         return 0;
5167 }
5168
5169 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
5170                                             const u8 *rates)
5171 {
5172         int i;
5173
5174         if (!rates)
5175                 return;
5176
5177         for (i = 0; i < rates[1]; i++) {
5178                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
5179                         params->ht_required = true;
5180                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
5181                         params->vht_required = true;
5182                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
5183                         params->he_required = true;
5184                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
5185                         params->sae_h2e_required = true;
5186         }
5187 }
5188
5189 /*
5190  * Since the nl80211 API didn't include, from the beginning, attributes about
5191  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
5192  * benefit of drivers that rebuild IEs in the firmware.
5193  */
5194 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
5195 {
5196         const struct cfg80211_beacon_data *bcn = &params->beacon;
5197         size_t ies_len = bcn->tail_len;
5198         const u8 *ies = bcn->tail;
5199         const u8 *rates;
5200         const u8 *cap;
5201
5202         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
5203         nl80211_check_ap_rate_selectors(params, rates);
5204
5205         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
5206         nl80211_check_ap_rate_selectors(params, rates);
5207
5208         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
5209         if (cap && cap[1] >= sizeof(*params->ht_cap))
5210                 params->ht_cap = (void *)(cap + 2);
5211         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
5212         if (cap && cap[1] >= sizeof(*params->vht_cap))
5213                 params->vht_cap = (void *)(cap + 2);
5214         cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
5215         if (cap && cap[1] >= sizeof(*params->he_cap) + 1)
5216                 params->he_cap = (void *)(cap + 3);
5217         cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
5218         if (cap && cap[1] >= sizeof(*params->he_oper) + 1)
5219                 params->he_oper = (void *)(cap + 3);
5220 }
5221
5222 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
5223                                    struct cfg80211_ap_settings *params)
5224 {
5225         struct wireless_dev *wdev;
5226         bool ret = false;
5227
5228         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
5229                 if (wdev->iftype != NL80211_IFTYPE_AP &&
5230                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
5231                         continue;
5232
5233                 if (!wdev->preset_chandef.chan)
5234                         continue;
5235
5236                 params->chandef = wdev->preset_chandef;
5237                 ret = true;
5238                 break;
5239         }
5240
5241         return ret;
5242 }
5243
5244 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
5245                                     enum nl80211_auth_type auth_type,
5246                                     enum nl80211_commands cmd)
5247 {
5248         if (auth_type > NL80211_AUTHTYPE_MAX)
5249                 return false;
5250
5251         switch (cmd) {
5252         case NL80211_CMD_AUTHENTICATE:
5253                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5254                     auth_type == NL80211_AUTHTYPE_SAE)
5255                         return false;
5256                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5257                                              NL80211_EXT_FEATURE_FILS_STA) &&
5258                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5259                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5260                      auth_type == NL80211_AUTHTYPE_FILS_PK))
5261                         return false;
5262                 return true;
5263         case NL80211_CMD_CONNECT:
5264                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5265                     !wiphy_ext_feature_isset(&rdev->wiphy,
5266                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
5267                     auth_type == NL80211_AUTHTYPE_SAE)
5268                         return false;
5269
5270                 /* FILS with SK PFS or PK not supported yet */
5271                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5272                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5273                         return false;
5274                 if (!wiphy_ext_feature_isset(
5275                             &rdev->wiphy,
5276                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
5277                     auth_type == NL80211_AUTHTYPE_FILS_SK)
5278                         return false;
5279                 return true;
5280         case NL80211_CMD_START_AP:
5281                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5282                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
5283                     auth_type == NL80211_AUTHTYPE_SAE)
5284                         return false;
5285                 /* FILS not supported yet */
5286                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5287                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5288                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5289                         return false;
5290                 return true;
5291         default:
5292                 return false;
5293         }
5294 }
5295
5296 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
5297 {
5298         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5299         struct net_device *dev = info->user_ptr[1];
5300         struct wireless_dev *wdev = dev->ieee80211_ptr;
5301         struct cfg80211_ap_settings params;
5302         int err;
5303
5304         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5305             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5306                 return -EOPNOTSUPP;
5307
5308         if (!rdev->ops->start_ap)
5309                 return -EOPNOTSUPP;
5310
5311         if (wdev->beacon_interval)
5312                 return -EALREADY;
5313
5314         memset(&params, 0, sizeof(params));
5315
5316         /* these are required for START_AP */
5317         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
5318             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
5319             !info->attrs[NL80211_ATTR_BEACON_HEAD])
5320                 return -EINVAL;
5321
5322         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon);
5323         if (err)
5324                 return err;
5325
5326         params.beacon_interval =
5327                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5328         params.dtim_period =
5329                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
5330
5331         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
5332                                            params.beacon_interval);
5333         if (err)
5334                 return err;
5335
5336         /*
5337          * In theory, some of these attributes should be required here
5338          * but since they were not used when the command was originally
5339          * added, keep them optional for old user space programs to let
5340          * them continue to work with drivers that do not need the
5341          * additional information -- drivers must check!
5342          */
5343         if (info->attrs[NL80211_ATTR_SSID]) {
5344                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5345                 params.ssid_len =
5346                         nla_len(info->attrs[NL80211_ATTR_SSID]);
5347                 if (params.ssid_len == 0)
5348                         return -EINVAL;
5349         }
5350
5351         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
5352                 params.hidden_ssid = nla_get_u32(
5353                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
5354
5355         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5356
5357         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5358                 params.auth_type = nla_get_u32(
5359                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
5360                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
5361                                              NL80211_CMD_START_AP))
5362                         return -EINVAL;
5363         } else
5364                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5365
5366         err = nl80211_crypto_settings(rdev, info, &params.crypto,
5367                                       NL80211_MAX_NR_CIPHER_SUITES);
5368         if (err)
5369                 return err;
5370
5371         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
5372                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
5373                         return -EOPNOTSUPP;
5374                 params.inactivity_timeout = nla_get_u16(
5375                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
5376         }
5377
5378         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5379                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5380                         return -EINVAL;
5381                 params.p2p_ctwindow =
5382                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5383                 if (params.p2p_ctwindow != 0 &&
5384                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5385                         return -EINVAL;
5386         }
5387
5388         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5389                 u8 tmp;
5390
5391                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5392                         return -EINVAL;
5393                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5394                 params.p2p_opp_ps = tmp;
5395                 if (params.p2p_opp_ps != 0 &&
5396                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5397                         return -EINVAL;
5398         }
5399
5400         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5401                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
5402                 if (err)
5403                         return err;
5404         } else if (wdev->preset_chandef.chan) {
5405                 params.chandef = wdev->preset_chandef;
5406         } else if (!nl80211_get_ap_channel(rdev, &params))
5407                 return -EINVAL;
5408
5409         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
5410                                            wdev->iftype))
5411                 return -EINVAL;
5412
5413         if (info->attrs[NL80211_ATTR_TX_RATES]) {
5414                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
5415                                                     NL80211_ATTR_TX_RATES,
5416                                                     &params.beacon_rate,
5417                                                     dev, false);
5418                 if (err)
5419                         return err;
5420
5421                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
5422                                               &params.beacon_rate);
5423                 if (err)
5424                         return err;
5425         }
5426
5427         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
5428                 params.smps_mode =
5429                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
5430                 switch (params.smps_mode) {
5431                 case NL80211_SMPS_OFF:
5432                         break;
5433                 case NL80211_SMPS_STATIC:
5434                         if (!(rdev->wiphy.features &
5435                               NL80211_FEATURE_STATIC_SMPS))
5436                                 return -EINVAL;
5437                         break;
5438                 case NL80211_SMPS_DYNAMIC:
5439                         if (!(rdev->wiphy.features &
5440                               NL80211_FEATURE_DYNAMIC_SMPS))
5441                                 return -EINVAL;
5442                         break;
5443                 default:
5444                         return -EINVAL;
5445                 }
5446         } else {
5447                 params.smps_mode = NL80211_SMPS_OFF;
5448         }
5449
5450         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
5451         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
5452                 return -EOPNOTSUPP;
5453
5454         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
5455                 params.acl = parse_acl_data(&rdev->wiphy, info);
5456                 if (IS_ERR(params.acl))
5457                         return PTR_ERR(params.acl);
5458         }
5459
5460         params.twt_responder =
5461                     nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
5462
5463         if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
5464                 err = nl80211_parse_he_obss_pd(
5465                                         info->attrs[NL80211_ATTR_HE_OBSS_PD],
5466                                         &params.he_obss_pd);
5467                 if (err)
5468                         goto out;
5469         }
5470
5471         if (info->attrs[NL80211_ATTR_HE_BSS_COLOR]) {
5472                 err = nl80211_parse_he_bss_color(
5473                                         info->attrs[NL80211_ATTR_HE_BSS_COLOR],
5474                                         &params.he_bss_color);
5475                 if (err)
5476                         goto out;
5477         }
5478
5479         if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
5480                 err = nl80211_parse_fils_discovery(rdev,
5481                                                    info->attrs[NL80211_ATTR_FILS_DISCOVERY],
5482                                                    &params);
5483                 if (err)
5484                         goto out;
5485         }
5486
5487         if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
5488                 err = nl80211_parse_unsol_bcast_probe_resp(
5489                         rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
5490                         &params);
5491                 if (err)
5492                         goto out;
5493         }
5494
5495         nl80211_calculate_ap_params(&params);
5496
5497         if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
5498                 params.flags |= AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
5499
5500         wdev_lock(wdev);
5501         err = rdev_start_ap(rdev, dev, &params);
5502         if (!err) {
5503                 wdev->preset_chandef = params.chandef;
5504                 wdev->beacon_interval = params.beacon_interval;
5505                 wdev->chandef = params.chandef;
5506                 wdev->ssid_len = params.ssid_len;
5507                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
5508
5509                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
5510                         wdev->conn_owner_nlportid = info->snd_portid;
5511         }
5512         wdev_unlock(wdev);
5513
5514 out:
5515         kfree(params.acl);
5516
5517         return err;
5518 }
5519
5520 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
5521 {
5522         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5523         struct net_device *dev = info->user_ptr[1];
5524         struct wireless_dev *wdev = dev->ieee80211_ptr;
5525         struct cfg80211_beacon_data params;
5526         int err;
5527
5528         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5529             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5530                 return -EOPNOTSUPP;
5531
5532         if (!rdev->ops->change_beacon)
5533                 return -EOPNOTSUPP;
5534
5535         if (!wdev->beacon_interval)
5536                 return -EINVAL;
5537
5538         err = nl80211_parse_beacon(rdev, info->attrs, &params);
5539         if (err)
5540                 return err;
5541
5542         wdev_lock(wdev);
5543         err = rdev_change_beacon(rdev, dev, &params);
5544         wdev_unlock(wdev);
5545
5546         return err;
5547 }
5548
5549 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
5550 {
5551         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5552         struct net_device *dev = info->user_ptr[1];
5553
5554         return cfg80211_stop_ap(rdev, dev, false);
5555 }
5556
5557 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
5558         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
5559         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
5560         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
5561         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
5562         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
5563         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
5564 };
5565
5566 static int parse_station_flags(struct genl_info *info,
5567                                enum nl80211_iftype iftype,
5568                                struct station_parameters *params)
5569 {
5570         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
5571         struct nlattr *nla;
5572         int flag;
5573
5574         /*
5575          * Try parsing the new attribute first so userspace
5576          * can specify both for older kernels.
5577          */
5578         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
5579         if (nla) {
5580                 struct nl80211_sta_flag_update *sta_flags;
5581
5582                 sta_flags = nla_data(nla);
5583                 params->sta_flags_mask = sta_flags->mask;
5584                 params->sta_flags_set = sta_flags->set;
5585                 params->sta_flags_set &= params->sta_flags_mask;
5586                 if ((params->sta_flags_mask |
5587                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
5588                         return -EINVAL;
5589                 return 0;
5590         }
5591
5592         /* if present, parse the old attribute */
5593
5594         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
5595         if (!nla)
5596                 return 0;
5597
5598         if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
5599                 return -EINVAL;
5600
5601         /*
5602          * Only allow certain flags for interface types so that
5603          * other attributes are silently ignored. Remember that
5604          * this is backward compatibility code with old userspace
5605          * and shouldn't be hit in other cases anyway.
5606          */
5607         switch (iftype) {
5608         case NL80211_IFTYPE_AP:
5609         case NL80211_IFTYPE_AP_VLAN:
5610         case NL80211_IFTYPE_P2P_GO:
5611                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
5612                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5613                                          BIT(NL80211_STA_FLAG_WME) |
5614                                          BIT(NL80211_STA_FLAG_MFP);
5615                 break;
5616         case NL80211_IFTYPE_P2P_CLIENT:
5617         case NL80211_IFTYPE_STATION:
5618                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
5619                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
5620                 break;
5621         case NL80211_IFTYPE_MESH_POINT:
5622                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5623                                          BIT(NL80211_STA_FLAG_MFP) |
5624                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
5625                 break;
5626         default:
5627                 return -EINVAL;
5628         }
5629
5630         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
5631                 if (flags[flag]) {
5632                         params->sta_flags_set |= (1<<flag);
5633
5634                         /* no longer support new API additions in old API */
5635                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
5636                                 return -EINVAL;
5637                 }
5638         }
5639
5640         return 0;
5641 }
5642
5643 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
5644 {
5645         struct nlattr *rate;
5646         u32 bitrate;
5647         u16 bitrate_compat;
5648         enum nl80211_rate_info rate_flg;
5649
5650         rate = nla_nest_start_noflag(msg, attr);
5651         if (!rate)
5652                 return false;
5653
5654         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
5655         bitrate = cfg80211_calculate_bitrate(info);
5656         /* report 16-bit bitrate only if we can */
5657         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
5658         if (bitrate > 0 &&
5659             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
5660                 return false;
5661         if (bitrate_compat > 0 &&
5662             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
5663                 return false;
5664
5665         switch (info->bw) {
5666         case RATE_INFO_BW_5:
5667                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
5668                 break;
5669         case RATE_INFO_BW_10:
5670                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
5671                 break;
5672         default:
5673                 WARN_ON(1);
5674                 fallthrough;
5675         case RATE_INFO_BW_20:
5676                 rate_flg = 0;
5677                 break;
5678         case RATE_INFO_BW_40:
5679                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
5680                 break;
5681         case RATE_INFO_BW_80:
5682                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
5683                 break;
5684         case RATE_INFO_BW_160:
5685                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
5686                 break;
5687         case RATE_INFO_BW_HE_RU:
5688                 rate_flg = 0;
5689                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
5690         }
5691
5692         if (rate_flg && nla_put_flag(msg, rate_flg))
5693                 return false;
5694
5695         if (info->flags & RATE_INFO_FLAGS_MCS) {
5696                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
5697                         return false;
5698                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
5699                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
5700                         return false;
5701         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
5702                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
5703                         return false;
5704                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
5705                         return false;
5706                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
5707                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
5708                         return false;
5709         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
5710                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
5711                         return false;
5712                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
5713                         return false;
5714                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
5715                         return false;
5716                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
5717                         return false;
5718                 if (info->bw == RATE_INFO_BW_HE_RU &&
5719                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
5720                                info->he_ru_alloc))
5721                         return false;
5722         }
5723
5724         nla_nest_end(msg, rate);
5725         return true;
5726 }
5727
5728 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
5729                                int id)
5730 {
5731         void *attr;
5732         int i = 0;
5733
5734         if (!mask)
5735                 return true;
5736
5737         attr = nla_nest_start_noflag(msg, id);
5738         if (!attr)
5739                 return false;
5740
5741         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
5742                 if (!(mask & BIT(i)))
5743                         continue;
5744
5745                 if (nla_put_u8(msg, i, signal[i]))
5746                         return false;
5747         }
5748
5749         nla_nest_end(msg, attr);
5750
5751         return true;
5752 }
5753
5754 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
5755                                 u32 seq, int flags,
5756                                 struct cfg80211_registered_device *rdev,
5757                                 struct net_device *dev,
5758                                 const u8 *mac_addr, struct station_info *sinfo)
5759 {
5760         void *hdr;
5761         struct nlattr *sinfoattr, *bss_param;
5762
5763         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
5764         if (!hdr) {
5765                 cfg80211_sinfo_release_content(sinfo);
5766                 return -1;
5767         }
5768
5769         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5770             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
5771             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
5772                 goto nla_put_failure;
5773
5774         sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
5775         if (!sinfoattr)
5776                 goto nla_put_failure;
5777
5778 #define PUT_SINFO(attr, memb, type) do {                                \
5779         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
5780         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
5781             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
5782                              sinfo->memb))                              \
5783                 goto nla_put_failure;                                   \
5784         } while (0)
5785 #define PUT_SINFO_U64(attr, memb) do {                                  \
5786         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
5787             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
5788                               sinfo->memb, NL80211_STA_INFO_PAD))       \
5789                 goto nla_put_failure;                                   \
5790         } while (0)
5791
5792         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
5793         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
5794         PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
5795
5796         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
5797                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
5798             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
5799                         (u32)sinfo->rx_bytes))
5800                 goto nla_put_failure;
5801
5802         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
5803                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
5804             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
5805                         (u32)sinfo->tx_bytes))
5806                 goto nla_put_failure;
5807
5808         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
5809         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
5810         PUT_SINFO(LLID, llid, u16);
5811         PUT_SINFO(PLID, plid, u16);
5812         PUT_SINFO(PLINK_STATE, plink_state, u8);
5813         PUT_SINFO_U64(RX_DURATION, rx_duration);
5814         PUT_SINFO_U64(TX_DURATION, tx_duration);
5815
5816         if (wiphy_ext_feature_isset(&rdev->wiphy,
5817                                     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5818                 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
5819
5820         switch (rdev->wiphy.signal_type) {
5821         case CFG80211_SIGNAL_TYPE_MBM:
5822                 PUT_SINFO(SIGNAL, signal, u8);
5823                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
5824                 break;
5825         default:
5826                 break;
5827         }
5828         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
5829                 if (!nl80211_put_signal(msg, sinfo->chains,
5830                                         sinfo->chain_signal,
5831                                         NL80211_STA_INFO_CHAIN_SIGNAL))
5832                         goto nla_put_failure;
5833         }
5834         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
5835                 if (!nl80211_put_signal(msg, sinfo->chains,
5836                                         sinfo->chain_signal_avg,
5837                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
5838                         goto nla_put_failure;
5839         }
5840         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
5841                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
5842                                           NL80211_STA_INFO_TX_BITRATE))
5843                         goto nla_put_failure;
5844         }
5845         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
5846                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
5847                                           NL80211_STA_INFO_RX_BITRATE))
5848                         goto nla_put_failure;
5849         }
5850
5851         PUT_SINFO(RX_PACKETS, rx_packets, u32);
5852         PUT_SINFO(TX_PACKETS, tx_packets, u32);
5853         PUT_SINFO(TX_RETRIES, tx_retries, u32);
5854         PUT_SINFO(TX_FAILED, tx_failed, u32);
5855         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
5856         PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
5857         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
5858         PUT_SINFO(LOCAL_PM, local_pm, u32);
5859         PUT_SINFO(PEER_PM, peer_pm, u32);
5860         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
5861         PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
5862         PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
5863
5864         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
5865                 bss_param = nla_nest_start_noflag(msg,
5866                                                   NL80211_STA_INFO_BSS_PARAM);
5867                 if (!bss_param)
5868                         goto nla_put_failure;
5869
5870                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
5871                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
5872                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
5873                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
5874                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
5875                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
5876                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
5877                                sinfo->bss_param.dtim_period) ||
5878                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
5879                                 sinfo->bss_param.beacon_interval))
5880                         goto nla_put_failure;
5881
5882                 nla_nest_end(msg, bss_param);
5883         }
5884         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
5885             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
5886                     sizeof(struct nl80211_sta_flag_update),
5887                     &sinfo->sta_flags))
5888                 goto nla_put_failure;
5889
5890         PUT_SINFO_U64(T_OFFSET, t_offset);
5891         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
5892         PUT_SINFO_U64(BEACON_RX, rx_beacon);
5893         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
5894         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
5895         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
5896         if (wiphy_ext_feature_isset(&rdev->wiphy,
5897                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
5898                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
5899                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
5900         }
5901
5902 #undef PUT_SINFO
5903 #undef PUT_SINFO_U64
5904
5905         if (sinfo->pertid) {
5906                 struct nlattr *tidsattr;
5907                 int tid;
5908
5909                 tidsattr = nla_nest_start_noflag(msg,
5910                                                  NL80211_STA_INFO_TID_STATS);
5911                 if (!tidsattr)
5912                         goto nla_put_failure;
5913
5914                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
5915                         struct cfg80211_tid_stats *tidstats;
5916                         struct nlattr *tidattr;
5917
5918                         tidstats = &sinfo->pertid[tid];
5919
5920                         if (!tidstats->filled)
5921                                 continue;
5922
5923                         tidattr = nla_nest_start_noflag(msg, tid + 1);
5924                         if (!tidattr)
5925                                 goto nla_put_failure;
5926
5927 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
5928         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
5929             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
5930                               tidstats->memb, NL80211_TID_STATS_PAD))   \
5931                 goto nla_put_failure;                                   \
5932         } while (0)
5933
5934                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
5935                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
5936                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
5937                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
5938
5939 #undef PUT_TIDVAL_U64
5940                         if ((tidstats->filled &
5941                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
5942                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
5943                                                    NL80211_TID_STATS_TXQ_STATS))
5944                                 goto nla_put_failure;
5945
5946                         nla_nest_end(msg, tidattr);
5947                 }
5948
5949                 nla_nest_end(msg, tidsattr);
5950         }
5951
5952         nla_nest_end(msg, sinfoattr);
5953
5954         if (sinfo->assoc_req_ies_len &&
5955             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
5956                     sinfo->assoc_req_ies))
5957                 goto nla_put_failure;
5958
5959         cfg80211_sinfo_release_content(sinfo);
5960         genlmsg_end(msg, hdr);
5961         return 0;
5962
5963  nla_put_failure:
5964         cfg80211_sinfo_release_content(sinfo);
5965         genlmsg_cancel(msg, hdr);
5966         return -EMSGSIZE;
5967 }
5968
5969 static int nl80211_dump_station(struct sk_buff *skb,
5970                                 struct netlink_callback *cb)
5971 {
5972         struct station_info sinfo;
5973         struct cfg80211_registered_device *rdev;
5974         struct wireless_dev *wdev;
5975         u8 mac_addr[ETH_ALEN];
5976         int sta_idx = cb->args[2];
5977         int err;
5978
5979         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5980         if (err)
5981                 return err;
5982         /* nl80211_prepare_wdev_dump acquired it in the successful case */
5983         __acquire(&rdev->wiphy.mtx);
5984
5985         if (!wdev->netdev) {
5986                 err = -EINVAL;
5987                 goto out_err;
5988         }
5989
5990         if (!rdev->ops->dump_station) {
5991                 err = -EOPNOTSUPP;
5992                 goto out_err;
5993         }
5994
5995         while (1) {
5996                 memset(&sinfo, 0, sizeof(sinfo));
5997                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
5998                                         mac_addr, &sinfo);
5999                 if (err == -ENOENT)
6000                         break;
6001                 if (err)
6002                         goto out_err;
6003
6004                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
6005                                 NETLINK_CB(cb->skb).portid,
6006                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6007                                 rdev, wdev->netdev, mac_addr,
6008                                 &sinfo) < 0)
6009                         goto out;
6010
6011                 sta_idx++;
6012         }
6013
6014  out:
6015         cb->args[2] = sta_idx;
6016         err = skb->len;
6017  out_err:
6018         wiphy_unlock(&rdev->wiphy);
6019
6020         return err;
6021 }
6022
6023 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
6024 {
6025         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6026         struct net_device *dev = info->user_ptr[1];
6027         struct station_info sinfo;
6028         struct sk_buff *msg;
6029         u8 *mac_addr = NULL;
6030         int err;
6031
6032         memset(&sinfo, 0, sizeof(sinfo));
6033
6034         if (!info->attrs[NL80211_ATTR_MAC])
6035                 return -EINVAL;
6036
6037         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6038
6039         if (!rdev->ops->get_station)
6040                 return -EOPNOTSUPP;
6041
6042         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
6043         if (err)
6044                 return err;
6045
6046         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6047         if (!msg) {
6048                 cfg80211_sinfo_release_content(&sinfo);
6049                 return -ENOMEM;
6050         }
6051
6052         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
6053                                  info->snd_portid, info->snd_seq, 0,
6054                                  rdev, dev, mac_addr, &sinfo) < 0) {
6055                 nlmsg_free(msg);
6056                 return -ENOBUFS;
6057         }
6058
6059         return genlmsg_reply(msg, info);
6060 }
6061
6062 int cfg80211_check_station_change(struct wiphy *wiphy,
6063                                   struct station_parameters *params,
6064                                   enum cfg80211_station_type statype)
6065 {
6066         if (params->listen_interval != -1 &&
6067             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6068                 return -EINVAL;
6069
6070         if (params->support_p2p_ps != -1 &&
6071             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6072                 return -EINVAL;
6073
6074         if (params->aid &&
6075             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
6076             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6077                 return -EINVAL;
6078
6079         /* When you run into this, adjust the code below for the new flag */
6080         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
6081
6082         switch (statype) {
6083         case CFG80211_STA_MESH_PEER_KERNEL:
6084         case CFG80211_STA_MESH_PEER_USER:
6085                 /*
6086                  * No ignoring the TDLS flag here -- the userspace mesh
6087                  * code doesn't have the bug of including TDLS in the
6088                  * mask everywhere.
6089                  */
6090                 if (params->sta_flags_mask &
6091                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6092                                   BIT(NL80211_STA_FLAG_MFP) |
6093                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
6094                         return -EINVAL;
6095                 break;
6096         case CFG80211_STA_TDLS_PEER_SETUP:
6097         case CFG80211_STA_TDLS_PEER_ACTIVE:
6098                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6099                         return -EINVAL;
6100                 /* ignore since it can't change */
6101                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6102                 break;
6103         default:
6104                 /* disallow mesh-specific things */
6105                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
6106                         return -EINVAL;
6107                 if (params->local_pm)
6108                         return -EINVAL;
6109                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6110                         return -EINVAL;
6111         }
6112
6113         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6114             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
6115                 /* TDLS can't be set, ... */
6116                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
6117                         return -EINVAL;
6118                 /*
6119                  * ... but don't bother the driver with it. This works around
6120                  * a hostapd/wpa_supplicant issue -- it always includes the
6121                  * TLDS_PEER flag in the mask even for AP mode.
6122                  */
6123                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6124         }
6125
6126         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6127             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6128                 /* reject other things that can't change */
6129                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
6130                         return -EINVAL;
6131                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
6132                         return -EINVAL;
6133                 if (params->supported_rates)
6134                         return -EINVAL;
6135                 if (params->ext_capab || params->ht_capa || params->vht_capa ||
6136                     params->he_capa)
6137                         return -EINVAL;
6138         }
6139
6140         if (statype != CFG80211_STA_AP_CLIENT &&
6141             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6142                 if (params->vlan)
6143                         return -EINVAL;
6144         }
6145
6146         switch (statype) {
6147         case CFG80211_STA_AP_MLME_CLIENT:
6148                 /* Use this only for authorizing/unauthorizing a station */
6149                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
6150                         return -EOPNOTSUPP;
6151                 break;
6152         case CFG80211_STA_AP_CLIENT:
6153         case CFG80211_STA_AP_CLIENT_UNASSOC:
6154                 /* accept only the listed bits */
6155                 if (params->sta_flags_mask &
6156                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6157                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6158                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
6159                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6160                                   BIT(NL80211_STA_FLAG_WME) |
6161                                   BIT(NL80211_STA_FLAG_MFP)))
6162                         return -EINVAL;
6163
6164                 /* but authenticated/associated only if driver handles it */
6165                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6166                     params->sta_flags_mask &
6167                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6168                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
6169                         return -EINVAL;
6170                 break;
6171         case CFG80211_STA_IBSS:
6172         case CFG80211_STA_AP_STA:
6173                 /* reject any changes other than AUTHORIZED */
6174                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
6175                         return -EINVAL;
6176                 break;
6177         case CFG80211_STA_TDLS_PEER_SETUP:
6178                 /* reject any changes other than AUTHORIZED or WME */
6179                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6180                                                BIT(NL80211_STA_FLAG_WME)))
6181                         return -EINVAL;
6182                 /* force (at least) rates when authorizing */
6183                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
6184                     !params->supported_rates)
6185                         return -EINVAL;
6186                 break;
6187         case CFG80211_STA_TDLS_PEER_ACTIVE:
6188                 /* reject any changes */
6189                 return -EINVAL;
6190         case CFG80211_STA_MESH_PEER_KERNEL:
6191                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6192                         return -EINVAL;
6193                 break;
6194         case CFG80211_STA_MESH_PEER_USER:
6195                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
6196                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
6197                         return -EINVAL;
6198                 break;
6199         }
6200
6201         /*
6202          * Older kernel versions ignored this attribute entirely, so don't
6203          * reject attempts to update it but mark it as unused instead so the
6204          * driver won't look at the data.
6205          */
6206         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
6207             statype != CFG80211_STA_TDLS_PEER_SETUP)
6208                 params->opmode_notif_used = false;
6209
6210         return 0;
6211 }
6212 EXPORT_SYMBOL(cfg80211_check_station_change);
6213
6214 /*
6215  * Get vlan interface making sure it is running and on the right wiphy.
6216  */
6217 static struct net_device *get_vlan(struct genl_info *info,
6218                                    struct cfg80211_registered_device *rdev)
6219 {
6220         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
6221         struct net_device *v;
6222         int ret;
6223
6224         if (!vlanattr)
6225                 return NULL;
6226
6227         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
6228         if (!v)
6229                 return ERR_PTR(-ENODEV);
6230
6231         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
6232                 ret = -EINVAL;
6233                 goto error;
6234         }
6235
6236         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
6237             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6238             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6239                 ret = -EINVAL;
6240                 goto error;
6241         }
6242
6243         if (!netif_running(v)) {
6244                 ret = -ENETDOWN;
6245                 goto error;
6246         }
6247
6248         return v;
6249  error:
6250         dev_put(v);
6251         return ERR_PTR(ret);
6252 }
6253
6254 static const struct nla_policy
6255 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
6256         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
6257         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
6258 };
6259
6260 static int nl80211_parse_sta_wme(struct genl_info *info,
6261                                  struct station_parameters *params)
6262 {
6263         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
6264         struct nlattr *nla;
6265         int err;
6266
6267         /* parse WME attributes if present */
6268         if (!info->attrs[NL80211_ATTR_STA_WME])
6269                 return 0;
6270
6271         nla = info->attrs[NL80211_ATTR_STA_WME];
6272         err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
6273                                           nl80211_sta_wme_policy,
6274                                           info->extack);
6275         if (err)
6276                 return err;
6277
6278         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
6279                 params->uapsd_queues = nla_get_u8(
6280                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
6281         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
6282                 return -EINVAL;
6283
6284         if (tb[NL80211_STA_WME_MAX_SP])
6285                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
6286
6287         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
6288                 return -EINVAL;
6289
6290         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
6291
6292         return 0;
6293 }
6294
6295 static int nl80211_parse_sta_channel_info(struct genl_info *info,
6296                                       struct station_parameters *params)
6297 {
6298         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
6299                 params->supported_channels =
6300                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
6301                 params->supported_channels_len =
6302                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
6303                 /*
6304                  * Need to include at least one (first channel, number of
6305                  * channels) tuple for each subband (checked in policy),
6306                  * and must have proper tuples for the rest of the data as well.
6307                  */
6308                 if (params->supported_channels_len % 2)
6309                         return -EINVAL;
6310         }
6311
6312         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
6313                 params->supported_oper_classes =
6314                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
6315                 params->supported_oper_classes_len =
6316                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
6317         }
6318         return 0;
6319 }
6320
6321 static int nl80211_set_station_tdls(struct genl_info *info,
6322                                     struct station_parameters *params)
6323 {
6324         int err;
6325         /* Dummy STA entry gets updated once the peer capabilities are known */
6326         if (info->attrs[NL80211_ATTR_PEER_AID])
6327                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
6328         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
6329                 params->ht_capa =
6330                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
6331         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
6332                 params->vht_capa =
6333                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
6334         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
6335                 params->he_capa =
6336                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6337                 params->he_capa_len =
6338                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6339         }
6340
6341         err = nl80211_parse_sta_channel_info(info, params);
6342         if (err)
6343                 return err;
6344
6345         return nl80211_parse_sta_wme(info, params);
6346 }
6347
6348 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
6349                                              struct station_parameters *params)
6350 {
6351         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6352         int idx;
6353
6354         if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
6355                 if (!rdev->ops->set_tx_power ||
6356                     !wiphy_ext_feature_isset(&rdev->wiphy,
6357                                          NL80211_EXT_FEATURE_STA_TX_PWR))
6358                         return -EOPNOTSUPP;
6359
6360                 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
6361                 params->txpwr.type = nla_get_u8(info->attrs[idx]);
6362
6363                 if (params->txpwr.type == NL80211_TX_POWER_LIMITED) {
6364                         idx = NL80211_ATTR_STA_TX_POWER;
6365
6366                         if (info->attrs[idx])
6367                                 params->txpwr.power =
6368                                         nla_get_s16(info->attrs[idx]);
6369                         else
6370                                 return -EINVAL;
6371                 }
6372                 params->sta_modify_mask |= STATION_PARAM_APPLY_STA_TXPOWER;
6373         }
6374
6375         return 0;
6376 }
6377
6378 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
6379 {
6380         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6381         struct net_device *dev = info->user_ptr[1];
6382         struct station_parameters params;
6383         u8 *mac_addr;
6384         int err;
6385
6386         memset(&params, 0, sizeof(params));
6387
6388         if (!rdev->ops->change_station)
6389                 return -EOPNOTSUPP;
6390
6391         /*
6392          * AID and listen_interval properties can be set only for unassociated
6393          * station. Include these parameters here and will check them in
6394          * cfg80211_check_station_change().
6395          */
6396         if (info->attrs[NL80211_ATTR_STA_AID])
6397                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
6398
6399         if (info->attrs[NL80211_ATTR_VLAN_ID])
6400                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
6401
6402         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
6403                 params.listen_interval =
6404                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
6405         else
6406                 params.listen_interval = -1;
6407
6408         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
6409                 params.support_p2p_ps =
6410                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
6411         else
6412                 params.support_p2p_ps = -1;
6413
6414         if (!info->attrs[NL80211_ATTR_MAC])
6415                 return -EINVAL;
6416
6417         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6418
6419         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
6420                 params.supported_rates =
6421                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6422                 params.supported_rates_len =
6423                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6424         }
6425
6426         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
6427                 params.capability =
6428                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
6429                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
6430         }
6431
6432         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
6433                 params.ext_capab =
6434                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6435                 params.ext_capab_len =
6436                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6437         }
6438
6439         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
6440                 return -EINVAL;
6441
6442         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
6443                 params.plink_action =
6444                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
6445
6446         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
6447                 params.plink_state =
6448                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
6449                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
6450                         params.peer_aid = nla_get_u16(
6451                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
6452                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
6453         }
6454
6455         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
6456                 params.local_pm = nla_get_u32(
6457                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
6458
6459         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
6460                 params.opmode_notif_used = true;
6461                 params.opmode_notif =
6462                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
6463         }
6464
6465         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
6466                 params.he_6ghz_capa =
6467                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
6468
6469         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
6470                 params.airtime_weight =
6471                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
6472
6473         if (params.airtime_weight &&
6474             !wiphy_ext_feature_isset(&rdev->wiphy,
6475                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6476                 return -EOPNOTSUPP;
6477
6478         err = nl80211_parse_sta_txpower_setting(info, &params);
6479         if (err)
6480                 return err;
6481
6482         /* Include parameters for TDLS peer (will check later) */
6483         err = nl80211_set_station_tdls(info, &params);
6484         if (err)
6485                 return err;
6486
6487         params.vlan = get_vlan(info, rdev);
6488         if (IS_ERR(params.vlan))
6489                 return PTR_ERR(params.vlan);
6490
6491         switch (dev->ieee80211_ptr->iftype) {
6492         case NL80211_IFTYPE_AP:
6493         case NL80211_IFTYPE_AP_VLAN:
6494         case NL80211_IFTYPE_P2P_GO:
6495         case NL80211_IFTYPE_P2P_CLIENT:
6496         case NL80211_IFTYPE_STATION:
6497         case NL80211_IFTYPE_ADHOC:
6498         case NL80211_IFTYPE_MESH_POINT:
6499                 break;
6500         default:
6501                 err = -EOPNOTSUPP;
6502                 goto out_put_vlan;
6503         }
6504
6505         /* driver will call cfg80211_check_station_change() */
6506         err = rdev_change_station(rdev, dev, mac_addr, &params);
6507
6508  out_put_vlan:
6509         if (params.vlan)
6510                 dev_put(params.vlan);
6511
6512         return err;
6513 }
6514
6515 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
6516 {
6517         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6518         int err;
6519         struct net_device *dev = info->user_ptr[1];
6520         struct station_parameters params;
6521         u8 *mac_addr = NULL;
6522         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6523                          BIT(NL80211_STA_FLAG_ASSOCIATED);
6524
6525         memset(&params, 0, sizeof(params));
6526
6527         if (!rdev->ops->add_station)
6528                 return -EOPNOTSUPP;
6529
6530         if (!info->attrs[NL80211_ATTR_MAC])
6531                 return -EINVAL;
6532
6533         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
6534                 return -EINVAL;
6535
6536         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
6537                 return -EINVAL;
6538
6539         if (!info->attrs[NL80211_ATTR_STA_AID] &&
6540             !info->attrs[NL80211_ATTR_PEER_AID])
6541                 return -EINVAL;
6542
6543         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6544         params.supported_rates =
6545                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6546         params.supported_rates_len =
6547                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6548         params.listen_interval =
6549                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
6550
6551         if (info->attrs[NL80211_ATTR_VLAN_ID])
6552                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
6553
6554         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
6555                 params.support_p2p_ps =
6556                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
6557         } else {
6558                 /*
6559                  * if not specified, assume it's supported for P2P GO interface,
6560                  * and is NOT supported for AP interface
6561                  */
6562                 params.support_p2p_ps =
6563                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
6564         }
6565
6566         if (info->attrs[NL80211_ATTR_PEER_AID])
6567                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
6568         else
6569                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
6570
6571         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
6572                 params.capability =
6573                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
6574                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
6575         }
6576
6577         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
6578                 params.ext_capab =
6579                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6580                 params.ext_capab_len =
6581                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6582         }
6583
6584         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
6585                 params.ht_capa =
6586                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
6587
6588         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
6589                 params.vht_capa =
6590                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
6591
6592         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
6593                 params.he_capa =
6594                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6595                 params.he_capa_len =
6596                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6597         }
6598
6599         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
6600                 params.he_6ghz_capa =
6601                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
6602
6603         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
6604                 params.opmode_notif_used = true;
6605                 params.opmode_notif =
6606                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
6607         }
6608
6609         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
6610                 params.plink_action =
6611                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
6612
6613         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
6614                 params.airtime_weight =
6615                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
6616
6617         if (params.airtime_weight &&
6618             !wiphy_ext_feature_isset(&rdev->wiphy,
6619                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6620                 return -EOPNOTSUPP;
6621
6622         err = nl80211_parse_sta_txpower_setting(info, &params);
6623         if (err)
6624                 return err;
6625
6626         err = nl80211_parse_sta_channel_info(info, &params);
6627         if (err)
6628                 return err;
6629
6630         err = nl80211_parse_sta_wme(info, &params);
6631         if (err)
6632                 return err;
6633
6634         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
6635                 return -EINVAL;
6636
6637         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
6638          * as userspace might just pass through the capabilities from the IEs
6639          * directly, rather than enforcing this restriction and returning an
6640          * error in this case.
6641          */
6642         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
6643                 params.ht_capa = NULL;
6644                 params.vht_capa = NULL;
6645
6646                 /* HE requires WME */
6647                 if (params.he_capa_len || params.he_6ghz_capa)
6648                         return -EINVAL;
6649         }
6650
6651         /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
6652         if (params.he_6ghz_capa && (params.ht_capa || params.vht_capa))
6653                 return -EINVAL;
6654
6655         /* When you run into this, adjust the code below for the new flag */
6656         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
6657
6658         switch (dev->ieee80211_ptr->iftype) {
6659         case NL80211_IFTYPE_AP:
6660         case NL80211_IFTYPE_AP_VLAN:
6661         case NL80211_IFTYPE_P2P_GO:
6662                 /* ignore WME attributes if iface/sta is not capable */
6663                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
6664                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
6665                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6666
6667                 /* TDLS peers cannot be added */
6668                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
6669                     info->attrs[NL80211_ATTR_PEER_AID])
6670                         return -EINVAL;
6671                 /* but don't bother the driver with it */
6672                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6673
6674                 /* allow authenticated/associated only if driver handles it */
6675                 if (!(rdev->wiphy.features &
6676                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6677                     params.sta_flags_mask & auth_assoc)
6678                         return -EINVAL;
6679
6680                 /* Older userspace, or userspace wanting to be compatible with
6681                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
6682                  * and assoc flags in the mask, but assumes the station will be
6683                  * added as associated anyway since this was the required driver
6684                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
6685                  * introduced.
6686                  * In order to not bother drivers with this quirk in the API
6687                  * set the flags in both the mask and set for new stations in
6688                  * this case.
6689                  */
6690                 if (!(params.sta_flags_mask & auth_assoc)) {
6691                         params.sta_flags_mask |= auth_assoc;
6692                         params.sta_flags_set |= auth_assoc;
6693                 }
6694
6695                 /* must be last in here for error handling */
6696                 params.vlan = get_vlan(info, rdev);
6697                 if (IS_ERR(params.vlan))
6698                         return PTR_ERR(params.vlan);
6699                 break;
6700         case NL80211_IFTYPE_MESH_POINT:
6701                 /* ignore uAPSD data */
6702                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6703
6704                 /* associated is disallowed */
6705                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
6706                         return -EINVAL;
6707                 /* TDLS peers cannot be added */
6708                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
6709                     info->attrs[NL80211_ATTR_PEER_AID])
6710                         return -EINVAL;
6711                 break;
6712         case NL80211_IFTYPE_STATION:
6713         case NL80211_IFTYPE_P2P_CLIENT:
6714                 /* ignore uAPSD data */
6715                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6716
6717                 /* these are disallowed */
6718                 if (params.sta_flags_mask &
6719                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
6720                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
6721                         return -EINVAL;
6722                 /* Only TDLS peers can be added */
6723                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6724                         return -EINVAL;
6725                 /* Can only add if TDLS ... */
6726                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
6727                         return -EOPNOTSUPP;
6728                 /* ... with external setup is supported */
6729                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
6730                         return -EOPNOTSUPP;
6731                 /*
6732                  * Older wpa_supplicant versions always mark the TDLS peer
6733                  * as authorized, but it shouldn't yet be.
6734                  */
6735                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
6736                 break;
6737         default:
6738                 return -EOPNOTSUPP;
6739         }
6740
6741         /* be aware of params.vlan when changing code here */
6742
6743         err = rdev_add_station(rdev, dev, mac_addr, &params);
6744
6745         if (params.vlan)
6746                 dev_put(params.vlan);
6747         return err;
6748 }
6749
6750 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
6751 {
6752         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6753         struct net_device *dev = info->user_ptr[1];
6754         struct station_del_parameters params;
6755
6756         memset(&params, 0, sizeof(params));
6757
6758         if (info->attrs[NL80211_ATTR_MAC])
6759                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
6760
6761         switch (dev->ieee80211_ptr->iftype) {
6762         case NL80211_IFTYPE_AP:
6763         case NL80211_IFTYPE_AP_VLAN:
6764         case NL80211_IFTYPE_MESH_POINT:
6765         case NL80211_IFTYPE_P2P_GO:
6766                 /* always accept these */
6767                 break;
6768         case NL80211_IFTYPE_ADHOC:
6769                 /* conditionally accept */
6770                 if (wiphy_ext_feature_isset(&rdev->wiphy,
6771                                             NL80211_EXT_FEATURE_DEL_IBSS_STA))
6772                         break;
6773                 return -EINVAL;
6774         default:
6775                 return -EINVAL;
6776         }
6777
6778         if (!rdev->ops->del_station)
6779                 return -EOPNOTSUPP;
6780
6781         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
6782                 params.subtype =
6783                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
6784                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
6785                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
6786                         return -EINVAL;
6787         } else {
6788                 /* Default to Deauthentication frame */
6789                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
6790         }
6791
6792         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
6793                 params.reason_code =
6794                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6795                 if (params.reason_code == 0)
6796                         return -EINVAL; /* 0 is reserved */
6797         } else {
6798                 /* Default to reason code 2 */
6799                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
6800         }
6801
6802         return rdev_del_station(rdev, dev, &params);
6803 }
6804
6805 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
6806                                 int flags, struct net_device *dev,
6807                                 u8 *dst, u8 *next_hop,
6808                                 struct mpath_info *pinfo)
6809 {
6810         void *hdr;
6811         struct nlattr *pinfoattr;
6812
6813         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
6814         if (!hdr)
6815                 return -1;
6816
6817         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6818             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
6819             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
6820             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
6821                 goto nla_put_failure;
6822
6823         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
6824         if (!pinfoattr)
6825                 goto nla_put_failure;
6826         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
6827             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
6828                         pinfo->frame_qlen))
6829                 goto nla_put_failure;
6830         if (((pinfo->filled & MPATH_INFO_SN) &&
6831              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
6832             ((pinfo->filled & MPATH_INFO_METRIC) &&
6833              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
6834                          pinfo->metric)) ||
6835             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
6836              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
6837                          pinfo->exptime)) ||
6838             ((pinfo->filled & MPATH_INFO_FLAGS) &&
6839              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
6840                         pinfo->flags)) ||
6841             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
6842              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
6843                          pinfo->discovery_timeout)) ||
6844             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
6845              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
6846                         pinfo->discovery_retries)) ||
6847             ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
6848              nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
6849                         pinfo->hop_count)) ||
6850             ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
6851              nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
6852                          pinfo->path_change_count)))
6853                 goto nla_put_failure;
6854
6855         nla_nest_end(msg, pinfoattr);
6856
6857         genlmsg_end(msg, hdr);
6858         return 0;
6859
6860  nla_put_failure:
6861         genlmsg_cancel(msg, hdr);
6862         return -EMSGSIZE;
6863 }
6864
6865 static int nl80211_dump_mpath(struct sk_buff *skb,
6866                               struct netlink_callback *cb)
6867 {
6868         struct mpath_info pinfo;
6869         struct cfg80211_registered_device *rdev;
6870         struct wireless_dev *wdev;
6871         u8 dst[ETH_ALEN];
6872         u8 next_hop[ETH_ALEN];
6873         int path_idx = cb->args[2];
6874         int err;
6875
6876         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
6877         if (err)
6878                 return err;
6879         /* nl80211_prepare_wdev_dump acquired it in the successful case */
6880         __acquire(&rdev->wiphy.mtx);
6881
6882         if (!rdev->ops->dump_mpath) {
6883                 err = -EOPNOTSUPP;
6884                 goto out_err;
6885         }
6886
6887         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6888                 err = -EOPNOTSUPP;
6889                 goto out_err;
6890         }
6891
6892         while (1) {
6893                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
6894                                       next_hop, &pinfo);
6895                 if (err == -ENOENT)
6896                         break;
6897                 if (err)
6898                         goto out_err;
6899
6900                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
6901                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
6902                                        wdev->netdev, dst, next_hop,
6903                                        &pinfo) < 0)
6904                         goto out;
6905
6906                 path_idx++;
6907         }
6908
6909  out:
6910         cb->args[2] = path_idx;
6911         err = skb->len;
6912  out_err:
6913         wiphy_unlock(&rdev->wiphy);
6914         return err;
6915 }
6916
6917 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
6918 {
6919         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6920         int err;
6921         struct net_device *dev = info->user_ptr[1];
6922         struct mpath_info pinfo;
6923         struct sk_buff *msg;
6924         u8 *dst = NULL;
6925         u8 next_hop[ETH_ALEN];
6926
6927         memset(&pinfo, 0, sizeof(pinfo));
6928
6929         if (!info->attrs[NL80211_ATTR_MAC])
6930                 return -EINVAL;
6931
6932         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6933
6934         if (!rdev->ops->get_mpath)
6935                 return -EOPNOTSUPP;
6936
6937         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6938                 return -EOPNOTSUPP;
6939
6940         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
6941         if (err)
6942                 return err;
6943
6944         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6945         if (!msg)
6946                 return -ENOMEM;
6947
6948         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6949                                  dev, dst, next_hop, &pinfo) < 0) {
6950                 nlmsg_free(msg);
6951                 return -ENOBUFS;
6952         }
6953
6954         return genlmsg_reply(msg, info);
6955 }
6956
6957 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
6958 {
6959         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6960         struct net_device *dev = info->user_ptr[1];
6961         u8 *dst = NULL;
6962         u8 *next_hop = NULL;
6963
6964         if (!info->attrs[NL80211_ATTR_MAC])
6965                 return -EINVAL;
6966
6967         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6968                 return -EINVAL;
6969
6970         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6971         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6972
6973         if (!rdev->ops->change_mpath)
6974                 return -EOPNOTSUPP;
6975
6976         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6977                 return -EOPNOTSUPP;
6978
6979         return rdev_change_mpath(rdev, dev, dst, next_hop);
6980 }
6981
6982 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
6983 {
6984         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6985         struct net_device *dev = info->user_ptr[1];
6986         u8 *dst = NULL;
6987         u8 *next_hop = NULL;
6988
6989         if (!info->attrs[NL80211_ATTR_MAC])
6990                 return -EINVAL;
6991
6992         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6993                 return -EINVAL;
6994
6995         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6996         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6997
6998         if (!rdev->ops->add_mpath)
6999                 return -EOPNOTSUPP;
7000
7001         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7002                 return -EOPNOTSUPP;
7003
7004         return rdev_add_mpath(rdev, dev, dst, next_hop);
7005 }
7006
7007 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
7008 {
7009         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7010         struct net_device *dev = info->user_ptr[1];
7011         u8 *dst = NULL;
7012
7013         if (info->attrs[NL80211_ATTR_MAC])
7014                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7015
7016         if (!rdev->ops->del_mpath)
7017                 return -EOPNOTSUPP;
7018
7019         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7020                 return -EOPNOTSUPP;
7021
7022         return rdev_del_mpath(rdev, dev, dst);
7023 }
7024
7025 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
7026 {
7027         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7028         int err;
7029         struct net_device *dev = info->user_ptr[1];
7030         struct mpath_info pinfo;
7031         struct sk_buff *msg;
7032         u8 *dst = NULL;
7033         u8 mpp[ETH_ALEN];
7034
7035         memset(&pinfo, 0, sizeof(pinfo));
7036
7037         if (!info->attrs[NL80211_ATTR_MAC])
7038                 return -EINVAL;
7039
7040         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7041
7042         if (!rdev->ops->get_mpp)
7043                 return -EOPNOTSUPP;
7044
7045         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7046                 return -EOPNOTSUPP;
7047
7048         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
7049         if (err)
7050                 return err;
7051
7052         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7053         if (!msg)
7054                 return -ENOMEM;
7055
7056         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7057                                dev, dst, mpp, &pinfo) < 0) {
7058                 nlmsg_free(msg);
7059                 return -ENOBUFS;
7060         }
7061
7062         return genlmsg_reply(msg, info);
7063 }
7064
7065 static int nl80211_dump_mpp(struct sk_buff *skb,
7066                             struct netlink_callback *cb)
7067 {
7068         struct mpath_info pinfo;
7069         struct cfg80211_registered_device *rdev;
7070         struct wireless_dev *wdev;
7071         u8 dst[ETH_ALEN];
7072         u8 mpp[ETH_ALEN];
7073         int path_idx = cb->args[2];
7074         int err;
7075
7076         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
7077         if (err)
7078                 return err;
7079         /* nl80211_prepare_wdev_dump acquired it in the successful case */
7080         __acquire(&rdev->wiphy.mtx);
7081
7082         if (!rdev->ops->dump_mpp) {
7083                 err = -EOPNOTSUPP;
7084                 goto out_err;
7085         }
7086
7087         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7088                 err = -EOPNOTSUPP;
7089                 goto out_err;
7090         }
7091
7092         while (1) {
7093                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
7094                                     mpp, &pinfo);
7095                 if (err == -ENOENT)
7096                         break;
7097                 if (err)
7098                         goto out_err;
7099
7100                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7101                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
7102                                        wdev->netdev, dst, mpp,
7103                                        &pinfo) < 0)
7104                         goto out;
7105
7106                 path_idx++;
7107         }
7108
7109  out:
7110         cb->args[2] = path_idx;
7111         err = skb->len;
7112  out_err:
7113         wiphy_unlock(&rdev->wiphy);
7114         return err;
7115 }
7116
7117 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
7118 {
7119         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7120         struct net_device *dev = info->user_ptr[1];
7121         struct wireless_dev *wdev = dev->ieee80211_ptr;
7122         struct bss_parameters params;
7123         int err;
7124
7125         memset(&params, 0, sizeof(params));
7126         /* default to not changing parameters */
7127         params.use_cts_prot = -1;
7128         params.use_short_preamble = -1;
7129         params.use_short_slot_time = -1;
7130         params.ap_isolate = -1;
7131         params.ht_opmode = -1;
7132         params.p2p_ctwindow = -1;
7133         params.p2p_opp_ps = -1;
7134
7135         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
7136                 params.use_cts_prot =
7137                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
7138         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
7139                 params.use_short_preamble =
7140                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
7141         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
7142                 params.use_short_slot_time =
7143                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
7144         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7145                 params.basic_rates =
7146                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7147                 params.basic_rates_len =
7148                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7149         }
7150         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
7151                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
7152         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
7153                 params.ht_opmode =
7154                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
7155
7156         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
7157                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7158                         return -EINVAL;
7159                 params.p2p_ctwindow =
7160                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
7161                 if (params.p2p_ctwindow != 0 &&
7162                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
7163                         return -EINVAL;
7164         }
7165
7166         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
7167                 u8 tmp;
7168
7169                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7170                         return -EINVAL;
7171                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
7172                 params.p2p_opp_ps = tmp;
7173                 if (params.p2p_opp_ps &&
7174                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
7175                         return -EINVAL;
7176         }
7177
7178         if (!rdev->ops->change_bss)
7179                 return -EOPNOTSUPP;
7180
7181         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
7182             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7183                 return -EOPNOTSUPP;
7184
7185         wdev_lock(wdev);
7186         err = rdev_change_bss(rdev, dev, &params);
7187         wdev_unlock(wdev);
7188
7189         return err;
7190 }
7191
7192 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
7193 {
7194         char *data = NULL;
7195         bool is_indoor;
7196         enum nl80211_user_reg_hint_type user_reg_hint_type;
7197         u32 owner_nlportid;
7198
7199         /*
7200          * You should only get this when cfg80211 hasn't yet initialized
7201          * completely when built-in to the kernel right between the time
7202          * window between nl80211_init() and regulatory_init(), if that is
7203          * even possible.
7204          */
7205         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
7206                 return -EINPROGRESS;
7207
7208         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
7209                 user_reg_hint_type =
7210                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
7211         else
7212                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
7213
7214         switch (user_reg_hint_type) {
7215         case NL80211_USER_REG_HINT_USER:
7216         case NL80211_USER_REG_HINT_CELL_BASE:
7217                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
7218                         return -EINVAL;
7219
7220                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
7221                 return regulatory_hint_user(data, user_reg_hint_type);
7222         case NL80211_USER_REG_HINT_INDOOR:
7223                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
7224                         owner_nlportid = info->snd_portid;
7225                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
7226                 } else {
7227                         owner_nlportid = 0;
7228                         is_indoor = true;
7229                 }
7230
7231                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
7232         default:
7233                 return -EINVAL;
7234         }
7235 }
7236
7237 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
7238 {
7239         return reg_reload_regdb();
7240 }
7241
7242 static int nl80211_get_mesh_config(struct sk_buff *skb,
7243                                    struct genl_info *info)
7244 {
7245         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7246         struct net_device *dev = info->user_ptr[1];
7247         struct wireless_dev *wdev = dev->ieee80211_ptr;
7248         struct mesh_config cur_params;
7249         int err = 0;
7250         void *hdr;
7251         struct nlattr *pinfoattr;
7252         struct sk_buff *msg;
7253
7254         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
7255                 return -EOPNOTSUPP;
7256
7257         if (!rdev->ops->get_mesh_config)
7258                 return -EOPNOTSUPP;
7259
7260         wdev_lock(wdev);
7261         /* If not connected, get default parameters */
7262         if (!wdev->mesh_id_len)
7263                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
7264         else
7265                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
7266         wdev_unlock(wdev);
7267
7268         if (err)
7269                 return err;
7270
7271         /* Draw up a netlink message to send back */
7272         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7273         if (!msg)
7274                 return -ENOMEM;
7275         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7276                              NL80211_CMD_GET_MESH_CONFIG);
7277         if (!hdr)
7278                 goto out;
7279         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
7280         if (!pinfoattr)
7281                 goto nla_put_failure;
7282         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7283             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
7284                         cur_params.dot11MeshRetryTimeout) ||
7285             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
7286                         cur_params.dot11MeshConfirmTimeout) ||
7287             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
7288                         cur_params.dot11MeshHoldingTimeout) ||
7289             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
7290                         cur_params.dot11MeshMaxPeerLinks) ||
7291             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
7292                        cur_params.dot11MeshMaxRetries) ||
7293             nla_put_u8(msg, NL80211_MESHCONF_TTL,
7294                        cur_params.dot11MeshTTL) ||
7295             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
7296                        cur_params.element_ttl) ||
7297             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
7298                        cur_params.auto_open_plinks) ||
7299             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
7300                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
7301             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
7302                        cur_params.dot11MeshHWMPmaxPREQretries) ||
7303             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
7304                         cur_params.path_refresh_time) ||
7305             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
7306                         cur_params.min_discovery_timeout) ||
7307             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
7308                         cur_params.dot11MeshHWMPactivePathTimeout) ||
7309             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
7310                         cur_params.dot11MeshHWMPpreqMinInterval) ||
7311             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
7312                         cur_params.dot11MeshHWMPperrMinInterval) ||
7313             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
7314                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
7315             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
7316                        cur_params.dot11MeshHWMPRootMode) ||
7317             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
7318                         cur_params.dot11MeshHWMPRannInterval) ||
7319             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
7320                        cur_params.dot11MeshGateAnnouncementProtocol) ||
7321             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
7322                        cur_params.dot11MeshForwarding) ||
7323             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
7324                         cur_params.rssi_threshold) ||
7325             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
7326                         cur_params.ht_opmode) ||
7327             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
7328                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
7329             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
7330                         cur_params.dot11MeshHWMProotInterval) ||
7331             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
7332                         cur_params.dot11MeshHWMPconfirmationInterval) ||
7333             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
7334                         cur_params.power_mode) ||
7335             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
7336                         cur_params.dot11MeshAwakeWindowDuration) ||
7337             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
7338                         cur_params.plink_timeout) ||
7339             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
7340                        cur_params.dot11MeshConnectedToMeshGate) ||
7341             nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
7342                        cur_params.dot11MeshNolearn) ||
7343             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
7344                        cur_params.dot11MeshConnectedToAuthServer))
7345                 goto nla_put_failure;
7346         nla_nest_end(msg, pinfoattr);
7347         genlmsg_end(msg, hdr);
7348         return genlmsg_reply(msg, info);
7349
7350  nla_put_failure:
7351  out:
7352         nlmsg_free(msg);
7353         return -ENOBUFS;
7354 }
7355
7356 static const struct nla_policy
7357 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
7358         [NL80211_MESHCONF_RETRY_TIMEOUT] =
7359                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7360         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
7361                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7362         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
7363                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7364         [NL80211_MESHCONF_MAX_PEER_LINKS] =
7365                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
7366         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
7367         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
7368         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
7369         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
7370         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
7371                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
7372         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
7373         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
7374         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
7375         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
7376         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
7377                 NLA_POLICY_MIN(NLA_U16, 1),
7378         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
7379                 NLA_POLICY_MIN(NLA_U16, 1),
7380         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
7381                 NLA_POLICY_MIN(NLA_U16, 1),
7382         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
7383         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
7384                 NLA_POLICY_MIN(NLA_U16, 1),
7385         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
7386         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
7387         [NL80211_MESHCONF_RSSI_THRESHOLD] =
7388                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
7389         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
7390         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
7391         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
7392                 NLA_POLICY_MIN(NLA_U16, 1),
7393         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
7394                 NLA_POLICY_MIN(NLA_U16, 1),
7395         [NL80211_MESHCONF_POWER_MODE] =
7396                 NLA_POLICY_RANGE(NLA_U32,
7397                                  NL80211_MESH_POWER_ACTIVE,
7398                                  NL80211_MESH_POWER_MAX),
7399         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
7400         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
7401         [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7402         [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7403         [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7404 };
7405
7406 static const struct nla_policy
7407         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
7408         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
7409         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
7410         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
7411         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
7412         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
7413         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
7414         [NL80211_MESH_SETUP_IE] =
7415                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
7416                                        IEEE80211_MAX_DATA_LEN),
7417         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
7418 };
7419
7420 static int nl80211_parse_mesh_config(struct genl_info *info,
7421                                      struct mesh_config *cfg,
7422                                      u32 *mask_out)
7423 {
7424         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
7425         u32 mask = 0;
7426         u16 ht_opmode;
7427
7428 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
7429 do {                                                                    \
7430         if (tb[attr]) {                                                 \
7431                 cfg->param = fn(tb[attr]);                              \
7432                 mask |= BIT((attr) - 1);                                \
7433         }                                                               \
7434 } while (0)
7435
7436         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
7437                 return -EINVAL;
7438         if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
7439                 return -EINVAL;
7440
7441         /* This makes sure that there aren't more than 32 mesh config
7442          * parameters (otherwise our bitfield scheme would not work.) */
7443         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
7444
7445         /* Fill in the params struct */
7446         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
7447                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
7448         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
7449                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
7450                                   nla_get_u16);
7451         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
7452                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
7453                                   nla_get_u16);
7454         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
7455                                   NL80211_MESHCONF_MAX_PEER_LINKS,
7456                                   nla_get_u16);
7457         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
7458                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
7459         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
7460                                   NL80211_MESHCONF_TTL, nla_get_u8);
7461         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
7462                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
7463         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
7464                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
7465                                   nla_get_u8);
7466         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
7467                                   mask,
7468                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
7469                                   nla_get_u32);
7470         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
7471                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
7472                                   nla_get_u8);
7473         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
7474                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
7475                                   nla_get_u32);
7476         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
7477             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
7478                 return -EINVAL;
7479         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
7480                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
7481                                   nla_get_u16);
7482         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
7483                                   mask,
7484                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
7485                                   nla_get_u32);
7486         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
7487             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
7488              cfg->dot11MeshHWMPactivePathTimeout > 65535))
7489                 return -EINVAL;
7490         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
7491                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
7492                                   nla_get_u16);
7493         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
7494                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
7495                                   nla_get_u16);
7496         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
7497                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
7498                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
7499                                   nla_get_u16);
7500         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
7501                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
7502         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
7503                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
7504                                   nla_get_u16);
7505         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
7506                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
7507                                   nla_get_u8);
7508         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
7509                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
7510         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
7511                                   NL80211_MESHCONF_RSSI_THRESHOLD,
7512                                   nla_get_s32);
7513         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
7514                                   NL80211_MESHCONF_CONNECTED_TO_GATE,
7515                                   nla_get_u8);
7516         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
7517                                   NL80211_MESHCONF_CONNECTED_TO_AS,
7518                                   nla_get_u8);
7519         /*
7520          * Check HT operation mode based on
7521          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
7522          */
7523         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
7524                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
7525
7526                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
7527                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
7528                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
7529                         return -EINVAL;
7530
7531                 /* NON_HT_STA bit is reserved, but some programs set it */
7532                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
7533
7534                 cfg->ht_opmode = ht_opmode;
7535                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
7536         }
7537         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
7538                                   dot11MeshHWMPactivePathToRootTimeout, mask,
7539                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
7540                                   nla_get_u32);
7541         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
7542             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
7543              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
7544                 return -EINVAL;
7545         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
7546                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
7547                                   nla_get_u16);
7548         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
7549                                   mask,
7550                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
7551                                   nla_get_u16);
7552         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
7553                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
7554         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
7555                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
7556         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
7557                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
7558         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
7559                                   NL80211_MESHCONF_NOLEARN, nla_get_u8);
7560         if (mask_out)
7561                 *mask_out = mask;
7562
7563         return 0;
7564
7565 #undef FILL_IN_MESH_PARAM_IF_SET
7566 }
7567
7568 static int nl80211_parse_mesh_setup(struct genl_info *info,
7569                                      struct mesh_setup *setup)
7570 {
7571         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7572         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
7573
7574         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
7575                 return -EINVAL;
7576         if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
7577                 return -EINVAL;
7578
7579         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
7580                 setup->sync_method =
7581                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
7582                  IEEE80211_SYNC_METHOD_VENDOR :
7583                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
7584
7585         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
7586                 setup->path_sel_proto =
7587                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
7588                  IEEE80211_PATH_PROTOCOL_VENDOR :
7589                  IEEE80211_PATH_PROTOCOL_HWMP;
7590
7591         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
7592                 setup->path_metric =
7593                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
7594                  IEEE80211_PATH_METRIC_VENDOR :
7595                  IEEE80211_PATH_METRIC_AIRTIME;
7596
7597         if (tb[NL80211_MESH_SETUP_IE]) {
7598                 struct nlattr *ieattr =
7599                         tb[NL80211_MESH_SETUP_IE];
7600                 setup->ie = nla_data(ieattr);
7601                 setup->ie_len = nla_len(ieattr);
7602         }
7603         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
7604             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
7605                 return -EINVAL;
7606         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
7607         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
7608         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
7609         if (setup->is_secure)
7610                 setup->user_mpm = true;
7611
7612         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
7613                 if (!setup->user_mpm)
7614                         return -EINVAL;
7615                 setup->auth_id =
7616                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
7617         }
7618
7619         return 0;
7620 }
7621
7622 static int nl80211_update_mesh_config(struct sk_buff *skb,
7623                                       struct genl_info *info)
7624 {
7625         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7626         struct net_device *dev = info->user_ptr[1];
7627         struct wireless_dev *wdev = dev->ieee80211_ptr;
7628         struct mesh_config cfg;
7629         u32 mask;
7630         int err;
7631
7632         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
7633                 return -EOPNOTSUPP;
7634
7635         if (!rdev->ops->update_mesh_config)
7636                 return -EOPNOTSUPP;
7637
7638         err = nl80211_parse_mesh_config(info, &cfg, &mask);
7639         if (err)
7640                 return err;
7641
7642         wdev_lock(wdev);
7643         if (!wdev->mesh_id_len)
7644                 err = -ENOLINK;
7645
7646         if (!err)
7647                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
7648
7649         wdev_unlock(wdev);
7650
7651         return err;
7652 }
7653
7654 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
7655                               struct sk_buff *msg)
7656 {
7657         struct nlattr *nl_reg_rules;
7658         unsigned int i;
7659
7660         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
7661             (regdom->dfs_region &&
7662              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
7663                 goto nla_put_failure;
7664
7665         nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
7666         if (!nl_reg_rules)
7667                 goto nla_put_failure;
7668
7669         for (i = 0; i < regdom->n_reg_rules; i++) {
7670                 struct nlattr *nl_reg_rule;
7671                 const struct ieee80211_reg_rule *reg_rule;
7672                 const struct ieee80211_freq_range *freq_range;
7673                 const struct ieee80211_power_rule *power_rule;
7674                 unsigned int max_bandwidth_khz;
7675
7676                 reg_rule = &regdom->reg_rules[i];
7677                 freq_range = &reg_rule->freq_range;
7678                 power_rule = &reg_rule->power_rule;
7679
7680                 nl_reg_rule = nla_nest_start_noflag(msg, i);
7681                 if (!nl_reg_rule)
7682                         goto nla_put_failure;
7683
7684                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
7685                 if (!max_bandwidth_khz)
7686                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
7687                                                                   reg_rule);
7688
7689                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
7690                                 reg_rule->flags) ||
7691                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
7692                                 freq_range->start_freq_khz) ||
7693                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
7694                                 freq_range->end_freq_khz) ||
7695                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
7696                                 max_bandwidth_khz) ||
7697                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
7698                                 power_rule->max_antenna_gain) ||
7699                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
7700                                 power_rule->max_eirp) ||
7701                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
7702                                 reg_rule->dfs_cac_ms))
7703                         goto nla_put_failure;
7704
7705                 nla_nest_end(msg, nl_reg_rule);
7706         }
7707
7708         nla_nest_end(msg, nl_reg_rules);
7709         return 0;
7710
7711 nla_put_failure:
7712         return -EMSGSIZE;
7713 }
7714
7715 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
7716 {
7717         const struct ieee80211_regdomain *regdom = NULL;
7718         struct cfg80211_registered_device *rdev;
7719         struct wiphy *wiphy = NULL;
7720         struct sk_buff *msg;
7721         void *hdr;
7722
7723         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7724         if (!msg)
7725                 return -ENOBUFS;
7726
7727         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7728                              NL80211_CMD_GET_REG);
7729         if (!hdr)
7730                 goto put_failure;
7731
7732         rtnl_lock();
7733
7734         if (info->attrs[NL80211_ATTR_WIPHY]) {
7735                 bool self_managed;
7736
7737                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
7738                 if (IS_ERR(rdev)) {
7739                         nlmsg_free(msg);
7740                         rtnl_unlock();
7741                         return PTR_ERR(rdev);
7742                 }
7743
7744                 wiphy = &rdev->wiphy;
7745                 self_managed = wiphy->regulatory_flags &
7746                                REGULATORY_WIPHY_SELF_MANAGED;
7747                 regdom = get_wiphy_regdom(wiphy);
7748
7749                 /* a self-managed-reg device must have a private regdom */
7750                 if (WARN_ON(!regdom && self_managed)) {
7751                         nlmsg_free(msg);
7752                         rtnl_unlock();
7753                         return -EINVAL;
7754                 }
7755
7756                 if (regdom &&
7757                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
7758                         goto nla_put_failure;
7759         }
7760
7761         if (!wiphy && reg_last_request_cell_base() &&
7762             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
7763                         NL80211_USER_REG_HINT_CELL_BASE))
7764                 goto nla_put_failure;
7765
7766         rcu_read_lock();
7767
7768         if (!regdom)
7769                 regdom = rcu_dereference(cfg80211_regdomain);
7770
7771         if (nl80211_put_regdom(regdom, msg))
7772                 goto nla_put_failure_rcu;
7773
7774         rcu_read_unlock();
7775
7776         genlmsg_end(msg, hdr);
7777         rtnl_unlock();
7778         return genlmsg_reply(msg, info);
7779
7780 nla_put_failure_rcu:
7781         rcu_read_unlock();
7782 nla_put_failure:
7783         rtnl_unlock();
7784 put_failure:
7785         nlmsg_free(msg);
7786         return -EMSGSIZE;
7787 }
7788
7789 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
7790                                u32 seq, int flags, struct wiphy *wiphy,
7791                                const struct ieee80211_regdomain *regdom)
7792 {
7793         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7794                                    NL80211_CMD_GET_REG);
7795
7796         if (!hdr)
7797                 return -1;
7798
7799         genl_dump_check_consistent(cb, hdr);
7800
7801         if (nl80211_put_regdom(regdom, msg))
7802                 goto nla_put_failure;
7803
7804         if (!wiphy && reg_last_request_cell_base() &&
7805             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
7806                         NL80211_USER_REG_HINT_CELL_BASE))
7807                 goto nla_put_failure;
7808
7809         if (wiphy &&
7810             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
7811                 goto nla_put_failure;
7812
7813         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
7814             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
7815                 goto nla_put_failure;
7816
7817         genlmsg_end(msg, hdr);
7818         return 0;
7819
7820 nla_put_failure:
7821         genlmsg_cancel(msg, hdr);
7822         return -EMSGSIZE;
7823 }
7824
7825 static int nl80211_get_reg_dump(struct sk_buff *skb,
7826                                 struct netlink_callback *cb)
7827 {
7828         const struct ieee80211_regdomain *regdom = NULL;
7829         struct cfg80211_registered_device *rdev;
7830         int err, reg_idx, start = cb->args[2];
7831
7832         rtnl_lock();
7833
7834         if (cfg80211_regdomain && start == 0) {
7835                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
7836                                           NLM_F_MULTI, NULL,
7837                                           rtnl_dereference(cfg80211_regdomain));
7838                 if (err < 0)
7839                         goto out_err;
7840         }
7841
7842         /* the global regdom is idx 0 */
7843         reg_idx = 1;
7844         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
7845                 regdom = get_wiphy_regdom(&rdev->wiphy);
7846                 if (!regdom)
7847                         continue;
7848
7849                 if (++reg_idx <= start)
7850                         continue;
7851
7852                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
7853                                           NLM_F_MULTI, &rdev->wiphy, regdom);
7854                 if (err < 0) {
7855                         reg_idx--;
7856                         break;
7857                 }
7858         }
7859
7860         cb->args[2] = reg_idx;
7861         err = skb->len;
7862 out_err:
7863         rtnl_unlock();
7864         return err;
7865 }
7866
7867 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
7868 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
7869         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
7870         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
7871         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
7872         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
7873         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
7874         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
7875         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
7876 };
7877
7878 static int parse_reg_rule(struct nlattr *tb[],
7879         struct ieee80211_reg_rule *reg_rule)
7880 {
7881         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
7882         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
7883
7884         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
7885                 return -EINVAL;
7886         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
7887                 return -EINVAL;
7888         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
7889                 return -EINVAL;
7890         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
7891                 return -EINVAL;
7892         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
7893                 return -EINVAL;
7894
7895         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
7896
7897         freq_range->start_freq_khz =
7898                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
7899         freq_range->end_freq_khz =
7900                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
7901         freq_range->max_bandwidth_khz =
7902                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
7903
7904         power_rule->max_eirp =
7905                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
7906
7907         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
7908                 power_rule->max_antenna_gain =
7909                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
7910
7911         if (tb[NL80211_ATTR_DFS_CAC_TIME])
7912                 reg_rule->dfs_cac_ms =
7913                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
7914
7915         return 0;
7916 }
7917
7918 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
7919 {
7920         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
7921         struct nlattr *nl_reg_rule;
7922         char *alpha2;
7923         int rem_reg_rules, r;
7924         u32 num_rules = 0, rule_idx = 0;
7925         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
7926         struct ieee80211_regdomain *rd;
7927
7928         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
7929                 return -EINVAL;
7930
7931         if (!info->attrs[NL80211_ATTR_REG_RULES])
7932                 return -EINVAL;
7933
7934         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
7935
7936         if (info->attrs[NL80211_ATTR_DFS_REGION])
7937                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
7938
7939         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7940                             rem_reg_rules) {
7941                 num_rules++;
7942                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
7943                         return -EINVAL;
7944         }
7945
7946         rtnl_lock();
7947         if (!reg_is_valid_request(alpha2)) {
7948                 r = -EINVAL;
7949                 goto out;
7950         }
7951
7952         rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
7953         if (!rd) {
7954                 r = -ENOMEM;
7955                 goto out;
7956         }
7957
7958         rd->n_reg_rules = num_rules;
7959         rd->alpha2[0] = alpha2[0];
7960         rd->alpha2[1] = alpha2[1];
7961
7962         /*
7963          * Disable DFS master mode if the DFS region was
7964          * not supported or known on this kernel.
7965          */
7966         if (reg_supported_dfs_region(dfs_region))
7967                 rd->dfs_region = dfs_region;
7968
7969         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7970                             rem_reg_rules) {
7971                 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
7972                                                 nl_reg_rule, reg_rule_policy,
7973                                                 info->extack);
7974                 if (r)
7975                         goto bad_reg;
7976                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
7977                 if (r)
7978                         goto bad_reg;
7979
7980                 rule_idx++;
7981
7982                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
7983                         r = -EINVAL;
7984                         goto bad_reg;
7985                 }
7986         }
7987
7988         r = set_regdom(rd, REGD_SOURCE_CRDA);
7989         /* set_regdom takes ownership of rd */
7990         rd = NULL;
7991  bad_reg:
7992         kfree(rd);
7993  out:
7994         rtnl_unlock();
7995         return r;
7996 }
7997 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
7998
7999 static int validate_scan_freqs(struct nlattr *freqs)
8000 {
8001         struct nlattr *attr1, *attr2;
8002         int n_channels = 0, tmp1, tmp2;
8003
8004         nla_for_each_nested(attr1, freqs, tmp1)
8005                 if (nla_len(attr1) != sizeof(u32))
8006                         return 0;
8007
8008         nla_for_each_nested(attr1, freqs, tmp1) {
8009                 n_channels++;
8010                 /*
8011                  * Some hardware has a limited channel list for
8012                  * scanning, and it is pretty much nonsensical
8013                  * to scan for a channel twice, so disallow that
8014                  * and don't require drivers to check that the
8015                  * channel list they get isn't longer than what
8016                  * they can scan, as long as they can scan all
8017                  * the channels they registered at once.
8018                  */
8019                 nla_for_each_nested(attr2, freqs, tmp2)
8020                         if (attr1 != attr2 &&
8021                             nla_get_u32(attr1) == nla_get_u32(attr2))
8022                                 return 0;
8023         }
8024
8025         return n_channels;
8026 }
8027
8028 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
8029 {
8030         return b < NUM_NL80211_BANDS && wiphy->bands[b];
8031 }
8032
8033 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
8034                             struct cfg80211_bss_selection *bss_select)
8035 {
8036         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
8037         struct nlattr *nest;
8038         int err;
8039         bool found = false;
8040         int i;
8041
8042         /* only process one nested attribute */
8043         nest = nla_data(nla);
8044         if (!nla_ok(nest, nla_len(nest)))
8045                 return -EINVAL;
8046
8047         err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
8048                                           nest, nl80211_bss_select_policy,
8049                                           NULL);
8050         if (err)
8051                 return err;
8052
8053         /* only one attribute may be given */
8054         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
8055                 if (attr[i]) {
8056                         if (found)
8057                                 return -EINVAL;
8058                         found = true;
8059                 }
8060         }
8061
8062         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
8063
8064         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
8065                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
8066
8067         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
8068                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
8069                 bss_select->param.band_pref =
8070                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
8071                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
8072                         return -EINVAL;
8073         }
8074
8075         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
8076                 struct nl80211_bss_select_rssi_adjust *adj_param;
8077
8078                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
8079                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
8080                 bss_select->param.adjust.band = adj_param->band;
8081                 bss_select->param.adjust.delta = adj_param->delta;
8082                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
8083                         return -EINVAL;
8084         }
8085
8086         /* user-space did not provide behaviour attribute */
8087         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
8088                 return -EINVAL;
8089
8090         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
8091                 return -EINVAL;
8092
8093         return 0;
8094 }
8095
8096 int nl80211_parse_random_mac(struct nlattr **attrs,
8097                              u8 *mac_addr, u8 *mac_addr_mask)
8098 {
8099         int i;
8100
8101         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
8102                 eth_zero_addr(mac_addr);
8103                 eth_zero_addr(mac_addr_mask);
8104                 mac_addr[0] = 0x2;
8105                 mac_addr_mask[0] = 0x3;
8106
8107                 return 0;
8108         }
8109
8110         /* need both or none */
8111         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
8112                 return -EINVAL;
8113
8114         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
8115         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
8116
8117         /* don't allow or configure an mcast address */
8118         if (!is_multicast_ether_addr(mac_addr_mask) ||
8119             is_multicast_ether_addr(mac_addr))
8120                 return -EINVAL;
8121
8122         /*
8123          * allow users to pass a MAC address that has bits set outside
8124          * of the mask, but don't bother drivers with having to deal
8125          * with such bits
8126          */
8127         for (i = 0; i < ETH_ALEN; i++)
8128                 mac_addr[i] &= mac_addr_mask[i];
8129
8130         return 0;
8131 }
8132
8133 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
8134 {
8135         ASSERT_WDEV_LOCK(wdev);
8136
8137         if (!cfg80211_beaconing_iface_active(wdev))
8138                 return true;
8139
8140         if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
8141                 return true;
8142
8143         return regulatory_pre_cac_allowed(wdev->wiphy);
8144 }
8145
8146 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
8147                                     enum nl80211_ext_feature_index feat)
8148 {
8149         if (!(flags & flag))
8150                 return true;
8151         if (wiphy_ext_feature_isset(wiphy, feat))
8152                 return true;
8153         return false;
8154 }
8155
8156 static int
8157 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
8158                          void *request, struct nlattr **attrs,
8159                          bool is_sched_scan)
8160 {
8161         u8 *mac_addr, *mac_addr_mask;
8162         u32 *flags;
8163         enum nl80211_feature_flags randomness_flag;
8164
8165         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
8166                 return 0;
8167
8168         if (is_sched_scan) {
8169                 struct cfg80211_sched_scan_request *req = request;
8170
8171                 randomness_flag = wdev ?
8172                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
8173                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
8174                 flags = &req->flags;
8175                 mac_addr = req->mac_addr;
8176                 mac_addr_mask = req->mac_addr_mask;
8177         } else {
8178                 struct cfg80211_scan_request *req = request;
8179
8180                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
8181                 flags = &req->flags;
8182                 mac_addr = req->mac_addr;
8183                 mac_addr_mask = req->mac_addr_mask;
8184         }
8185
8186         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
8187
8188         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
8189              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
8190             !nl80211_check_scan_feat(wiphy, *flags,
8191                                      NL80211_SCAN_FLAG_LOW_SPAN,
8192                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
8193             !nl80211_check_scan_feat(wiphy, *flags,
8194                                      NL80211_SCAN_FLAG_LOW_POWER,
8195                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
8196             !nl80211_check_scan_feat(wiphy, *flags,
8197                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
8198                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
8199             !nl80211_check_scan_feat(wiphy, *flags,
8200                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
8201                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
8202             !nl80211_check_scan_feat(wiphy, *flags,
8203                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
8204                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
8205             !nl80211_check_scan_feat(wiphy, *flags,
8206                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
8207                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
8208             !nl80211_check_scan_feat(wiphy, *flags,
8209                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
8210                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
8211             !nl80211_check_scan_feat(wiphy, *flags,
8212                                      NL80211_SCAN_FLAG_RANDOM_SN,
8213                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
8214             !nl80211_check_scan_feat(wiphy, *flags,
8215                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
8216                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
8217                 return -EOPNOTSUPP;
8218
8219         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
8220                 int err;
8221
8222                 if (!(wiphy->features & randomness_flag) ||
8223                     (wdev && wdev->current_bss))
8224                         return -EOPNOTSUPP;
8225
8226                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
8227                 if (err)
8228                         return err;
8229         }
8230
8231         return 0;
8232 }
8233
8234 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
8235 {
8236         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8237         struct wireless_dev *wdev = info->user_ptr[1];
8238         struct cfg80211_scan_request *request;
8239         struct nlattr *scan_freqs = NULL;
8240         bool scan_freqs_khz = false;
8241         struct nlattr *attr;
8242         struct wiphy *wiphy;
8243         int err, tmp, n_ssids = 0, n_channels, i;
8244         size_t ie_len;
8245
8246         wiphy = &rdev->wiphy;
8247
8248         if (wdev->iftype == NL80211_IFTYPE_NAN)
8249                 return -EOPNOTSUPP;
8250
8251         if (!rdev->ops->scan)
8252                 return -EOPNOTSUPP;
8253
8254         if (rdev->scan_req || rdev->scan_msg)
8255                 return -EBUSY;
8256
8257         if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
8258                 if (!wiphy_ext_feature_isset(wiphy,
8259                                              NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
8260                         return -EOPNOTSUPP;
8261                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
8262                 scan_freqs_khz = true;
8263         } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
8264                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
8265
8266         if (scan_freqs) {
8267                 n_channels = validate_scan_freqs(scan_freqs);
8268                 if (!n_channels)
8269                         return -EINVAL;
8270         } else {
8271                 n_channels = ieee80211_get_num_supported_channels(wiphy);
8272         }
8273
8274         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
8275                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
8276                         n_ssids++;
8277
8278         if (n_ssids > wiphy->max_scan_ssids)
8279                 return -EINVAL;
8280
8281         if (info->attrs[NL80211_ATTR_IE])
8282                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8283         else
8284                 ie_len = 0;
8285
8286         if (ie_len > wiphy->max_scan_ie_len)
8287                 return -EINVAL;
8288
8289         request = kzalloc(sizeof(*request)
8290                         + sizeof(*request->ssids) * n_ssids
8291                         + sizeof(*request->channels) * n_channels
8292                         + ie_len, GFP_KERNEL);
8293         if (!request)
8294                 return -ENOMEM;
8295
8296         if (n_ssids)
8297                 request->ssids = (void *)&request->channels[n_channels];
8298         request->n_ssids = n_ssids;
8299         if (ie_len) {
8300                 if (n_ssids)
8301                         request->ie = (void *)(request->ssids + n_ssids);
8302                 else
8303                         request->ie = (void *)(request->channels + n_channels);
8304         }
8305
8306         i = 0;
8307         if (scan_freqs) {
8308                 /* user specified, bail out if channel not found */
8309                 nla_for_each_nested(attr, scan_freqs, tmp) {
8310                         struct ieee80211_channel *chan;
8311                         int freq = nla_get_u32(attr);
8312
8313                         if (!scan_freqs_khz)
8314                                 freq = MHZ_TO_KHZ(freq);
8315
8316                         chan = ieee80211_get_channel_khz(wiphy, freq);
8317                         if (!chan) {
8318                                 err = -EINVAL;
8319                                 goto out_free;
8320                         }
8321
8322                         /* ignore disabled channels */
8323                         if (chan->flags & IEEE80211_CHAN_DISABLED)
8324                                 continue;
8325
8326                         request->channels[i] = chan;
8327                         i++;
8328                 }
8329         } else {
8330                 enum nl80211_band band;
8331
8332                 /* all channels */
8333                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
8334                         int j;
8335
8336                         if (!wiphy->bands[band])
8337                                 continue;
8338                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
8339                                 struct ieee80211_channel *chan;
8340
8341                                 chan = &wiphy->bands[band]->channels[j];
8342
8343                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
8344                                         continue;
8345
8346                                 request->channels[i] = chan;
8347                                 i++;
8348                         }
8349                 }
8350         }
8351
8352         if (!i) {
8353                 err = -EINVAL;
8354                 goto out_free;
8355         }
8356
8357         request->n_channels = i;
8358
8359         wdev_lock(wdev);
8360         if (!cfg80211_off_channel_oper_allowed(wdev)) {
8361                 struct ieee80211_channel *chan;
8362
8363                 if (request->n_channels != 1) {
8364                         wdev_unlock(wdev);
8365                         err = -EBUSY;
8366                         goto out_free;
8367                 }
8368
8369                 chan = request->channels[0];
8370                 if (chan->center_freq != wdev->chandef.chan->center_freq) {
8371                         wdev_unlock(wdev);
8372                         err = -EBUSY;
8373                         goto out_free;
8374                 }
8375         }
8376         wdev_unlock(wdev);
8377
8378         i = 0;
8379         if (n_ssids) {
8380                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
8381                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
8382                                 err = -EINVAL;
8383                                 goto out_free;
8384                         }
8385                         request->ssids[i].ssid_len = nla_len(attr);
8386                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
8387                         i++;
8388                 }
8389         }
8390
8391         if (info->attrs[NL80211_ATTR_IE]) {
8392                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8393                 memcpy((void *)request->ie,
8394                        nla_data(info->attrs[NL80211_ATTR_IE]),
8395                        request->ie_len);
8396         }
8397
8398         for (i = 0; i < NUM_NL80211_BANDS; i++)
8399                 if (wiphy->bands[i])
8400                         request->rates[i] =
8401                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
8402
8403         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
8404                 nla_for_each_nested(attr,
8405                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
8406                                     tmp) {
8407                         enum nl80211_band band = nla_type(attr);
8408
8409                         if (band < 0 || band >= NUM_NL80211_BANDS) {
8410                                 err = -EINVAL;
8411                                 goto out_free;
8412                         }
8413
8414                         if (!wiphy->bands[band])
8415                                 continue;
8416
8417                         err = ieee80211_get_ratemask(wiphy->bands[band],
8418                                                      nla_data(attr),
8419                                                      nla_len(attr),
8420                                                      &request->rates[band]);
8421                         if (err)
8422                                 goto out_free;
8423                 }
8424         }
8425
8426         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
8427                 request->duration =
8428                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
8429                 request->duration_mandatory =
8430                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
8431         }
8432
8433         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
8434                                        false);
8435         if (err)
8436                 goto out_free;
8437
8438         request->no_cck =
8439                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8440
8441         /* Initial implementation used NL80211_ATTR_MAC to set the specific
8442          * BSSID to scan for. This was problematic because that same attribute
8443          * was already used for another purpose (local random MAC address). The
8444          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
8445          * compatibility with older userspace components, also use the
8446          * NL80211_ATTR_MAC value here if it can be determined to be used for
8447          * the specific BSSID use case instead of the random MAC address
8448          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
8449          */
8450         if (info->attrs[NL80211_ATTR_BSSID])
8451                 memcpy(request->bssid,
8452                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
8453         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
8454                  info->attrs[NL80211_ATTR_MAC])
8455                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
8456                        ETH_ALEN);
8457         else
8458                 eth_broadcast_addr(request->bssid);
8459
8460         request->wdev = wdev;
8461         request->wiphy = &rdev->wiphy;
8462         request->scan_start = jiffies;
8463
8464         rdev->scan_req = request;
8465         err = cfg80211_scan(rdev);
8466
8467         if (err)
8468                 goto out_free;
8469
8470         nl80211_send_scan_start(rdev, wdev);
8471         if (wdev->netdev)
8472                 dev_hold(wdev->netdev);
8473
8474         return 0;
8475
8476  out_free:
8477         rdev->scan_req = NULL;
8478         kfree(request);
8479
8480         return err;
8481 }
8482
8483 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
8484 {
8485         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8486         struct wireless_dev *wdev = info->user_ptr[1];
8487
8488         if (!rdev->ops->abort_scan)
8489                 return -EOPNOTSUPP;
8490
8491         if (rdev->scan_msg)
8492                 return 0;
8493
8494         if (!rdev->scan_req)
8495                 return -ENOENT;
8496
8497         rdev_abort_scan(rdev, wdev);
8498         return 0;
8499 }
8500
8501 static int
8502 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
8503                                struct cfg80211_sched_scan_request *request,
8504                                struct nlattr **attrs)
8505 {
8506         int tmp, err, i = 0;
8507         struct nlattr *attr;
8508
8509         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
8510                 u32 interval;
8511
8512                 /*
8513                  * If scan plans are not specified,
8514                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
8515                  * case one scan plan will be set with the specified scan
8516                  * interval and infinite number of iterations.
8517                  */
8518                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
8519                 if (!interval)
8520                         return -EINVAL;
8521
8522                 request->scan_plans[0].interval =
8523                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
8524                 if (!request->scan_plans[0].interval)
8525                         return -EINVAL;
8526
8527                 if (request->scan_plans[0].interval >
8528                     wiphy->max_sched_scan_plan_interval)
8529                         request->scan_plans[0].interval =
8530                                 wiphy->max_sched_scan_plan_interval;
8531
8532                 return 0;
8533         }
8534
8535         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
8536                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
8537
8538                 if (WARN_ON(i >= n_plans))
8539                         return -EINVAL;
8540
8541                 err = nla_parse_nested_deprecated(plan,
8542                                                   NL80211_SCHED_SCAN_PLAN_MAX,
8543                                                   attr, nl80211_plan_policy,
8544                                                   NULL);
8545                 if (err)
8546                         return err;
8547
8548                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
8549                         return -EINVAL;
8550
8551                 request->scan_plans[i].interval =
8552                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
8553                 if (!request->scan_plans[i].interval ||
8554                     request->scan_plans[i].interval >
8555                     wiphy->max_sched_scan_plan_interval)
8556                         return -EINVAL;
8557
8558                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
8559                         request->scan_plans[i].iterations =
8560                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
8561                         if (!request->scan_plans[i].iterations ||
8562                             (request->scan_plans[i].iterations >
8563                              wiphy->max_sched_scan_plan_iterations))
8564                                 return -EINVAL;
8565                 } else if (i < n_plans - 1) {
8566                         /*
8567                          * All scan plans but the last one must specify
8568                          * a finite number of iterations
8569                          */
8570                         return -EINVAL;
8571                 }
8572
8573                 i++;
8574         }
8575
8576         /*
8577          * The last scan plan must not specify the number of
8578          * iterations, it is supposed to run infinitely
8579          */
8580         if (request->scan_plans[n_plans - 1].iterations)
8581                 return  -EINVAL;
8582
8583         return 0;
8584 }
8585
8586 static int
8587 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
8588                                        struct cfg80211_match_set *match_sets,
8589                                        struct nlattr *tb_band_rssi,
8590                                        s32 rssi_thold)
8591 {
8592         struct nlattr *attr;
8593         int i, tmp, ret = 0;
8594
8595         if (!wiphy_ext_feature_isset(wiphy,
8596                     NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
8597                 if (tb_band_rssi)
8598                         ret = -EOPNOTSUPP;
8599                 else
8600                         for (i = 0; i < NUM_NL80211_BANDS; i++)
8601                                 match_sets->per_band_rssi_thold[i] =
8602                                         NL80211_SCAN_RSSI_THOLD_OFF;
8603                 return ret;
8604         }
8605
8606         for (i = 0; i < NUM_NL80211_BANDS; i++)
8607                 match_sets->per_band_rssi_thold[i] = rssi_thold;
8608
8609         nla_for_each_nested(attr, tb_band_rssi, tmp) {
8610                 enum nl80211_band band = nla_type(attr);
8611
8612                 if (band < 0 || band >= NUM_NL80211_BANDS)
8613                         return -EINVAL;
8614
8615                 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr);
8616         }
8617
8618         return 0;
8619 }
8620
8621 static struct cfg80211_sched_scan_request *
8622 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
8623                          struct nlattr **attrs, int max_match_sets)
8624 {
8625         struct cfg80211_sched_scan_request *request;
8626         struct nlattr *attr;
8627         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
8628         enum nl80211_band band;
8629         size_t ie_len;
8630         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
8631         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
8632
8633         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
8634                 n_channels = validate_scan_freqs(
8635                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
8636                 if (!n_channels)
8637                         return ERR_PTR(-EINVAL);
8638         } else {
8639                 n_channels = ieee80211_get_num_supported_channels(wiphy);
8640         }
8641
8642         if (attrs[NL80211_ATTR_SCAN_SSIDS])
8643                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
8644                                     tmp)
8645                         n_ssids++;
8646
8647         if (n_ssids > wiphy->max_sched_scan_ssids)
8648                 return ERR_PTR(-EINVAL);
8649
8650         /*
8651          * First, count the number of 'real' matchsets. Due to an issue with
8652          * the old implementation, matchsets containing only the RSSI attribute
8653          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
8654          * RSSI for all matchsets, rather than their own matchset for reporting
8655          * all APs with a strong RSSI. This is needed to be compatible with
8656          * older userspace that treated a matchset with only the RSSI as the
8657          * global RSSI for all other matchsets - if there are other matchsets.
8658          */
8659         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
8660                 nla_for_each_nested(attr,
8661                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
8662                                     tmp) {
8663                         struct nlattr *rssi;
8664
8665                         err = nla_parse_nested_deprecated(tb,
8666                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
8667                                                           attr,
8668                                                           nl80211_match_policy,
8669                                                           NULL);
8670                         if (err)
8671                                 return ERR_PTR(err);
8672
8673                         /* SSID and BSSID are mutually exclusive */
8674                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
8675                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
8676                                 return ERR_PTR(-EINVAL);
8677
8678                         /* add other standalone attributes here */
8679                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
8680                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
8681                                 n_match_sets++;
8682                                 continue;
8683                         }
8684                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
8685                         if (rssi)
8686                                 default_match_rssi = nla_get_s32(rssi);
8687                 }
8688         }
8689
8690         /* However, if there's no other matchset, add the RSSI one */
8691         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
8692                 n_match_sets = 1;
8693
8694         if (n_match_sets > max_match_sets)
8695                 return ERR_PTR(-EINVAL);
8696
8697         if (attrs[NL80211_ATTR_IE])
8698                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
8699         else
8700                 ie_len = 0;
8701
8702         if (ie_len > wiphy->max_sched_scan_ie_len)
8703                 return ERR_PTR(-EINVAL);
8704
8705         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
8706                 /*
8707                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
8708                  * each scan plan already specifies its own interval
8709                  */
8710                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
8711                         return ERR_PTR(-EINVAL);
8712
8713                 nla_for_each_nested(attr,
8714                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
8715                         n_plans++;
8716         } else {
8717                 /*
8718                  * The scan interval attribute is kept for backward
8719                  * compatibility. If no scan plans are specified and sched scan
8720                  * interval is specified, one scan plan will be set with this
8721                  * scan interval and infinite number of iterations.
8722                  */
8723                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
8724                         return ERR_PTR(-EINVAL);
8725
8726                 n_plans = 1;
8727         }
8728
8729         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
8730                 return ERR_PTR(-EINVAL);
8731
8732         if (!wiphy_ext_feature_isset(
8733                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
8734             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
8735              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
8736                 return ERR_PTR(-EINVAL);
8737
8738         request = kzalloc(sizeof(*request)
8739                         + sizeof(*request->ssids) * n_ssids
8740                         + sizeof(*request->match_sets) * n_match_sets
8741                         + sizeof(*request->scan_plans) * n_plans
8742                         + sizeof(*request->channels) * n_channels
8743                         + ie_len, GFP_KERNEL);
8744         if (!request)
8745                 return ERR_PTR(-ENOMEM);
8746
8747         if (n_ssids)
8748                 request->ssids = (void *)&request->channels[n_channels];
8749         request->n_ssids = n_ssids;
8750         if (ie_len) {
8751                 if (n_ssids)
8752                         request->ie = (void *)(request->ssids + n_ssids);
8753                 else
8754                         request->ie = (void *)(request->channels + n_channels);
8755         }
8756
8757         if (n_match_sets) {
8758                 if (request->ie)
8759                         request->match_sets = (void *)(request->ie + ie_len);
8760                 else if (n_ssids)
8761                         request->match_sets =
8762                                 (void *)(request->ssids + n_ssids);
8763                 else
8764                         request->match_sets =
8765                                 (void *)(request->channels + n_channels);
8766         }
8767         request->n_match_sets = n_match_sets;
8768
8769         if (n_match_sets)
8770                 request->scan_plans = (void *)(request->match_sets +
8771                                                n_match_sets);
8772         else if (request->ie)
8773                 request->scan_plans = (void *)(request->ie + ie_len);
8774         else if (n_ssids)
8775                 request->scan_plans = (void *)(request->ssids + n_ssids);
8776         else
8777                 request->scan_plans = (void *)(request->channels + n_channels);
8778
8779         request->n_scan_plans = n_plans;
8780
8781         i = 0;
8782         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
8783                 /* user specified, bail out if channel not found */
8784                 nla_for_each_nested(attr,
8785                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
8786                                     tmp) {
8787                         struct ieee80211_channel *chan;
8788
8789                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
8790
8791                         if (!chan) {
8792                                 err = -EINVAL;
8793                                 goto out_free;
8794                         }
8795
8796                         /* ignore disabled channels */
8797                         if (chan->flags & IEEE80211_CHAN_DISABLED)
8798                                 continue;
8799
8800                         request->channels[i] = chan;
8801                         i++;
8802                 }
8803         } else {
8804                 /* all channels */
8805                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
8806                         int j;
8807
8808                         if (!wiphy->bands[band])
8809                                 continue;
8810                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
8811                                 struct ieee80211_channel *chan;
8812
8813                                 chan = &wiphy->bands[band]->channels[j];
8814
8815                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
8816                                         continue;
8817
8818                                 request->channels[i] = chan;
8819                                 i++;
8820                         }
8821                 }
8822         }
8823
8824         if (!i) {
8825                 err = -EINVAL;
8826                 goto out_free;
8827         }
8828
8829         request->n_channels = i;
8830
8831         i = 0;
8832         if (n_ssids) {
8833                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
8834                                     tmp) {
8835                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
8836                                 err = -EINVAL;
8837                                 goto out_free;
8838                         }
8839                         request->ssids[i].ssid_len = nla_len(attr);
8840                         memcpy(request->ssids[i].ssid, nla_data(attr),
8841                                nla_len(attr));
8842                         i++;
8843                 }
8844         }
8845
8846         i = 0;
8847         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
8848                 nla_for_each_nested(attr,
8849                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
8850                                     tmp) {
8851                         struct nlattr *ssid, *bssid, *rssi;
8852
8853                         err = nla_parse_nested_deprecated(tb,
8854                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
8855                                                           attr,
8856                                                           nl80211_match_policy,
8857                                                           NULL);
8858                         if (err)
8859                                 goto out_free;
8860                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
8861                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
8862
8863                         if (!ssid && !bssid) {
8864                                 i++;
8865                                 continue;
8866                         }
8867
8868                         if (WARN_ON(i >= n_match_sets)) {
8869                                 /* this indicates a programming error,
8870                                  * the loop above should have verified
8871                                  * things properly
8872                                  */
8873                                 err = -EINVAL;
8874                                 goto out_free;
8875                         }
8876
8877                         if (ssid) {
8878                                 memcpy(request->match_sets[i].ssid.ssid,
8879                                        nla_data(ssid), nla_len(ssid));
8880                                 request->match_sets[i].ssid.ssid_len =
8881                                         nla_len(ssid);
8882                         }
8883                         if (bssid)
8884                                 memcpy(request->match_sets[i].bssid,
8885                                        nla_data(bssid), ETH_ALEN);
8886
8887                         /* special attribute - old implementation w/a */
8888                         request->match_sets[i].rssi_thold = default_match_rssi;
8889                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
8890                         if (rssi)
8891                                 request->match_sets[i].rssi_thold =
8892                                         nla_get_s32(rssi);
8893
8894                         /* Parse per band RSSI attribute */
8895                         err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
8896                                 &request->match_sets[i],
8897                                 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
8898                                 request->match_sets[i].rssi_thold);
8899                         if (err)
8900                                 goto out_free;
8901
8902                         i++;
8903                 }
8904
8905                 /* there was no other matchset, so the RSSI one is alone */
8906                 if (i == 0 && n_match_sets)
8907                         request->match_sets[0].rssi_thold = default_match_rssi;
8908
8909                 request->min_rssi_thold = INT_MAX;
8910                 for (i = 0; i < n_match_sets; i++)
8911                         request->min_rssi_thold =
8912                                 min(request->match_sets[i].rssi_thold,
8913                                     request->min_rssi_thold);
8914         } else {
8915                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
8916         }
8917
8918         if (ie_len) {
8919                 request->ie_len = ie_len;
8920                 memcpy((void *)request->ie,
8921                        nla_data(attrs[NL80211_ATTR_IE]),
8922                        request->ie_len);
8923         }
8924
8925         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
8926         if (err)
8927                 goto out_free;
8928
8929         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
8930                 request->delay =
8931                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
8932
8933         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
8934                 request->relative_rssi = nla_get_s8(
8935                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
8936                 request->relative_rssi_set = true;
8937         }
8938
8939         if (request->relative_rssi_set &&
8940             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
8941                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
8942
8943                 rssi_adjust = nla_data(
8944                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
8945                 request->rssi_adjust.band = rssi_adjust->band;
8946                 request->rssi_adjust.delta = rssi_adjust->delta;
8947                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
8948                         err = -EINVAL;
8949                         goto out_free;
8950                 }
8951         }
8952
8953         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
8954         if (err)
8955                 goto out_free;
8956
8957         request->scan_start = jiffies;
8958
8959         return request;
8960
8961 out_free:
8962         kfree(request);
8963         return ERR_PTR(err);
8964 }
8965
8966 static int nl80211_start_sched_scan(struct sk_buff *skb,
8967                                     struct genl_info *info)
8968 {
8969         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8970         struct net_device *dev = info->user_ptr[1];
8971         struct wireless_dev *wdev = dev->ieee80211_ptr;
8972         struct cfg80211_sched_scan_request *sched_scan_req;
8973         bool want_multi;
8974         int err;
8975
8976         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
8977                 return -EOPNOTSUPP;
8978
8979         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
8980         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
8981         if (err)
8982                 return err;
8983
8984         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
8985                                                   info->attrs,
8986                                                   rdev->wiphy.max_match_sets);
8987
8988         err = PTR_ERR_OR_ZERO(sched_scan_req);
8989         if (err)
8990                 goto out_err;
8991
8992         /* leave request id zero for legacy request
8993          * or if driver does not support multi-scheduled scan
8994          */
8995         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
8996                 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
8997
8998         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
8999         if (err)
9000                 goto out_free;
9001
9002         sched_scan_req->dev = dev;
9003         sched_scan_req->wiphy = &rdev->wiphy;
9004
9005         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9006                 sched_scan_req->owner_nlportid = info->snd_portid;
9007
9008         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
9009
9010         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
9011         return 0;
9012
9013 out_free:
9014         kfree(sched_scan_req);
9015 out_err:
9016         return err;
9017 }
9018
9019 static int nl80211_stop_sched_scan(struct sk_buff *skb,
9020                                    struct genl_info *info)
9021 {
9022         struct cfg80211_sched_scan_request *req;
9023         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9024         u64 cookie;
9025
9026         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
9027                 return -EOPNOTSUPP;
9028
9029         if (info->attrs[NL80211_ATTR_COOKIE]) {
9030                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9031                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
9032         }
9033
9034         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
9035                                      struct cfg80211_sched_scan_request,
9036                                      list);
9037         if (!req || req->reqid ||
9038             (req->owner_nlportid &&
9039              req->owner_nlportid != info->snd_portid))
9040                 return -ENOENT;
9041
9042         return cfg80211_stop_sched_scan_req(rdev, req, false);
9043 }
9044
9045 static int nl80211_start_radar_detection(struct sk_buff *skb,
9046                                          struct genl_info *info)
9047 {
9048         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9049         struct net_device *dev = info->user_ptr[1];
9050         struct wireless_dev *wdev = dev->ieee80211_ptr;
9051         struct wiphy *wiphy = wdev->wiphy;
9052         struct cfg80211_chan_def chandef;
9053         enum nl80211_dfs_regions dfs_region;
9054         unsigned int cac_time_ms;
9055         int err;
9056
9057         dfs_region = reg_get_dfs_region(wiphy);
9058         if (dfs_region == NL80211_DFS_UNSET)
9059                 return -EINVAL;
9060
9061         err = nl80211_parse_chandef(rdev, info, &chandef);
9062         if (err)
9063                 return err;
9064
9065         if (netif_carrier_ok(dev))
9066                 return -EBUSY;
9067
9068         if (wdev->cac_started)
9069                 return -EBUSY;
9070
9071         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9072         if (err < 0)
9073                 return err;
9074
9075         if (err == 0)
9076                 return -EINVAL;
9077
9078         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
9079                 return -EINVAL;
9080
9081         /* CAC start is offloaded to HW and can't be started manually */
9082         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
9083                 return -EOPNOTSUPP;
9084
9085         if (!rdev->ops->start_radar_detection)
9086                 return -EOPNOTSUPP;
9087
9088         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
9089         if (WARN_ON(!cac_time_ms))
9090                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
9091
9092         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
9093         if (!err) {
9094                 wdev->chandef = chandef;
9095                 wdev->cac_started = true;
9096                 wdev->cac_start_time = jiffies;
9097                 wdev->cac_time_ms = cac_time_ms;
9098         }
9099         return err;
9100 }
9101
9102 static int nl80211_notify_radar_detection(struct sk_buff *skb,
9103                                           struct genl_info *info)
9104 {
9105         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9106         struct net_device *dev = info->user_ptr[1];
9107         struct wireless_dev *wdev = dev->ieee80211_ptr;
9108         struct wiphy *wiphy = wdev->wiphy;
9109         struct cfg80211_chan_def chandef;
9110         enum nl80211_dfs_regions dfs_region;
9111         int err;
9112
9113         dfs_region = reg_get_dfs_region(wiphy);
9114         if (dfs_region == NL80211_DFS_UNSET) {
9115                 GENL_SET_ERR_MSG(info,
9116                                  "DFS Region is not set. Unexpected Radar indication");
9117                 return -EINVAL;
9118         }
9119
9120         err = nl80211_parse_chandef(rdev, info, &chandef);
9121         if (err) {
9122                 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
9123                 return err;
9124         }
9125
9126         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9127         if (err < 0) {
9128                 GENL_SET_ERR_MSG(info, "chandef is invalid");
9129                 return err;
9130         }
9131
9132         if (err == 0) {
9133                 GENL_SET_ERR_MSG(info,
9134                                  "Unexpected Radar indication for chandef/iftype");
9135                 return -EINVAL;
9136         }
9137
9138         /* Do not process this notification if radar is already detected
9139          * by kernel on this channel, and return success.
9140          */
9141         if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
9142                 return 0;
9143
9144         cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
9145
9146         cfg80211_sched_dfs_chan_update(rdev);
9147
9148         rdev->radar_chandef = chandef;
9149
9150         /* Propagate this notification to other radios as well */
9151         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
9152
9153         return 0;
9154 }
9155
9156 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
9157 {
9158         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9159         struct net_device *dev = info->user_ptr[1];
9160         struct wireless_dev *wdev = dev->ieee80211_ptr;
9161         struct cfg80211_csa_settings params;
9162         struct nlattr **csa_attrs = NULL;
9163         int err;
9164         bool need_new_beacon = false;
9165         bool need_handle_dfs_flag = true;
9166         int len, i;
9167         u32 cs_count;
9168
9169         if (!rdev->ops->channel_switch ||
9170             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
9171                 return -EOPNOTSUPP;
9172
9173         switch (dev->ieee80211_ptr->iftype) {
9174         case NL80211_IFTYPE_AP:
9175         case NL80211_IFTYPE_P2P_GO:
9176                 need_new_beacon = true;
9177                 /* For all modes except AP the handle_dfs flag needs to be
9178                  * supplied to tell the kernel that userspace will handle radar
9179                  * events when they happen. Otherwise a switch to a channel
9180                  * requiring DFS will be rejected.
9181                  */
9182                 need_handle_dfs_flag = false;
9183
9184                 /* useless if AP is not running */
9185                 if (!wdev->beacon_interval)
9186                         return -ENOTCONN;
9187                 break;
9188         case NL80211_IFTYPE_ADHOC:
9189                 if (!wdev->ssid_len)
9190                         return -ENOTCONN;
9191                 break;
9192         case NL80211_IFTYPE_MESH_POINT:
9193                 if (!wdev->mesh_id_len)
9194                         return -ENOTCONN;
9195                 break;
9196         default:
9197                 return -EOPNOTSUPP;
9198         }
9199
9200         memset(&params, 0, sizeof(params));
9201         params.beacon_csa.ftm_responder = -1;
9202
9203         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9204             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
9205                 return -EINVAL;
9206
9207         /* only important for AP, IBSS and mesh create IEs internally */
9208         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
9209                 return -EINVAL;
9210
9211         /* Even though the attribute is u32, the specification says
9212          * u8, so let's make sure we don't overflow.
9213          */
9214         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
9215         if (cs_count > 255)
9216                 return -EINVAL;
9217
9218         params.count = cs_count;
9219
9220         if (!need_new_beacon)
9221                 goto skip_beacons;
9222
9223         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after);
9224         if (err)
9225                 return err;
9226
9227         csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
9228                             GFP_KERNEL);
9229         if (!csa_attrs)
9230                 return -ENOMEM;
9231
9232         err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
9233                                           info->attrs[NL80211_ATTR_CSA_IES],
9234                                           nl80211_policy, info->extack);
9235         if (err)
9236                 goto free;
9237
9238         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa);
9239         if (err)
9240                 goto free;
9241
9242         if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
9243                 err = -EINVAL;
9244                 goto free;
9245         }
9246
9247         len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
9248         if (!len || (len % sizeof(u16))) {
9249                 err = -EINVAL;
9250                 goto free;
9251         }
9252
9253         params.n_counter_offsets_beacon = len / sizeof(u16);
9254         if (rdev->wiphy.max_num_csa_counters &&
9255             (params.n_counter_offsets_beacon >
9256              rdev->wiphy.max_num_csa_counters)) {
9257                 err = -EINVAL;
9258                 goto free;
9259         }
9260
9261         params.counter_offsets_beacon =
9262                 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
9263
9264         /* sanity checks - counters should fit and be the same */
9265         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
9266                 u16 offset = params.counter_offsets_beacon[i];
9267
9268                 if (offset >= params.beacon_csa.tail_len) {
9269                         err = -EINVAL;
9270                         goto free;
9271                 }
9272
9273                 if (params.beacon_csa.tail[offset] != params.count) {
9274                         err = -EINVAL;
9275                         goto free;
9276                 }
9277         }
9278
9279         if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
9280                 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
9281                 if (!len || (len % sizeof(u16))) {
9282                         err = -EINVAL;
9283                         goto free;
9284                 }
9285
9286                 params.n_counter_offsets_presp = len / sizeof(u16);
9287                 if (rdev->wiphy.max_num_csa_counters &&
9288                     (params.n_counter_offsets_presp >
9289                      rdev->wiphy.max_num_csa_counters)) {
9290                         err = -EINVAL;
9291                         goto free;
9292                 }
9293
9294                 params.counter_offsets_presp =
9295                         nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
9296
9297                 /* sanity checks - counters should fit and be the same */
9298                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
9299                         u16 offset = params.counter_offsets_presp[i];
9300
9301                         if (offset >= params.beacon_csa.probe_resp_len) {
9302                                 err = -EINVAL;
9303                                 goto free;
9304                         }
9305
9306                         if (params.beacon_csa.probe_resp[offset] !=
9307                             params.count) {
9308                                 err = -EINVAL;
9309                                 goto free;
9310                         }
9311                 }
9312         }
9313
9314 skip_beacons:
9315         err = nl80211_parse_chandef(rdev, info, &params.chandef);
9316         if (err)
9317                 goto free;
9318
9319         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
9320                                            wdev->iftype)) {
9321                 err = -EINVAL;
9322                 goto free;
9323         }
9324
9325         err = cfg80211_chandef_dfs_required(wdev->wiphy,
9326                                             &params.chandef,
9327                                             wdev->iftype);
9328         if (err < 0)
9329                 goto free;
9330
9331         if (err > 0) {
9332                 params.radar_required = true;
9333                 if (need_handle_dfs_flag &&
9334                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
9335                         err = -EINVAL;
9336                         goto free;
9337                 }
9338         }
9339
9340         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
9341                 params.block_tx = true;
9342
9343         wdev_lock(wdev);
9344         err = rdev_channel_switch(rdev, dev, &params);
9345         wdev_unlock(wdev);
9346
9347 free:
9348         kfree(csa_attrs);
9349         return err;
9350 }
9351
9352 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
9353                             u32 seq, int flags,
9354                             struct cfg80211_registered_device *rdev,
9355                             struct wireless_dev *wdev,
9356                             struct cfg80211_internal_bss *intbss)
9357 {
9358         struct cfg80211_bss *res = &intbss->pub;
9359         const struct cfg80211_bss_ies *ies;
9360         void *hdr;
9361         struct nlattr *bss;
9362
9363         ASSERT_WDEV_LOCK(wdev);
9364
9365         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
9366                              NL80211_CMD_NEW_SCAN_RESULTS);
9367         if (!hdr)
9368                 return -1;
9369
9370         genl_dump_check_consistent(cb, hdr);
9371
9372         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
9373                 goto nla_put_failure;
9374         if (wdev->netdev &&
9375             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
9376                 goto nla_put_failure;
9377         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
9378                               NL80211_ATTR_PAD))
9379                 goto nla_put_failure;
9380
9381         bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
9382         if (!bss)
9383                 goto nla_put_failure;
9384         if ((!is_zero_ether_addr(res->bssid) &&
9385              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
9386                 goto nla_put_failure;
9387
9388         rcu_read_lock();
9389         /* indicate whether we have probe response data or not */
9390         if (rcu_access_pointer(res->proberesp_ies) &&
9391             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
9392                 goto fail_unlock_rcu;
9393
9394         /* this pointer prefers to be pointed to probe response data
9395          * but is always valid
9396          */
9397         ies = rcu_dereference(res->ies);
9398         if (ies) {
9399                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
9400                                       NL80211_BSS_PAD))
9401                         goto fail_unlock_rcu;
9402                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
9403                                         ies->len, ies->data))
9404                         goto fail_unlock_rcu;
9405         }
9406
9407         /* and this pointer is always (unless driver didn't know) beacon data */
9408         ies = rcu_dereference(res->beacon_ies);
9409         if (ies && ies->from_beacon) {
9410                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
9411                                       NL80211_BSS_PAD))
9412                         goto fail_unlock_rcu;
9413                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
9414                                         ies->len, ies->data))
9415                         goto fail_unlock_rcu;
9416         }
9417         rcu_read_unlock();
9418
9419         if (res->beacon_interval &&
9420             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
9421                 goto nla_put_failure;
9422         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
9423             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
9424             nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
9425                         res->channel->freq_offset) ||
9426             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
9427             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
9428                         jiffies_to_msecs(jiffies - intbss->ts)))
9429                 goto nla_put_failure;
9430
9431         if (intbss->parent_tsf &&
9432             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
9433                                intbss->parent_tsf, NL80211_BSS_PAD) ||
9434              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
9435                      intbss->parent_bssid)))
9436                 goto nla_put_failure;
9437
9438         if (intbss->ts_boottime &&
9439             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
9440                               intbss->ts_boottime, NL80211_BSS_PAD))
9441                 goto nla_put_failure;
9442
9443         if (!nl80211_put_signal(msg, intbss->pub.chains,
9444                                 intbss->pub.chain_signal,
9445                                 NL80211_BSS_CHAIN_SIGNAL))
9446                 goto nla_put_failure;
9447
9448         switch (rdev->wiphy.signal_type) {
9449         case CFG80211_SIGNAL_TYPE_MBM:
9450                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
9451                         goto nla_put_failure;
9452                 break;
9453         case CFG80211_SIGNAL_TYPE_UNSPEC:
9454                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
9455                         goto nla_put_failure;
9456                 break;
9457         default:
9458                 break;
9459         }
9460
9461         switch (wdev->iftype) {
9462         case NL80211_IFTYPE_P2P_CLIENT:
9463         case NL80211_IFTYPE_STATION:
9464                 if (intbss == wdev->current_bss &&
9465                     nla_put_u32(msg, NL80211_BSS_STATUS,
9466                                 NL80211_BSS_STATUS_ASSOCIATED))
9467                         goto nla_put_failure;
9468                 break;
9469         case NL80211_IFTYPE_ADHOC:
9470                 if (intbss == wdev->current_bss &&
9471                     nla_put_u32(msg, NL80211_BSS_STATUS,
9472                                 NL80211_BSS_STATUS_IBSS_JOINED))
9473                         goto nla_put_failure;
9474                 break;
9475         default:
9476                 break;
9477         }
9478
9479         nla_nest_end(msg, bss);
9480
9481         genlmsg_end(msg, hdr);
9482         return 0;
9483
9484  fail_unlock_rcu:
9485         rcu_read_unlock();
9486  nla_put_failure:
9487         genlmsg_cancel(msg, hdr);
9488         return -EMSGSIZE;
9489 }
9490
9491 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
9492 {
9493         struct cfg80211_registered_device *rdev;
9494         struct cfg80211_internal_bss *scan;
9495         struct wireless_dev *wdev;
9496         int start = cb->args[2], idx = 0;
9497         int err;
9498
9499         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
9500         if (err)
9501                 return err;
9502         /* nl80211_prepare_wdev_dump acquired it in the successful case */
9503         __acquire(&rdev->wiphy.mtx);
9504
9505         wdev_lock(wdev);
9506         spin_lock_bh(&rdev->bss_lock);
9507
9508         /*
9509          * dump_scan will be called multiple times to break up the scan results
9510          * into multiple messages.  It is unlikely that any more bss-es will be
9511          * expired after the first call, so only call only call this on the
9512          * first dump_scan invocation.
9513          */
9514         if (start == 0)
9515                 cfg80211_bss_expire(rdev);
9516
9517         cb->seq = rdev->bss_generation;
9518
9519         list_for_each_entry(scan, &rdev->bss_list, list) {
9520                 if (++idx <= start)
9521                         continue;
9522                 if (nl80211_send_bss(skb, cb,
9523                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
9524                                 rdev, wdev, scan) < 0) {
9525                         idx--;
9526                         break;
9527                 }
9528         }
9529
9530         spin_unlock_bh(&rdev->bss_lock);
9531         wdev_unlock(wdev);
9532
9533         cb->args[2] = idx;
9534         wiphy_unlock(&rdev->wiphy);
9535
9536         return skb->len;
9537 }
9538
9539 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
9540                                int flags, struct net_device *dev,
9541                                bool allow_radio_stats,
9542                                struct survey_info *survey)
9543 {
9544         void *hdr;
9545         struct nlattr *infoattr;
9546
9547         /* skip radio stats if userspace didn't request them */
9548         if (!survey->channel && !allow_radio_stats)
9549                 return 0;
9550
9551         hdr = nl80211hdr_put(msg, portid, seq, flags,
9552                              NL80211_CMD_NEW_SURVEY_RESULTS);
9553         if (!hdr)
9554                 return -ENOMEM;
9555
9556         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
9557                 goto nla_put_failure;
9558
9559         infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
9560         if (!infoattr)
9561                 goto nla_put_failure;
9562
9563         if (survey->channel &&
9564             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
9565                         survey->channel->center_freq))
9566                 goto nla_put_failure;
9567
9568         if (survey->channel && survey->channel->freq_offset &&
9569             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
9570                         survey->channel->freq_offset))
9571                 goto nla_put_failure;
9572
9573         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
9574             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
9575                 goto nla_put_failure;
9576         if ((survey->filled & SURVEY_INFO_IN_USE) &&
9577             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
9578                 goto nla_put_failure;
9579         if ((survey->filled & SURVEY_INFO_TIME) &&
9580             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
9581                         survey->time, NL80211_SURVEY_INFO_PAD))
9582                 goto nla_put_failure;
9583         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
9584             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
9585                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
9586                 goto nla_put_failure;
9587         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
9588             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
9589                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
9590                 goto nla_put_failure;
9591         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
9592             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
9593                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
9594                 goto nla_put_failure;
9595         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
9596             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
9597                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
9598                 goto nla_put_failure;
9599         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
9600             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
9601                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
9602                 goto nla_put_failure;
9603         if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
9604             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
9605                               survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
9606                 goto nla_put_failure;
9607
9608         nla_nest_end(msg, infoattr);
9609
9610         genlmsg_end(msg, hdr);
9611         return 0;
9612
9613  nla_put_failure:
9614         genlmsg_cancel(msg, hdr);
9615         return -EMSGSIZE;
9616 }
9617
9618 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
9619 {
9620         struct nlattr **attrbuf;
9621         struct survey_info survey;
9622         struct cfg80211_registered_device *rdev;
9623         struct wireless_dev *wdev;
9624         int survey_idx = cb->args[2];
9625         int res;
9626         bool radio_stats;
9627
9628         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
9629         if (!attrbuf)
9630                 return -ENOMEM;
9631
9632         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
9633         if (res) {
9634                 kfree(attrbuf);
9635                 return res;
9636         }
9637         /* nl80211_prepare_wdev_dump acquired it in the successful case */
9638         __acquire(&rdev->wiphy.mtx);
9639
9640         /* prepare_wdev_dump parsed the attributes */
9641         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
9642
9643         if (!wdev->netdev) {
9644                 res = -EINVAL;
9645                 goto out_err;
9646         }
9647
9648         if (!rdev->ops->dump_survey) {
9649                 res = -EOPNOTSUPP;
9650                 goto out_err;
9651         }
9652
9653         while (1) {
9654                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
9655                 if (res == -ENOENT)
9656                         break;
9657                 if (res)
9658                         goto out_err;
9659
9660                 /* don't send disabled channels, but do send non-channel data */
9661                 if (survey.channel &&
9662                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
9663                         survey_idx++;
9664                         continue;
9665                 }
9666
9667                 if (nl80211_send_survey(skb,
9668                                 NETLINK_CB(cb->skb).portid,
9669                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
9670                                 wdev->netdev, radio_stats, &survey) < 0)
9671                         goto out;
9672                 survey_idx++;
9673         }
9674
9675  out:
9676         cb->args[2] = survey_idx;
9677         res = skb->len;
9678  out_err:
9679         kfree(attrbuf);
9680         wiphy_unlock(&rdev->wiphy);
9681         return res;
9682 }
9683
9684 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
9685 {
9686         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
9687                                   NL80211_WPA_VERSION_2 |
9688                                   NL80211_WPA_VERSION_3));
9689 }
9690
9691 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
9692 {
9693         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9694         struct net_device *dev = info->user_ptr[1];
9695         struct ieee80211_channel *chan;
9696         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
9697         int err, ssid_len, ie_len = 0, auth_data_len = 0;
9698         enum nl80211_auth_type auth_type;
9699         struct key_parse key;
9700         bool local_state_change;
9701         u32 freq;
9702
9703         if (!info->attrs[NL80211_ATTR_MAC])
9704                 return -EINVAL;
9705
9706         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
9707                 return -EINVAL;
9708
9709         if (!info->attrs[NL80211_ATTR_SSID])
9710                 return -EINVAL;
9711
9712         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9713                 return -EINVAL;
9714
9715         err = nl80211_parse_key(info, &key);
9716         if (err)
9717                 return err;
9718
9719         if (key.idx >= 0) {
9720                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
9721                         return -EINVAL;
9722                 if (!key.p.key || !key.p.key_len)
9723                         return -EINVAL;
9724                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
9725                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
9726                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
9727                      key.p.key_len != WLAN_KEY_LEN_WEP104))
9728                         return -EINVAL;
9729                 if (key.idx > 3)
9730                         return -EINVAL;
9731         } else {
9732                 key.p.key_len = 0;
9733                 key.p.key = NULL;
9734         }
9735
9736         if (key.idx >= 0) {
9737                 int i;
9738                 bool ok = false;
9739
9740                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
9741                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
9742                                 ok = true;
9743                                 break;
9744                         }
9745                 }
9746                 if (!ok)
9747                         return -EINVAL;
9748         }
9749
9750         if (!rdev->ops->auth)
9751                 return -EOPNOTSUPP;
9752
9753         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9754             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9755                 return -EOPNOTSUPP;
9756
9757         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9758         freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
9759         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
9760                 freq +=
9761                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
9762
9763         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
9764         if (!chan)
9765                 return -EINVAL;
9766
9767         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9768         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9769
9770         if (info->attrs[NL80211_ATTR_IE]) {
9771                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9772                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9773         }
9774
9775         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9776         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
9777                 return -EINVAL;
9778
9779         if ((auth_type == NL80211_AUTHTYPE_SAE ||
9780              auth_type == NL80211_AUTHTYPE_FILS_SK ||
9781              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
9782              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
9783             !info->attrs[NL80211_ATTR_AUTH_DATA])
9784                 return -EINVAL;
9785
9786         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
9787                 if (auth_type != NL80211_AUTHTYPE_SAE &&
9788                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
9789                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
9790                     auth_type != NL80211_AUTHTYPE_FILS_PK)
9791                         return -EINVAL;
9792                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
9793                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
9794         }
9795
9796         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9797
9798         /*
9799          * Since we no longer track auth state, ignore
9800          * requests to only change local state.
9801          */
9802         if (local_state_change)
9803                 return 0;
9804
9805         wdev_lock(dev->ieee80211_ptr);
9806         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
9807                                  ssid, ssid_len, ie, ie_len,
9808                                  key.p.key, key.p.key_len, key.idx,
9809                                  auth_data, auth_data_len);
9810         wdev_unlock(dev->ieee80211_ptr);
9811         return err;
9812 }
9813
9814 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
9815                                      struct genl_info *info)
9816 {
9817         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9818                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
9819                 return -EINVAL;
9820         }
9821
9822         if (!rdev->ops->tx_control_port ||
9823             !wiphy_ext_feature_isset(&rdev->wiphy,
9824                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
9825                 return -EOPNOTSUPP;
9826
9827         return 0;
9828 }
9829
9830 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
9831                                    struct genl_info *info,
9832                                    struct cfg80211_crypto_settings *settings,
9833                                    int cipher_limit)
9834 {
9835         memset(settings, 0, sizeof(*settings));
9836
9837         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
9838
9839         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
9840                 u16 proto;
9841
9842                 proto = nla_get_u16(
9843                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
9844                 settings->control_port_ethertype = cpu_to_be16(proto);
9845                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
9846                     proto != ETH_P_PAE)
9847                         return -EINVAL;
9848                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
9849                         settings->control_port_no_encrypt = true;
9850         } else
9851                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
9852
9853         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
9854                 int r = validate_pae_over_nl80211(rdev, info);
9855
9856                 if (r < 0)
9857                         return r;
9858
9859                 settings->control_port_over_nl80211 = true;
9860
9861                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
9862                         settings->control_port_no_preauth = true;
9863         }
9864
9865         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
9866                 void *data;
9867                 int len, i;
9868
9869                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
9870                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
9871                 settings->n_ciphers_pairwise = len / sizeof(u32);
9872
9873                 if (len % sizeof(u32))
9874                         return -EINVAL;
9875
9876                 if (settings->n_ciphers_pairwise > cipher_limit)
9877                         return -EINVAL;
9878
9879                 memcpy(settings->ciphers_pairwise, data, len);
9880
9881                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
9882                         if (!cfg80211_supported_cipher_suite(
9883                                         &rdev->wiphy,
9884                                         settings->ciphers_pairwise[i]))
9885                                 return -EINVAL;
9886         }
9887
9888         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
9889                 settings->cipher_group =
9890                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
9891                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
9892                                                      settings->cipher_group))
9893                         return -EINVAL;
9894         }
9895
9896         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
9897                 settings->wpa_versions =
9898                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
9899                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
9900                         return -EINVAL;
9901         }
9902
9903         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
9904                 void *data;
9905                 int len;
9906
9907                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
9908                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
9909                 settings->n_akm_suites = len / sizeof(u32);
9910
9911                 if (len % sizeof(u32))
9912                         return -EINVAL;
9913
9914                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
9915                         return -EINVAL;
9916
9917                 memcpy(settings->akm_suites, data, len);
9918         }
9919
9920         if (info->attrs[NL80211_ATTR_PMK]) {
9921                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
9922                         return -EINVAL;
9923                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9924                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
9925                     !wiphy_ext_feature_isset(&rdev->wiphy,
9926                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
9927                         return -EINVAL;
9928                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9929         }
9930
9931         if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
9932                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9933                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
9934                     !wiphy_ext_feature_isset(&rdev->wiphy,
9935                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
9936                         return -EINVAL;
9937                 settings->sae_pwd =
9938                         nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
9939                 settings->sae_pwd_len =
9940                         nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
9941         }
9942
9943         if (info->attrs[NL80211_ATTR_SAE_PWE])
9944                 settings->sae_pwe =
9945                         nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]);
9946         else
9947                 settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED;
9948
9949         return 0;
9950 }
9951
9952 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
9953 {
9954         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9955         struct net_device *dev = info->user_ptr[1];
9956         struct ieee80211_channel *chan;
9957         struct cfg80211_assoc_request req = {};
9958         const u8 *bssid, *ssid;
9959         int err, ssid_len = 0;
9960         u32 freq;
9961
9962         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9963             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9964                 return -EPERM;
9965
9966         if (!info->attrs[NL80211_ATTR_MAC] ||
9967             !info->attrs[NL80211_ATTR_SSID] ||
9968             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
9969                 return -EINVAL;
9970
9971         if (!rdev->ops->assoc)
9972                 return -EOPNOTSUPP;
9973
9974         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9975             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9976                 return -EOPNOTSUPP;
9977
9978         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9979
9980         freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
9981         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
9982                 freq +=
9983                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
9984         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
9985         if (!chan)
9986                 return -EINVAL;
9987
9988         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9989         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9990
9991         if (info->attrs[NL80211_ATTR_IE]) {
9992                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9993                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9994         }
9995
9996         if (info->attrs[NL80211_ATTR_USE_MFP]) {
9997                 enum nl80211_mfp mfp =
9998                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9999                 if (mfp == NL80211_MFP_REQUIRED)
10000                         req.use_mfp = true;
10001                 else if (mfp != NL80211_MFP_NO)
10002                         return -EINVAL;
10003         }
10004
10005         if (info->attrs[NL80211_ATTR_PREV_BSSID])
10006                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
10007
10008         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
10009                 req.flags |= ASSOC_REQ_DISABLE_HT;
10010
10011         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10012                 memcpy(&req.ht_capa_mask,
10013                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10014                        sizeof(req.ht_capa_mask));
10015
10016         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10017                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10018                         return -EINVAL;
10019                 memcpy(&req.ht_capa,
10020                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10021                        sizeof(req.ht_capa));
10022         }
10023
10024         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
10025                 req.flags |= ASSOC_REQ_DISABLE_VHT;
10026
10027         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
10028                 req.flags |= ASSOC_REQ_DISABLE_HE;
10029
10030         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10031                 memcpy(&req.vht_capa_mask,
10032                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
10033                        sizeof(req.vht_capa_mask));
10034
10035         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
10036                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10037                         return -EINVAL;
10038                 memcpy(&req.vht_capa,
10039                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
10040                        sizeof(req.vht_capa));
10041         }
10042
10043         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
10044                 if (!((rdev->wiphy.features &
10045                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
10046                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
10047                     !wiphy_ext_feature_isset(&rdev->wiphy,
10048                                              NL80211_EXT_FEATURE_RRM))
10049                         return -EINVAL;
10050                 req.flags |= ASSOC_REQ_USE_RRM;
10051         }
10052
10053         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
10054                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
10055                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
10056                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
10057                         return -EINVAL;
10058                 req.fils_nonces =
10059                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
10060         }
10061
10062         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
10063                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
10064                         return -EINVAL;
10065                 memcpy(&req.s1g_capa_mask,
10066                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
10067                        sizeof(req.s1g_capa_mask));
10068         }
10069
10070         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
10071                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
10072                         return -EINVAL;
10073                 memcpy(&req.s1g_capa,
10074                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
10075                        sizeof(req.s1g_capa));
10076         }
10077
10078         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
10079         if (!err) {
10080                 wdev_lock(dev->ieee80211_ptr);
10081
10082                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
10083                                           ssid, ssid_len, &req);
10084
10085                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10086                         dev->ieee80211_ptr->conn_owner_nlportid =
10087                                 info->snd_portid;
10088                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
10089                                bssid, ETH_ALEN);
10090                 }
10091
10092                 wdev_unlock(dev->ieee80211_ptr);
10093         }
10094
10095         return err;
10096 }
10097
10098 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
10099 {
10100         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10101         struct net_device *dev = info->user_ptr[1];
10102         const u8 *ie = NULL, *bssid;
10103         int ie_len = 0, err;
10104         u16 reason_code;
10105         bool local_state_change;
10106
10107         if (dev->ieee80211_ptr->conn_owner_nlportid &&
10108             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10109                 return -EPERM;
10110
10111         if (!info->attrs[NL80211_ATTR_MAC])
10112                 return -EINVAL;
10113
10114         if (!info->attrs[NL80211_ATTR_REASON_CODE])
10115                 return -EINVAL;
10116
10117         if (!rdev->ops->deauth)
10118                 return -EOPNOTSUPP;
10119
10120         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10121             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10122                 return -EOPNOTSUPP;
10123
10124         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10125
10126         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
10127         if (reason_code == 0) {
10128                 /* Reason Code 0 is reserved */
10129                 return -EINVAL;
10130         }
10131
10132         if (info->attrs[NL80211_ATTR_IE]) {
10133                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10134                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10135         }
10136
10137         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10138
10139         wdev_lock(dev->ieee80211_ptr);
10140         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
10141                                    local_state_change);
10142         wdev_unlock(dev->ieee80211_ptr);
10143         return err;
10144 }
10145
10146 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
10147 {
10148         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10149         struct net_device *dev = info->user_ptr[1];
10150         const u8 *ie = NULL, *bssid;
10151         int ie_len = 0, err;
10152         u16 reason_code;
10153         bool local_state_change;
10154
10155         if (dev->ieee80211_ptr->conn_owner_nlportid &&
10156             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10157                 return -EPERM;
10158
10159         if (!info->attrs[NL80211_ATTR_MAC])
10160                 return -EINVAL;
10161
10162         if (!info->attrs[NL80211_ATTR_REASON_CODE])
10163                 return -EINVAL;
10164
10165         if (!rdev->ops->disassoc)
10166                 return -EOPNOTSUPP;
10167
10168         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10169             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10170                 return -EOPNOTSUPP;
10171
10172         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10173
10174         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
10175         if (reason_code == 0) {
10176                 /* Reason Code 0 is reserved */
10177                 return -EINVAL;
10178         }
10179
10180         if (info->attrs[NL80211_ATTR_IE]) {
10181                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10182                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10183         }
10184
10185         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10186
10187         wdev_lock(dev->ieee80211_ptr);
10188         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
10189                                      local_state_change);
10190         wdev_unlock(dev->ieee80211_ptr);
10191         return err;
10192 }
10193
10194 static bool
10195 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
10196                          int mcast_rate[NUM_NL80211_BANDS],
10197                          int rateval)
10198 {
10199         struct wiphy *wiphy = &rdev->wiphy;
10200         bool found = false;
10201         int band, i;
10202
10203         for (band = 0; band < NUM_NL80211_BANDS; band++) {
10204                 struct ieee80211_supported_band *sband;
10205
10206                 sband = wiphy->bands[band];
10207                 if (!sband)
10208                         continue;
10209
10210                 for (i = 0; i < sband->n_bitrates; i++) {
10211                         if (sband->bitrates[i].bitrate == rateval) {
10212                                 mcast_rate[band] = i + 1;
10213                                 found = true;
10214                                 break;
10215                         }
10216                 }
10217         }
10218
10219         return found;
10220 }
10221
10222 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
10223 {
10224         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10225         struct net_device *dev = info->user_ptr[1];
10226         struct cfg80211_ibss_params ibss;
10227         struct wiphy *wiphy;
10228         struct cfg80211_cached_keys *connkeys = NULL;
10229         int err;
10230
10231         memset(&ibss, 0, sizeof(ibss));
10232
10233         if (!info->attrs[NL80211_ATTR_SSID] ||
10234             !nla_len(info->attrs[NL80211_ATTR_SSID]))
10235                 return -EINVAL;
10236
10237         ibss.beacon_interval = 100;
10238
10239         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
10240                 ibss.beacon_interval =
10241                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10242
10243         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
10244                                            ibss.beacon_interval);
10245         if (err)
10246                 return err;
10247
10248         if (!rdev->ops->join_ibss)
10249                 return -EOPNOTSUPP;
10250
10251         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
10252                 return -EOPNOTSUPP;
10253
10254         wiphy = &rdev->wiphy;
10255
10256         if (info->attrs[NL80211_ATTR_MAC]) {
10257                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10258
10259                 if (!is_valid_ether_addr(ibss.bssid))
10260                         return -EINVAL;
10261         }
10262         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10263         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10264
10265         if (info->attrs[NL80211_ATTR_IE]) {
10266                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10267                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10268         }
10269
10270         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
10271         if (err)
10272                 return err;
10273
10274         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
10275                                      NL80211_IFTYPE_ADHOC))
10276                 return -EINVAL;
10277
10278         switch (ibss.chandef.width) {
10279         case NL80211_CHAN_WIDTH_5:
10280         case NL80211_CHAN_WIDTH_10:
10281         case NL80211_CHAN_WIDTH_20_NOHT:
10282                 break;
10283         case NL80211_CHAN_WIDTH_20:
10284         case NL80211_CHAN_WIDTH_40:
10285                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
10286                         return -EINVAL;
10287                 break;
10288         case NL80211_CHAN_WIDTH_80:
10289         case NL80211_CHAN_WIDTH_80P80:
10290         case NL80211_CHAN_WIDTH_160:
10291                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
10292                         return -EINVAL;
10293                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10294                                              NL80211_EXT_FEATURE_VHT_IBSS))
10295                         return -EINVAL;
10296                 break;
10297         default:
10298                 return -EINVAL;
10299         }
10300
10301         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
10302         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
10303
10304         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10305                 u8 *rates =
10306                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10307                 int n_rates =
10308                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10309                 struct ieee80211_supported_band *sband =
10310                         wiphy->bands[ibss.chandef.chan->band];
10311
10312                 err = ieee80211_get_ratemask(sband, rates, n_rates,
10313                                              &ibss.basic_rates);
10314                 if (err)
10315                         return err;
10316         }
10317
10318         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10319                 memcpy(&ibss.ht_capa_mask,
10320                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10321                        sizeof(ibss.ht_capa_mask));
10322
10323         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10324                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10325                         return -EINVAL;
10326                 memcpy(&ibss.ht_capa,
10327                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10328                        sizeof(ibss.ht_capa));
10329         }
10330
10331         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10332             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
10333                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10334                 return -EINVAL;
10335
10336         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
10337                 bool no_ht = false;
10338
10339                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
10340                 if (IS_ERR(connkeys))
10341                         return PTR_ERR(connkeys);
10342
10343                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
10344                     no_ht) {
10345                         kfree_sensitive(connkeys);
10346                         return -EINVAL;
10347                 }
10348         }
10349
10350         ibss.control_port =
10351                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
10352
10353         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10354                 int r = validate_pae_over_nl80211(rdev, info);
10355
10356                 if (r < 0) {
10357                         kfree_sensitive(connkeys);
10358                         return r;
10359                 }
10360
10361                 ibss.control_port_over_nl80211 = true;
10362         }
10363
10364         ibss.userspace_handles_dfs =
10365                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10366
10367         wdev_lock(dev->ieee80211_ptr);
10368         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
10369         if (err)
10370                 kfree_sensitive(connkeys);
10371         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
10372                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10373         wdev_unlock(dev->ieee80211_ptr);
10374
10375         return err;
10376 }
10377
10378 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
10379 {
10380         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10381         struct net_device *dev = info->user_ptr[1];
10382
10383         if (!rdev->ops->leave_ibss)
10384                 return -EOPNOTSUPP;
10385
10386         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
10387                 return -EOPNOTSUPP;
10388
10389         return cfg80211_leave_ibss(rdev, dev, false);
10390 }
10391
10392 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
10393 {
10394         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10395         struct net_device *dev = info->user_ptr[1];
10396         int mcast_rate[NUM_NL80211_BANDS];
10397         u32 nla_rate;
10398         int err;
10399
10400         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
10401             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
10402             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
10403                 return -EOPNOTSUPP;
10404
10405         if (!rdev->ops->set_mcast_rate)
10406                 return -EOPNOTSUPP;
10407
10408         memset(mcast_rate, 0, sizeof(mcast_rate));
10409
10410         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
10411                 return -EINVAL;
10412
10413         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
10414         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
10415                 return -EINVAL;
10416
10417         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
10418
10419         return err;
10420 }
10421
10422 static struct sk_buff *
10423 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
10424                             struct wireless_dev *wdev, int approxlen,
10425                             u32 portid, u32 seq, enum nl80211_commands cmd,
10426                             enum nl80211_attrs attr,
10427                             const struct nl80211_vendor_cmd_info *info,
10428                             gfp_t gfp)
10429 {
10430         struct sk_buff *skb;
10431         void *hdr;
10432         struct nlattr *data;
10433
10434         skb = nlmsg_new(approxlen + 100, gfp);
10435         if (!skb)
10436                 return NULL;
10437
10438         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
10439         if (!hdr) {
10440                 kfree_skb(skb);
10441                 return NULL;
10442         }
10443
10444         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
10445                 goto nla_put_failure;
10446
10447         if (info) {
10448                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
10449                                 info->vendor_id))
10450                         goto nla_put_failure;
10451                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
10452                                 info->subcmd))
10453                         goto nla_put_failure;
10454         }
10455
10456         if (wdev) {
10457                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
10458                                       wdev_id(wdev), NL80211_ATTR_PAD))
10459                         goto nla_put_failure;
10460                 if (wdev->netdev &&
10461                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
10462                                 wdev->netdev->ifindex))
10463                         goto nla_put_failure;
10464         }
10465
10466         data = nla_nest_start_noflag(skb, attr);
10467         if (!data)
10468                 goto nla_put_failure;
10469
10470         ((void **)skb->cb)[0] = rdev;
10471         ((void **)skb->cb)[1] = hdr;
10472         ((void **)skb->cb)[2] = data;
10473
10474         return skb;
10475
10476  nla_put_failure:
10477         kfree_skb(skb);
10478         return NULL;
10479 }
10480
10481 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
10482                                            struct wireless_dev *wdev,
10483                                            enum nl80211_commands cmd,
10484                                            enum nl80211_attrs attr,
10485                                            unsigned int portid,
10486                                            int vendor_event_idx,
10487                                            int approxlen, gfp_t gfp)
10488 {
10489         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10490         const struct nl80211_vendor_cmd_info *info;
10491
10492         switch (cmd) {
10493         case NL80211_CMD_TESTMODE:
10494                 if (WARN_ON(vendor_event_idx != -1))
10495                         return NULL;
10496                 info = NULL;
10497                 break;
10498         case NL80211_CMD_VENDOR:
10499                 if (WARN_ON(vendor_event_idx < 0 ||
10500                             vendor_event_idx >= wiphy->n_vendor_events))
10501                         return NULL;
10502                 info = &wiphy->vendor_events[vendor_event_idx];
10503                 break;
10504         default:
10505                 WARN_ON(1);
10506                 return NULL;
10507         }
10508
10509         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
10510                                            cmd, attr, info, gfp);
10511 }
10512 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
10513
10514 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
10515 {
10516         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
10517         void *hdr = ((void **)skb->cb)[1];
10518         struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
10519         struct nlattr *data = ((void **)skb->cb)[2];
10520         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
10521
10522         /* clear CB data for netlink core to own from now on */
10523         memset(skb->cb, 0, sizeof(skb->cb));
10524
10525         nla_nest_end(skb, data);
10526         genlmsg_end(skb, hdr);
10527
10528         if (nlhdr->nlmsg_pid) {
10529                 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
10530                                 nlhdr->nlmsg_pid);
10531         } else {
10532                 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
10533                         mcgrp = NL80211_MCGRP_VENDOR;
10534
10535                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
10536                                         skb, 0, mcgrp, gfp);
10537         }
10538 }
10539 EXPORT_SYMBOL(__cfg80211_send_event_skb);
10540
10541 #ifdef CONFIG_NL80211_TESTMODE
10542 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
10543 {
10544         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10545         struct wireless_dev *wdev;
10546         int err;
10547
10548         lockdep_assert_held(&rdev->wiphy.mtx);
10549
10550         wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
10551                                           info->attrs);
10552
10553         if (!rdev->ops->testmode_cmd)
10554                 return -EOPNOTSUPP;
10555
10556         if (IS_ERR(wdev)) {
10557                 err = PTR_ERR(wdev);
10558                 if (err != -EINVAL)
10559                         return err;
10560                 wdev = NULL;
10561         } else if (wdev->wiphy != &rdev->wiphy) {
10562                 return -EINVAL;
10563         }
10564
10565         if (!info->attrs[NL80211_ATTR_TESTDATA])
10566                 return -EINVAL;
10567
10568         rdev->cur_cmd_info = info;
10569         err = rdev_testmode_cmd(rdev, wdev,
10570                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
10571                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
10572         rdev->cur_cmd_info = NULL;
10573
10574         return err;
10575 }
10576
10577 static int nl80211_testmode_dump(struct sk_buff *skb,
10578                                  struct netlink_callback *cb)
10579 {
10580         struct cfg80211_registered_device *rdev;
10581         struct nlattr **attrbuf = NULL;
10582         int err;
10583         long phy_idx;
10584         void *data = NULL;
10585         int data_len = 0;
10586
10587         rtnl_lock();
10588
10589         if (cb->args[0]) {
10590                 /*
10591                  * 0 is a valid index, but not valid for args[0],
10592                  * so we need to offset by 1.
10593                  */
10594                 phy_idx = cb->args[0] - 1;
10595
10596                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
10597                 if (!rdev) {
10598                         err = -ENOENT;
10599                         goto out_err;
10600                 }
10601         } else {
10602                 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
10603                                   GFP_KERNEL);
10604                 if (!attrbuf) {
10605                         err = -ENOMEM;
10606                         goto out_err;
10607                 }
10608
10609                 err = nlmsg_parse_deprecated(cb->nlh,
10610                                              GENL_HDRLEN + nl80211_fam.hdrsize,
10611                                              attrbuf, nl80211_fam.maxattr,
10612                                              nl80211_policy, NULL);
10613                 if (err)
10614                         goto out_err;
10615
10616                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
10617                 if (IS_ERR(rdev)) {
10618                         err = PTR_ERR(rdev);
10619                         goto out_err;
10620                 }
10621                 phy_idx = rdev->wiphy_idx;
10622
10623                 if (attrbuf[NL80211_ATTR_TESTDATA])
10624                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
10625         }
10626
10627         if (cb->args[1]) {
10628                 data = nla_data((void *)cb->args[1]);
10629                 data_len = nla_len((void *)cb->args[1]);
10630         }
10631
10632         if (!rdev->ops->testmode_dump) {
10633                 err = -EOPNOTSUPP;
10634                 goto out_err;
10635         }
10636
10637         while (1) {
10638                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
10639                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
10640                                            NL80211_CMD_TESTMODE);
10641                 struct nlattr *tmdata;
10642
10643                 if (!hdr)
10644                         break;
10645
10646                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
10647                         genlmsg_cancel(skb, hdr);
10648                         break;
10649                 }
10650
10651                 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
10652                 if (!tmdata) {
10653                         genlmsg_cancel(skb, hdr);
10654                         break;
10655                 }
10656                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
10657                 nla_nest_end(skb, tmdata);
10658
10659                 if (err == -ENOBUFS || err == -ENOENT) {
10660                         genlmsg_cancel(skb, hdr);
10661                         break;
10662                 } else if (err) {
10663                         genlmsg_cancel(skb, hdr);
10664                         goto out_err;
10665                 }
10666
10667                 genlmsg_end(skb, hdr);
10668         }
10669
10670         err = skb->len;
10671         /* see above */
10672         cb->args[0] = phy_idx + 1;
10673  out_err:
10674         kfree(attrbuf);
10675         rtnl_unlock();
10676         return err;
10677 }
10678 #endif
10679
10680 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
10681 {
10682         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10683         struct net_device *dev = info->user_ptr[1];
10684         struct cfg80211_connect_params connect;
10685         struct wiphy *wiphy;
10686         struct cfg80211_cached_keys *connkeys = NULL;
10687         u32 freq = 0;
10688         int err;
10689
10690         memset(&connect, 0, sizeof(connect));
10691
10692         if (!info->attrs[NL80211_ATTR_SSID] ||
10693             !nla_len(info->attrs[NL80211_ATTR_SSID]))
10694                 return -EINVAL;
10695
10696         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
10697                 connect.auth_type =
10698                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10699                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
10700                                              NL80211_CMD_CONNECT))
10701                         return -EINVAL;
10702         } else
10703                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
10704
10705         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
10706
10707         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
10708             !wiphy_ext_feature_isset(&rdev->wiphy,
10709                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
10710                 return -EINVAL;
10711         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
10712
10713         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
10714                                       NL80211_MAX_NR_CIPHER_SUITES);
10715         if (err)
10716                 return err;
10717
10718         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10719             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10720                 return -EOPNOTSUPP;
10721
10722         wiphy = &rdev->wiphy;
10723
10724         connect.bg_scan_period = -1;
10725         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
10726                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
10727                 connect.bg_scan_period =
10728                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
10729         }
10730
10731         if (info->attrs[NL80211_ATTR_MAC])
10732                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10733         else if (info->attrs[NL80211_ATTR_MAC_HINT])
10734                 connect.bssid_hint =
10735                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
10736         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10737         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10738
10739         if (info->attrs[NL80211_ATTR_IE]) {
10740                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10741                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10742         }
10743
10744         if (info->attrs[NL80211_ATTR_USE_MFP]) {
10745                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
10746                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
10747                     !wiphy_ext_feature_isset(&rdev->wiphy,
10748                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
10749                         return -EOPNOTSUPP;
10750         } else {
10751                 connect.mfp = NL80211_MFP_NO;
10752         }
10753
10754         if (info->attrs[NL80211_ATTR_PREV_BSSID])
10755                 connect.prev_bssid =
10756                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
10757
10758         if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
10759                 freq = MHZ_TO_KHZ(nla_get_u32(
10760                                         info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10761         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10762                 freq +=
10763                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10764
10765         if (freq) {
10766                 connect.channel = nl80211_get_valid_chan(wiphy, freq);
10767                 if (!connect.channel)
10768                         return -EINVAL;
10769         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
10770                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
10771                 freq = MHZ_TO_KHZ(freq);
10772                 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
10773                 if (!connect.channel_hint)
10774                         return -EINVAL;
10775         }
10776
10777         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
10778                 connect.edmg.channels =
10779                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
10780
10781                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
10782                         connect.edmg.bw_config =
10783                                 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
10784         }
10785
10786         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
10787                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
10788                 if (IS_ERR(connkeys))
10789                         return PTR_ERR(connkeys);
10790         }
10791
10792         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
10793                 connect.flags |= ASSOC_REQ_DISABLE_HT;
10794
10795         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10796                 memcpy(&connect.ht_capa_mask,
10797                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10798                        sizeof(connect.ht_capa_mask));
10799
10800         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10801                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
10802                         kfree_sensitive(connkeys);
10803                         return -EINVAL;
10804                 }
10805                 memcpy(&connect.ht_capa,
10806                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10807                        sizeof(connect.ht_capa));
10808         }
10809
10810         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
10811                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
10812
10813         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
10814                 connect.flags |= ASSOC_REQ_DISABLE_HE;
10815
10816         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10817                 memcpy(&connect.vht_capa_mask,
10818                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
10819                        sizeof(connect.vht_capa_mask));
10820
10821         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
10822                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
10823                         kfree_sensitive(connkeys);
10824                         return -EINVAL;
10825                 }
10826                 memcpy(&connect.vht_capa,
10827                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
10828                        sizeof(connect.vht_capa));
10829         }
10830
10831         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
10832                 if (!((rdev->wiphy.features &
10833                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
10834                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
10835                     !wiphy_ext_feature_isset(&rdev->wiphy,
10836                                              NL80211_EXT_FEATURE_RRM)) {
10837                         kfree_sensitive(connkeys);
10838                         return -EINVAL;
10839                 }
10840                 connect.flags |= ASSOC_REQ_USE_RRM;
10841         }
10842
10843         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
10844         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
10845                 kfree_sensitive(connkeys);
10846                 return -EOPNOTSUPP;
10847         }
10848
10849         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
10850                 /* bss selection makes no sense if bssid is set */
10851                 if (connect.bssid) {
10852                         kfree_sensitive(connkeys);
10853                         return -EINVAL;
10854                 }
10855
10856                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
10857                                        wiphy, &connect.bss_select);
10858                 if (err) {
10859                         kfree_sensitive(connkeys);
10860                         return err;
10861                 }
10862         }
10863
10864         if (wiphy_ext_feature_isset(&rdev->wiphy,
10865                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
10866             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
10867             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
10868             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
10869             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10870                 connect.fils_erp_username =
10871                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10872                 connect.fils_erp_username_len =
10873                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10874                 connect.fils_erp_realm =
10875                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10876                 connect.fils_erp_realm_len =
10877                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10878                 connect.fils_erp_next_seq_num =
10879                         nla_get_u16(
10880                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
10881                 connect.fils_erp_rrk =
10882                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10883                 connect.fils_erp_rrk_len =
10884                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10885         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
10886                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
10887                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
10888                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10889                 kfree_sensitive(connkeys);
10890                 return -EINVAL;
10891         }
10892
10893         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
10894                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10895                         kfree_sensitive(connkeys);
10896                         GENL_SET_ERR_MSG(info,
10897                                          "external auth requires connection ownership");
10898                         return -EINVAL;
10899                 }
10900                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
10901         }
10902
10903         wdev_lock(dev->ieee80211_ptr);
10904
10905         err = cfg80211_connect(rdev, dev, &connect, connkeys,
10906                                connect.prev_bssid);
10907         if (err)
10908                 kfree_sensitive(connkeys);
10909
10910         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10911                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10912                 if (connect.bssid)
10913                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
10914                                connect.bssid, ETH_ALEN);
10915                 else
10916                         eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
10917         }
10918
10919         wdev_unlock(dev->ieee80211_ptr);
10920
10921         return err;
10922 }
10923
10924 static int nl80211_update_connect_params(struct sk_buff *skb,
10925                                          struct genl_info *info)
10926 {
10927         struct cfg80211_connect_params connect = {};
10928         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10929         struct net_device *dev = info->user_ptr[1];
10930         struct wireless_dev *wdev = dev->ieee80211_ptr;
10931         bool fils_sk_offload;
10932         u32 auth_type;
10933         u32 changed = 0;
10934         int ret;
10935
10936         if (!rdev->ops->update_connect_params)
10937                 return -EOPNOTSUPP;
10938
10939         if (info->attrs[NL80211_ATTR_IE]) {
10940                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10941                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10942                 changed |= UPDATE_ASSOC_IES;
10943         }
10944
10945         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
10946                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
10947
10948         /*
10949          * when driver supports fils-sk offload all attributes must be
10950          * provided. So the else covers "fils-sk-not-all" and
10951          * "no-fils-sk-any".
10952          */
10953         if (fils_sk_offload &&
10954             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
10955             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
10956             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
10957             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10958                 connect.fils_erp_username =
10959                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10960                 connect.fils_erp_username_len =
10961                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10962                 connect.fils_erp_realm =
10963                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10964                 connect.fils_erp_realm_len =
10965                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10966                 connect.fils_erp_next_seq_num =
10967                         nla_get_u16(
10968                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
10969                 connect.fils_erp_rrk =
10970                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10971                 connect.fils_erp_rrk_len =
10972                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10973                 changed |= UPDATE_FILS_ERP_INFO;
10974         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
10975                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
10976                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
10977                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10978                 return -EINVAL;
10979         }
10980
10981         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
10982                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10983                 if (!nl80211_valid_auth_type(rdev, auth_type,
10984                                              NL80211_CMD_CONNECT))
10985                         return -EINVAL;
10986
10987                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
10988                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
10989                         return -EINVAL;
10990
10991                 connect.auth_type = auth_type;
10992                 changed |= UPDATE_AUTH_TYPE;
10993         }
10994
10995         wdev_lock(dev->ieee80211_ptr);
10996         if (!wdev->current_bss)
10997                 ret = -ENOLINK;
10998         else
10999                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
11000         wdev_unlock(dev->ieee80211_ptr);
11001
11002         return ret;
11003 }
11004
11005 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
11006 {
11007         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11008         struct net_device *dev = info->user_ptr[1];
11009         u16 reason;
11010         int ret;
11011
11012         if (dev->ieee80211_ptr->conn_owner_nlportid &&
11013             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11014                 return -EPERM;
11015
11016         if (!info->attrs[NL80211_ATTR_REASON_CODE])
11017                 reason = WLAN_REASON_DEAUTH_LEAVING;
11018         else
11019                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11020
11021         if (reason == 0)
11022                 return -EINVAL;
11023
11024         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11025             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11026                 return -EOPNOTSUPP;
11027
11028         wdev_lock(dev->ieee80211_ptr);
11029         ret = cfg80211_disconnect(rdev, dev, reason, true);
11030         wdev_unlock(dev->ieee80211_ptr);
11031         return ret;
11032 }
11033
11034 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
11035 {
11036         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11037         struct net *net;
11038         int err;
11039
11040         if (info->attrs[NL80211_ATTR_PID]) {
11041                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
11042
11043                 net = get_net_ns_by_pid(pid);
11044         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
11045                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
11046
11047                 net = get_net_ns_by_fd(fd);
11048         } else {
11049                 return -EINVAL;
11050         }
11051
11052         if (IS_ERR(net))
11053                 return PTR_ERR(net);
11054
11055         err = 0;
11056
11057         /* check if anything to do */
11058         if (!net_eq(wiphy_net(&rdev->wiphy), net))
11059                 err = cfg80211_switch_netns(rdev, net);
11060
11061         put_net(net);
11062         return err;
11063 }
11064
11065 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
11066 {
11067         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11068         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
11069                         struct cfg80211_pmksa *pmksa) = NULL;
11070         struct net_device *dev = info->user_ptr[1];
11071         struct cfg80211_pmksa pmksa;
11072
11073         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
11074
11075         if (!info->attrs[NL80211_ATTR_PMKID])
11076                 return -EINVAL;
11077
11078         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
11079
11080         if (info->attrs[NL80211_ATTR_MAC]) {
11081                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11082         } else if (info->attrs[NL80211_ATTR_SSID] &&
11083                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
11084                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
11085                     info->attrs[NL80211_ATTR_PMK])) {
11086                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11087                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11088                 pmksa.cache_id =
11089                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
11090         } else {
11091                 return -EINVAL;
11092         }
11093         if (info->attrs[NL80211_ATTR_PMK]) {
11094                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
11095                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
11096         }
11097
11098         if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
11099                 pmksa.pmk_lifetime =
11100                         nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
11101
11102         if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
11103                 pmksa.pmk_reauth_threshold =
11104                         nla_get_u8(
11105                                 info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
11106
11107         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11108             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
11109             !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
11110               wiphy_ext_feature_isset(&rdev->wiphy,
11111                                       NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
11112                 return -EOPNOTSUPP;
11113
11114         switch (info->genlhdr->cmd) {
11115         case NL80211_CMD_SET_PMKSA:
11116                 rdev_ops = rdev->ops->set_pmksa;
11117                 break;
11118         case NL80211_CMD_DEL_PMKSA:
11119                 rdev_ops = rdev->ops->del_pmksa;
11120                 break;
11121         default:
11122                 WARN_ON(1);
11123                 break;
11124         }
11125
11126         if (!rdev_ops)
11127                 return -EOPNOTSUPP;
11128
11129         return rdev_ops(&rdev->wiphy, dev, &pmksa);
11130 }
11131
11132 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
11133 {
11134         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11135         struct net_device *dev = info->user_ptr[1];
11136
11137         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11138             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11139                 return -EOPNOTSUPP;
11140
11141         if (!rdev->ops->flush_pmksa)
11142                 return -EOPNOTSUPP;
11143
11144         return rdev_flush_pmksa(rdev, dev);
11145 }
11146
11147 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
11148 {
11149         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11150         struct net_device *dev = info->user_ptr[1];
11151         u8 action_code, dialog_token;
11152         u32 peer_capability = 0;
11153         u16 status_code;
11154         u8 *peer;
11155         bool initiator;
11156
11157         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
11158             !rdev->ops->tdls_mgmt)
11159                 return -EOPNOTSUPP;
11160
11161         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
11162             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
11163             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
11164             !info->attrs[NL80211_ATTR_IE] ||
11165             !info->attrs[NL80211_ATTR_MAC])
11166                 return -EINVAL;
11167
11168         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11169         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
11170         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
11171         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
11172         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
11173         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
11174                 peer_capability =
11175                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
11176
11177         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
11178                               dialog_token, status_code, peer_capability,
11179                               initiator,
11180                               nla_data(info->attrs[NL80211_ATTR_IE]),
11181                               nla_len(info->attrs[NL80211_ATTR_IE]));
11182 }
11183
11184 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
11185 {
11186         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11187         struct net_device *dev = info->user_ptr[1];
11188         enum nl80211_tdls_operation operation;
11189         u8 *peer;
11190
11191         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
11192             !rdev->ops->tdls_oper)
11193                 return -EOPNOTSUPP;
11194
11195         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
11196             !info->attrs[NL80211_ATTR_MAC])
11197                 return -EINVAL;
11198
11199         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
11200         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11201
11202         return rdev_tdls_oper(rdev, dev, peer, operation);
11203 }
11204
11205 static int nl80211_remain_on_channel(struct sk_buff *skb,
11206                                      struct genl_info *info)
11207 {
11208         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11209         struct wireless_dev *wdev = info->user_ptr[1];
11210         struct cfg80211_chan_def chandef;
11211         const struct cfg80211_chan_def *compat_chandef;
11212         struct sk_buff *msg;
11213         void *hdr;
11214         u64 cookie;
11215         u32 duration;
11216         int err;
11217
11218         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11219             !info->attrs[NL80211_ATTR_DURATION])
11220                 return -EINVAL;
11221
11222         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
11223
11224         if (!rdev->ops->remain_on_channel ||
11225             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
11226                 return -EOPNOTSUPP;
11227
11228         /*
11229          * We should be on that channel for at least a minimum amount of
11230          * time (10ms) but no longer than the driver supports.
11231          */
11232         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
11233             duration > rdev->wiphy.max_remain_on_channel_duration)
11234                 return -EINVAL;
11235
11236         err = nl80211_parse_chandef(rdev, info, &chandef);
11237         if (err)
11238                 return err;
11239
11240         wdev_lock(wdev);
11241         if (!cfg80211_off_channel_oper_allowed(wdev) &&
11242             !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
11243                 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
11244                                                              &chandef);
11245                 if (compat_chandef != &chandef) {
11246                         wdev_unlock(wdev);
11247                         return -EBUSY;
11248                 }
11249         }
11250         wdev_unlock(wdev);
11251
11252         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11253         if (!msg)
11254                 return -ENOMEM;
11255
11256         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11257                              NL80211_CMD_REMAIN_ON_CHANNEL);
11258         if (!hdr) {
11259                 err = -ENOBUFS;
11260                 goto free_msg;
11261         }
11262
11263         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
11264                                      duration, &cookie);
11265
11266         if (err)
11267                 goto free_msg;
11268
11269         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11270                               NL80211_ATTR_PAD))
11271                 goto nla_put_failure;
11272
11273         genlmsg_end(msg, hdr);
11274
11275         return genlmsg_reply(msg, info);
11276
11277  nla_put_failure:
11278         err = -ENOBUFS;
11279  free_msg:
11280         nlmsg_free(msg);
11281         return err;
11282 }
11283
11284 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
11285                                             struct genl_info *info)
11286 {
11287         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11288         struct wireless_dev *wdev = info->user_ptr[1];
11289         u64 cookie;
11290
11291         if (!info->attrs[NL80211_ATTR_COOKIE])
11292                 return -EINVAL;
11293
11294         if (!rdev->ops->cancel_remain_on_channel)
11295                 return -EOPNOTSUPP;
11296
11297         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11298
11299         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
11300 }
11301
11302 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
11303                                        struct genl_info *info)
11304 {
11305         struct cfg80211_bitrate_mask mask;
11306         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11307         struct net_device *dev = info->user_ptr[1];
11308         int err;
11309
11310         if (!rdev->ops->set_bitrate_mask)
11311                 return -EOPNOTSUPP;
11312
11313         err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
11314                                             NL80211_ATTR_TX_RATES, &mask,
11315                                             dev, true);
11316         if (err)
11317                 return err;
11318
11319         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
11320 }
11321
11322 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
11323 {
11324         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11325         struct wireless_dev *wdev = info->user_ptr[1];
11326         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
11327
11328         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
11329                 return -EINVAL;
11330
11331         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
11332                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
11333
11334         switch (wdev->iftype) {
11335         case NL80211_IFTYPE_STATION:
11336         case NL80211_IFTYPE_ADHOC:
11337         case NL80211_IFTYPE_P2P_CLIENT:
11338         case NL80211_IFTYPE_AP:
11339         case NL80211_IFTYPE_AP_VLAN:
11340         case NL80211_IFTYPE_MESH_POINT:
11341         case NL80211_IFTYPE_P2P_GO:
11342         case NL80211_IFTYPE_P2P_DEVICE:
11343                 break;
11344         case NL80211_IFTYPE_NAN:
11345         default:
11346                 return -EOPNOTSUPP;
11347         }
11348
11349         /* not much point in registering if we can't reply */
11350         if (!rdev->ops->mgmt_tx)
11351                 return -EOPNOTSUPP;
11352
11353         if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
11354             !wiphy_ext_feature_isset(&rdev->wiphy,
11355                                      NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
11356                 GENL_SET_ERR_MSG(info,
11357                                  "multicast RX registrations are not supported");
11358                 return -EOPNOTSUPP;
11359         }
11360
11361         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
11362                                            nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
11363                                            nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
11364                                            info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
11365                                            info->extack);
11366 }
11367
11368 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
11369 {
11370         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11371         struct wireless_dev *wdev = info->user_ptr[1];
11372         struct cfg80211_chan_def chandef;
11373         int err;
11374         void *hdr = NULL;
11375         u64 cookie;
11376         struct sk_buff *msg = NULL;
11377         struct cfg80211_mgmt_tx_params params = {
11378                 .dont_wait_for_ack =
11379                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
11380         };
11381
11382         if (!info->attrs[NL80211_ATTR_FRAME])
11383                 return -EINVAL;
11384
11385         if (!rdev->ops->mgmt_tx)
11386                 return -EOPNOTSUPP;
11387
11388         switch (wdev->iftype) {
11389         case NL80211_IFTYPE_P2P_DEVICE:
11390                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
11391                         return -EINVAL;
11392                 break;
11393         case NL80211_IFTYPE_STATION:
11394         case NL80211_IFTYPE_ADHOC:
11395         case NL80211_IFTYPE_P2P_CLIENT:
11396         case NL80211_IFTYPE_AP:
11397         case NL80211_IFTYPE_AP_VLAN:
11398         case NL80211_IFTYPE_MESH_POINT:
11399         case NL80211_IFTYPE_P2P_GO:
11400                 break;
11401         case NL80211_IFTYPE_NAN:
11402         default:
11403                 return -EOPNOTSUPP;
11404         }
11405
11406         if (info->attrs[NL80211_ATTR_DURATION]) {
11407                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
11408                         return -EINVAL;
11409                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
11410
11411                 /*
11412                  * We should wait on the channel for at least a minimum amount
11413                  * of time (10ms) but no longer than the driver supports.
11414                  */
11415                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
11416                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
11417                         return -EINVAL;
11418         }
11419
11420         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
11421
11422         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
11423                 return -EINVAL;
11424
11425         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
11426
11427         /* get the channel if any has been specified, otherwise pass NULL to
11428          * the driver. The latter will use the current one
11429          */
11430         chandef.chan = NULL;
11431         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
11432                 err = nl80211_parse_chandef(rdev, info, &chandef);
11433                 if (err)
11434                         return err;
11435         }
11436
11437         if (!chandef.chan && params.offchan)
11438                 return -EINVAL;
11439
11440         wdev_lock(wdev);
11441         if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
11442                 wdev_unlock(wdev);
11443                 return -EBUSY;
11444         }
11445         wdev_unlock(wdev);
11446
11447         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
11448         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
11449
11450         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
11451                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
11452                 int i;
11453
11454                 if (len % sizeof(u16))
11455                         return -EINVAL;
11456
11457                 params.n_csa_offsets = len / sizeof(u16);
11458                 params.csa_offsets =
11459                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
11460
11461                 /* check that all the offsets fit the frame */
11462                 for (i = 0; i < params.n_csa_offsets; i++) {
11463                         if (params.csa_offsets[i] >= params.len)
11464                                 return -EINVAL;
11465                 }
11466         }
11467
11468         if (!params.dont_wait_for_ack) {
11469                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11470                 if (!msg)
11471                         return -ENOMEM;
11472
11473                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11474                                      NL80211_CMD_FRAME);
11475                 if (!hdr) {
11476                         err = -ENOBUFS;
11477                         goto free_msg;
11478                 }
11479         }
11480
11481         params.chan = chandef.chan;
11482         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
11483         if (err)
11484                 goto free_msg;
11485
11486         if (msg) {
11487                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11488                                       NL80211_ATTR_PAD))
11489                         goto nla_put_failure;
11490
11491                 genlmsg_end(msg, hdr);
11492                 return genlmsg_reply(msg, info);
11493         }
11494
11495         return 0;
11496
11497  nla_put_failure:
11498         err = -ENOBUFS;
11499  free_msg:
11500         nlmsg_free(msg);
11501         return err;
11502 }
11503
11504 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
11505 {
11506         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11507         struct wireless_dev *wdev = info->user_ptr[1];
11508         u64 cookie;
11509
11510         if (!info->attrs[NL80211_ATTR_COOKIE])
11511                 return -EINVAL;
11512
11513         if (!rdev->ops->mgmt_tx_cancel_wait)
11514                 return -EOPNOTSUPP;
11515
11516         switch (wdev->iftype) {
11517         case NL80211_IFTYPE_STATION:
11518         case NL80211_IFTYPE_ADHOC:
11519         case NL80211_IFTYPE_P2P_CLIENT:
11520         case NL80211_IFTYPE_AP:
11521         case NL80211_IFTYPE_AP_VLAN:
11522         case NL80211_IFTYPE_P2P_GO:
11523         case NL80211_IFTYPE_P2P_DEVICE:
11524                 break;
11525         case NL80211_IFTYPE_NAN:
11526         default:
11527                 return -EOPNOTSUPP;
11528         }
11529
11530         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11531
11532         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
11533 }
11534
11535 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
11536 {
11537         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11538         struct wireless_dev *wdev;
11539         struct net_device *dev = info->user_ptr[1];
11540         u8 ps_state;
11541         bool state;
11542         int err;
11543
11544         if (!info->attrs[NL80211_ATTR_PS_STATE])
11545                 return -EINVAL;
11546
11547         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
11548
11549         wdev = dev->ieee80211_ptr;
11550
11551         if (!rdev->ops->set_power_mgmt)
11552                 return -EOPNOTSUPP;
11553
11554         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
11555
11556         if (state == wdev->ps)
11557                 return 0;
11558
11559         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
11560         if (!err)
11561                 wdev->ps = state;
11562         return err;
11563 }
11564
11565 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
11566 {
11567         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11568         enum nl80211_ps_state ps_state;
11569         struct wireless_dev *wdev;
11570         struct net_device *dev = info->user_ptr[1];
11571         struct sk_buff *msg;
11572         void *hdr;
11573         int err;
11574
11575         wdev = dev->ieee80211_ptr;
11576
11577         if (!rdev->ops->set_power_mgmt)
11578                 return -EOPNOTSUPP;
11579
11580         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11581         if (!msg)
11582                 return -ENOMEM;
11583
11584         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11585                              NL80211_CMD_GET_POWER_SAVE);
11586         if (!hdr) {
11587                 err = -ENOBUFS;
11588                 goto free_msg;
11589         }
11590
11591         if (wdev->ps)
11592                 ps_state = NL80211_PS_ENABLED;
11593         else
11594                 ps_state = NL80211_PS_DISABLED;
11595
11596         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
11597                 goto nla_put_failure;
11598
11599         genlmsg_end(msg, hdr);
11600         return genlmsg_reply(msg, info);
11601
11602  nla_put_failure:
11603         err = -ENOBUFS;
11604  free_msg:
11605         nlmsg_free(msg);
11606         return err;
11607 }
11608
11609 static const struct nla_policy
11610 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
11611         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
11612         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
11613         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
11614         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
11615         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
11616         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
11617         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
11618 };
11619
11620 static int nl80211_set_cqm_txe(struct genl_info *info,
11621                                u32 rate, u32 pkts, u32 intvl)
11622 {
11623         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11624         struct net_device *dev = info->user_ptr[1];
11625         struct wireless_dev *wdev = dev->ieee80211_ptr;
11626
11627         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
11628                 return -EINVAL;
11629
11630         if (!rdev->ops->set_cqm_txe_config)
11631                 return -EOPNOTSUPP;
11632
11633         if (wdev->iftype != NL80211_IFTYPE_STATION &&
11634             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
11635                 return -EOPNOTSUPP;
11636
11637         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
11638 }
11639
11640 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
11641                                     struct net_device *dev)
11642 {
11643         struct wireless_dev *wdev = dev->ieee80211_ptr;
11644         s32 last, low, high;
11645         u32 hyst;
11646         int i, n, low_index;
11647         int err;
11648
11649         /* RSSI reporting disabled? */
11650         if (!wdev->cqm_config)
11651                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
11652
11653         /*
11654          * Obtain current RSSI value if possible, if not and no RSSI threshold
11655          * event has been received yet, we should receive an event after a
11656          * connection is established and enough beacons received to calculate
11657          * the average.
11658          */
11659         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
11660             rdev->ops->get_station) {
11661                 struct station_info sinfo = {};
11662                 u8 *mac_addr;
11663
11664                 mac_addr = wdev->current_bss->pub.bssid;
11665
11666                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
11667                 if (err)
11668                         return err;
11669
11670                 cfg80211_sinfo_release_content(&sinfo);
11671                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
11672                         wdev->cqm_config->last_rssi_event_value =
11673                                 (s8) sinfo.rx_beacon_signal_avg;
11674         }
11675
11676         last = wdev->cqm_config->last_rssi_event_value;
11677         hyst = wdev->cqm_config->rssi_hyst;
11678         n = wdev->cqm_config->n_rssi_thresholds;
11679
11680         for (i = 0; i < n; i++) {
11681                 i = array_index_nospec(i, n);
11682                 if (last < wdev->cqm_config->rssi_thresholds[i])
11683                         break;
11684         }
11685
11686         low_index = i - 1;
11687         if (low_index >= 0) {
11688                 low_index = array_index_nospec(low_index, n);
11689                 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
11690         } else {
11691                 low = S32_MIN;
11692         }
11693         if (i < n) {
11694                 i = array_index_nospec(i, n);
11695                 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
11696         } else {
11697                 high = S32_MAX;
11698         }
11699
11700         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
11701 }
11702
11703 static int nl80211_set_cqm_rssi(struct genl_info *info,
11704                                 const s32 *thresholds, int n_thresholds,
11705                                 u32 hysteresis)
11706 {
11707         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11708         struct net_device *dev = info->user_ptr[1];
11709         struct wireless_dev *wdev = dev->ieee80211_ptr;
11710         int i, err;
11711         s32 prev = S32_MIN;
11712
11713         /* Check all values negative and sorted */
11714         for (i = 0; i < n_thresholds; i++) {
11715                 if (thresholds[i] > 0 || thresholds[i] <= prev)
11716                         return -EINVAL;
11717
11718                 prev = thresholds[i];
11719         }
11720
11721         if (wdev->iftype != NL80211_IFTYPE_STATION &&
11722             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
11723                 return -EOPNOTSUPP;
11724
11725         wdev_lock(wdev);
11726         cfg80211_cqm_config_free(wdev);
11727         wdev_unlock(wdev);
11728
11729         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
11730                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
11731                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
11732
11733                 return rdev_set_cqm_rssi_config(rdev, dev,
11734                                                 thresholds[0], hysteresis);
11735         }
11736
11737         if (!wiphy_ext_feature_isset(&rdev->wiphy,
11738                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
11739                 return -EOPNOTSUPP;
11740
11741         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
11742                 n_thresholds = 0;
11743
11744         wdev_lock(wdev);
11745         if (n_thresholds) {
11746                 struct cfg80211_cqm_config *cqm_config;
11747
11748                 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
11749                                      n_thresholds * sizeof(s32), GFP_KERNEL);
11750                 if (!cqm_config) {
11751                         err = -ENOMEM;
11752                         goto unlock;
11753                 }
11754
11755                 cqm_config->rssi_hyst = hysteresis;
11756                 cqm_config->n_rssi_thresholds = n_thresholds;
11757                 memcpy(cqm_config->rssi_thresholds, thresholds,
11758                        n_thresholds * sizeof(s32));
11759
11760                 wdev->cqm_config = cqm_config;
11761         }
11762
11763         err = cfg80211_cqm_rssi_update(rdev, dev);
11764
11765 unlock:
11766         wdev_unlock(wdev);
11767
11768         return err;
11769 }
11770
11771 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
11772 {
11773         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
11774         struct nlattr *cqm;
11775         int err;
11776
11777         cqm = info->attrs[NL80211_ATTR_CQM];
11778         if (!cqm)
11779                 return -EINVAL;
11780
11781         err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
11782                                           nl80211_attr_cqm_policy,
11783                                           info->extack);
11784         if (err)
11785                 return err;
11786
11787         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
11788             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
11789                 const s32 *thresholds =
11790                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
11791                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
11792                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
11793
11794                 if (len % 4)
11795                         return -EINVAL;
11796
11797                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
11798                                             hysteresis);
11799         }
11800
11801         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
11802             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
11803             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
11804                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
11805                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
11806                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
11807
11808                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
11809         }
11810
11811         return -EINVAL;
11812 }
11813
11814 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
11815 {
11816         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11817         struct net_device *dev = info->user_ptr[1];
11818         struct ocb_setup setup = {};
11819         int err;
11820
11821         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
11822         if (err)
11823                 return err;
11824
11825         return cfg80211_join_ocb(rdev, dev, &setup);
11826 }
11827
11828 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
11829 {
11830         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11831         struct net_device *dev = info->user_ptr[1];
11832
11833         return cfg80211_leave_ocb(rdev, dev);
11834 }
11835
11836 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
11837 {
11838         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11839         struct net_device *dev = info->user_ptr[1];
11840         struct mesh_config cfg;
11841         struct mesh_setup setup;
11842         int err;
11843
11844         /* start with default */
11845         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
11846         memcpy(&setup, &default_mesh_setup, sizeof(setup));
11847
11848         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
11849                 /* and parse parameters if given */
11850                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
11851                 if (err)
11852                         return err;
11853         }
11854
11855         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
11856             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
11857                 return -EINVAL;
11858
11859         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
11860         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
11861
11862         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11863             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
11864                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11865                         return -EINVAL;
11866
11867         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
11868                 setup.beacon_interval =
11869                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11870
11871                 err = cfg80211_validate_beacon_int(rdev,
11872                                                    NL80211_IFTYPE_MESH_POINT,
11873                                                    setup.beacon_interval);
11874                 if (err)
11875                         return err;
11876         }
11877
11878         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
11879                 setup.dtim_period =
11880                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
11881                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
11882                         return -EINVAL;
11883         }
11884
11885         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
11886                 /* parse additional setup parameters if given */
11887                 err = nl80211_parse_mesh_setup(info, &setup);
11888                 if (err)
11889                         return err;
11890         }
11891
11892         if (setup.user_mpm)
11893                 cfg.auto_open_plinks = false;
11894
11895         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
11896                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
11897                 if (err)
11898                         return err;
11899         } else {
11900                 /* __cfg80211_join_mesh() will sort it out */
11901                 setup.chandef.chan = NULL;
11902         }
11903
11904         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11905                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11906                 int n_rates =
11907                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11908                 struct ieee80211_supported_band *sband;
11909
11910                 if (!setup.chandef.chan)
11911                         return -EINVAL;
11912
11913                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
11914
11915                 err = ieee80211_get_ratemask(sband, rates, n_rates,
11916                                              &setup.basic_rates);
11917                 if (err)
11918                         return err;
11919         }
11920
11921         if (info->attrs[NL80211_ATTR_TX_RATES]) {
11922                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
11923                                                     NL80211_ATTR_TX_RATES,
11924                                                     &setup.beacon_rate,
11925                                                     dev, false);
11926                 if (err)
11927                         return err;
11928
11929                 if (!setup.chandef.chan)
11930                         return -EINVAL;
11931
11932                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
11933                                               &setup.beacon_rate);
11934                 if (err)
11935                         return err;
11936         }
11937
11938         setup.userspace_handles_dfs =
11939                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11940
11941         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11942                 int r = validate_pae_over_nl80211(rdev, info);
11943
11944                 if (r < 0)
11945                         return r;
11946
11947                 setup.control_port_over_nl80211 = true;
11948         }
11949
11950         wdev_lock(dev->ieee80211_ptr);
11951         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
11952         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
11953                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11954         wdev_unlock(dev->ieee80211_ptr);
11955
11956         return err;
11957 }
11958
11959 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
11960 {
11961         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11962         struct net_device *dev = info->user_ptr[1];
11963
11964         return cfg80211_leave_mesh(rdev, dev);
11965 }
11966
11967 #ifdef CONFIG_PM
11968 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
11969                                         struct cfg80211_registered_device *rdev)
11970 {
11971         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
11972         struct nlattr *nl_pats, *nl_pat;
11973         int i, pat_len;
11974
11975         if (!wowlan->n_patterns)
11976                 return 0;
11977
11978         nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
11979         if (!nl_pats)
11980                 return -ENOBUFS;
11981
11982         for (i = 0; i < wowlan->n_patterns; i++) {
11983                 nl_pat = nla_nest_start_noflag(msg, i + 1);
11984                 if (!nl_pat)
11985                         return -ENOBUFS;
11986                 pat_len = wowlan->patterns[i].pattern_len;
11987                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
11988                             wowlan->patterns[i].mask) ||
11989                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
11990                             wowlan->patterns[i].pattern) ||
11991                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
11992                                 wowlan->patterns[i].pkt_offset))
11993                         return -ENOBUFS;
11994                 nla_nest_end(msg, nl_pat);
11995         }
11996         nla_nest_end(msg, nl_pats);
11997
11998         return 0;
11999 }
12000
12001 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
12002                                    struct cfg80211_wowlan_tcp *tcp)
12003 {
12004         struct nlattr *nl_tcp;
12005
12006         if (!tcp)
12007                 return 0;
12008
12009         nl_tcp = nla_nest_start_noflag(msg,
12010                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
12011         if (!nl_tcp)
12012                 return -ENOBUFS;
12013
12014         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
12015             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
12016             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
12017             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
12018             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
12019             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
12020                     tcp->payload_len, tcp->payload) ||
12021             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
12022                         tcp->data_interval) ||
12023             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
12024                     tcp->wake_len, tcp->wake_data) ||
12025             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
12026                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
12027                 return -ENOBUFS;
12028
12029         if (tcp->payload_seq.len &&
12030             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
12031                     sizeof(tcp->payload_seq), &tcp->payload_seq))
12032                 return -ENOBUFS;
12033
12034         if (tcp->payload_tok.len &&
12035             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
12036                     sizeof(tcp->payload_tok) + tcp->tokens_size,
12037                     &tcp->payload_tok))
12038                 return -ENOBUFS;
12039
12040         nla_nest_end(msg, nl_tcp);
12041
12042         return 0;
12043 }
12044
12045 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
12046                                   struct cfg80211_sched_scan_request *req)
12047 {
12048         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
12049         int i;
12050
12051         if (!req)
12052                 return 0;
12053
12054         nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
12055         if (!nd)
12056                 return -ENOBUFS;
12057
12058         if (req->n_scan_plans == 1 &&
12059             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
12060                         req->scan_plans[0].interval * 1000))
12061                 return -ENOBUFS;
12062
12063         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
12064                 return -ENOBUFS;
12065
12066         if (req->relative_rssi_set) {
12067                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
12068
12069                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
12070                                req->relative_rssi))
12071                         return -ENOBUFS;
12072
12073                 rssi_adjust.band = req->rssi_adjust.band;
12074                 rssi_adjust.delta = req->rssi_adjust.delta;
12075                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
12076                             sizeof(rssi_adjust), &rssi_adjust))
12077                         return -ENOBUFS;
12078         }
12079
12080         freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
12081         if (!freqs)
12082                 return -ENOBUFS;
12083
12084         for (i = 0; i < req->n_channels; i++) {
12085                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
12086                         return -ENOBUFS;
12087         }
12088
12089         nla_nest_end(msg, freqs);
12090
12091         if (req->n_match_sets) {
12092                 matches = nla_nest_start_noflag(msg,
12093                                                 NL80211_ATTR_SCHED_SCAN_MATCH);
12094                 if (!matches)
12095                         return -ENOBUFS;
12096
12097                 for (i = 0; i < req->n_match_sets; i++) {
12098                         match = nla_nest_start_noflag(msg, i);
12099                         if (!match)
12100                                 return -ENOBUFS;
12101
12102                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
12103                                     req->match_sets[i].ssid.ssid_len,
12104                                     req->match_sets[i].ssid.ssid))
12105                                 return -ENOBUFS;
12106                         nla_nest_end(msg, match);
12107                 }
12108                 nla_nest_end(msg, matches);
12109         }
12110
12111         scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
12112         if (!scan_plans)
12113                 return -ENOBUFS;
12114
12115         for (i = 0; i < req->n_scan_plans; i++) {
12116                 scan_plan = nla_nest_start_noflag(msg, i + 1);
12117                 if (!scan_plan)
12118                         return -ENOBUFS;
12119
12120                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
12121                                 req->scan_plans[i].interval) ||
12122                     (req->scan_plans[i].iterations &&
12123                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
12124                                  req->scan_plans[i].iterations)))
12125                         return -ENOBUFS;
12126                 nla_nest_end(msg, scan_plan);
12127         }
12128         nla_nest_end(msg, scan_plans);
12129
12130         nla_nest_end(msg, nd);
12131
12132         return 0;
12133 }
12134
12135 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
12136 {
12137         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12138         struct sk_buff *msg;
12139         void *hdr;
12140         u32 size = NLMSG_DEFAULT_SIZE;
12141
12142         if (!rdev->wiphy.wowlan)
12143                 return -EOPNOTSUPP;
12144
12145         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
12146                 /* adjust size to have room for all the data */
12147                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
12148                         rdev->wiphy.wowlan_config->tcp->payload_len +
12149                         rdev->wiphy.wowlan_config->tcp->wake_len +
12150                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
12151         }
12152
12153         msg = nlmsg_new(size, GFP_KERNEL);
12154         if (!msg)
12155                 return -ENOMEM;
12156
12157         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12158                              NL80211_CMD_GET_WOWLAN);
12159         if (!hdr)
12160                 goto nla_put_failure;
12161
12162         if (rdev->wiphy.wowlan_config) {
12163                 struct nlattr *nl_wowlan;
12164
12165                 nl_wowlan = nla_nest_start_noflag(msg,
12166                                                   NL80211_ATTR_WOWLAN_TRIGGERS);
12167                 if (!nl_wowlan)
12168                         goto nla_put_failure;
12169
12170                 if ((rdev->wiphy.wowlan_config->any &&
12171                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
12172                     (rdev->wiphy.wowlan_config->disconnect &&
12173                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
12174                     (rdev->wiphy.wowlan_config->magic_pkt &&
12175                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
12176                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
12177                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
12178                     (rdev->wiphy.wowlan_config->eap_identity_req &&
12179                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
12180                     (rdev->wiphy.wowlan_config->four_way_handshake &&
12181                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
12182                     (rdev->wiphy.wowlan_config->rfkill_release &&
12183                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
12184                         goto nla_put_failure;
12185
12186                 if (nl80211_send_wowlan_patterns(msg, rdev))
12187                         goto nla_put_failure;
12188
12189                 if (nl80211_send_wowlan_tcp(msg,
12190                                             rdev->wiphy.wowlan_config->tcp))
12191                         goto nla_put_failure;
12192
12193                 if (nl80211_send_wowlan_nd(
12194                             msg,
12195                             rdev->wiphy.wowlan_config->nd_config))
12196                         goto nla_put_failure;
12197
12198                 nla_nest_end(msg, nl_wowlan);
12199         }
12200
12201         genlmsg_end(msg, hdr);
12202         return genlmsg_reply(msg, info);
12203
12204 nla_put_failure:
12205         nlmsg_free(msg);
12206         return -ENOBUFS;
12207 }
12208
12209 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
12210                                     struct nlattr *attr,
12211                                     struct cfg80211_wowlan *trig)
12212 {
12213         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
12214         struct cfg80211_wowlan_tcp *cfg;
12215         struct nl80211_wowlan_tcp_data_token *tok = NULL;
12216         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
12217         u32 size;
12218         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
12219         int err, port;
12220
12221         if (!rdev->wiphy.wowlan->tcp)
12222                 return -EINVAL;
12223
12224         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
12225                                           nl80211_wowlan_tcp_policy, NULL);
12226         if (err)
12227                 return err;
12228
12229         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
12230             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
12231             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
12232             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
12233             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
12234             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
12235             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
12236             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
12237                 return -EINVAL;
12238
12239         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
12240         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
12241                 return -EINVAL;
12242
12243         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
12244                         rdev->wiphy.wowlan->tcp->data_interval_max ||
12245             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
12246                 return -EINVAL;
12247
12248         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
12249         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
12250                 return -EINVAL;
12251
12252         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
12253         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
12254                 return -EINVAL;
12255
12256         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
12257                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
12258
12259                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
12260                 tokens_size = tokln - sizeof(*tok);
12261
12262                 if (!tok->len || tokens_size % tok->len)
12263                         return -EINVAL;
12264                 if (!rdev->wiphy.wowlan->tcp->tok)
12265                         return -EINVAL;
12266                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
12267                         return -EINVAL;
12268                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
12269                         return -EINVAL;
12270                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
12271                         return -EINVAL;
12272                 if (tok->offset + tok->len > data_size)
12273                         return -EINVAL;
12274         }
12275
12276         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
12277                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
12278                 if (!rdev->wiphy.wowlan->tcp->seq)
12279                         return -EINVAL;
12280                 if (seq->len == 0 || seq->len > 4)
12281                         return -EINVAL;
12282                 if (seq->len + seq->offset > data_size)
12283                         return -EINVAL;
12284         }
12285
12286         size = sizeof(*cfg);
12287         size += data_size;
12288         size += wake_size + wake_mask_size;
12289         size += tokens_size;
12290
12291         cfg = kzalloc(size, GFP_KERNEL);
12292         if (!cfg)
12293                 return -ENOMEM;
12294         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
12295         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
12296         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
12297                ETH_ALEN);
12298         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
12299                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
12300         else
12301                 port = 0;
12302 #ifdef CONFIG_INET
12303         /* allocate a socket and port for it and use it */
12304         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
12305                             IPPROTO_TCP, &cfg->sock, 1);
12306         if (err) {
12307                 kfree(cfg);
12308                 return err;
12309         }
12310         if (inet_csk_get_port(cfg->sock->sk, port)) {
12311                 sock_release(cfg->sock);
12312                 kfree(cfg);
12313                 return -EADDRINUSE;
12314         }
12315         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
12316 #else
12317         if (!port) {
12318                 kfree(cfg);
12319                 return -EINVAL;
12320         }
12321         cfg->src_port = port;
12322 #endif
12323
12324         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
12325         cfg->payload_len = data_size;
12326         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
12327         memcpy((void *)cfg->payload,
12328                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
12329                data_size);
12330         if (seq)
12331                 cfg->payload_seq = *seq;
12332         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
12333         cfg->wake_len = wake_size;
12334         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
12335         memcpy((void *)cfg->wake_data,
12336                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
12337                wake_size);
12338         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
12339                          data_size + wake_size;
12340         memcpy((void *)cfg->wake_mask,
12341                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
12342                wake_mask_size);
12343         if (tok) {
12344                 cfg->tokens_size = tokens_size;
12345                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
12346         }
12347
12348         trig->tcp = cfg;
12349
12350         return 0;
12351 }
12352
12353 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
12354                                    const struct wiphy_wowlan_support *wowlan,
12355                                    struct nlattr *attr,
12356                                    struct cfg80211_wowlan *trig)
12357 {
12358         struct nlattr **tb;
12359         int err;
12360
12361         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
12362         if (!tb)
12363                 return -ENOMEM;
12364
12365         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
12366                 err = -EOPNOTSUPP;
12367                 goto out;
12368         }
12369
12370         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
12371                                           nl80211_policy, NULL);
12372         if (err)
12373                 goto out;
12374
12375         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
12376                                                    wowlan->max_nd_match_sets);
12377         err = PTR_ERR_OR_ZERO(trig->nd_config);
12378         if (err)
12379                 trig->nd_config = NULL;
12380
12381 out:
12382         kfree(tb);
12383         return err;
12384 }
12385
12386 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
12387 {
12388         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12389         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
12390         struct cfg80211_wowlan new_triggers = {};
12391         struct cfg80211_wowlan *ntrig;
12392         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
12393         int err, i;
12394         bool prev_enabled = rdev->wiphy.wowlan_config;
12395         bool regular = false;
12396
12397         if (!wowlan)
12398                 return -EOPNOTSUPP;
12399
12400         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
12401                 cfg80211_rdev_free_wowlan(rdev);
12402                 rdev->wiphy.wowlan_config = NULL;
12403                 goto set_wakeup;
12404         }
12405
12406         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
12407                                           info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
12408                                           nl80211_wowlan_policy, info->extack);
12409         if (err)
12410                 return err;
12411
12412         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
12413                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
12414                         return -EINVAL;
12415                 new_triggers.any = true;
12416         }
12417
12418         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
12419                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
12420                         return -EINVAL;
12421                 new_triggers.disconnect = true;
12422                 regular = true;
12423         }
12424
12425         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
12426                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
12427                         return -EINVAL;
12428                 new_triggers.magic_pkt = true;
12429                 regular = true;
12430         }
12431
12432         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
12433                 return -EINVAL;
12434
12435         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
12436                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
12437                         return -EINVAL;
12438                 new_triggers.gtk_rekey_failure = true;
12439                 regular = true;
12440         }
12441
12442         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
12443                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
12444                         return -EINVAL;
12445                 new_triggers.eap_identity_req = true;
12446                 regular = true;
12447         }
12448
12449         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
12450                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
12451                         return -EINVAL;
12452                 new_triggers.four_way_handshake = true;
12453                 regular = true;
12454         }
12455
12456         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
12457                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
12458                         return -EINVAL;
12459                 new_triggers.rfkill_release = true;
12460                 regular = true;
12461         }
12462
12463         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
12464                 struct nlattr *pat;
12465                 int n_patterns = 0;
12466                 int rem, pat_len, mask_len, pkt_offset;
12467                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
12468
12469                 regular = true;
12470
12471                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
12472                                     rem)
12473                         n_patterns++;
12474                 if (n_patterns > wowlan->n_patterns)
12475                         return -EINVAL;
12476
12477                 new_triggers.patterns = kcalloc(n_patterns,
12478                                                 sizeof(new_triggers.patterns[0]),
12479                                                 GFP_KERNEL);
12480                 if (!new_triggers.patterns)
12481                         return -ENOMEM;
12482
12483                 new_triggers.n_patterns = n_patterns;
12484                 i = 0;
12485
12486                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
12487                                     rem) {
12488                         u8 *mask_pat;
12489
12490                         err = nla_parse_nested_deprecated(pat_tb,
12491                                                           MAX_NL80211_PKTPAT,
12492                                                           pat,
12493                                                           nl80211_packet_pattern_policy,
12494                                                           info->extack);
12495                         if (err)
12496                                 goto error;
12497
12498                         err = -EINVAL;
12499                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
12500                             !pat_tb[NL80211_PKTPAT_PATTERN])
12501                                 goto error;
12502                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
12503                         mask_len = DIV_ROUND_UP(pat_len, 8);
12504                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
12505                                 goto error;
12506                         if (pat_len > wowlan->pattern_max_len ||
12507                             pat_len < wowlan->pattern_min_len)
12508                                 goto error;
12509
12510                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
12511                                 pkt_offset = 0;
12512                         else
12513                                 pkt_offset = nla_get_u32(
12514                                         pat_tb[NL80211_PKTPAT_OFFSET]);
12515                         if (pkt_offset > wowlan->max_pkt_offset)
12516                                 goto error;
12517                         new_triggers.patterns[i].pkt_offset = pkt_offset;
12518
12519                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
12520                         if (!mask_pat) {
12521                                 err = -ENOMEM;
12522                                 goto error;
12523                         }
12524                         new_triggers.patterns[i].mask = mask_pat;
12525                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
12526                                mask_len);
12527                         mask_pat += mask_len;
12528                         new_triggers.patterns[i].pattern = mask_pat;
12529                         new_triggers.patterns[i].pattern_len = pat_len;
12530                         memcpy(mask_pat,
12531                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
12532                                pat_len);
12533                         i++;
12534                 }
12535         }
12536
12537         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
12538                 regular = true;
12539                 err = nl80211_parse_wowlan_tcp(
12540                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
12541                         &new_triggers);
12542                 if (err)
12543                         goto error;
12544         }
12545
12546         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
12547                 regular = true;
12548                 err = nl80211_parse_wowlan_nd(
12549                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
12550                         &new_triggers);
12551                 if (err)
12552                         goto error;
12553         }
12554
12555         /* The 'any' trigger means the device continues operating more or less
12556          * as in its normal operation mode and wakes up the host on most of the
12557          * normal interrupts (like packet RX, ...)
12558          * It therefore makes little sense to combine with the more constrained
12559          * wakeup trigger modes.
12560          */
12561         if (new_triggers.any && regular) {
12562                 err = -EINVAL;
12563                 goto error;
12564         }
12565
12566         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
12567         if (!ntrig) {
12568                 err = -ENOMEM;
12569                 goto error;
12570         }
12571         cfg80211_rdev_free_wowlan(rdev);
12572         rdev->wiphy.wowlan_config = ntrig;
12573
12574  set_wakeup:
12575         if (rdev->ops->set_wakeup &&
12576             prev_enabled != !!rdev->wiphy.wowlan_config)
12577                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
12578
12579         return 0;
12580  error:
12581         for (i = 0; i < new_triggers.n_patterns; i++)
12582                 kfree(new_triggers.patterns[i].mask);
12583         kfree(new_triggers.patterns);
12584         if (new_triggers.tcp && new_triggers.tcp->sock)
12585                 sock_release(new_triggers.tcp->sock);
12586         kfree(new_triggers.tcp);
12587         kfree(new_triggers.nd_config);
12588         return err;
12589 }
12590 #endif
12591
12592 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
12593                                        struct cfg80211_registered_device *rdev)
12594 {
12595         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
12596         int i, j, pat_len;
12597         struct cfg80211_coalesce_rules *rule;
12598
12599         if (!rdev->coalesce->n_rules)
12600                 return 0;
12601
12602         nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
12603         if (!nl_rules)
12604                 return -ENOBUFS;
12605
12606         for (i = 0; i < rdev->coalesce->n_rules; i++) {
12607                 nl_rule = nla_nest_start_noflag(msg, i + 1);
12608                 if (!nl_rule)
12609                         return -ENOBUFS;
12610
12611                 rule = &rdev->coalesce->rules[i];
12612                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
12613                                 rule->delay))
12614                         return -ENOBUFS;
12615
12616                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
12617                                 rule->condition))
12618                         return -ENOBUFS;
12619
12620                 nl_pats = nla_nest_start_noflag(msg,
12621                                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
12622                 if (!nl_pats)
12623                         return -ENOBUFS;
12624
12625                 for (j = 0; j < rule->n_patterns; j++) {
12626                         nl_pat = nla_nest_start_noflag(msg, j + 1);
12627                         if (!nl_pat)
12628                                 return -ENOBUFS;
12629                         pat_len = rule->patterns[j].pattern_len;
12630                         if (nla_put(msg, NL80211_PKTPAT_MASK,
12631                                     DIV_ROUND_UP(pat_len, 8),
12632                                     rule->patterns[j].mask) ||
12633                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
12634                                     rule->patterns[j].pattern) ||
12635                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
12636                                         rule->patterns[j].pkt_offset))
12637                                 return -ENOBUFS;
12638                         nla_nest_end(msg, nl_pat);
12639                 }
12640                 nla_nest_end(msg, nl_pats);
12641                 nla_nest_end(msg, nl_rule);
12642         }
12643         nla_nest_end(msg, nl_rules);
12644
12645         return 0;
12646 }
12647
12648 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
12649 {
12650         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12651         struct sk_buff *msg;
12652         void *hdr;
12653
12654         if (!rdev->wiphy.coalesce)
12655                 return -EOPNOTSUPP;
12656
12657         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12658         if (!msg)
12659                 return -ENOMEM;
12660
12661         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12662                              NL80211_CMD_GET_COALESCE);
12663         if (!hdr)
12664                 goto nla_put_failure;
12665
12666         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
12667                 goto nla_put_failure;
12668
12669         genlmsg_end(msg, hdr);
12670         return genlmsg_reply(msg, info);
12671
12672 nla_put_failure:
12673         nlmsg_free(msg);
12674         return -ENOBUFS;
12675 }
12676
12677 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
12678 {
12679         struct cfg80211_coalesce *coalesce = rdev->coalesce;
12680         int i, j;
12681         struct cfg80211_coalesce_rules *rule;
12682
12683         if (!coalesce)
12684                 return;
12685
12686         for (i = 0; i < coalesce->n_rules; i++) {
12687                 rule = &coalesce->rules[i];
12688                 for (j = 0; j < rule->n_patterns; j++)
12689                         kfree(rule->patterns[j].mask);
12690                 kfree(rule->patterns);
12691         }
12692         kfree(coalesce->rules);
12693         kfree(coalesce);
12694         rdev->coalesce = NULL;
12695 }
12696
12697 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
12698                                        struct nlattr *rule,
12699                                        struct cfg80211_coalesce_rules *new_rule)
12700 {
12701         int err, i;
12702         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
12703         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
12704         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
12705         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
12706
12707         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
12708                                           rule, nl80211_coalesce_policy, NULL);
12709         if (err)
12710                 return err;
12711
12712         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
12713                 new_rule->delay =
12714                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
12715         if (new_rule->delay > coalesce->max_delay)
12716                 return -EINVAL;
12717
12718         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
12719                 new_rule->condition =
12720                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
12721
12722         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
12723                 return -EINVAL;
12724
12725         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
12726                             rem)
12727                 n_patterns++;
12728         if (n_patterns > coalesce->n_patterns)
12729                 return -EINVAL;
12730
12731         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
12732                                      GFP_KERNEL);
12733         if (!new_rule->patterns)
12734                 return -ENOMEM;
12735
12736         new_rule->n_patterns = n_patterns;
12737         i = 0;
12738
12739         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
12740                             rem) {
12741                 u8 *mask_pat;
12742
12743                 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
12744                                                   pat,
12745                                                   nl80211_packet_pattern_policy,
12746                                                   NULL);
12747                 if (err)
12748                         return err;
12749
12750                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
12751                     !pat_tb[NL80211_PKTPAT_PATTERN])
12752                         return -EINVAL;
12753                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
12754                 mask_len = DIV_ROUND_UP(pat_len, 8);
12755                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
12756                         return -EINVAL;
12757                 if (pat_len > coalesce->pattern_max_len ||
12758                     pat_len < coalesce->pattern_min_len)
12759                         return -EINVAL;
12760
12761                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
12762                         pkt_offset = 0;
12763                 else
12764                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
12765                 if (pkt_offset > coalesce->max_pkt_offset)
12766                         return -EINVAL;
12767                 new_rule->patterns[i].pkt_offset = pkt_offset;
12768
12769                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
12770                 if (!mask_pat)
12771                         return -ENOMEM;
12772
12773                 new_rule->patterns[i].mask = mask_pat;
12774                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
12775                        mask_len);
12776
12777                 mask_pat += mask_len;
12778                 new_rule->patterns[i].pattern = mask_pat;
12779                 new_rule->patterns[i].pattern_len = pat_len;
12780                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
12781                        pat_len);
12782                 i++;
12783         }
12784
12785         return 0;
12786 }
12787
12788 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
12789 {
12790         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12791         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
12792         struct cfg80211_coalesce new_coalesce = {};
12793         struct cfg80211_coalesce *n_coalesce;
12794         int err, rem_rule, n_rules = 0, i, j;
12795         struct nlattr *rule;
12796         struct cfg80211_coalesce_rules *tmp_rule;
12797
12798         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
12799                 return -EOPNOTSUPP;
12800
12801         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
12802                 cfg80211_rdev_free_coalesce(rdev);
12803                 rdev_set_coalesce(rdev, NULL);
12804                 return 0;
12805         }
12806
12807         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
12808                             rem_rule)
12809                 n_rules++;
12810         if (n_rules > coalesce->n_rules)
12811                 return -EINVAL;
12812
12813         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
12814                                      GFP_KERNEL);
12815         if (!new_coalesce.rules)
12816                 return -ENOMEM;
12817
12818         new_coalesce.n_rules = n_rules;
12819         i = 0;
12820
12821         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
12822                             rem_rule) {
12823                 err = nl80211_parse_coalesce_rule(rdev, rule,
12824                                                   &new_coalesce.rules[i]);
12825                 if (err)
12826                         goto error;
12827
12828                 i++;
12829         }
12830
12831         err = rdev_set_coalesce(rdev, &new_coalesce);
12832         if (err)
12833                 goto error;
12834
12835         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
12836         if (!n_coalesce) {
12837                 err = -ENOMEM;
12838                 goto error;
12839         }
12840         cfg80211_rdev_free_coalesce(rdev);
12841         rdev->coalesce = n_coalesce;
12842
12843         return 0;
12844 error:
12845         for (i = 0; i < new_coalesce.n_rules; i++) {
12846                 tmp_rule = &new_coalesce.rules[i];
12847                 for (j = 0; j < tmp_rule->n_patterns; j++)
12848                         kfree(tmp_rule->patterns[j].mask);
12849                 kfree(tmp_rule->patterns);
12850         }
12851         kfree(new_coalesce.rules);
12852
12853         return err;
12854 }
12855
12856 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
12857 {
12858         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12859         struct net_device *dev = info->user_ptr[1];
12860         struct wireless_dev *wdev = dev->ieee80211_ptr;
12861         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
12862         struct cfg80211_gtk_rekey_data rekey_data = {};
12863         int err;
12864
12865         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
12866                 return -EINVAL;
12867
12868         err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
12869                                           info->attrs[NL80211_ATTR_REKEY_DATA],
12870                                           nl80211_rekey_policy, info->extack);
12871         if (err)
12872                 return err;
12873
12874         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
12875             !tb[NL80211_REKEY_DATA_KCK])
12876                 return -EINVAL;
12877         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
12878             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
12879               nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
12880                 return -ERANGE;
12881         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
12882             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
12883               nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KCK_EXT_LEN))
12884                 return -ERANGE;
12885
12886         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
12887         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
12888         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
12889         rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
12890         rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
12891         if (tb[NL80211_REKEY_DATA_AKM])
12892                 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
12893
12894         wdev_lock(wdev);
12895         if (!wdev->current_bss) {
12896                 err = -ENOTCONN;
12897                 goto out;
12898         }
12899
12900         if (!rdev->ops->set_rekey_data) {
12901                 err = -EOPNOTSUPP;
12902                 goto out;
12903         }
12904
12905         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
12906  out:
12907         wdev_unlock(wdev);
12908         return err;
12909 }
12910
12911 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
12912                                              struct genl_info *info)
12913 {
12914         struct net_device *dev = info->user_ptr[1];
12915         struct wireless_dev *wdev = dev->ieee80211_ptr;
12916
12917         if (wdev->iftype != NL80211_IFTYPE_AP &&
12918             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12919                 return -EINVAL;
12920
12921         if (wdev->ap_unexpected_nlportid)
12922                 return -EBUSY;
12923
12924         wdev->ap_unexpected_nlportid = info->snd_portid;
12925         return 0;
12926 }
12927
12928 static int nl80211_probe_client(struct sk_buff *skb,
12929                                 struct genl_info *info)
12930 {
12931         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12932         struct net_device *dev = info->user_ptr[1];
12933         struct wireless_dev *wdev = dev->ieee80211_ptr;
12934         struct sk_buff *msg;
12935         void *hdr;
12936         const u8 *addr;
12937         u64 cookie;
12938         int err;
12939
12940         if (wdev->iftype != NL80211_IFTYPE_AP &&
12941             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12942                 return -EOPNOTSUPP;
12943
12944         if (!info->attrs[NL80211_ATTR_MAC])
12945                 return -EINVAL;
12946
12947         if (!rdev->ops->probe_client)
12948                 return -EOPNOTSUPP;
12949
12950         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12951         if (!msg)
12952                 return -ENOMEM;
12953
12954         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12955                              NL80211_CMD_PROBE_CLIENT);
12956         if (!hdr) {
12957                 err = -ENOBUFS;
12958                 goto free_msg;
12959         }
12960
12961         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12962
12963         err = rdev_probe_client(rdev, dev, addr, &cookie);
12964         if (err)
12965                 goto free_msg;
12966
12967         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12968                               NL80211_ATTR_PAD))
12969                 goto nla_put_failure;
12970
12971         genlmsg_end(msg, hdr);
12972
12973         return genlmsg_reply(msg, info);
12974
12975  nla_put_failure:
12976         err = -ENOBUFS;
12977  free_msg:
12978         nlmsg_free(msg);
12979         return err;
12980 }
12981
12982 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
12983 {
12984         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12985         struct cfg80211_beacon_registration *reg, *nreg;
12986         int rv;
12987
12988         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
12989                 return -EOPNOTSUPP;
12990
12991         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
12992         if (!nreg)
12993                 return -ENOMEM;
12994
12995         /* First, check if already registered. */
12996         spin_lock_bh(&rdev->beacon_registrations_lock);
12997         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
12998                 if (reg->nlportid == info->snd_portid) {
12999                         rv = -EALREADY;
13000                         goto out_err;
13001                 }
13002         }
13003         /* Add it to the list */
13004         nreg->nlportid = info->snd_portid;
13005         list_add(&nreg->list, &rdev->beacon_registrations);
13006
13007         spin_unlock_bh(&rdev->beacon_registrations_lock);
13008
13009         return 0;
13010 out_err:
13011         spin_unlock_bh(&rdev->beacon_registrations_lock);
13012         kfree(nreg);
13013         return rv;
13014 }
13015
13016 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
13017 {
13018         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13019         struct wireless_dev *wdev = info->user_ptr[1];
13020         int err;
13021
13022         if (!rdev->ops->start_p2p_device)
13023                 return -EOPNOTSUPP;
13024
13025         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
13026                 return -EOPNOTSUPP;
13027
13028         if (wdev_running(wdev))
13029                 return 0;
13030
13031         if (rfkill_blocked(rdev->rfkill))
13032                 return -ERFKILL;
13033
13034         err = rdev_start_p2p_device(rdev, wdev);
13035         if (err)
13036                 return err;
13037
13038         wdev->is_running = true;
13039         rdev->opencount++;
13040
13041         return 0;
13042 }
13043
13044 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
13045 {
13046         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13047         struct wireless_dev *wdev = info->user_ptr[1];
13048
13049         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
13050                 return -EOPNOTSUPP;
13051
13052         if (!rdev->ops->stop_p2p_device)
13053                 return -EOPNOTSUPP;
13054
13055         cfg80211_stop_p2p_device(rdev, wdev);
13056
13057         return 0;
13058 }
13059
13060 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
13061 {
13062         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13063         struct wireless_dev *wdev = info->user_ptr[1];
13064         struct cfg80211_nan_conf conf = {};
13065         int err;
13066
13067         if (wdev->iftype != NL80211_IFTYPE_NAN)
13068                 return -EOPNOTSUPP;
13069
13070         if (wdev_running(wdev))
13071                 return -EEXIST;
13072
13073         if (rfkill_blocked(rdev->rfkill))
13074                 return -ERFKILL;
13075
13076         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
13077                 return -EINVAL;
13078
13079         conf.master_pref =
13080                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
13081
13082         if (info->attrs[NL80211_ATTR_BANDS]) {
13083                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
13084
13085                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
13086                         return -EOPNOTSUPP;
13087
13088                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
13089                         return -EINVAL;
13090
13091                 conf.bands = bands;
13092         }
13093
13094         err = rdev_start_nan(rdev, wdev, &conf);
13095         if (err)
13096                 return err;
13097
13098         wdev->is_running = true;
13099         rdev->opencount++;
13100
13101         return 0;
13102 }
13103
13104 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
13105 {
13106         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13107         struct wireless_dev *wdev = info->user_ptr[1];
13108
13109         if (wdev->iftype != NL80211_IFTYPE_NAN)
13110                 return -EOPNOTSUPP;
13111
13112         cfg80211_stop_nan(rdev, wdev);
13113
13114         return 0;
13115 }
13116
13117 static int validate_nan_filter(struct nlattr *filter_attr)
13118 {
13119         struct nlattr *attr;
13120         int len = 0, n_entries = 0, rem;
13121
13122         nla_for_each_nested(attr, filter_attr, rem) {
13123                 len += nla_len(attr);
13124                 n_entries++;
13125         }
13126
13127         if (len >= U8_MAX)
13128                 return -EINVAL;
13129
13130         return n_entries;
13131 }
13132
13133 static int handle_nan_filter(struct nlattr *attr_filter,
13134                              struct cfg80211_nan_func *func,
13135                              bool tx)
13136 {
13137         struct nlattr *attr;
13138         int n_entries, rem, i;
13139         struct cfg80211_nan_func_filter *filter;
13140
13141         n_entries = validate_nan_filter(attr_filter);
13142         if (n_entries < 0)
13143                 return n_entries;
13144
13145         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
13146
13147         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
13148         if (!filter)
13149                 return -ENOMEM;
13150
13151         i = 0;
13152         nla_for_each_nested(attr, attr_filter, rem) {
13153                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
13154                 filter[i].len = nla_len(attr);
13155                 i++;
13156         }
13157         if (tx) {
13158                 func->num_tx_filters = n_entries;
13159                 func->tx_filters = filter;
13160         } else {
13161                 func->num_rx_filters = n_entries;
13162                 func->rx_filters = filter;
13163         }
13164
13165         return 0;
13166 }
13167
13168 static int nl80211_nan_add_func(struct sk_buff *skb,
13169                                 struct genl_info *info)
13170 {
13171         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13172         struct wireless_dev *wdev = info->user_ptr[1];
13173         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
13174         struct cfg80211_nan_func *func;
13175         struct sk_buff *msg = NULL;
13176         void *hdr = NULL;
13177         int err = 0;
13178
13179         if (wdev->iftype != NL80211_IFTYPE_NAN)
13180                 return -EOPNOTSUPP;
13181
13182         if (!wdev_running(wdev))
13183                 return -ENOTCONN;
13184
13185         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
13186                 return -EINVAL;
13187
13188         err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
13189                                           info->attrs[NL80211_ATTR_NAN_FUNC],
13190                                           nl80211_nan_func_policy,
13191                                           info->extack);
13192         if (err)
13193                 return err;
13194
13195         func = kzalloc(sizeof(*func), GFP_KERNEL);
13196         if (!func)
13197                 return -ENOMEM;
13198
13199         func->cookie = cfg80211_assign_cookie(rdev);
13200
13201         if (!tb[NL80211_NAN_FUNC_TYPE]) {
13202                 err = -EINVAL;
13203                 goto out;
13204         }
13205
13206
13207         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
13208
13209         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
13210                 err = -EINVAL;
13211                 goto out;
13212         }
13213
13214         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
13215                sizeof(func->service_id));
13216
13217         func->close_range =
13218                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
13219
13220         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
13221                 func->serv_spec_info_len =
13222                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
13223                 func->serv_spec_info =
13224                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
13225                                 func->serv_spec_info_len,
13226                                 GFP_KERNEL);
13227                 if (!func->serv_spec_info) {
13228                         err = -ENOMEM;
13229                         goto out;
13230                 }
13231         }
13232
13233         if (tb[NL80211_NAN_FUNC_TTL])
13234                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
13235
13236         switch (func->type) {
13237         case NL80211_NAN_FUNC_PUBLISH:
13238                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
13239                         err = -EINVAL;
13240                         goto out;
13241                 }
13242
13243                 func->publish_type =
13244                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
13245                 func->publish_bcast =
13246                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
13247
13248                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
13249                         func->publish_bcast) {
13250                         err = -EINVAL;
13251                         goto out;
13252                 }
13253                 break;
13254         case NL80211_NAN_FUNC_SUBSCRIBE:
13255                 func->subscribe_active =
13256                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
13257                 break;
13258         case NL80211_NAN_FUNC_FOLLOW_UP:
13259                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
13260                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
13261                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
13262                         err = -EINVAL;
13263                         goto out;
13264                 }
13265
13266                 func->followup_id =
13267                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
13268                 func->followup_reqid =
13269                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
13270                 memcpy(func->followup_dest.addr,
13271                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
13272                        sizeof(func->followup_dest.addr));
13273                 if (func->ttl) {
13274                         err = -EINVAL;
13275                         goto out;
13276                 }
13277                 break;
13278         default:
13279                 err = -EINVAL;
13280                 goto out;
13281         }
13282
13283         if (tb[NL80211_NAN_FUNC_SRF]) {
13284                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
13285
13286                 err = nla_parse_nested_deprecated(srf_tb,
13287                                                   NL80211_NAN_SRF_ATTR_MAX,
13288                                                   tb[NL80211_NAN_FUNC_SRF],
13289                                                   nl80211_nan_srf_policy,
13290                                                   info->extack);
13291                 if (err)
13292                         goto out;
13293
13294                 func->srf_include =
13295                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
13296
13297                 if (srf_tb[NL80211_NAN_SRF_BF]) {
13298                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
13299                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
13300                                 err = -EINVAL;
13301                                 goto out;
13302                         }
13303
13304                         func->srf_bf_len =
13305                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
13306                         func->srf_bf =
13307                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
13308                                         func->srf_bf_len, GFP_KERNEL);
13309                         if (!func->srf_bf) {
13310                                 err = -ENOMEM;
13311                                 goto out;
13312                         }
13313
13314                         func->srf_bf_idx =
13315                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
13316                 } else {
13317                         struct nlattr *attr, *mac_attr =
13318                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
13319                         int n_entries, rem, i = 0;
13320
13321                         if (!mac_attr) {
13322                                 err = -EINVAL;
13323                                 goto out;
13324                         }
13325
13326                         n_entries = validate_acl_mac_addrs(mac_attr);
13327                         if (n_entries <= 0) {
13328                                 err = -EINVAL;
13329                                 goto out;
13330                         }
13331
13332                         func->srf_num_macs = n_entries;
13333                         func->srf_macs =
13334                                 kcalloc(n_entries, sizeof(*func->srf_macs),
13335                                         GFP_KERNEL);
13336                         if (!func->srf_macs) {
13337                                 err = -ENOMEM;
13338                                 goto out;
13339                         }
13340
13341                         nla_for_each_nested(attr, mac_attr, rem)
13342                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
13343                                        sizeof(*func->srf_macs));
13344                 }
13345         }
13346
13347         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
13348                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
13349                                         func, true);
13350                 if (err)
13351                         goto out;
13352         }
13353
13354         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
13355                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
13356                                         func, false);
13357                 if (err)
13358                         goto out;
13359         }
13360
13361         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13362         if (!msg) {
13363                 err = -ENOMEM;
13364                 goto out;
13365         }
13366
13367         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13368                              NL80211_CMD_ADD_NAN_FUNCTION);
13369         /* This can't really happen - we just allocated 4KB */
13370         if (WARN_ON(!hdr)) {
13371                 err = -ENOMEM;
13372                 goto out;
13373         }
13374
13375         err = rdev_add_nan_func(rdev, wdev, func);
13376 out:
13377         if (err < 0) {
13378                 cfg80211_free_nan_func(func);
13379                 nlmsg_free(msg);
13380                 return err;
13381         }
13382
13383         /* propagate the instance id and cookie to userspace  */
13384         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
13385                               NL80211_ATTR_PAD))
13386                 goto nla_put_failure;
13387
13388         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
13389         if (!func_attr)
13390                 goto nla_put_failure;
13391
13392         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
13393                        func->instance_id))
13394                 goto nla_put_failure;
13395
13396         nla_nest_end(msg, func_attr);
13397
13398         genlmsg_end(msg, hdr);
13399         return genlmsg_reply(msg, info);
13400
13401 nla_put_failure:
13402         nlmsg_free(msg);
13403         return -ENOBUFS;
13404 }
13405
13406 static int nl80211_nan_del_func(struct sk_buff *skb,
13407                                struct genl_info *info)
13408 {
13409         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13410         struct wireless_dev *wdev = info->user_ptr[1];
13411         u64 cookie;
13412
13413         if (wdev->iftype != NL80211_IFTYPE_NAN)
13414                 return -EOPNOTSUPP;
13415
13416         if (!wdev_running(wdev))
13417                 return -ENOTCONN;
13418
13419         if (!info->attrs[NL80211_ATTR_COOKIE])
13420                 return -EINVAL;
13421
13422         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
13423
13424         rdev_del_nan_func(rdev, wdev, cookie);
13425
13426         return 0;
13427 }
13428
13429 static int nl80211_nan_change_config(struct sk_buff *skb,
13430                                      struct genl_info *info)
13431 {
13432         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13433         struct wireless_dev *wdev = info->user_ptr[1];
13434         struct cfg80211_nan_conf conf = {};
13435         u32 changed = 0;
13436
13437         if (wdev->iftype != NL80211_IFTYPE_NAN)
13438                 return -EOPNOTSUPP;
13439
13440         if (!wdev_running(wdev))
13441                 return -ENOTCONN;
13442
13443         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
13444                 conf.master_pref =
13445                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
13446                 if (conf.master_pref <= 1 || conf.master_pref == 255)
13447                         return -EINVAL;
13448
13449                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
13450         }
13451
13452         if (info->attrs[NL80211_ATTR_BANDS]) {
13453                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
13454
13455                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
13456                         return -EOPNOTSUPP;
13457
13458                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
13459                         return -EINVAL;
13460
13461                 conf.bands = bands;
13462                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
13463         }
13464
13465         if (!changed)
13466                 return -EINVAL;
13467
13468         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
13469 }
13470
13471 void cfg80211_nan_match(struct wireless_dev *wdev,
13472                         struct cfg80211_nan_match_params *match, gfp_t gfp)
13473 {
13474         struct wiphy *wiphy = wdev->wiphy;
13475         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13476         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
13477         struct sk_buff *msg;
13478         void *hdr;
13479
13480         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
13481                 return;
13482
13483         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13484         if (!msg)
13485                 return;
13486
13487         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
13488         if (!hdr) {
13489                 nlmsg_free(msg);
13490                 return;
13491         }
13492
13493         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13494             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13495                                          wdev->netdev->ifindex)) ||
13496             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13497                               NL80211_ATTR_PAD))
13498                 goto nla_put_failure;
13499
13500         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
13501                               NL80211_ATTR_PAD) ||
13502             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
13503                 goto nla_put_failure;
13504
13505         match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
13506         if (!match_attr)
13507                 goto nla_put_failure;
13508
13509         local_func_attr = nla_nest_start_noflag(msg,
13510                                                 NL80211_NAN_MATCH_FUNC_LOCAL);
13511         if (!local_func_attr)
13512                 goto nla_put_failure;
13513
13514         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
13515                 goto nla_put_failure;
13516
13517         nla_nest_end(msg, local_func_attr);
13518
13519         peer_func_attr = nla_nest_start_noflag(msg,
13520                                                NL80211_NAN_MATCH_FUNC_PEER);
13521         if (!peer_func_attr)
13522                 goto nla_put_failure;
13523
13524         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
13525             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
13526                 goto nla_put_failure;
13527
13528         if (match->info && match->info_len &&
13529             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
13530                     match->info))
13531                 goto nla_put_failure;
13532
13533         nla_nest_end(msg, peer_func_attr);
13534         nla_nest_end(msg, match_attr);
13535         genlmsg_end(msg, hdr);
13536
13537         if (!wdev->owner_nlportid)
13538                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
13539                                         msg, 0, NL80211_MCGRP_NAN, gfp);
13540         else
13541                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
13542                                 wdev->owner_nlportid);
13543
13544         return;
13545
13546 nla_put_failure:
13547         nlmsg_free(msg);
13548 }
13549 EXPORT_SYMBOL(cfg80211_nan_match);
13550
13551 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
13552                                   u8 inst_id,
13553                                   enum nl80211_nan_func_term_reason reason,
13554                                   u64 cookie, gfp_t gfp)
13555 {
13556         struct wiphy *wiphy = wdev->wiphy;
13557         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13558         struct sk_buff *msg;
13559         struct nlattr *func_attr;
13560         void *hdr;
13561
13562         if (WARN_ON(!inst_id))
13563                 return;
13564
13565         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13566         if (!msg)
13567                 return;
13568
13569         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
13570         if (!hdr) {
13571                 nlmsg_free(msg);
13572                 return;
13573         }
13574
13575         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13576             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13577                                          wdev->netdev->ifindex)) ||
13578             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13579                               NL80211_ATTR_PAD))
13580                 goto nla_put_failure;
13581
13582         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13583                               NL80211_ATTR_PAD))
13584                 goto nla_put_failure;
13585
13586         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
13587         if (!func_attr)
13588                 goto nla_put_failure;
13589
13590         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
13591             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
13592                 goto nla_put_failure;
13593
13594         nla_nest_end(msg, func_attr);
13595         genlmsg_end(msg, hdr);
13596
13597         if (!wdev->owner_nlportid)
13598                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
13599                                         msg, 0, NL80211_MCGRP_NAN, gfp);
13600         else
13601                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
13602                                 wdev->owner_nlportid);
13603
13604         return;
13605
13606 nla_put_failure:
13607         nlmsg_free(msg);
13608 }
13609 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
13610
13611 static int nl80211_get_protocol_features(struct sk_buff *skb,
13612                                          struct genl_info *info)
13613 {
13614         void *hdr;
13615         struct sk_buff *msg;
13616
13617         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13618         if (!msg)
13619                 return -ENOMEM;
13620
13621         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13622                              NL80211_CMD_GET_PROTOCOL_FEATURES);
13623         if (!hdr)
13624                 goto nla_put_failure;
13625
13626         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
13627                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
13628                 goto nla_put_failure;
13629
13630         genlmsg_end(msg, hdr);
13631         return genlmsg_reply(msg, info);
13632
13633  nla_put_failure:
13634         kfree_skb(msg);
13635         return -ENOBUFS;
13636 }
13637
13638 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
13639 {
13640         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13641         struct cfg80211_update_ft_ies_params ft_params;
13642         struct net_device *dev = info->user_ptr[1];
13643
13644         if (!rdev->ops->update_ft_ies)
13645                 return -EOPNOTSUPP;
13646
13647         if (!info->attrs[NL80211_ATTR_MDID] ||
13648             !info->attrs[NL80211_ATTR_IE])
13649                 return -EINVAL;
13650
13651         memset(&ft_params, 0, sizeof(ft_params));
13652         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
13653         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13654         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13655
13656         return rdev_update_ft_ies(rdev, dev, &ft_params);
13657 }
13658
13659 static int nl80211_crit_protocol_start(struct sk_buff *skb,
13660                                        struct genl_info *info)
13661 {
13662         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13663         struct wireless_dev *wdev = info->user_ptr[1];
13664         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
13665         u16 duration;
13666         int ret;
13667
13668         if (!rdev->ops->crit_proto_start)
13669                 return -EOPNOTSUPP;
13670
13671         if (WARN_ON(!rdev->ops->crit_proto_stop))
13672                 return -EINVAL;
13673
13674         if (rdev->crit_proto_nlportid)
13675                 return -EBUSY;
13676
13677         /* determine protocol if provided */
13678         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
13679                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
13680
13681         if (proto >= NUM_NL80211_CRIT_PROTO)
13682                 return -EINVAL;
13683
13684         /* timeout must be provided */
13685         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
13686                 return -EINVAL;
13687
13688         duration =
13689                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
13690
13691         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
13692         if (!ret)
13693                 rdev->crit_proto_nlportid = info->snd_portid;
13694
13695         return ret;
13696 }
13697
13698 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
13699                                       struct genl_info *info)
13700 {
13701         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13702         struct wireless_dev *wdev = info->user_ptr[1];
13703
13704         if (!rdev->ops->crit_proto_stop)
13705                 return -EOPNOTSUPP;
13706
13707         if (rdev->crit_proto_nlportid) {
13708                 rdev->crit_proto_nlportid = 0;
13709                 rdev_crit_proto_stop(rdev, wdev);
13710         }
13711         return 0;
13712 }
13713
13714 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
13715                                        struct nlattr *attr,
13716                                        struct netlink_ext_ack *extack)
13717 {
13718         if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
13719                 if (attr->nla_type & NLA_F_NESTED) {
13720                         NL_SET_ERR_MSG_ATTR(extack, attr,
13721                                             "unexpected nested data");
13722                         return -EINVAL;
13723                 }
13724
13725                 return 0;
13726         }
13727
13728         if (!(attr->nla_type & NLA_F_NESTED)) {
13729                 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
13730                 return -EINVAL;
13731         }
13732
13733         return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
13734 }
13735
13736 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
13737 {
13738         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13739         struct wireless_dev *wdev =
13740                 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
13741                                            info->attrs);
13742         int i, err;
13743         u32 vid, subcmd;
13744
13745         if (!rdev->wiphy.vendor_commands)
13746                 return -EOPNOTSUPP;
13747
13748         if (IS_ERR(wdev)) {
13749                 err = PTR_ERR(wdev);
13750                 if (err != -EINVAL)
13751                         return err;
13752                 wdev = NULL;
13753         } else if (wdev->wiphy != &rdev->wiphy) {
13754                 return -EINVAL;
13755         }
13756
13757         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
13758             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
13759                 return -EINVAL;
13760
13761         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
13762         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
13763         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
13764                 const struct wiphy_vendor_command *vcmd;
13765                 void *data = NULL;
13766                 int len = 0;
13767
13768                 vcmd = &rdev->wiphy.vendor_commands[i];
13769
13770                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
13771                         continue;
13772
13773                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
13774                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
13775                         if (!wdev)
13776                                 return -EINVAL;
13777                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
13778                             !wdev->netdev)
13779                                 return -EINVAL;
13780
13781                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
13782                                 if (!wdev_running(wdev))
13783                                         return -ENETDOWN;
13784                         }
13785                 } else {
13786                         wdev = NULL;
13787                 }
13788
13789                 if (!vcmd->doit)
13790                         return -EOPNOTSUPP;
13791
13792                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
13793                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
13794                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
13795
13796                         err = nl80211_vendor_check_policy(vcmd,
13797                                         info->attrs[NL80211_ATTR_VENDOR_DATA],
13798                                         info->extack);
13799                         if (err)
13800                                 return err;
13801                 }
13802
13803                 rdev->cur_cmd_info = info;
13804                 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
13805                 rdev->cur_cmd_info = NULL;
13806                 return err;
13807         }
13808
13809         return -EOPNOTSUPP;
13810 }
13811
13812 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
13813                                        struct netlink_callback *cb,
13814                                        struct cfg80211_registered_device **rdev,
13815                                        struct wireless_dev **wdev)
13816 {
13817         struct nlattr **attrbuf;
13818         u32 vid, subcmd;
13819         unsigned int i;
13820         int vcmd_idx = -1;
13821         int err;
13822         void *data = NULL;
13823         unsigned int data_len = 0;
13824
13825         if (cb->args[0]) {
13826                 /* subtract the 1 again here */
13827                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
13828                 struct wireless_dev *tmp;
13829
13830                 if (!wiphy)
13831                         return -ENODEV;
13832                 *rdev = wiphy_to_rdev(wiphy);
13833                 *wdev = NULL;
13834
13835                 if (cb->args[1]) {
13836                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
13837                                 if (tmp->identifier == cb->args[1] - 1) {
13838                                         *wdev = tmp;
13839                                         break;
13840                                 }
13841                         }
13842                 }
13843
13844                 /* keep rtnl locked in successful case */
13845                 return 0;
13846         }
13847
13848         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
13849         if (!attrbuf)
13850                 return -ENOMEM;
13851
13852         err = nlmsg_parse_deprecated(cb->nlh,
13853                                      GENL_HDRLEN + nl80211_fam.hdrsize,
13854                                      attrbuf, nl80211_fam.maxattr,
13855                                      nl80211_policy, NULL);
13856         if (err)
13857                 goto out;
13858
13859         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
13860             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
13861                 err = -EINVAL;
13862                 goto out;
13863         }
13864
13865         *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
13866         if (IS_ERR(*wdev))
13867                 *wdev = NULL;
13868
13869         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
13870         if (IS_ERR(*rdev)) {
13871                 err = PTR_ERR(*rdev);
13872                 goto out;
13873         }
13874
13875         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
13876         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
13877
13878         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
13879                 const struct wiphy_vendor_command *vcmd;
13880
13881                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
13882
13883                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
13884                         continue;
13885
13886                 if (!vcmd->dumpit) {
13887                         err = -EOPNOTSUPP;
13888                         goto out;
13889                 }
13890
13891                 vcmd_idx = i;
13892                 break;
13893         }
13894
13895         if (vcmd_idx < 0) {
13896                 err = -EOPNOTSUPP;
13897                 goto out;
13898         }
13899
13900         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
13901                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
13902                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
13903
13904                 err = nl80211_vendor_check_policy(
13905                                 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
13906                                 attrbuf[NL80211_ATTR_VENDOR_DATA],
13907                                 cb->extack);
13908                 if (err)
13909                         goto out;
13910         }
13911
13912         /* 0 is the first index - add 1 to parse only once */
13913         cb->args[0] = (*rdev)->wiphy_idx + 1;
13914         /* add 1 to know if it was NULL */
13915         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
13916         cb->args[2] = vcmd_idx;
13917         cb->args[3] = (unsigned long)data;
13918         cb->args[4] = data_len;
13919
13920         /* keep rtnl locked in successful case */
13921         err = 0;
13922 out:
13923         kfree(attrbuf);
13924         return err;
13925 }
13926
13927 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
13928                                    struct netlink_callback *cb)
13929 {
13930         struct cfg80211_registered_device *rdev;
13931         struct wireless_dev *wdev;
13932         unsigned int vcmd_idx;
13933         const struct wiphy_vendor_command *vcmd;
13934         void *data;
13935         int data_len;
13936         int err;
13937         struct nlattr *vendor_data;
13938
13939         rtnl_lock();
13940         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
13941         if (err)
13942                 goto out;
13943
13944         vcmd_idx = cb->args[2];
13945         data = (void *)cb->args[3];
13946         data_len = cb->args[4];
13947         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
13948
13949         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
13950                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
13951                 if (!wdev) {
13952                         err = -EINVAL;
13953                         goto out;
13954                 }
13955                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
13956                     !wdev->netdev) {
13957                         err = -EINVAL;
13958                         goto out;
13959                 }
13960
13961                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
13962                         if (!wdev_running(wdev)) {
13963                                 err = -ENETDOWN;
13964                                 goto out;
13965                         }
13966                 }
13967         }
13968
13969         while (1) {
13970                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
13971                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
13972                                            NL80211_CMD_VENDOR);
13973                 if (!hdr)
13974                         break;
13975
13976                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13977                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
13978                                                wdev_id(wdev),
13979                                                NL80211_ATTR_PAD))) {
13980                         genlmsg_cancel(skb, hdr);
13981                         break;
13982                 }
13983
13984                 vendor_data = nla_nest_start_noflag(skb,
13985                                                     NL80211_ATTR_VENDOR_DATA);
13986                 if (!vendor_data) {
13987                         genlmsg_cancel(skb, hdr);
13988                         break;
13989                 }
13990
13991                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
13992                                    (unsigned long *)&cb->args[5]);
13993                 nla_nest_end(skb, vendor_data);
13994
13995                 if (err == -ENOBUFS || err == -ENOENT) {
13996                         genlmsg_cancel(skb, hdr);
13997                         break;
13998                 } else if (err <= 0) {
13999                         genlmsg_cancel(skb, hdr);
14000                         goto out;
14001                 }
14002
14003                 genlmsg_end(skb, hdr);
14004         }
14005
14006         err = skb->len;
14007  out:
14008         rtnl_unlock();
14009         return err;
14010 }
14011
14012 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
14013                                            enum nl80211_commands cmd,
14014                                            enum nl80211_attrs attr,
14015                                            int approxlen)
14016 {
14017         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14018
14019         if (WARN_ON(!rdev->cur_cmd_info))
14020                 return NULL;
14021
14022         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
14023                                            rdev->cur_cmd_info->snd_portid,
14024                                            rdev->cur_cmd_info->snd_seq,
14025                                            cmd, attr, NULL, GFP_KERNEL);
14026 }
14027 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
14028
14029 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
14030 {
14031         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
14032         void *hdr = ((void **)skb->cb)[1];
14033         struct nlattr *data = ((void **)skb->cb)[2];
14034
14035         /* clear CB data for netlink core to own from now on */
14036         memset(skb->cb, 0, sizeof(skb->cb));
14037
14038         if (WARN_ON(!rdev->cur_cmd_info)) {
14039                 kfree_skb(skb);
14040                 return -EINVAL;
14041         }
14042
14043         nla_nest_end(skb, data);
14044         genlmsg_end(skb, hdr);
14045         return genlmsg_reply(skb, rdev->cur_cmd_info);
14046 }
14047 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
14048
14049 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
14050 {
14051         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14052
14053         if (WARN_ON(!rdev->cur_cmd_info))
14054                 return 0;
14055
14056         return rdev->cur_cmd_info->snd_portid;
14057 }
14058 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
14059
14060 static int nl80211_set_qos_map(struct sk_buff *skb,
14061                                struct genl_info *info)
14062 {
14063         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14064         struct cfg80211_qos_map *qos_map = NULL;
14065         struct net_device *dev = info->user_ptr[1];
14066         u8 *pos, len, num_des, des_len, des;
14067         int ret;
14068
14069         if (!rdev->ops->set_qos_map)
14070                 return -EOPNOTSUPP;
14071
14072         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
14073                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
14074                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
14075
14076                 if (len % 2)
14077                         return -EINVAL;
14078
14079                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
14080                 if (!qos_map)
14081                         return -ENOMEM;
14082
14083                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
14084                 if (num_des) {
14085                         des_len = num_des *
14086                                 sizeof(struct cfg80211_dscp_exception);
14087                         memcpy(qos_map->dscp_exception, pos, des_len);
14088                         qos_map->num_des = num_des;
14089                         for (des = 0; des < num_des; des++) {
14090                                 if (qos_map->dscp_exception[des].up > 7) {
14091                                         kfree(qos_map);
14092                                         return -EINVAL;
14093                                 }
14094                         }
14095                         pos += des_len;
14096                 }
14097                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
14098         }
14099
14100         wdev_lock(dev->ieee80211_ptr);
14101         ret = nl80211_key_allowed(dev->ieee80211_ptr);
14102         if (!ret)
14103                 ret = rdev_set_qos_map(rdev, dev, qos_map);
14104         wdev_unlock(dev->ieee80211_ptr);
14105
14106         kfree(qos_map);
14107         return ret;
14108 }
14109
14110 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
14111 {
14112         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14113         struct net_device *dev = info->user_ptr[1];
14114         struct wireless_dev *wdev = dev->ieee80211_ptr;
14115         const u8 *peer;
14116         u8 tsid, up;
14117         u16 admitted_time = 0;
14118         int err;
14119
14120         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
14121                 return -EOPNOTSUPP;
14122
14123         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
14124             !info->attrs[NL80211_ATTR_USER_PRIO])
14125                 return -EINVAL;
14126
14127         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
14128         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
14129
14130         /* WMM uses TIDs 0-7 even for TSPEC */
14131         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
14132                 /* TODO: handle 802.11 TSPEC/admission control
14133                  * need more attributes for that (e.g. BA session requirement);
14134                  * change the WMM adminssion test above to allow both then
14135                  */
14136                 return -EINVAL;
14137         }
14138
14139         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
14140
14141         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
14142                 admitted_time =
14143                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
14144                 if (!admitted_time)
14145                         return -EINVAL;
14146         }
14147
14148         wdev_lock(wdev);
14149         switch (wdev->iftype) {
14150         case NL80211_IFTYPE_STATION:
14151         case NL80211_IFTYPE_P2P_CLIENT:
14152                 if (wdev->current_bss)
14153                         break;
14154                 err = -ENOTCONN;
14155                 goto out;
14156         default:
14157                 err = -EOPNOTSUPP;
14158                 goto out;
14159         }
14160
14161         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
14162
14163  out:
14164         wdev_unlock(wdev);
14165         return err;
14166 }
14167
14168 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
14169 {
14170         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14171         struct net_device *dev = info->user_ptr[1];
14172         struct wireless_dev *wdev = dev->ieee80211_ptr;
14173         const u8 *peer;
14174         u8 tsid;
14175         int err;
14176
14177         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
14178                 return -EINVAL;
14179
14180         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
14181         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
14182
14183         wdev_lock(wdev);
14184         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
14185         wdev_unlock(wdev);
14186
14187         return err;
14188 }
14189
14190 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
14191                                        struct genl_info *info)
14192 {
14193         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14194         struct net_device *dev = info->user_ptr[1];
14195         struct wireless_dev *wdev = dev->ieee80211_ptr;
14196         struct cfg80211_chan_def chandef = {};
14197         const u8 *addr;
14198         u8 oper_class;
14199         int err;
14200
14201         if (!rdev->ops->tdls_channel_switch ||
14202             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
14203                 return -EOPNOTSUPP;
14204
14205         switch (dev->ieee80211_ptr->iftype) {
14206         case NL80211_IFTYPE_STATION:
14207         case NL80211_IFTYPE_P2P_CLIENT:
14208                 break;
14209         default:
14210                 return -EOPNOTSUPP;
14211         }
14212
14213         if (!info->attrs[NL80211_ATTR_MAC] ||
14214             !info->attrs[NL80211_ATTR_OPER_CLASS])
14215                 return -EINVAL;
14216
14217         err = nl80211_parse_chandef(rdev, info, &chandef);
14218         if (err)
14219                 return err;
14220
14221         /*
14222          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
14223          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
14224          * specification is not defined for them.
14225          */
14226         if (chandef.chan->band == NL80211_BAND_2GHZ &&
14227             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
14228             chandef.width != NL80211_CHAN_WIDTH_20)
14229                 return -EINVAL;
14230
14231         /* we will be active on the TDLS link */
14232         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
14233                                            wdev->iftype))
14234                 return -EINVAL;
14235
14236         /* don't allow switching to DFS channels */
14237         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
14238                 return -EINVAL;
14239
14240         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14241         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
14242
14243         wdev_lock(wdev);
14244         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
14245         wdev_unlock(wdev);
14246
14247         return err;
14248 }
14249
14250 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
14251                                               struct genl_info *info)
14252 {
14253         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14254         struct net_device *dev = info->user_ptr[1];
14255         struct wireless_dev *wdev = dev->ieee80211_ptr;
14256         const u8 *addr;
14257
14258         if (!rdev->ops->tdls_channel_switch ||
14259             !rdev->ops->tdls_cancel_channel_switch ||
14260             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
14261                 return -EOPNOTSUPP;
14262
14263         switch (dev->ieee80211_ptr->iftype) {
14264         case NL80211_IFTYPE_STATION:
14265         case NL80211_IFTYPE_P2P_CLIENT:
14266                 break;
14267         default:
14268                 return -EOPNOTSUPP;
14269         }
14270
14271         if (!info->attrs[NL80211_ATTR_MAC])
14272                 return -EINVAL;
14273
14274         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14275
14276         wdev_lock(wdev);
14277         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
14278         wdev_unlock(wdev);
14279
14280         return 0;
14281 }
14282
14283 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
14284                                             struct genl_info *info)
14285 {
14286         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14287         struct net_device *dev = info->user_ptr[1];
14288         struct wireless_dev *wdev = dev->ieee80211_ptr;
14289         const struct nlattr *nla;
14290         bool enabled;
14291
14292         if (!rdev->ops->set_multicast_to_unicast)
14293                 return -EOPNOTSUPP;
14294
14295         if (wdev->iftype != NL80211_IFTYPE_AP &&
14296             wdev->iftype != NL80211_IFTYPE_P2P_GO)
14297                 return -EOPNOTSUPP;
14298
14299         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
14300         enabled = nla_get_flag(nla);
14301
14302         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
14303 }
14304
14305 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
14306 {
14307         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14308         struct net_device *dev = info->user_ptr[1];
14309         struct wireless_dev *wdev = dev->ieee80211_ptr;
14310         struct cfg80211_pmk_conf pmk_conf = {};
14311         int ret;
14312
14313         if (wdev->iftype != NL80211_IFTYPE_STATION &&
14314             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14315                 return -EOPNOTSUPP;
14316
14317         if (!wiphy_ext_feature_isset(&rdev->wiphy,
14318                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
14319                 return -EOPNOTSUPP;
14320
14321         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
14322                 return -EINVAL;
14323
14324         wdev_lock(wdev);
14325         if (!wdev->current_bss) {
14326                 ret = -ENOTCONN;
14327                 goto out;
14328         }
14329
14330         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
14331         if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
14332                 ret = -EINVAL;
14333                 goto out;
14334         }
14335
14336         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
14337         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
14338         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
14339             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
14340                 ret = -EINVAL;
14341                 goto out;
14342         }
14343
14344         if (info->attrs[NL80211_ATTR_PMKR0_NAME])
14345                 pmk_conf.pmk_r0_name =
14346                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
14347
14348         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
14349 out:
14350         wdev_unlock(wdev);
14351         return ret;
14352 }
14353
14354 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
14355 {
14356         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14357         struct net_device *dev = info->user_ptr[1];
14358         struct wireless_dev *wdev = dev->ieee80211_ptr;
14359         const u8 *aa;
14360         int ret;
14361
14362         if (wdev->iftype != NL80211_IFTYPE_STATION &&
14363             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14364                 return -EOPNOTSUPP;
14365
14366         if (!wiphy_ext_feature_isset(&rdev->wiphy,
14367                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
14368                 return -EOPNOTSUPP;
14369
14370         if (!info->attrs[NL80211_ATTR_MAC])
14371                 return -EINVAL;
14372
14373         wdev_lock(wdev);
14374         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
14375         ret = rdev_del_pmk(rdev, dev, aa);
14376         wdev_unlock(wdev);
14377
14378         return ret;
14379 }
14380
14381 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
14382 {
14383         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14384         struct net_device *dev = info->user_ptr[1];
14385         struct cfg80211_external_auth_params params;
14386
14387         if (!rdev->ops->external_auth)
14388                 return -EOPNOTSUPP;
14389
14390         if (!info->attrs[NL80211_ATTR_SSID] &&
14391             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
14392             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
14393                 return -EINVAL;
14394
14395         if (!info->attrs[NL80211_ATTR_BSSID])
14396                 return -EINVAL;
14397
14398         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
14399                 return -EINVAL;
14400
14401         memset(&params, 0, sizeof(params));
14402
14403         if (info->attrs[NL80211_ATTR_SSID]) {
14404                 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
14405                 if (params.ssid.ssid_len == 0)
14406                         return -EINVAL;
14407                 memcpy(params.ssid.ssid,
14408                        nla_data(info->attrs[NL80211_ATTR_SSID]),
14409                        params.ssid.ssid_len);
14410         }
14411
14412         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
14413                ETH_ALEN);
14414
14415         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
14416
14417         if (info->attrs[NL80211_ATTR_PMKID])
14418                 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
14419
14420         return rdev_external_auth(rdev, dev, &params);
14421 }
14422
14423 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
14424 {
14425         bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
14426         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14427         struct net_device *dev = info->user_ptr[1];
14428         struct wireless_dev *wdev = dev->ieee80211_ptr;
14429         const u8 *buf;
14430         size_t len;
14431         u8 *dest;
14432         u16 proto;
14433         bool noencrypt;
14434         u64 cookie = 0;
14435         int err;
14436
14437         if (!wiphy_ext_feature_isset(&rdev->wiphy,
14438                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
14439                 return -EOPNOTSUPP;
14440
14441         if (!rdev->ops->tx_control_port)
14442                 return -EOPNOTSUPP;
14443
14444         if (!info->attrs[NL80211_ATTR_FRAME] ||
14445             !info->attrs[NL80211_ATTR_MAC] ||
14446             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
14447                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
14448                 return -EINVAL;
14449         }
14450
14451         wdev_lock(wdev);
14452
14453         switch (wdev->iftype) {
14454         case NL80211_IFTYPE_AP:
14455         case NL80211_IFTYPE_P2P_GO:
14456         case NL80211_IFTYPE_MESH_POINT:
14457                 break;
14458         case NL80211_IFTYPE_ADHOC:
14459         case NL80211_IFTYPE_STATION:
14460         case NL80211_IFTYPE_P2P_CLIENT:
14461                 if (wdev->current_bss)
14462                         break;
14463                 err = -ENOTCONN;
14464                 goto out;
14465         default:
14466                 err = -EOPNOTSUPP;
14467                 goto out;
14468         }
14469
14470         wdev_unlock(wdev);
14471
14472         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
14473         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
14474         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
14475         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
14476         noencrypt =
14477                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
14478
14479         err = rdev_tx_control_port(rdev, dev, buf, len,
14480                                    dest, cpu_to_be16(proto), noencrypt,
14481                                    dont_wait_for_ack ? NULL : &cookie);
14482         if (!err && !dont_wait_for_ack)
14483                 nl_set_extack_cookie_u64(info->extack, cookie);
14484         return err;
14485  out:
14486         wdev_unlock(wdev);
14487         return err;
14488 }
14489
14490 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
14491                                            struct genl_info *info)
14492 {
14493         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14494         struct net_device *dev = info->user_ptr[1];
14495         struct wireless_dev *wdev = dev->ieee80211_ptr;
14496         struct cfg80211_ftm_responder_stats ftm_stats = {};
14497         struct sk_buff *msg;
14498         void *hdr;
14499         struct nlattr *ftm_stats_attr;
14500         int err;
14501
14502         if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval)
14503                 return -EOPNOTSUPP;
14504
14505         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
14506         if (err)
14507                 return err;
14508
14509         if (!ftm_stats.filled)
14510                 return -ENODATA;
14511
14512         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14513         if (!msg)
14514                 return -ENOMEM;
14515
14516         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14517                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
14518         if (!hdr)
14519                 goto nla_put_failure;
14520
14521         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
14522                 goto nla_put_failure;
14523
14524         ftm_stats_attr = nla_nest_start_noflag(msg,
14525                                                NL80211_ATTR_FTM_RESPONDER_STATS);
14526         if (!ftm_stats_attr)
14527                 goto nla_put_failure;
14528
14529 #define SET_FTM(field, name, type)                                       \
14530         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
14531             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
14532                              ftm_stats.field))                           \
14533                 goto nla_put_failure; } while (0)
14534 #define SET_FTM_U64(field, name)                                         \
14535         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
14536             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
14537                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
14538                 goto nla_put_failure; } while (0)
14539
14540         SET_FTM(success_num, SUCCESS_NUM, u32);
14541         SET_FTM(partial_num, PARTIAL_NUM, u32);
14542         SET_FTM(failed_num, FAILED_NUM, u32);
14543         SET_FTM(asap_num, ASAP_NUM, u32);
14544         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
14545         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
14546         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
14547         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
14548         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
14549 #undef SET_FTM
14550
14551         nla_nest_end(msg, ftm_stats_attr);
14552
14553         genlmsg_end(msg, hdr);
14554         return genlmsg_reply(msg, info);
14555
14556 nla_put_failure:
14557         nlmsg_free(msg);
14558         return -ENOBUFS;
14559 }
14560
14561 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
14562 {
14563         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14564         struct cfg80211_update_owe_info owe_info;
14565         struct net_device *dev = info->user_ptr[1];
14566
14567         if (!rdev->ops->update_owe_info)
14568                 return -EOPNOTSUPP;
14569
14570         if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
14571             !info->attrs[NL80211_ATTR_MAC])
14572                 return -EINVAL;
14573
14574         memset(&owe_info, 0, sizeof(owe_info));
14575         owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
14576         nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
14577
14578         if (info->attrs[NL80211_ATTR_IE]) {
14579                 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
14580                 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
14581         }
14582
14583         return rdev_update_owe_info(rdev, dev, &owe_info);
14584 }
14585
14586 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
14587 {
14588         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14589         struct net_device *dev = info->user_ptr[1];
14590         struct wireless_dev *wdev = dev->ieee80211_ptr;
14591         struct station_info sinfo = {};
14592         const u8 *buf;
14593         size_t len;
14594         u8 *dest;
14595         int err;
14596
14597         if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
14598                 return -EOPNOTSUPP;
14599
14600         if (!info->attrs[NL80211_ATTR_MAC] ||
14601             !info->attrs[NL80211_ATTR_FRAME]) {
14602                 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
14603                 return -EINVAL;
14604         }
14605
14606         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
14607                 return -EOPNOTSUPP;
14608
14609         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
14610         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
14611         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
14612
14613         if (len < sizeof(struct ethhdr))
14614                 return -EINVAL;
14615
14616         if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
14617             !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
14618                 return -EINVAL;
14619
14620         err = rdev_get_station(rdev, dev, dest, &sinfo);
14621         if (err)
14622                 return err;
14623
14624         cfg80211_sinfo_release_content(&sinfo);
14625
14626         return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
14627 }
14628
14629 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
14630                           struct nlattr *attrs[], struct net_device *dev,
14631                           struct cfg80211_tid_cfg *tid_conf,
14632                           struct genl_info *info, const u8 *peer)
14633 {
14634         struct netlink_ext_ack *extack = info->extack;
14635         u64 mask;
14636         int err;
14637
14638         if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
14639                 return -EINVAL;
14640
14641         tid_conf->config_override =
14642                         nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
14643         tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
14644
14645         if (tid_conf->config_override) {
14646                 if (rdev->ops->reset_tid_config) {
14647                         err = rdev_reset_tid_config(rdev, dev, peer,
14648                                                     tid_conf->tids);
14649                         if (err)
14650                                 return err;
14651                 } else {
14652                         return -EINVAL;
14653                 }
14654         }
14655
14656         if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
14657                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
14658                 tid_conf->noack =
14659                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
14660         }
14661
14662         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
14663                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
14664                 tid_conf->retry_short =
14665                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
14666
14667                 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
14668                         return -EINVAL;
14669         }
14670
14671         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
14672                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
14673                 tid_conf->retry_long =
14674                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
14675
14676                 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
14677                         return -EINVAL;
14678         }
14679
14680         if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
14681                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
14682                 tid_conf->ampdu =
14683                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
14684         }
14685
14686         if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
14687                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
14688                 tid_conf->rtscts =
14689                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
14690         }
14691
14692         if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
14693                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
14694                 tid_conf->amsdu =
14695                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
14696         }
14697
14698         if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
14699                 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
14700
14701                 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
14702
14703                 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
14704                         attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
14705                         err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
14706                                                     &tid_conf->txrate_mask, dev,
14707                                                     true);
14708                         if (err)
14709                                 return err;
14710
14711                         tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
14712                 }
14713                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
14714         }
14715
14716         if (peer)
14717                 mask = rdev->wiphy.tid_config_support.peer;
14718         else
14719                 mask = rdev->wiphy.tid_config_support.vif;
14720
14721         if (tid_conf->mask & ~mask) {
14722                 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
14723                 return -ENOTSUPP;
14724         }
14725
14726         return 0;
14727 }
14728
14729 static int nl80211_set_tid_config(struct sk_buff *skb,
14730                                   struct genl_info *info)
14731 {
14732         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14733         struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
14734         struct net_device *dev = info->user_ptr[1];
14735         struct cfg80211_tid_config *tid_config;
14736         struct nlattr *tid;
14737         int conf_idx = 0, rem_conf;
14738         int ret = -EINVAL;
14739         u32 num_conf = 0;
14740
14741         if (!info->attrs[NL80211_ATTR_TID_CONFIG])
14742                 return -EINVAL;
14743
14744         if (!rdev->ops->set_tid_config)
14745                 return -EOPNOTSUPP;
14746
14747         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
14748                             rem_conf)
14749                 num_conf++;
14750
14751         tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
14752                              GFP_KERNEL);
14753         if (!tid_config)
14754                 return -ENOMEM;
14755
14756         tid_config->n_tid_conf = num_conf;
14757
14758         if (info->attrs[NL80211_ATTR_MAC])
14759                 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
14760
14761         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
14762                             rem_conf) {
14763                 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
14764                                        tid, NULL, NULL);
14765
14766                 if (ret)
14767                         goto bad_tid_conf;
14768
14769                 ret = parse_tid_conf(rdev, attrs, dev,
14770                                      &tid_config->tid_conf[conf_idx],
14771                                      info, tid_config->peer);
14772                 if (ret)
14773                         goto bad_tid_conf;
14774
14775                 conf_idx++;
14776         }
14777
14778         ret = rdev_set_tid_config(rdev, dev, tid_config);
14779
14780 bad_tid_conf:
14781         kfree(tid_config);
14782         return ret;
14783 }
14784
14785 #define NL80211_FLAG_NEED_WIPHY         0x01
14786 #define NL80211_FLAG_NEED_NETDEV        0x02
14787 #define NL80211_FLAG_NEED_RTNL          0x04
14788 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
14789 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
14790                                          NL80211_FLAG_CHECK_NETDEV_UP)
14791 #define NL80211_FLAG_NEED_WDEV          0x10
14792 /* If a netdev is associated, it must be UP, P2P must be started */
14793 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
14794                                          NL80211_FLAG_CHECK_NETDEV_UP)
14795 #define NL80211_FLAG_CLEAR_SKB          0x20
14796 #define NL80211_FLAG_NO_WIPHY_MTX       0x40
14797
14798 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
14799                             struct genl_info *info)
14800 {
14801         struct cfg80211_registered_device *rdev = NULL;
14802         struct wireless_dev *wdev;
14803         struct net_device *dev;
14804
14805         rtnl_lock();
14806         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
14807                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
14808                 if (IS_ERR(rdev)) {
14809                         rtnl_unlock();
14810                         return PTR_ERR(rdev);
14811                 }
14812                 info->user_ptr[0] = rdev;
14813         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
14814                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
14815                 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
14816                                                   info->attrs);
14817                 if (IS_ERR(wdev)) {
14818                         rtnl_unlock();
14819                         return PTR_ERR(wdev);
14820                 }
14821
14822                 dev = wdev->netdev;
14823                 rdev = wiphy_to_rdev(wdev->wiphy);
14824
14825                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
14826                         if (!dev) {
14827                                 rtnl_unlock();
14828                                 return -EINVAL;
14829                         }
14830
14831                         info->user_ptr[1] = dev;
14832                 } else {
14833                         info->user_ptr[1] = wdev;
14834                 }
14835
14836                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
14837                     !wdev_running(wdev)) {
14838                         rtnl_unlock();
14839                         return -ENETDOWN;
14840                 }
14841
14842                 if (dev)
14843                         dev_hold(dev);
14844
14845                 info->user_ptr[0] = rdev;
14846         }
14847
14848         if (rdev && !(ops->internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
14849                 wiphy_lock(&rdev->wiphy);
14850                 /* we keep the mutex locked until post_doit */
14851                 __release(&rdev->wiphy.mtx);
14852         }
14853         if (!(ops->internal_flags & NL80211_FLAG_NEED_RTNL))
14854                 rtnl_unlock();
14855
14856         return 0;
14857 }
14858
14859 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
14860                               struct genl_info *info)
14861 {
14862         if (info->user_ptr[1]) {
14863                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
14864                         struct wireless_dev *wdev = info->user_ptr[1];
14865
14866                         if (wdev->netdev)
14867                                 dev_put(wdev->netdev);
14868                 } else {
14869                         dev_put(info->user_ptr[1]);
14870                 }
14871         }
14872
14873         if (info->user_ptr[0] &&
14874             !(ops->internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
14875                 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14876
14877                 /* we kept the mutex locked since pre_doit */
14878                 __acquire(&rdev->wiphy.mtx);
14879                 wiphy_unlock(&rdev->wiphy);
14880         }
14881
14882         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
14883                 rtnl_unlock();
14884
14885         /* If needed, clear the netlink message payload from the SKB
14886          * as it might contain key data that shouldn't stick around on
14887          * the heap after the SKB is freed. The netlink message header
14888          * is still needed for further processing, so leave it intact.
14889          */
14890         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
14891                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
14892
14893                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
14894         }
14895 }
14896
14897 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
14898                                      struct cfg80211_sar_specs *sar_specs,
14899                                      struct nlattr *spec[], int index)
14900 {
14901         u32 range_index, i;
14902
14903         if (!sar_specs || !spec)
14904                 return -EINVAL;
14905
14906         if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
14907             !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
14908                 return -EINVAL;
14909
14910         range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
14911
14912         /* check if range_index exceeds num_freq_ranges */
14913         if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
14914                 return -EINVAL;
14915
14916         /* check if range_index duplicates */
14917         for (i = 0; i < index; i++) {
14918                 if (sar_specs->sub_specs[i].freq_range_index == range_index)
14919                         return -EINVAL;
14920         }
14921
14922         sar_specs->sub_specs[index].power =
14923                 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
14924
14925         sar_specs->sub_specs[index].freq_range_index = range_index;
14926
14927         return 0;
14928 }
14929
14930 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
14931 {
14932         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14933         struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
14934         struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
14935         struct cfg80211_sar_specs *sar_spec;
14936         enum nl80211_sar_type type;
14937         struct nlattr *spec_list;
14938         u32 specs;
14939         int rem, err;
14940
14941         if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
14942                 return -EOPNOTSUPP;
14943
14944         if (!info->attrs[NL80211_ATTR_SAR_SPEC])
14945                 return -EINVAL;
14946
14947         nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
14948                          info->attrs[NL80211_ATTR_SAR_SPEC],
14949                          NULL, NULL);
14950
14951         if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
14952                 return -EINVAL;
14953
14954         type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
14955         if (type != rdev->wiphy.sar_capa->type)
14956                 return -EINVAL;
14957
14958         specs = 0;
14959         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
14960                 specs++;
14961
14962         if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
14963                 return -EINVAL;
14964
14965         sar_spec = kzalloc(sizeof(*sar_spec) +
14966                            specs * sizeof(struct cfg80211_sar_sub_specs),
14967                            GFP_KERNEL);
14968         if (!sar_spec)
14969                 return -ENOMEM;
14970
14971         sar_spec->type = type;
14972         specs = 0;
14973         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
14974                 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
14975                                  spec_list, NULL, NULL);
14976
14977                 switch (type) {
14978                 case NL80211_SAR_TYPE_POWER:
14979                         if (nl80211_set_sar_sub_specs(rdev, sar_spec,
14980                                                       spec, specs)) {
14981                                 err = -EINVAL;
14982                                 goto error;
14983                         }
14984                         break;
14985                 default:
14986                         err = -EINVAL;
14987                         goto error;
14988                 }
14989                 specs++;
14990         }
14991
14992         sar_spec->num_sub_specs = specs;
14993
14994         rdev->cur_cmd_info = info;
14995         err = rdev_set_sar_specs(rdev, sar_spec);
14996         rdev->cur_cmd_info = NULL;
14997 error:
14998         kfree(sar_spec);
14999         return err;
15000 }
15001
15002 static const struct genl_ops nl80211_ops[] = {
15003         {
15004                 .cmd = NL80211_CMD_GET_WIPHY,
15005                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15006                 .doit = nl80211_get_wiphy,
15007                 .dumpit = nl80211_dump_wiphy,
15008                 .done = nl80211_dump_wiphy_done,
15009                 /* can be retrieved by unprivileged users */
15010                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15011         },
15012 };
15013
15014 static const struct genl_small_ops nl80211_small_ops[] = {
15015         {
15016                 .cmd = NL80211_CMD_SET_WIPHY,
15017                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15018                 .doit = nl80211_set_wiphy,
15019                 .flags = GENL_UNS_ADMIN_PERM,
15020         },
15021         {
15022                 .cmd = NL80211_CMD_GET_INTERFACE,
15023                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15024                 .doit = nl80211_get_interface,
15025                 .dumpit = nl80211_dump_interface,
15026                 /* can be retrieved by unprivileged users */
15027                 .internal_flags = NL80211_FLAG_NEED_WDEV,
15028         },
15029         {
15030                 .cmd = NL80211_CMD_SET_INTERFACE,
15031                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15032                 .doit = nl80211_set_interface,
15033                 .flags = GENL_UNS_ADMIN_PERM,
15034                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15035                                   NL80211_FLAG_NEED_RTNL,
15036         },
15037         {
15038                 .cmd = NL80211_CMD_NEW_INTERFACE,
15039                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15040                 .doit = nl80211_new_interface,
15041                 .flags = GENL_UNS_ADMIN_PERM,
15042                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15043                                   NL80211_FLAG_NEED_RTNL,
15044         },
15045         {
15046                 .cmd = NL80211_CMD_DEL_INTERFACE,
15047                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15048                 .doit = nl80211_del_interface,
15049                 .flags = GENL_UNS_ADMIN_PERM,
15050                 .internal_flags = NL80211_FLAG_NEED_WDEV |
15051                                   NL80211_FLAG_NEED_RTNL,
15052         },
15053         {
15054                 .cmd = NL80211_CMD_GET_KEY,
15055                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15056                 .doit = nl80211_get_key,
15057                 .flags = GENL_UNS_ADMIN_PERM,
15058                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15059         },
15060         {
15061                 .cmd = NL80211_CMD_SET_KEY,
15062                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15063                 .doit = nl80211_set_key,
15064                 .flags = GENL_UNS_ADMIN_PERM,
15065                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15066                                   NL80211_FLAG_CLEAR_SKB,
15067         },
15068         {
15069                 .cmd = NL80211_CMD_NEW_KEY,
15070                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15071                 .doit = nl80211_new_key,
15072                 .flags = GENL_UNS_ADMIN_PERM,
15073                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15074                                   NL80211_FLAG_CLEAR_SKB,
15075         },
15076         {
15077                 .cmd = NL80211_CMD_DEL_KEY,
15078                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15079                 .doit = nl80211_del_key,
15080                 .flags = GENL_UNS_ADMIN_PERM,
15081                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15082         },
15083         {
15084                 .cmd = NL80211_CMD_SET_BEACON,
15085                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15086                 .flags = GENL_UNS_ADMIN_PERM,
15087                 .doit = nl80211_set_beacon,
15088                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15089         },
15090         {
15091                 .cmd = NL80211_CMD_START_AP,
15092                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15093                 .flags = GENL_UNS_ADMIN_PERM,
15094                 .doit = nl80211_start_ap,
15095                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15096         },
15097         {
15098                 .cmd = NL80211_CMD_STOP_AP,
15099                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15100                 .flags = GENL_UNS_ADMIN_PERM,
15101                 .doit = nl80211_stop_ap,
15102                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15103         },
15104         {
15105                 .cmd = NL80211_CMD_GET_STATION,
15106                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15107                 .doit = nl80211_get_station,
15108                 .dumpit = nl80211_dump_station,
15109                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15110         },
15111         {
15112                 .cmd = NL80211_CMD_SET_STATION,
15113                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15114                 .doit = nl80211_set_station,
15115                 .flags = GENL_UNS_ADMIN_PERM,
15116                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15117         },
15118         {
15119                 .cmd = NL80211_CMD_NEW_STATION,
15120                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15121                 .doit = nl80211_new_station,
15122                 .flags = GENL_UNS_ADMIN_PERM,
15123                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15124         },
15125         {
15126                 .cmd = NL80211_CMD_DEL_STATION,
15127                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15128                 .doit = nl80211_del_station,
15129                 .flags = GENL_UNS_ADMIN_PERM,
15130                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15131         },
15132         {
15133                 .cmd = NL80211_CMD_GET_MPATH,
15134                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15135                 .doit = nl80211_get_mpath,
15136                 .dumpit = nl80211_dump_mpath,
15137                 .flags = GENL_UNS_ADMIN_PERM,
15138                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15139         },
15140         {
15141                 .cmd = NL80211_CMD_GET_MPP,
15142                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15143                 .doit = nl80211_get_mpp,
15144                 .dumpit = nl80211_dump_mpp,
15145                 .flags = GENL_UNS_ADMIN_PERM,
15146                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15147         },
15148         {
15149                 .cmd = NL80211_CMD_SET_MPATH,
15150                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15151                 .doit = nl80211_set_mpath,
15152                 .flags = GENL_UNS_ADMIN_PERM,
15153                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15154         },
15155         {
15156                 .cmd = NL80211_CMD_NEW_MPATH,
15157                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15158                 .doit = nl80211_new_mpath,
15159                 .flags = GENL_UNS_ADMIN_PERM,
15160                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15161         },
15162         {
15163                 .cmd = NL80211_CMD_DEL_MPATH,
15164                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15165                 .doit = nl80211_del_mpath,
15166                 .flags = GENL_UNS_ADMIN_PERM,
15167                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15168         },
15169         {
15170                 .cmd = NL80211_CMD_SET_BSS,
15171                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15172                 .doit = nl80211_set_bss,
15173                 .flags = GENL_UNS_ADMIN_PERM,
15174                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15175         },
15176         {
15177                 .cmd = NL80211_CMD_GET_REG,
15178                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15179                 .doit = nl80211_get_reg_do,
15180                 .dumpit = nl80211_get_reg_dump,
15181                 .internal_flags = 0,
15182                 /* can be retrieved by unprivileged users */
15183         },
15184 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
15185         {
15186                 .cmd = NL80211_CMD_SET_REG,
15187                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15188                 .doit = nl80211_set_reg,
15189                 .flags = GENL_ADMIN_PERM,
15190                 .internal_flags = 0,
15191         },
15192 #endif
15193         {
15194                 .cmd = NL80211_CMD_REQ_SET_REG,
15195                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15196                 .doit = nl80211_req_set_reg,
15197                 .flags = GENL_ADMIN_PERM,
15198         },
15199         {
15200                 .cmd = NL80211_CMD_RELOAD_REGDB,
15201                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15202                 .doit = nl80211_reload_regdb,
15203                 .flags = GENL_ADMIN_PERM,
15204         },
15205         {
15206                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
15207                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15208                 .doit = nl80211_get_mesh_config,
15209                 /* can be retrieved by unprivileged users */
15210                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15211         },
15212         {
15213                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
15214                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15215                 .doit = nl80211_update_mesh_config,
15216                 .flags = GENL_UNS_ADMIN_PERM,
15217                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15218         },
15219         {
15220                 .cmd = NL80211_CMD_TRIGGER_SCAN,
15221                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15222                 .doit = nl80211_trigger_scan,
15223                 .flags = GENL_UNS_ADMIN_PERM,
15224                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15225         },
15226         {
15227                 .cmd = NL80211_CMD_ABORT_SCAN,
15228                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15229                 .doit = nl80211_abort_scan,
15230                 .flags = GENL_UNS_ADMIN_PERM,
15231                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15232         },
15233         {
15234                 .cmd = NL80211_CMD_GET_SCAN,
15235                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15236                 .dumpit = nl80211_dump_scan,
15237         },
15238         {
15239                 .cmd = NL80211_CMD_START_SCHED_SCAN,
15240                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15241                 .doit = nl80211_start_sched_scan,
15242                 .flags = GENL_UNS_ADMIN_PERM,
15243                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15244         },
15245         {
15246                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
15247                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15248                 .doit = nl80211_stop_sched_scan,
15249                 .flags = GENL_UNS_ADMIN_PERM,
15250                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15251         },
15252         {
15253                 .cmd = NL80211_CMD_AUTHENTICATE,
15254                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15255                 .doit = nl80211_authenticate,
15256                 .flags = GENL_UNS_ADMIN_PERM,
15257                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15258                                   0 |
15259                                   NL80211_FLAG_CLEAR_SKB,
15260         },
15261         {
15262                 .cmd = NL80211_CMD_ASSOCIATE,
15263                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15264                 .doit = nl80211_associate,
15265                 .flags = GENL_UNS_ADMIN_PERM,
15266                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15267                                   0 |
15268                                   NL80211_FLAG_CLEAR_SKB,
15269         },
15270         {
15271                 .cmd = NL80211_CMD_DEAUTHENTICATE,
15272                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15273                 .doit = nl80211_deauthenticate,
15274                 .flags = GENL_UNS_ADMIN_PERM,
15275                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15276         },
15277         {
15278                 .cmd = NL80211_CMD_DISASSOCIATE,
15279                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15280                 .doit = nl80211_disassociate,
15281                 .flags = GENL_UNS_ADMIN_PERM,
15282                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15283         },
15284         {
15285                 .cmd = NL80211_CMD_JOIN_IBSS,
15286                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15287                 .doit = nl80211_join_ibss,
15288                 .flags = GENL_UNS_ADMIN_PERM,
15289                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15290         },
15291         {
15292                 .cmd = NL80211_CMD_LEAVE_IBSS,
15293                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15294                 .doit = nl80211_leave_ibss,
15295                 .flags = GENL_UNS_ADMIN_PERM,
15296                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15297         },
15298 #ifdef CONFIG_NL80211_TESTMODE
15299         {
15300                 .cmd = NL80211_CMD_TESTMODE,
15301                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15302                 .doit = nl80211_testmode_do,
15303                 .dumpit = nl80211_testmode_dump,
15304                 .flags = GENL_UNS_ADMIN_PERM,
15305                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15306         },
15307 #endif
15308         {
15309                 .cmd = NL80211_CMD_CONNECT,
15310                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15311                 .doit = nl80211_connect,
15312                 .flags = GENL_UNS_ADMIN_PERM,
15313                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15314                                   0 |
15315                                   NL80211_FLAG_CLEAR_SKB,
15316         },
15317         {
15318                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
15319                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15320                 .doit = nl80211_update_connect_params,
15321                 .flags = GENL_ADMIN_PERM,
15322                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15323                                   0 |
15324                                   NL80211_FLAG_CLEAR_SKB,
15325         },
15326         {
15327                 .cmd = NL80211_CMD_DISCONNECT,
15328                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15329                 .doit = nl80211_disconnect,
15330                 .flags = GENL_UNS_ADMIN_PERM,
15331                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15332         },
15333         {
15334                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
15335                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15336                 .doit = nl80211_wiphy_netns,
15337                 .flags = GENL_UNS_ADMIN_PERM,
15338                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15339                                   NL80211_FLAG_NEED_RTNL |
15340                                   NL80211_FLAG_NO_WIPHY_MTX,
15341         },
15342         {
15343                 .cmd = NL80211_CMD_GET_SURVEY,
15344                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15345                 .dumpit = nl80211_dump_survey,
15346         },
15347         {
15348                 .cmd = NL80211_CMD_SET_PMKSA,
15349                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15350                 .doit = nl80211_setdel_pmksa,
15351                 .flags = GENL_UNS_ADMIN_PERM,
15352                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15353                                   0 |
15354                                   NL80211_FLAG_CLEAR_SKB,
15355         },
15356         {
15357                 .cmd = NL80211_CMD_DEL_PMKSA,
15358                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15359                 .doit = nl80211_setdel_pmksa,
15360                 .flags = GENL_UNS_ADMIN_PERM,
15361                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15362         },
15363         {
15364                 .cmd = NL80211_CMD_FLUSH_PMKSA,
15365                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15366                 .doit = nl80211_flush_pmksa,
15367                 .flags = GENL_UNS_ADMIN_PERM,
15368                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15369         },
15370         {
15371                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
15372                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15373                 .doit = nl80211_remain_on_channel,
15374                 .flags = GENL_UNS_ADMIN_PERM,
15375                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15376         },
15377         {
15378                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
15379                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15380                 .doit = nl80211_cancel_remain_on_channel,
15381                 .flags = GENL_UNS_ADMIN_PERM,
15382                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15383         },
15384         {
15385                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
15386                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15387                 .doit = nl80211_set_tx_bitrate_mask,
15388                 .flags = GENL_UNS_ADMIN_PERM,
15389                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15390         },
15391         {
15392                 .cmd = NL80211_CMD_REGISTER_FRAME,
15393                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15394                 .doit = nl80211_register_mgmt,
15395                 .flags = GENL_UNS_ADMIN_PERM,
15396                 .internal_flags = NL80211_FLAG_NEED_WDEV,
15397         },
15398         {
15399                 .cmd = NL80211_CMD_FRAME,
15400                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15401                 .doit = nl80211_tx_mgmt,
15402                 .flags = GENL_UNS_ADMIN_PERM,
15403                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15404         },
15405         {
15406                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
15407                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15408                 .doit = nl80211_tx_mgmt_cancel_wait,
15409                 .flags = GENL_UNS_ADMIN_PERM,
15410                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15411         },
15412         {
15413                 .cmd = NL80211_CMD_SET_POWER_SAVE,
15414                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15415                 .doit = nl80211_set_power_save,
15416                 .flags = GENL_UNS_ADMIN_PERM,
15417                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15418         },
15419         {
15420                 .cmd = NL80211_CMD_GET_POWER_SAVE,
15421                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15422                 .doit = nl80211_get_power_save,
15423                 /* can be retrieved by unprivileged users */
15424                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15425         },
15426         {
15427                 .cmd = NL80211_CMD_SET_CQM,
15428                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15429                 .doit = nl80211_set_cqm,
15430                 .flags = GENL_UNS_ADMIN_PERM,
15431                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15432         },
15433         {
15434                 .cmd = NL80211_CMD_SET_CHANNEL,
15435                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15436                 .doit = nl80211_set_channel,
15437                 .flags = GENL_UNS_ADMIN_PERM,
15438                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15439         },
15440         {
15441                 .cmd = NL80211_CMD_JOIN_MESH,
15442                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15443                 .doit = nl80211_join_mesh,
15444                 .flags = GENL_UNS_ADMIN_PERM,
15445                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15446         },
15447         {
15448                 .cmd = NL80211_CMD_LEAVE_MESH,
15449                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15450                 .doit = nl80211_leave_mesh,
15451                 .flags = GENL_UNS_ADMIN_PERM,
15452                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15453         },
15454         {
15455                 .cmd = NL80211_CMD_JOIN_OCB,
15456                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15457                 .doit = nl80211_join_ocb,
15458                 .flags = GENL_UNS_ADMIN_PERM,
15459                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15460         },
15461         {
15462                 .cmd = NL80211_CMD_LEAVE_OCB,
15463                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15464                 .doit = nl80211_leave_ocb,
15465                 .flags = GENL_UNS_ADMIN_PERM,
15466                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15467         },
15468 #ifdef CONFIG_PM
15469         {
15470                 .cmd = NL80211_CMD_GET_WOWLAN,
15471                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15472                 .doit = nl80211_get_wowlan,
15473                 /* can be retrieved by unprivileged users */
15474                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15475         },
15476         {
15477                 .cmd = NL80211_CMD_SET_WOWLAN,
15478                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15479                 .doit = nl80211_set_wowlan,
15480                 .flags = GENL_UNS_ADMIN_PERM,
15481                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15482         },
15483 #endif
15484         {
15485                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
15486                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15487                 .doit = nl80211_set_rekey_data,
15488                 .flags = GENL_UNS_ADMIN_PERM,
15489                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15490                                   0 |
15491                                   NL80211_FLAG_CLEAR_SKB,
15492         },
15493         {
15494                 .cmd = NL80211_CMD_TDLS_MGMT,
15495                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15496                 .doit = nl80211_tdls_mgmt,
15497                 .flags = GENL_UNS_ADMIN_PERM,
15498                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15499         },
15500         {
15501                 .cmd = NL80211_CMD_TDLS_OPER,
15502                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15503                 .doit = nl80211_tdls_oper,
15504                 .flags = GENL_UNS_ADMIN_PERM,
15505                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15506         },
15507         {
15508                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
15509                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15510                 .doit = nl80211_register_unexpected_frame,
15511                 .flags = GENL_UNS_ADMIN_PERM,
15512                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15513         },
15514         {
15515                 .cmd = NL80211_CMD_PROBE_CLIENT,
15516                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15517                 .doit = nl80211_probe_client,
15518                 .flags = GENL_UNS_ADMIN_PERM,
15519                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15520         },
15521         {
15522                 .cmd = NL80211_CMD_REGISTER_BEACONS,
15523                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15524                 .doit = nl80211_register_beacons,
15525                 .flags = GENL_UNS_ADMIN_PERM,
15526                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15527         },
15528         {
15529                 .cmd = NL80211_CMD_SET_NOACK_MAP,
15530                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15531                 .doit = nl80211_set_noack_map,
15532                 .flags = GENL_UNS_ADMIN_PERM,
15533                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15534         },
15535         {
15536                 .cmd = NL80211_CMD_START_P2P_DEVICE,
15537                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15538                 .doit = nl80211_start_p2p_device,
15539                 .flags = GENL_UNS_ADMIN_PERM,
15540                 .internal_flags = NL80211_FLAG_NEED_WDEV |
15541                                   NL80211_FLAG_NEED_RTNL,
15542         },
15543         {
15544                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
15545                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15546                 .doit = nl80211_stop_p2p_device,
15547                 .flags = GENL_UNS_ADMIN_PERM,
15548                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15549                                   NL80211_FLAG_NEED_RTNL,
15550         },
15551         {
15552                 .cmd = NL80211_CMD_START_NAN,
15553                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15554                 .doit = nl80211_start_nan,
15555                 .flags = GENL_ADMIN_PERM,
15556                 .internal_flags = NL80211_FLAG_NEED_WDEV |
15557                                   NL80211_FLAG_NEED_RTNL,
15558         },
15559         {
15560                 .cmd = NL80211_CMD_STOP_NAN,
15561                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15562                 .doit = nl80211_stop_nan,
15563                 .flags = GENL_ADMIN_PERM,
15564                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15565                                   NL80211_FLAG_NEED_RTNL,
15566         },
15567         {
15568                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
15569                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15570                 .doit = nl80211_nan_add_func,
15571                 .flags = GENL_ADMIN_PERM,
15572                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15573         },
15574         {
15575                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
15576                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15577                 .doit = nl80211_nan_del_func,
15578                 .flags = GENL_ADMIN_PERM,
15579                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15580         },
15581         {
15582                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
15583                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15584                 .doit = nl80211_nan_change_config,
15585                 .flags = GENL_ADMIN_PERM,
15586                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15587         },
15588         {
15589                 .cmd = NL80211_CMD_SET_MCAST_RATE,
15590                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15591                 .doit = nl80211_set_mcast_rate,
15592                 .flags = GENL_UNS_ADMIN_PERM,
15593                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15594         },
15595         {
15596                 .cmd = NL80211_CMD_SET_MAC_ACL,
15597                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15598                 .doit = nl80211_set_mac_acl,
15599                 .flags = GENL_UNS_ADMIN_PERM,
15600                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15601         },
15602         {
15603                 .cmd = NL80211_CMD_RADAR_DETECT,
15604                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15605                 .doit = nl80211_start_radar_detection,
15606                 .flags = GENL_UNS_ADMIN_PERM,
15607                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15608         },
15609         {
15610                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
15611                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15612                 .doit = nl80211_get_protocol_features,
15613         },
15614         {
15615                 .cmd = NL80211_CMD_UPDATE_FT_IES,
15616                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15617                 .doit = nl80211_update_ft_ies,
15618                 .flags = GENL_UNS_ADMIN_PERM,
15619                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15620         },
15621         {
15622                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
15623                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15624                 .doit = nl80211_crit_protocol_start,
15625                 .flags = GENL_UNS_ADMIN_PERM,
15626                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15627         },
15628         {
15629                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
15630                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15631                 .doit = nl80211_crit_protocol_stop,
15632                 .flags = GENL_UNS_ADMIN_PERM,
15633                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15634         },
15635         {
15636                 .cmd = NL80211_CMD_GET_COALESCE,
15637                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15638                 .doit = nl80211_get_coalesce,
15639                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15640         },
15641         {
15642                 .cmd = NL80211_CMD_SET_COALESCE,
15643                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15644                 .doit = nl80211_set_coalesce,
15645                 .flags = GENL_UNS_ADMIN_PERM,
15646                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15647         },
15648         {
15649                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
15650                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15651                 .doit = nl80211_channel_switch,
15652                 .flags = GENL_UNS_ADMIN_PERM,
15653                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15654         },
15655         {
15656                 .cmd = NL80211_CMD_VENDOR,
15657                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15658                 .doit = nl80211_vendor_cmd,
15659                 .dumpit = nl80211_vendor_cmd_dump,
15660                 .flags = GENL_UNS_ADMIN_PERM,
15661                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15662                                   0 |
15663                                   NL80211_FLAG_CLEAR_SKB,
15664         },
15665         {
15666                 .cmd = NL80211_CMD_SET_QOS_MAP,
15667                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15668                 .doit = nl80211_set_qos_map,
15669                 .flags = GENL_UNS_ADMIN_PERM,
15670                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15671         },
15672         {
15673                 .cmd = NL80211_CMD_ADD_TX_TS,
15674                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15675                 .doit = nl80211_add_tx_ts,
15676                 .flags = GENL_UNS_ADMIN_PERM,
15677                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15678         },
15679         {
15680                 .cmd = NL80211_CMD_DEL_TX_TS,
15681                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15682                 .doit = nl80211_del_tx_ts,
15683                 .flags = GENL_UNS_ADMIN_PERM,
15684                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15685         },
15686         {
15687                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
15688                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15689                 .doit = nl80211_tdls_channel_switch,
15690                 .flags = GENL_UNS_ADMIN_PERM,
15691                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15692         },
15693         {
15694                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
15695                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15696                 .doit = nl80211_tdls_cancel_channel_switch,
15697                 .flags = GENL_UNS_ADMIN_PERM,
15698                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15699         },
15700         {
15701                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
15702                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15703                 .doit = nl80211_set_multicast_to_unicast,
15704                 .flags = GENL_UNS_ADMIN_PERM,
15705                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15706         },
15707         {
15708                 .cmd = NL80211_CMD_SET_PMK,
15709                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15710                 .doit = nl80211_set_pmk,
15711                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15712                                   0 |
15713                                   NL80211_FLAG_CLEAR_SKB,
15714         },
15715         {
15716                 .cmd = NL80211_CMD_DEL_PMK,
15717                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15718                 .doit = nl80211_del_pmk,
15719                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15720         },
15721         {
15722                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
15723                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15724                 .doit = nl80211_external_auth,
15725                 .flags = GENL_ADMIN_PERM,
15726                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15727         },
15728         {
15729                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
15730                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15731                 .doit = nl80211_tx_control_port,
15732                 .flags = GENL_UNS_ADMIN_PERM,
15733                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15734         },
15735         {
15736                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
15737                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15738                 .doit = nl80211_get_ftm_responder_stats,
15739                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15740         },
15741         {
15742                 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
15743                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15744                 .doit = nl80211_pmsr_start,
15745                 .flags = GENL_UNS_ADMIN_PERM,
15746                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15747         },
15748         {
15749                 .cmd = NL80211_CMD_NOTIFY_RADAR,
15750                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15751                 .doit = nl80211_notify_radar_detection,
15752                 .flags = GENL_UNS_ADMIN_PERM,
15753                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15754         },
15755         {
15756                 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
15757                 .doit = nl80211_update_owe_info,
15758                 .flags = GENL_ADMIN_PERM,
15759                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15760         },
15761         {
15762                 .cmd = NL80211_CMD_PROBE_MESH_LINK,
15763                 .doit = nl80211_probe_mesh_link,
15764                 .flags = GENL_UNS_ADMIN_PERM,
15765                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15766         },
15767         {
15768                 .cmd = NL80211_CMD_SET_TID_CONFIG,
15769                 .doit = nl80211_set_tid_config,
15770                 .flags = GENL_UNS_ADMIN_PERM,
15771                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15772         },
15773         {
15774                 .cmd = NL80211_CMD_SET_SAR_SPECS,
15775                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15776                 .doit = nl80211_set_sar_specs,
15777                 .flags = GENL_UNS_ADMIN_PERM,
15778                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15779                                   NL80211_FLAG_NEED_RTNL,
15780         },
15781 };
15782
15783 static struct genl_family nl80211_fam __ro_after_init = {
15784         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
15785         .hdrsize = 0,                   /* no private header */
15786         .version = 1,                   /* no particular meaning now */
15787         .maxattr = NL80211_ATTR_MAX,
15788         .policy = nl80211_policy,
15789         .netnsok = true,
15790         .pre_doit = nl80211_pre_doit,
15791         .post_doit = nl80211_post_doit,
15792         .module = THIS_MODULE,
15793         .ops = nl80211_ops,
15794         .n_ops = ARRAY_SIZE(nl80211_ops),
15795         .small_ops = nl80211_small_ops,
15796         .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
15797         .mcgrps = nl80211_mcgrps,
15798         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
15799         .parallel_ops = true,
15800 };
15801
15802 /* notification functions */
15803
15804 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
15805                           enum nl80211_commands cmd)
15806 {
15807         struct sk_buff *msg;
15808         struct nl80211_dump_wiphy_state state = {};
15809
15810         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
15811                 cmd != NL80211_CMD_DEL_WIPHY);
15812
15813         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15814         if (!msg)
15815                 return;
15816
15817         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
15818                 nlmsg_free(msg);
15819                 return;
15820         }
15821
15822         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15823                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
15824 }
15825
15826 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
15827                                 struct wireless_dev *wdev,
15828                                 enum nl80211_commands cmd)
15829 {
15830         struct sk_buff *msg;
15831
15832         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15833         if (!msg)
15834                 return;
15835
15836         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
15837                 nlmsg_free(msg);
15838                 return;
15839         }
15840
15841         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15842                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
15843 }
15844
15845 static int nl80211_add_scan_req(struct sk_buff *msg,
15846                                 struct cfg80211_registered_device *rdev)
15847 {
15848         struct cfg80211_scan_request *req = rdev->scan_req;
15849         struct nlattr *nest;
15850         int i;
15851         struct cfg80211_scan_info *info;
15852
15853         if (WARN_ON(!req))
15854                 return 0;
15855
15856         nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
15857         if (!nest)
15858                 goto nla_put_failure;
15859         for (i = 0; i < req->n_ssids; i++) {
15860                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
15861                         goto nla_put_failure;
15862         }
15863         nla_nest_end(msg, nest);
15864
15865         if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
15866                 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
15867                 if (!nest)
15868                         goto nla_put_failure;
15869                 for (i = 0; i < req->n_channels; i++) {
15870                         if (nla_put_u32(msg, i,
15871                                    ieee80211_channel_to_khz(req->channels[i])))
15872                                 goto nla_put_failure;
15873                 }
15874                 nla_nest_end(msg, nest);
15875         } else {
15876                 nest = nla_nest_start_noflag(msg,
15877                                              NL80211_ATTR_SCAN_FREQUENCIES);
15878                 if (!nest)
15879                         goto nla_put_failure;
15880                 for (i = 0; i < req->n_channels; i++) {
15881                         if (nla_put_u32(msg, i, req->channels[i]->center_freq))
15882                                 goto nla_put_failure;
15883                 }
15884                 nla_nest_end(msg, nest);
15885         }
15886
15887         if (req->ie &&
15888             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
15889                 goto nla_put_failure;
15890
15891         if (req->flags &&
15892             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
15893                 goto nla_put_failure;
15894
15895         info = rdev->int_scan_req ? &rdev->int_scan_req->info :
15896                 &rdev->scan_req->info;
15897         if (info->scan_start_tsf &&
15898             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
15899                                info->scan_start_tsf, NL80211_BSS_PAD) ||
15900              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
15901                      info->tsf_bssid)))
15902                 goto nla_put_failure;
15903
15904         return 0;
15905  nla_put_failure:
15906         return -ENOBUFS;
15907 }
15908
15909 static int nl80211_prep_scan_msg(struct sk_buff *msg,
15910                                  struct cfg80211_registered_device *rdev,
15911                                  struct wireless_dev *wdev,
15912                                  u32 portid, u32 seq, int flags,
15913                                  u32 cmd)
15914 {
15915         void *hdr;
15916
15917         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
15918         if (!hdr)
15919                 return -1;
15920
15921         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15922             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15923                                          wdev->netdev->ifindex)) ||
15924             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15925                               NL80211_ATTR_PAD))
15926                 goto nla_put_failure;
15927
15928         /* ignore errors and send incomplete event anyway */
15929         nl80211_add_scan_req(msg, rdev);
15930
15931         genlmsg_end(msg, hdr);
15932         return 0;
15933
15934  nla_put_failure:
15935         genlmsg_cancel(msg, hdr);
15936         return -EMSGSIZE;
15937 }
15938
15939 static int
15940 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
15941                             struct cfg80211_sched_scan_request *req, u32 cmd)
15942 {
15943         void *hdr;
15944
15945         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15946         if (!hdr)
15947                 return -1;
15948
15949         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
15950                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
15951             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
15952             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
15953                               NL80211_ATTR_PAD))
15954                 goto nla_put_failure;
15955
15956         genlmsg_end(msg, hdr);
15957         return 0;
15958
15959  nla_put_failure:
15960         genlmsg_cancel(msg, hdr);
15961         return -EMSGSIZE;
15962 }
15963
15964 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
15965                              struct wireless_dev *wdev)
15966 {
15967         struct sk_buff *msg;
15968
15969         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15970         if (!msg)
15971                 return;
15972
15973         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
15974                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
15975                 nlmsg_free(msg);
15976                 return;
15977         }
15978
15979         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15980                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
15981 }
15982
15983 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
15984                                        struct wireless_dev *wdev, bool aborted)
15985 {
15986         struct sk_buff *msg;
15987
15988         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15989         if (!msg)
15990                 return NULL;
15991
15992         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
15993                                   aborted ? NL80211_CMD_SCAN_ABORTED :
15994                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
15995                 nlmsg_free(msg);
15996                 return NULL;
15997         }
15998
15999         return msg;
16000 }
16001
16002 /* send message created by nl80211_build_scan_msg() */
16003 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
16004                            struct sk_buff *msg)
16005 {
16006         if (!msg)
16007                 return;
16008
16009         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16010                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
16011 }
16012
16013 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
16014 {
16015         struct sk_buff *msg;
16016
16017         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16018         if (!msg)
16019                 return;
16020
16021         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
16022                 nlmsg_free(msg);
16023                 return;
16024         }
16025
16026         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
16027                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
16028 }
16029
16030 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
16031                                           struct regulatory_request *request)
16032 {
16033         /* Userspace can always count this one always being set */
16034         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
16035                 goto nla_put_failure;
16036
16037         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
16038                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
16039                                NL80211_REGDOM_TYPE_WORLD))
16040                         goto nla_put_failure;
16041         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
16042                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
16043                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
16044                         goto nla_put_failure;
16045         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
16046                    request->intersect) {
16047                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
16048                                NL80211_REGDOM_TYPE_INTERSECTION))
16049                         goto nla_put_failure;
16050         } else {
16051                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
16052                                NL80211_REGDOM_TYPE_COUNTRY) ||
16053                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
16054                                    request->alpha2))
16055                         goto nla_put_failure;
16056         }
16057
16058         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
16059                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
16060
16061                 if (wiphy &&
16062                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
16063                         goto nla_put_failure;
16064
16065                 if (wiphy &&
16066                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
16067                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
16068                         goto nla_put_failure;
16069         }
16070
16071         return true;
16072
16073 nla_put_failure:
16074         return false;
16075 }
16076
16077 /*
16078  * This can happen on global regulatory changes or device specific settings
16079  * based on custom regulatory domains.
16080  */
16081 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
16082                                      struct regulatory_request *request)
16083 {
16084         struct sk_buff *msg;
16085         void *hdr;
16086
16087         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16088         if (!msg)
16089                 return;
16090
16091         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
16092         if (!hdr)
16093                 goto nla_put_failure;
16094
16095         if (!nl80211_reg_change_event_fill(msg, request))
16096                 goto nla_put_failure;
16097
16098         genlmsg_end(msg, hdr);
16099
16100         rcu_read_lock();
16101         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
16102                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
16103         rcu_read_unlock();
16104
16105         return;
16106
16107 nla_put_failure:
16108         nlmsg_free(msg);
16109 }
16110
16111 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
16112                                     struct net_device *netdev,
16113                                     const u8 *buf, size_t len,
16114                                     enum nl80211_commands cmd, gfp_t gfp,
16115                                     int uapsd_queues, const u8 *req_ies,
16116                                     size_t req_ies_len, bool reconnect)
16117 {
16118         struct sk_buff *msg;
16119         void *hdr;
16120
16121         msg = nlmsg_new(100 + len + req_ies_len, gfp);
16122         if (!msg)
16123                 return;
16124
16125         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16126         if (!hdr) {
16127                 nlmsg_free(msg);
16128                 return;
16129         }
16130
16131         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16132             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16133             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
16134             (req_ies &&
16135              nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
16136                 goto nla_put_failure;
16137
16138         if (reconnect && nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
16139                 goto nla_put_failure;
16140
16141         if (uapsd_queues >= 0) {
16142                 struct nlattr *nla_wmm =
16143                         nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
16144                 if (!nla_wmm)
16145                         goto nla_put_failure;
16146
16147                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
16148                                uapsd_queues))
16149                         goto nla_put_failure;
16150
16151                 nla_nest_end(msg, nla_wmm);
16152         }
16153
16154         genlmsg_end(msg, hdr);
16155
16156         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16157                                 NL80211_MCGRP_MLME, gfp);
16158         return;
16159
16160  nla_put_failure:
16161         nlmsg_free(msg);
16162 }
16163
16164 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
16165                           struct net_device *netdev, const u8 *buf,
16166                           size_t len, gfp_t gfp)
16167 {
16168         nl80211_send_mlme_event(rdev, netdev, buf, len,
16169                                 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0,
16170                                 false);
16171 }
16172
16173 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
16174                            struct net_device *netdev, const u8 *buf,
16175                            size_t len, gfp_t gfp, int uapsd_queues,
16176                            const u8 *req_ies, size_t req_ies_len)
16177 {
16178         nl80211_send_mlme_event(rdev, netdev, buf, len,
16179                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues,
16180                                 req_ies, req_ies_len, false);
16181 }
16182
16183 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
16184                          struct net_device *netdev, const u8 *buf,
16185                          size_t len, bool reconnect, gfp_t gfp)
16186 {
16187         nl80211_send_mlme_event(rdev, netdev, buf, len,
16188                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0,
16189                                 reconnect);
16190 }
16191
16192 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
16193                            struct net_device *netdev, const u8 *buf,
16194                            size_t len, bool reconnect, gfp_t gfp)
16195 {
16196         nl80211_send_mlme_event(rdev, netdev, buf, len,
16197                                 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0,
16198                                 reconnect);
16199 }
16200
16201 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
16202                                   size_t len)
16203 {
16204         struct wireless_dev *wdev = dev->ieee80211_ptr;
16205         struct wiphy *wiphy = wdev->wiphy;
16206         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16207         const struct ieee80211_mgmt *mgmt = (void *)buf;
16208         u32 cmd;
16209
16210         if (WARN_ON(len < 2))
16211                 return;
16212
16213         if (ieee80211_is_deauth(mgmt->frame_control)) {
16214                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
16215         } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
16216                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
16217         } else if (ieee80211_is_beacon(mgmt->frame_control)) {
16218                 if (wdev->unprot_beacon_reported &&
16219                     elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
16220                         return;
16221                 cmd = NL80211_CMD_UNPROT_BEACON;
16222                 wdev->unprot_beacon_reported = jiffies;
16223         } else {
16224                 return;
16225         }
16226
16227         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
16228         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
16229                                 NULL, 0, false);
16230 }
16231 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
16232
16233 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
16234                                       struct net_device *netdev, int cmd,
16235                                       const u8 *addr, gfp_t gfp)
16236 {
16237         struct sk_buff *msg;
16238         void *hdr;
16239
16240         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16241         if (!msg)
16242                 return;
16243
16244         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16245         if (!hdr) {
16246                 nlmsg_free(msg);
16247                 return;
16248         }
16249
16250         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16251             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16252             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
16253             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
16254                 goto nla_put_failure;
16255
16256         genlmsg_end(msg, hdr);
16257
16258         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16259                                 NL80211_MCGRP_MLME, gfp);
16260         return;
16261
16262  nla_put_failure:
16263         nlmsg_free(msg);
16264 }
16265
16266 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
16267                                struct net_device *netdev, const u8 *addr,
16268                                gfp_t gfp)
16269 {
16270         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
16271                                   addr, gfp);
16272 }
16273
16274 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
16275                                 struct net_device *netdev, const u8 *addr,
16276                                 gfp_t gfp)
16277 {
16278         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
16279                                   addr, gfp);
16280 }
16281
16282 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
16283                                  struct net_device *netdev,
16284                                  struct cfg80211_connect_resp_params *cr,
16285                                  gfp_t gfp)
16286 {
16287         struct sk_buff *msg;
16288         void *hdr;
16289
16290         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
16291                         cr->fils.kek_len + cr->fils.pmk_len +
16292                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
16293         if (!msg)
16294                 return;
16295
16296         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
16297         if (!hdr) {
16298                 nlmsg_free(msg);
16299                 return;
16300         }
16301
16302         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16303             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16304             (cr->bssid &&
16305              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
16306             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
16307                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
16308                         cr->status) ||
16309             (cr->status < 0 &&
16310              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
16311               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
16312                           cr->timeout_reason))) ||
16313             (cr->req_ie &&
16314              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
16315             (cr->resp_ie &&
16316              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
16317                      cr->resp_ie)) ||
16318             (cr->fils.update_erp_next_seq_num &&
16319              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
16320                          cr->fils.erp_next_seq_num)) ||
16321             (cr->status == WLAN_STATUS_SUCCESS &&
16322              ((cr->fils.kek &&
16323                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
16324                        cr->fils.kek)) ||
16325               (cr->fils.pmk &&
16326                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
16327               (cr->fils.pmkid &&
16328                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
16329                 goto nla_put_failure;
16330
16331         genlmsg_end(msg, hdr);
16332
16333         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16334                                 NL80211_MCGRP_MLME, gfp);
16335         return;
16336
16337  nla_put_failure:
16338         nlmsg_free(msg);
16339 }
16340
16341 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
16342                          struct net_device *netdev,
16343                          struct cfg80211_roam_info *info, gfp_t gfp)
16344 {
16345         struct sk_buff *msg;
16346         void *hdr;
16347         const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
16348
16349         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
16350                         info->fils.kek_len + info->fils.pmk_len +
16351                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
16352         if (!msg)
16353                 return;
16354
16355         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
16356         if (!hdr) {
16357                 nlmsg_free(msg);
16358                 return;
16359         }
16360
16361         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16362             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16363             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
16364             (info->req_ie &&
16365              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
16366                      info->req_ie)) ||
16367             (info->resp_ie &&
16368              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
16369                      info->resp_ie)) ||
16370             (info->fils.update_erp_next_seq_num &&
16371              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
16372                          info->fils.erp_next_seq_num)) ||
16373             (info->fils.kek &&
16374              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
16375                      info->fils.kek)) ||
16376             (info->fils.pmk &&
16377              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
16378             (info->fils.pmkid &&
16379              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
16380                 goto nla_put_failure;
16381
16382         genlmsg_end(msg, hdr);
16383
16384         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16385                                 NL80211_MCGRP_MLME, gfp);
16386         return;
16387
16388  nla_put_failure:
16389         nlmsg_free(msg);
16390 }
16391
16392 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
16393                                   struct net_device *netdev, const u8 *bssid)
16394 {
16395         struct sk_buff *msg;
16396         void *hdr;
16397
16398         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16399         if (!msg)
16400                 return;
16401
16402         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
16403         if (!hdr) {
16404                 nlmsg_free(msg);
16405                 return;
16406         }
16407
16408         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16409             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16410             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
16411                 goto nla_put_failure;
16412
16413         genlmsg_end(msg, hdr);
16414
16415         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16416                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16417         return;
16418
16419  nla_put_failure:
16420         nlmsg_free(msg);
16421 }
16422
16423 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
16424                                struct net_device *netdev, u16 reason,
16425                                const u8 *ie, size_t ie_len, bool from_ap)
16426 {
16427         struct sk_buff *msg;
16428         void *hdr;
16429
16430         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
16431         if (!msg)
16432                 return;
16433
16434         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
16435         if (!hdr) {
16436                 nlmsg_free(msg);
16437                 return;
16438         }
16439
16440         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16441             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16442             (reason &&
16443              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
16444             (from_ap &&
16445              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
16446             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
16447                 goto nla_put_failure;
16448
16449         genlmsg_end(msg, hdr);
16450
16451         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16452                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16453         return;
16454
16455  nla_put_failure:
16456         nlmsg_free(msg);
16457 }
16458
16459 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
16460                              struct net_device *netdev, const u8 *bssid,
16461                              gfp_t gfp)
16462 {
16463         struct sk_buff *msg;
16464         void *hdr;
16465
16466         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16467         if (!msg)
16468                 return;
16469
16470         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
16471         if (!hdr) {
16472                 nlmsg_free(msg);
16473                 return;
16474         }
16475
16476         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16477             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16478             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
16479                 goto nla_put_failure;
16480
16481         genlmsg_end(msg, hdr);
16482
16483         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16484                                 NL80211_MCGRP_MLME, gfp);
16485         return;
16486
16487  nla_put_failure:
16488         nlmsg_free(msg);
16489 }
16490
16491 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
16492                                         const u8 *ie, u8 ie_len,
16493                                         int sig_dbm, gfp_t gfp)
16494 {
16495         struct wireless_dev *wdev = dev->ieee80211_ptr;
16496         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16497         struct sk_buff *msg;
16498         void *hdr;
16499
16500         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
16501                 return;
16502
16503         trace_cfg80211_notify_new_peer_candidate(dev, addr);
16504
16505         msg = nlmsg_new(100 + ie_len, gfp);
16506         if (!msg)
16507                 return;
16508
16509         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
16510         if (!hdr) {
16511                 nlmsg_free(msg);
16512                 return;
16513         }
16514
16515         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16516             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16517             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
16518             (ie_len && ie &&
16519              nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
16520             (sig_dbm &&
16521              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
16522                 goto nla_put_failure;
16523
16524         genlmsg_end(msg, hdr);
16525
16526         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16527                                 NL80211_MCGRP_MLME, gfp);
16528         return;
16529
16530  nla_put_failure:
16531         nlmsg_free(msg);
16532 }
16533 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
16534
16535 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
16536                                  struct net_device *netdev, const u8 *addr,
16537                                  enum nl80211_key_type key_type, int key_id,
16538                                  const u8 *tsc, gfp_t gfp)
16539 {
16540         struct sk_buff *msg;
16541         void *hdr;
16542
16543         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16544         if (!msg)
16545                 return;
16546
16547         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
16548         if (!hdr) {
16549                 nlmsg_free(msg);
16550                 return;
16551         }
16552
16553         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16554             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16555             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
16556             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
16557             (key_id != -1 &&
16558              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
16559             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
16560                 goto nla_put_failure;
16561
16562         genlmsg_end(msg, hdr);
16563
16564         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16565                                 NL80211_MCGRP_MLME, gfp);
16566         return;
16567
16568  nla_put_failure:
16569         nlmsg_free(msg);
16570 }
16571
16572 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
16573                                     struct ieee80211_channel *channel_before,
16574                                     struct ieee80211_channel *channel_after)
16575 {
16576         struct sk_buff *msg;
16577         void *hdr;
16578         struct nlattr *nl_freq;
16579
16580         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
16581         if (!msg)
16582                 return;
16583
16584         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
16585         if (!hdr) {
16586                 nlmsg_free(msg);
16587                 return;
16588         }
16589
16590         /*
16591          * Since we are applying the beacon hint to a wiphy we know its
16592          * wiphy_idx is valid
16593          */
16594         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
16595                 goto nla_put_failure;
16596
16597         /* Before */
16598         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
16599         if (!nl_freq)
16600                 goto nla_put_failure;
16601
16602         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
16603                 goto nla_put_failure;
16604         nla_nest_end(msg, nl_freq);
16605
16606         /* After */
16607         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
16608         if (!nl_freq)
16609                 goto nla_put_failure;
16610
16611         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
16612                 goto nla_put_failure;
16613         nla_nest_end(msg, nl_freq);
16614
16615         genlmsg_end(msg, hdr);
16616
16617         rcu_read_lock();
16618         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
16619                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
16620         rcu_read_unlock();
16621
16622         return;
16623
16624 nla_put_failure:
16625         nlmsg_free(msg);
16626 }
16627
16628 static void nl80211_send_remain_on_chan_event(
16629         int cmd, struct cfg80211_registered_device *rdev,
16630         struct wireless_dev *wdev, u64 cookie,
16631         struct ieee80211_channel *chan,
16632         unsigned int duration, gfp_t gfp)
16633 {
16634         struct sk_buff *msg;
16635         void *hdr;
16636
16637         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16638         if (!msg)
16639                 return;
16640
16641         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16642         if (!hdr) {
16643                 nlmsg_free(msg);
16644                 return;
16645         }
16646
16647         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16648             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16649                                          wdev->netdev->ifindex)) ||
16650             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16651                               NL80211_ATTR_PAD) ||
16652             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
16653             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
16654                         NL80211_CHAN_NO_HT) ||
16655             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16656                               NL80211_ATTR_PAD))
16657                 goto nla_put_failure;
16658
16659         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
16660             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
16661                 goto nla_put_failure;
16662
16663         genlmsg_end(msg, hdr);
16664
16665         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16666                                 NL80211_MCGRP_MLME, gfp);
16667         return;
16668
16669  nla_put_failure:
16670         nlmsg_free(msg);
16671 }
16672
16673 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
16674                                struct ieee80211_channel *chan,
16675                                unsigned int duration, gfp_t gfp)
16676 {
16677         struct wiphy *wiphy = wdev->wiphy;
16678         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16679
16680         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
16681         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
16682                                           rdev, wdev, cookie, chan,
16683                                           duration, gfp);
16684 }
16685 EXPORT_SYMBOL(cfg80211_ready_on_channel);
16686
16687 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
16688                                         struct ieee80211_channel *chan,
16689                                         gfp_t gfp)
16690 {
16691         struct wiphy *wiphy = wdev->wiphy;
16692         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16693
16694         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
16695         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
16696                                           rdev, wdev, cookie, chan, 0, gfp);
16697 }
16698 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
16699
16700 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
16701                                         struct ieee80211_channel *chan,
16702                                         gfp_t gfp)
16703 {
16704         struct wiphy *wiphy = wdev->wiphy;
16705         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16706
16707         trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
16708         nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
16709                                           rdev, wdev, cookie, chan, 0, gfp);
16710 }
16711 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
16712
16713 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
16714                       struct station_info *sinfo, gfp_t gfp)
16715 {
16716         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16717         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16718         struct sk_buff *msg;
16719
16720         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
16721
16722         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16723         if (!msg)
16724                 return;
16725
16726         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
16727                                  rdev, dev, mac_addr, sinfo) < 0) {
16728                 nlmsg_free(msg);
16729                 return;
16730         }
16731
16732         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16733                                 NL80211_MCGRP_MLME, gfp);
16734 }
16735 EXPORT_SYMBOL(cfg80211_new_sta);
16736
16737 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
16738                             struct station_info *sinfo, gfp_t gfp)
16739 {
16740         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16741         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16742         struct sk_buff *msg;
16743         struct station_info empty_sinfo = {};
16744
16745         if (!sinfo)
16746                 sinfo = &empty_sinfo;
16747
16748         trace_cfg80211_del_sta(dev, mac_addr);
16749
16750         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16751         if (!msg) {
16752                 cfg80211_sinfo_release_content(sinfo);
16753                 return;
16754         }
16755
16756         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
16757                                  rdev, dev, mac_addr, sinfo) < 0) {
16758                 nlmsg_free(msg);
16759                 return;
16760         }
16761
16762         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16763                                 NL80211_MCGRP_MLME, gfp);
16764 }
16765 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
16766
16767 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
16768                           enum nl80211_connect_failed_reason reason,
16769                           gfp_t gfp)
16770 {
16771         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16772         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16773         struct sk_buff *msg;
16774         void *hdr;
16775
16776         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
16777         if (!msg)
16778                 return;
16779
16780         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
16781         if (!hdr) {
16782                 nlmsg_free(msg);
16783                 return;
16784         }
16785
16786         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16787             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
16788             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
16789                 goto nla_put_failure;
16790
16791         genlmsg_end(msg, hdr);
16792
16793         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16794                                 NL80211_MCGRP_MLME, gfp);
16795         return;
16796
16797  nla_put_failure:
16798         nlmsg_free(msg);
16799 }
16800 EXPORT_SYMBOL(cfg80211_conn_failed);
16801
16802 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
16803                                        const u8 *addr, gfp_t gfp)
16804 {
16805         struct wireless_dev *wdev = dev->ieee80211_ptr;
16806         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16807         struct sk_buff *msg;
16808         void *hdr;
16809         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
16810
16811         if (!nlportid)
16812                 return false;
16813
16814         msg = nlmsg_new(100, gfp);
16815         if (!msg)
16816                 return true;
16817
16818         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16819         if (!hdr) {
16820                 nlmsg_free(msg);
16821                 return true;
16822         }
16823
16824         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16825             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16826             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
16827                 goto nla_put_failure;
16828
16829         genlmsg_end(msg, hdr);
16830         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16831         return true;
16832
16833  nla_put_failure:
16834         nlmsg_free(msg);
16835         return true;
16836 }
16837
16838 bool cfg80211_rx_spurious_frame(struct net_device *dev,
16839                                 const u8 *addr, gfp_t gfp)
16840 {
16841         struct wireless_dev *wdev = dev->ieee80211_ptr;
16842         bool ret;
16843
16844         trace_cfg80211_rx_spurious_frame(dev, addr);
16845
16846         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
16847                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
16848                 trace_cfg80211_return_bool(false);
16849                 return false;
16850         }
16851         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
16852                                          addr, gfp);
16853         trace_cfg80211_return_bool(ret);
16854         return ret;
16855 }
16856 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
16857
16858 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
16859                                         const u8 *addr, gfp_t gfp)
16860 {
16861         struct wireless_dev *wdev = dev->ieee80211_ptr;
16862         bool ret;
16863
16864         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
16865
16866         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
16867                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
16868                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
16869                 trace_cfg80211_return_bool(false);
16870                 return false;
16871         }
16872         ret = __nl80211_unexpected_frame(dev,
16873                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
16874                                          addr, gfp);
16875         trace_cfg80211_return_bool(ret);
16876         return ret;
16877 }
16878 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
16879
16880 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
16881                       struct wireless_dev *wdev, u32 nlportid,
16882                       int freq, int sig_dbm,
16883                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
16884 {
16885         struct net_device *netdev = wdev->netdev;
16886         struct sk_buff *msg;
16887         void *hdr;
16888
16889         msg = nlmsg_new(100 + len, gfp);
16890         if (!msg)
16891                 return -ENOMEM;
16892
16893         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
16894         if (!hdr) {
16895                 nlmsg_free(msg);
16896                 return -ENOMEM;
16897         }
16898
16899         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16900             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16901                                         netdev->ifindex)) ||
16902             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16903                               NL80211_ATTR_PAD) ||
16904             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(freq)) ||
16905             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, freq % 1000) ||
16906             (sig_dbm &&
16907              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
16908             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
16909             (flags &&
16910              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
16911                 goto nla_put_failure;
16912
16913         genlmsg_end(msg, hdr);
16914
16915         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16916
16917  nla_put_failure:
16918         nlmsg_free(msg);
16919         return -ENOBUFS;
16920 }
16921
16922 static void nl80211_frame_tx_status(struct wireless_dev *wdev, u64 cookie,
16923                                     const u8 *buf, size_t len, bool ack,
16924                                     gfp_t gfp, enum nl80211_commands command)
16925 {
16926         struct wiphy *wiphy = wdev->wiphy;
16927         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16928         struct net_device *netdev = wdev->netdev;
16929         struct sk_buff *msg;
16930         void *hdr;
16931
16932         if (command == NL80211_CMD_FRAME_TX_STATUS)
16933                 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
16934         else
16935                 trace_cfg80211_control_port_tx_status(wdev, cookie, ack);
16936
16937         msg = nlmsg_new(100 + len, gfp);
16938         if (!msg)
16939                 return;
16940
16941         hdr = nl80211hdr_put(msg, 0, 0, 0, command);
16942         if (!hdr) {
16943                 nlmsg_free(msg);
16944                 return;
16945         }
16946
16947         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16948             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16949                                    netdev->ifindex)) ||
16950             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16951                               NL80211_ATTR_PAD) ||
16952             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
16953             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16954                               NL80211_ATTR_PAD) ||
16955             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
16956                 goto nla_put_failure;
16957
16958         genlmsg_end(msg, hdr);
16959
16960         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16961                                 NL80211_MCGRP_MLME, gfp);
16962         return;
16963
16964 nla_put_failure:
16965         nlmsg_free(msg);
16966 }
16967
16968 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
16969                                      const u8 *buf, size_t len, bool ack,
16970                                      gfp_t gfp)
16971 {
16972         nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp,
16973                                 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
16974 }
16975 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
16976
16977 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
16978                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
16979 {
16980         nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp,
16981                                 NL80211_CMD_FRAME_TX_STATUS);
16982 }
16983 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
16984
16985 static int __nl80211_rx_control_port(struct net_device *dev,
16986                                      struct sk_buff *skb,
16987                                      bool unencrypted, gfp_t gfp)
16988 {
16989         struct wireless_dev *wdev = dev->ieee80211_ptr;
16990         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16991         struct ethhdr *ehdr = eth_hdr(skb);
16992         const u8 *addr = ehdr->h_source;
16993         u16 proto = be16_to_cpu(skb->protocol);
16994         struct sk_buff *msg;
16995         void *hdr;
16996         struct nlattr *frame;
16997
16998         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
16999
17000         if (!nlportid)
17001                 return -ENOENT;
17002
17003         msg = nlmsg_new(100 + skb->len, gfp);
17004         if (!msg)
17005                 return -ENOMEM;
17006
17007         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
17008         if (!hdr) {
17009                 nlmsg_free(msg);
17010                 return -ENOBUFS;
17011         }
17012
17013         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17014             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17015             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17016                               NL80211_ATTR_PAD) ||
17017             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
17018             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
17019             (unencrypted && nla_put_flag(msg,
17020                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
17021                 goto nla_put_failure;
17022
17023         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
17024         if (!frame)
17025                 goto nla_put_failure;
17026
17027         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
17028         genlmsg_end(msg, hdr);
17029
17030         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
17031
17032  nla_put_failure:
17033         nlmsg_free(msg);
17034         return -ENOBUFS;
17035 }
17036
17037 bool cfg80211_rx_control_port(struct net_device *dev,
17038                               struct sk_buff *skb, bool unencrypted)
17039 {
17040         int ret;
17041
17042         trace_cfg80211_rx_control_port(dev, skb, unencrypted);
17043         ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
17044         trace_cfg80211_return_bool(ret == 0);
17045         return ret == 0;
17046 }
17047 EXPORT_SYMBOL(cfg80211_rx_control_port);
17048
17049 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
17050                                             const char *mac, gfp_t gfp)
17051 {
17052         struct wireless_dev *wdev = dev->ieee80211_ptr;
17053         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17054         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17055         void **cb;
17056
17057         if (!msg)
17058                 return NULL;
17059
17060         cb = (void **)msg->cb;
17061
17062         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
17063         if (!cb[0]) {
17064                 nlmsg_free(msg);
17065                 return NULL;
17066         }
17067
17068         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17069             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
17070                 goto nla_put_failure;
17071
17072         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
17073                 goto nla_put_failure;
17074
17075         cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
17076         if (!cb[1])
17077                 goto nla_put_failure;
17078
17079         cb[2] = rdev;
17080
17081         return msg;
17082  nla_put_failure:
17083         nlmsg_free(msg);
17084         return NULL;
17085 }
17086
17087 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
17088 {
17089         void **cb = (void **)msg->cb;
17090         struct cfg80211_registered_device *rdev = cb[2];
17091
17092         nla_nest_end(msg, cb[1]);
17093         genlmsg_end(msg, cb[0]);
17094
17095         memset(msg->cb, 0, sizeof(msg->cb));
17096
17097         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17098                                 NL80211_MCGRP_MLME, gfp);
17099 }
17100
17101 void cfg80211_cqm_rssi_notify(struct net_device *dev,
17102                               enum nl80211_cqm_rssi_threshold_event rssi_event,
17103                               s32 rssi_level, gfp_t gfp)
17104 {
17105         struct sk_buff *msg;
17106         struct wireless_dev *wdev = dev->ieee80211_ptr;
17107         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17108
17109         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
17110
17111         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
17112                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
17113                 return;
17114
17115         if (wdev->cqm_config) {
17116                 wdev->cqm_config->last_rssi_event_value = rssi_level;
17117
17118                 cfg80211_cqm_rssi_update(rdev, dev);
17119
17120                 if (rssi_level == 0)
17121                         rssi_level = wdev->cqm_config->last_rssi_event_value;
17122         }
17123
17124         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
17125         if (!msg)
17126                 return;
17127
17128         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
17129                         rssi_event))
17130                 goto nla_put_failure;
17131
17132         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
17133                                       rssi_level))
17134                 goto nla_put_failure;
17135
17136         cfg80211_send_cqm(msg, gfp);
17137
17138         return;
17139
17140  nla_put_failure:
17141         nlmsg_free(msg);
17142 }
17143 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
17144
17145 void cfg80211_cqm_txe_notify(struct net_device *dev,
17146                              const u8 *peer, u32 num_packets,
17147                              u32 rate, u32 intvl, gfp_t gfp)
17148 {
17149         struct sk_buff *msg;
17150
17151         msg = cfg80211_prepare_cqm(dev, peer, gfp);
17152         if (!msg)
17153                 return;
17154
17155         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
17156                 goto nla_put_failure;
17157
17158         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
17159                 goto nla_put_failure;
17160
17161         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
17162                 goto nla_put_failure;
17163
17164         cfg80211_send_cqm(msg, gfp);
17165         return;
17166
17167  nla_put_failure:
17168         nlmsg_free(msg);
17169 }
17170 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
17171
17172 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
17173                                  const u8 *peer, u32 num_packets, gfp_t gfp)
17174 {
17175         struct sk_buff *msg;
17176
17177         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
17178
17179         msg = cfg80211_prepare_cqm(dev, peer, gfp);
17180         if (!msg)
17181                 return;
17182
17183         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
17184                 goto nla_put_failure;
17185
17186         cfg80211_send_cqm(msg, gfp);
17187         return;
17188
17189  nla_put_failure:
17190         nlmsg_free(msg);
17191 }
17192 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
17193
17194 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
17195 {
17196         struct sk_buff *msg;
17197
17198         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
17199         if (!msg)
17200                 return;
17201
17202         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
17203                 goto nla_put_failure;
17204
17205         cfg80211_send_cqm(msg, gfp);
17206         return;
17207
17208  nla_put_failure:
17209         nlmsg_free(msg);
17210 }
17211 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
17212
17213 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
17214                                      struct net_device *netdev, const u8 *bssid,
17215                                      const u8 *replay_ctr, gfp_t gfp)
17216 {
17217         struct sk_buff *msg;
17218         struct nlattr *rekey_attr;
17219         void *hdr;
17220
17221         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17222         if (!msg)
17223                 return;
17224
17225         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
17226         if (!hdr) {
17227                 nlmsg_free(msg);
17228                 return;
17229         }
17230
17231         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17232             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17233             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
17234                 goto nla_put_failure;
17235
17236         rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
17237         if (!rekey_attr)
17238                 goto nla_put_failure;
17239
17240         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
17241                     NL80211_REPLAY_CTR_LEN, replay_ctr))
17242                 goto nla_put_failure;
17243
17244         nla_nest_end(msg, rekey_attr);
17245
17246         genlmsg_end(msg, hdr);
17247
17248         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17249                                 NL80211_MCGRP_MLME, gfp);
17250         return;
17251
17252  nla_put_failure:
17253         nlmsg_free(msg);
17254 }
17255
17256 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
17257                                const u8 *replay_ctr, gfp_t gfp)
17258 {
17259         struct wireless_dev *wdev = dev->ieee80211_ptr;
17260         struct wiphy *wiphy = wdev->wiphy;
17261         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17262
17263         trace_cfg80211_gtk_rekey_notify(dev, bssid);
17264         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
17265 }
17266 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
17267
17268 static void
17269 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
17270                                struct net_device *netdev, int index,
17271                                const u8 *bssid, bool preauth, gfp_t gfp)
17272 {
17273         struct sk_buff *msg;
17274         struct nlattr *attr;
17275         void *hdr;
17276
17277         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17278         if (!msg)
17279                 return;
17280
17281         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
17282         if (!hdr) {
17283                 nlmsg_free(msg);
17284                 return;
17285         }
17286
17287         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17288             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
17289                 goto nla_put_failure;
17290
17291         attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
17292         if (!attr)
17293                 goto nla_put_failure;
17294
17295         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
17296             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
17297             (preauth &&
17298              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
17299                 goto nla_put_failure;
17300
17301         nla_nest_end(msg, attr);
17302
17303         genlmsg_end(msg, hdr);
17304
17305         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17306                                 NL80211_MCGRP_MLME, gfp);
17307         return;
17308
17309  nla_put_failure:
17310         nlmsg_free(msg);
17311 }
17312
17313 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
17314                                      const u8 *bssid, bool preauth, gfp_t gfp)
17315 {
17316         struct wireless_dev *wdev = dev->ieee80211_ptr;
17317         struct wiphy *wiphy = wdev->wiphy;
17318         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17319
17320         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
17321         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
17322 }
17323 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
17324
17325 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
17326                                      struct net_device *netdev,
17327                                      struct cfg80211_chan_def *chandef,
17328                                      gfp_t gfp,
17329                                      enum nl80211_commands notif,
17330                                      u8 count, bool quiet)
17331 {
17332         struct sk_buff *msg;
17333         void *hdr;
17334
17335         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17336         if (!msg)
17337                 return;
17338
17339         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
17340         if (!hdr) {
17341                 nlmsg_free(msg);
17342                 return;
17343         }
17344
17345         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
17346                 goto nla_put_failure;
17347
17348         if (nl80211_send_chandef(msg, chandef))
17349                 goto nla_put_failure;
17350
17351         if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
17352                 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
17353                         goto nla_put_failure;
17354                 if (quiet &&
17355                     nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
17356                         goto nla_put_failure;
17357         }
17358
17359         genlmsg_end(msg, hdr);
17360
17361         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17362                                 NL80211_MCGRP_MLME, gfp);
17363         return;
17364
17365  nla_put_failure:
17366         nlmsg_free(msg);
17367 }
17368
17369 void cfg80211_ch_switch_notify(struct net_device *dev,
17370                                struct cfg80211_chan_def *chandef)
17371 {
17372         struct wireless_dev *wdev = dev->ieee80211_ptr;
17373         struct wiphy *wiphy = wdev->wiphy;
17374         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17375
17376         ASSERT_WDEV_LOCK(wdev);
17377
17378         trace_cfg80211_ch_switch_notify(dev, chandef);
17379
17380         wdev->chandef = *chandef;
17381         wdev->preset_chandef = *chandef;
17382
17383         if (wdev->iftype == NL80211_IFTYPE_STATION &&
17384             !WARN_ON(!wdev->current_bss))
17385                 cfg80211_update_assoc_bss_entry(wdev, chandef->chan);
17386
17387         cfg80211_sched_dfs_chan_update(rdev);
17388
17389         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
17390                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0, false);
17391 }
17392 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
17393
17394 void cfg80211_ch_switch_started_notify(struct net_device *dev,
17395                                        struct cfg80211_chan_def *chandef,
17396                                        u8 count, bool quiet)
17397 {
17398         struct wireless_dev *wdev = dev->ieee80211_ptr;
17399         struct wiphy *wiphy = wdev->wiphy;
17400         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17401
17402         trace_cfg80211_ch_switch_started_notify(dev, chandef);
17403
17404         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
17405                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
17406                                  count, quiet);
17407 }
17408 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
17409
17410 void
17411 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
17412                      const struct cfg80211_chan_def *chandef,
17413                      enum nl80211_radar_event event,
17414                      struct net_device *netdev, gfp_t gfp)
17415 {
17416         struct sk_buff *msg;
17417         void *hdr;
17418
17419         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17420         if (!msg)
17421                 return;
17422
17423         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
17424         if (!hdr) {
17425                 nlmsg_free(msg);
17426                 return;
17427         }
17428
17429         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
17430                 goto nla_put_failure;
17431
17432         /* NOP and radar events don't need a netdev parameter */
17433         if (netdev) {
17434                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
17435
17436                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17437                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17438                                       NL80211_ATTR_PAD))
17439                         goto nla_put_failure;
17440         }
17441
17442         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
17443                 goto nla_put_failure;
17444
17445         if (nl80211_send_chandef(msg, chandef))
17446                 goto nla_put_failure;
17447
17448         genlmsg_end(msg, hdr);
17449
17450         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17451                                 NL80211_MCGRP_MLME, gfp);
17452         return;
17453
17454  nla_put_failure:
17455         nlmsg_free(msg);
17456 }
17457
17458 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
17459                                        struct sta_opmode_info *sta_opmode,
17460                                        gfp_t gfp)
17461 {
17462         struct sk_buff *msg;
17463         struct wireless_dev *wdev = dev->ieee80211_ptr;
17464         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17465         void *hdr;
17466
17467         if (WARN_ON(!mac))
17468                 return;
17469
17470         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17471         if (!msg)
17472                 return;
17473
17474         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
17475         if (!hdr) {
17476                 nlmsg_free(msg);
17477                 return;
17478         }
17479
17480         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
17481                 goto nla_put_failure;
17482
17483         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
17484                 goto nla_put_failure;
17485
17486         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
17487                 goto nla_put_failure;
17488
17489         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
17490             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
17491                 goto nla_put_failure;
17492
17493         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
17494             nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
17495                 goto nla_put_failure;
17496
17497         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
17498             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
17499                 goto nla_put_failure;
17500
17501         genlmsg_end(msg, hdr);
17502
17503         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17504                                 NL80211_MCGRP_MLME, gfp);
17505
17506         return;
17507
17508 nla_put_failure:
17509         nlmsg_free(msg);
17510 }
17511 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
17512
17513 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
17514                            u64 cookie, bool acked, s32 ack_signal,
17515                            bool is_valid_ack_signal, gfp_t gfp)
17516 {
17517         struct wireless_dev *wdev = dev->ieee80211_ptr;
17518         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17519         struct sk_buff *msg;
17520         void *hdr;
17521
17522         trace_cfg80211_probe_status(dev, addr, cookie, acked);
17523
17524         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17525
17526         if (!msg)
17527                 return;
17528
17529         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
17530         if (!hdr) {
17531                 nlmsg_free(msg);
17532                 return;
17533         }
17534
17535         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17536             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17537             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
17538             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
17539                               NL80211_ATTR_PAD) ||
17540             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
17541             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
17542                                                 ack_signal)))
17543                 goto nla_put_failure;
17544
17545         genlmsg_end(msg, hdr);
17546
17547         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17548                                 NL80211_MCGRP_MLME, gfp);
17549         return;
17550
17551  nla_put_failure:
17552         nlmsg_free(msg);
17553 }
17554 EXPORT_SYMBOL(cfg80211_probe_status);
17555
17556 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
17557                                      size_t len, int freq, int sig_dbm)
17558 {
17559         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17560         struct sk_buff *msg;
17561         void *hdr;
17562         struct cfg80211_beacon_registration *reg;
17563
17564         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
17565
17566         spin_lock_bh(&rdev->beacon_registrations_lock);
17567         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
17568                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
17569                 if (!msg) {
17570                         spin_unlock_bh(&rdev->beacon_registrations_lock);
17571                         return;
17572                 }
17573
17574                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
17575                 if (!hdr)
17576                         goto nla_put_failure;
17577
17578                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17579                     (freq &&
17580                      (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
17581                                   KHZ_TO_MHZ(freq)) ||
17582                       nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
17583                                   freq % 1000))) ||
17584                     (sig_dbm &&
17585                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
17586                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
17587                         goto nla_put_failure;
17588
17589                 genlmsg_end(msg, hdr);
17590
17591                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
17592         }
17593         spin_unlock_bh(&rdev->beacon_registrations_lock);
17594         return;
17595
17596  nla_put_failure:
17597         spin_unlock_bh(&rdev->beacon_registrations_lock);
17598         nlmsg_free(msg);
17599 }
17600 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
17601
17602 #ifdef CONFIG_PM
17603 static int cfg80211_net_detect_results(struct sk_buff *msg,
17604                                        struct cfg80211_wowlan_wakeup *wakeup)
17605 {
17606         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
17607         struct nlattr *nl_results, *nl_match, *nl_freqs;
17608         int i, j;
17609
17610         nl_results = nla_nest_start_noflag(msg,
17611                                            NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
17612         if (!nl_results)
17613                 return -EMSGSIZE;
17614
17615         for (i = 0; i < nd->n_matches; i++) {
17616                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
17617
17618                 nl_match = nla_nest_start_noflag(msg, i);
17619                 if (!nl_match)
17620                         break;
17621
17622                 /* The SSID attribute is optional in nl80211, but for
17623                  * simplicity reasons it's always present in the
17624                  * cfg80211 structure.  If a driver can't pass the
17625                  * SSID, that needs to be changed.  A zero length SSID
17626                  * is still a valid SSID (wildcard), so it cannot be
17627                  * used for this purpose.
17628                  */
17629                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
17630                             match->ssid.ssid)) {
17631                         nla_nest_cancel(msg, nl_match);
17632                         goto out;
17633                 }
17634
17635                 if (match->n_channels) {
17636                         nl_freqs = nla_nest_start_noflag(msg,
17637                                                          NL80211_ATTR_SCAN_FREQUENCIES);
17638                         if (!nl_freqs) {
17639                                 nla_nest_cancel(msg, nl_match);
17640                                 goto out;
17641                         }
17642
17643                         for (j = 0; j < match->n_channels; j++) {
17644                                 if (nla_put_u32(msg, j, match->channels[j])) {
17645                                         nla_nest_cancel(msg, nl_freqs);
17646                                         nla_nest_cancel(msg, nl_match);
17647                                         goto out;
17648                                 }
17649                         }
17650
17651                         nla_nest_end(msg, nl_freqs);
17652                 }
17653
17654                 nla_nest_end(msg, nl_match);
17655         }
17656
17657 out:
17658         nla_nest_end(msg, nl_results);
17659         return 0;
17660 }
17661
17662 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
17663                                    struct cfg80211_wowlan_wakeup *wakeup,
17664                                    gfp_t gfp)
17665 {
17666         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17667         struct sk_buff *msg;
17668         void *hdr;
17669         int size = 200;
17670
17671         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
17672
17673         if (wakeup)
17674                 size += wakeup->packet_present_len;
17675
17676         msg = nlmsg_new(size, gfp);
17677         if (!msg)
17678                 return;
17679
17680         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
17681         if (!hdr)
17682                 goto free_msg;
17683
17684         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17685             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17686                               NL80211_ATTR_PAD))
17687                 goto free_msg;
17688
17689         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17690                                         wdev->netdev->ifindex))
17691                 goto free_msg;
17692
17693         if (wakeup) {
17694                 struct nlattr *reasons;
17695
17696                 reasons = nla_nest_start_noflag(msg,
17697                                                 NL80211_ATTR_WOWLAN_TRIGGERS);
17698                 if (!reasons)
17699                         goto free_msg;
17700
17701                 if (wakeup->disconnect &&
17702                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
17703                         goto free_msg;
17704                 if (wakeup->magic_pkt &&
17705                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
17706                         goto free_msg;
17707                 if (wakeup->gtk_rekey_failure &&
17708                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
17709                         goto free_msg;
17710                 if (wakeup->eap_identity_req &&
17711                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
17712                         goto free_msg;
17713                 if (wakeup->four_way_handshake &&
17714                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
17715                         goto free_msg;
17716                 if (wakeup->rfkill_release &&
17717                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
17718                         goto free_msg;
17719
17720                 if (wakeup->pattern_idx >= 0 &&
17721                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
17722                                 wakeup->pattern_idx))
17723                         goto free_msg;
17724
17725                 if (wakeup->tcp_match &&
17726                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
17727                         goto free_msg;
17728
17729                 if (wakeup->tcp_connlost &&
17730                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
17731                         goto free_msg;
17732
17733                 if (wakeup->tcp_nomoretokens &&
17734                     nla_put_flag(msg,
17735                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
17736                         goto free_msg;
17737
17738                 if (wakeup->packet) {
17739                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
17740                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
17741
17742                         if (!wakeup->packet_80211) {
17743                                 pkt_attr =
17744                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
17745                                 len_attr =
17746                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
17747                         }
17748
17749                         if (wakeup->packet_len &&
17750                             nla_put_u32(msg, len_attr, wakeup->packet_len))
17751                                 goto free_msg;
17752
17753                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
17754                                     wakeup->packet))
17755                                 goto free_msg;
17756                 }
17757
17758                 if (wakeup->net_detect &&
17759                     cfg80211_net_detect_results(msg, wakeup))
17760                                 goto free_msg;
17761
17762                 nla_nest_end(msg, reasons);
17763         }
17764
17765         genlmsg_end(msg, hdr);
17766
17767         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17768                                 NL80211_MCGRP_MLME, gfp);
17769         return;
17770
17771  free_msg:
17772         nlmsg_free(msg);
17773 }
17774 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
17775 #endif
17776
17777 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
17778                                 enum nl80211_tdls_operation oper,
17779                                 u16 reason_code, gfp_t gfp)
17780 {
17781         struct wireless_dev *wdev = dev->ieee80211_ptr;
17782         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17783         struct sk_buff *msg;
17784         void *hdr;
17785
17786         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
17787                                          reason_code);
17788
17789         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17790         if (!msg)
17791                 return;
17792
17793         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
17794         if (!hdr) {
17795                 nlmsg_free(msg);
17796                 return;
17797         }
17798
17799         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17800             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17801             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
17802             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
17803             (reason_code > 0 &&
17804              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
17805                 goto nla_put_failure;
17806
17807         genlmsg_end(msg, hdr);
17808
17809         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17810                                 NL80211_MCGRP_MLME, gfp);
17811         return;
17812
17813  nla_put_failure:
17814         nlmsg_free(msg);
17815 }
17816 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
17817
17818 static int nl80211_netlink_notify(struct notifier_block * nb,
17819                                   unsigned long state,
17820                                   void *_notify)
17821 {
17822         struct netlink_notify *notify = _notify;
17823         struct cfg80211_registered_device *rdev;
17824         struct wireless_dev *wdev;
17825         struct cfg80211_beacon_registration *reg, *tmp;
17826
17827         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
17828                 return NOTIFY_DONE;
17829
17830         rcu_read_lock();
17831
17832         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
17833                 struct cfg80211_sched_scan_request *sched_scan_req;
17834
17835                 list_for_each_entry_rcu(sched_scan_req,
17836                                         &rdev->sched_scan_req_list,
17837                                         list) {
17838                         if (sched_scan_req->owner_nlportid == notify->portid) {
17839                                 sched_scan_req->nl_owner_dead = true;
17840                                 schedule_work(&rdev->sched_scan_stop_wk);
17841                         }
17842                 }
17843
17844                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
17845                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
17846
17847                         if (wdev->owner_nlportid == notify->portid) {
17848                                 wdev->nl_owner_dead = true;
17849                                 schedule_work(&rdev->destroy_work);
17850                         } else if (wdev->conn_owner_nlportid == notify->portid) {
17851                                 schedule_work(&wdev->disconnect_wk);
17852                         }
17853
17854                         cfg80211_release_pmsr(wdev, notify->portid);
17855                 }
17856
17857                 spin_lock_bh(&rdev->beacon_registrations_lock);
17858                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
17859                                          list) {
17860                         if (reg->nlportid == notify->portid) {
17861                                 list_del(&reg->list);
17862                                 kfree(reg);
17863                                 break;
17864                         }
17865                 }
17866                 spin_unlock_bh(&rdev->beacon_registrations_lock);
17867         }
17868
17869         rcu_read_unlock();
17870
17871         /*
17872          * It is possible that the user space process that is controlling the
17873          * indoor setting disappeared, so notify the regulatory core.
17874          */
17875         regulatory_netlink_notify(notify->portid);
17876         return NOTIFY_OK;
17877 }
17878
17879 static struct notifier_block nl80211_netlink_notifier = {
17880         .notifier_call = nl80211_netlink_notify,
17881 };
17882
17883 void cfg80211_ft_event(struct net_device *netdev,
17884                        struct cfg80211_ft_event_params *ft_event)
17885 {
17886         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
17887         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17888         struct sk_buff *msg;
17889         void *hdr;
17890
17891         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
17892
17893         if (!ft_event->target_ap)
17894                 return;
17895
17896         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
17897                         GFP_KERNEL);
17898         if (!msg)
17899                 return;
17900
17901         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
17902         if (!hdr)
17903                 goto out;
17904
17905         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17906             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17907             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
17908                 goto out;
17909
17910         if (ft_event->ies &&
17911             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
17912                 goto out;
17913         if (ft_event->ric_ies &&
17914             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
17915                     ft_event->ric_ies))
17916                 goto out;
17917
17918         genlmsg_end(msg, hdr);
17919
17920         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17921                                 NL80211_MCGRP_MLME, GFP_KERNEL);
17922         return;
17923  out:
17924         nlmsg_free(msg);
17925 }
17926 EXPORT_SYMBOL(cfg80211_ft_event);
17927
17928 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
17929 {
17930         struct cfg80211_registered_device *rdev;
17931         struct sk_buff *msg;
17932         void *hdr;
17933         u32 nlportid;
17934
17935         rdev = wiphy_to_rdev(wdev->wiphy);
17936         if (!rdev->crit_proto_nlportid)
17937                 return;
17938
17939         nlportid = rdev->crit_proto_nlportid;
17940         rdev->crit_proto_nlportid = 0;
17941
17942         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17943         if (!msg)
17944                 return;
17945
17946         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
17947         if (!hdr)
17948                 goto nla_put_failure;
17949
17950         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17951             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17952                               NL80211_ATTR_PAD))
17953                 goto nla_put_failure;
17954
17955         genlmsg_end(msg, hdr);
17956
17957         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
17958         return;
17959
17960  nla_put_failure:
17961         nlmsg_free(msg);
17962 }
17963 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
17964
17965 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
17966 {
17967         struct wiphy *wiphy = wdev->wiphy;
17968         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17969         struct sk_buff *msg;
17970         void *hdr;
17971
17972         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17973         if (!msg)
17974                 return;
17975
17976         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
17977         if (!hdr)
17978                 goto out;
17979
17980         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17981             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
17982             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17983                               NL80211_ATTR_PAD))
17984                 goto out;
17985
17986         genlmsg_end(msg, hdr);
17987
17988         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
17989                                 NL80211_MCGRP_MLME, GFP_KERNEL);
17990         return;
17991  out:
17992         nlmsg_free(msg);
17993 }
17994
17995 int cfg80211_external_auth_request(struct net_device *dev,
17996                                    struct cfg80211_external_auth_params *params,
17997                                    gfp_t gfp)
17998 {
17999         struct wireless_dev *wdev = dev->ieee80211_ptr;
18000         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18001         struct sk_buff *msg;
18002         void *hdr;
18003
18004         if (!wdev->conn_owner_nlportid)
18005                 return -EINVAL;
18006
18007         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18008         if (!msg)
18009                 return -ENOMEM;
18010
18011         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
18012         if (!hdr)
18013                 goto nla_put_failure;
18014
18015         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18016             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18017             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
18018             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
18019                         params->action) ||
18020             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
18021             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
18022                     params->ssid.ssid))
18023                 goto nla_put_failure;
18024
18025         genlmsg_end(msg, hdr);
18026         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
18027                         wdev->conn_owner_nlportid);
18028         return 0;
18029
18030  nla_put_failure:
18031         nlmsg_free(msg);
18032         return -ENOBUFS;
18033 }
18034 EXPORT_SYMBOL(cfg80211_external_auth_request);
18035
18036 void cfg80211_update_owe_info_event(struct net_device *netdev,
18037                                     struct cfg80211_update_owe_info *owe_info,
18038                                     gfp_t gfp)
18039 {
18040         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
18041         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18042         struct sk_buff *msg;
18043         void *hdr;
18044
18045         trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
18046
18047         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18048         if (!msg)
18049                 return;
18050
18051         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
18052         if (!hdr)
18053                 goto nla_put_failure;
18054
18055         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18056             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18057             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
18058                 goto nla_put_failure;
18059
18060         if (!owe_info->ie_len ||
18061             nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
18062                 goto nla_put_failure;
18063
18064         genlmsg_end(msg, hdr);
18065
18066         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18067                                 NL80211_MCGRP_MLME, gfp);
18068         return;
18069
18070 nla_put_failure:
18071         genlmsg_cancel(msg, hdr);
18072         nlmsg_free(msg);
18073 }
18074 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
18075
18076 /* initialisation/exit functions */
18077
18078 int __init nl80211_init(void)
18079 {
18080         int err;
18081
18082         err = genl_register_family(&nl80211_fam);
18083         if (err)
18084                 return err;
18085
18086         err = netlink_register_notifier(&nl80211_netlink_notifier);
18087         if (err)
18088                 goto err_out;
18089
18090         return 0;
18091  err_out:
18092         genl_unregister_family(&nl80211_fam);
18093         return err;
18094 }
18095
18096 void nl80211_exit(void)
18097 {
18098         netlink_unregister_notifier(&nl80211_netlink_notifier);
18099         genl_unregister_family(&nl80211_fam);
18100 }